Improving integrity of embedded computers in control

Abstract

This paper gives an overview of a holistic project dealing with the consistent design of embedded control systems falling into the first level of safety integrity requirements (SIL l) (IEC, 1998). It shows how existing methods can be adapted and reasonably employed, whenever possible, without having to resort to new innovations. Firstly, the hardware issues are dealt with and extensively elaborated, particularly the peripheral interfaces with integrated processing capabilities. Secondly, the proven correct real-time operating system executing on its own dedicated processor is briefly addressed, and finally, programming issues including descriptions of the specific programming language, time bounded handling of exceptions, and how to deal with temporal overload.

Introduction

Computer control systems are increasingly being used in safety critical applications where the integrity of the systems depends substantially on them. Any failures could have severe consequences: they may result in massive material losses or endanger human safety.

Dependability, being an inherent requirement in the design of control systems, is usually insufficiently supported. Techniques intended to improve dependability are predominantly based on testing, and the quality achieved depends mainly on the experience and the intuition of the designers.

This approach, however, is inadequate. It is necessary to consider the safety measures for such systems already in the early design phases, which means that common commercial off-the-shelf control computers are usually unsuitable for safety critical applications.

In the late 1980s, the International Electrotechnical Commission (IEC) started the standardisation of safety issues in computer control (IEC, 1998). They identified four safety integrity levels, SIL 4 being the most critical. This paper, however, is concerned with applications falling into the least demanding first level which already allows employment of computer control systems based on generic microprocessors.

It is desirable that these systems should formally be proven correct or even safety licensed. Owing to the complexity of the software-based computer control systems, however, this is very difficult if not impossible to achieve.

Instead, in this paper we present certain contributions to several areas of control systems design, with the aim of improving both functional and temporal correctness. The implementation of long standing, but often neglected viable solutions will be shown, rather than devising new methods and techniques. As verification of functional correctness is more established than that of temporal correctness, although equally important, special emphasis will be given to the latter.

In Section 2 it will be shown how system integrity can be improved by certain hardware design measures, providing an adequate platform for safety critical control systems. A proven correct operating system with run-time schedulability checking based on this hardware architecture will be briefly mentioned in Section 3. Section 4 is in more detail dealing with programming issues, from the safe language properties to the handling of exceptions and dynamic overload. Finally, in Section 5 it is shown how the requirements of the SIL 1 compliant systems are matched by the features resulting from our project.

Because of the wide scope it was not possible to present the details of the implementation. Instead, more general descriptions of the topics are given; interested reader will be referred to the original works throughout the paper.