1. UNICOS-CPC PLC Baseline improvement proposals
Benjamin Bradu
BE/ICS/PCS

2. UNICOS PLC BASELINE END 2016
Motivations
2 main motivations
Homogenise the code through platforms and objects
Correct the undesired behaviours
Identified issues
Discrepancies between Schneider/Siemens
Discrepancies for the same features between objects
Not optimal code time to time
Formal verification issues to be solved, even if considered events are rare
Concerned objects
Only field objects + PCO for the moment
UNICOS PLC BASELINE END 2016

3. Reminder: baseline structure
INPUT MANAGER
Bit extraction
Rising edge computation
INTERLOCK AND ACKNOWLEDGE MANAGER
Compute all interlock and ack signals
MODE MANAGER
Compute the operation mode of the Object (Au/M/Fo/SoftLD/HLD)
LIMIT MANAGER
Compute the on/off status of the object based on feedbacks
REQUEST MANAGER
Compute the auto/manual requests
OUTPUT MANAGER
Compute the outputs based on the requests and on the active mode of the object
Change the outputs according to interlocks
SURVEILLANCE
Compute all warnings of the objects (IOError, Pos warning, AlB warning, etc.)
OUTPUT REGISTER
Invert the output order values according to fail safe position
STATUS REGISTER
Put statuses in Stsreg01/02
UNICOS PLC BASELINE END 2016

4. 1. Discrepancies Schneider/Siemens
Bi-stable behaviours
Schneider: use of RS flip-flop
Siemens: use of IF/THEN/ELSE
Suggestion: IF/THEN/ELSE to have similar codes
OnOff: change of 3 RS
Analog/AnaDig/AnaDO/PCO: change of 1 RS
UNICOS PLC BASELINE END 2016

5. 1. Old/New Schneider code
Meeting 21/09/2016: OK but put a fake ELSE at the end.
UNICOS PLC BASELINE END 2016

6. 2. Discrepancies between objects
3 different Interlock / Ack management in Schneider and Siemens
Analog/Anadig
OnOff / AnaDO
PCO
Suggestion for Schneider & Siemens:
Create a new (*INTERLOCK AND ACKNOWLEDGE MANAGER*)
Compute all interlock related signals at the BEGINNING of the code
FullNotAcknowledged, EnRstartSt, AlUnAck, InterlockR, RdyStartSt
Give priority to FS if an Ack is done at the same time.
The interlock consequences are done at the end of the “output manager” section.
UNICOS PLC BASELINE END 2016

7. 2. Old / New interlock manager
Meeting 21/09/2016:
OK to group everything in a single place.
Seems OK but need more verifications
No deployment before LS2
UNICOS PLC BASELINE END 2016

8. UNICOS PLC BASELINE END 2016
3. Not optimal code
Mode management is not optimal regarding the coding recommendations.
Suggestions:
Remove all “*_aux” variables
Priority of modes: HLD->Fo->SoftLD->M->Au
Put an “ELSIF” structure instead of 5 independent “IF”
UNICOS PLC BASELINE END 2016

9. UNICOS PLC BASELINE END 2016
3. Old/New mode manager
Meeting 21/09/2016: Cannot work. Need to store mode in aux variables to restore the good mode when back from local mode
UNICOS PLC BASELINE END 2016

10. 4. OnOff bugs found with formal verifications
General behaviour issues
Problem if AuAuMoR is always true  remove the rising edge
Problem if AuAlAck is always true  remove the rising edge
Mode management
Local Drive Request should be computed only in Local mode  Add the LDSt condition
Interlock management
Don't allow restart until interlock disappear and ack done  new interlock management
After a FuStop, MOnRSt is in fail-safe position unless MOnR  new interlock management
Reset Auto On Request after Full Stop in OnOff  new interlock management
Impossible to start with interlock  new interlock management
Meeting 21/09/2016: Keep rising edge.
AuIhMMo used if need to maintain auto
AuAlAck is normally never maintained
Meeting 21/09/2016: OK
Meeting 21/09/2016: see slide 7 for new interlock management
UNICOS PLC BASELINE END 2016

11. UNICOS PLC BASELINE END 2016
Question 1
Anticipate manual restart after full stop ? (UCPC-1257)
Full Stop Occurs  MOnRSt = 0
Ack of the full stop is done by operator
Operator do a MOnR. 3 cases:
If no allow restart  MOnRSt = 1
If allow restart always allowed MOnRSt = 1
If allow restart only after FS MOnRSt = 0
Full Stop Disappears and Allow Restart done. 3 cases:
If no allow restart  object restarts
If allow restart always allowed object restarts
If allow restart only after FS object does not restart: OK ?
Meeting 21/09/2016: OK
UNICOS PLC BASELINE END 2016

12. UNICOS PLC BASELINE END 2016
Question 2
Hardware Local Mode management
There is HLD + (HOnR + HOffR) OR (Haout)
The output is moved according to HonR/HOffR (pulse) OR HAOut
The interlocks are still effective
There is only HLD (common case in CRYO+CV)
The output is reset to 0 (except bug with AO of ANADO, UCPC-2360)
Suggestions:
The output follows feedbacks to avoid discordance and glitch when go back to auto mode.
Meeting 21/09/2016: OK but this case never happen in reality
Meeting 21/09/2016: NOK, don’t follow feedback. But if AuOnR is active, we should not have a glitch when go back to auto mode
UNICOS PLC BASELINE END 2016

13. UNICOS PLC BASELINE END 2016
Summary
Tracking of all these bugs/improvements in JIRA for the future baseline version
BUGS
ANADO: HLD does not reset the AO : UCPC-2360
Field+PCO: FS + Ack in the same cycle: UCPC-2215
Field+PCO: After a FuStop MOnRSt is in fail-safe unless MOnR: UCPC-1257
ONOFF: Reset Auto On Request after Full Stop: UCPC-1603
Field+PCO: Problem if AuAuMoR is always true: UCPC-2361
ONOFF: Impossible to start with Interlock: UCPC-2362
IMPROVEMENTS: UCPC-2367
Field+PCO: Remove RS flip-flop in Schneider baseline
Field+PCO: New acknowledge management
Field+PCO: New mode management
Field+PCO: New Hardware Local Mode management
UNICOS PLC BASELINE END 2016

14. Baseline validation scheme
Object modification
in 1 platform
(Based on a JIRA issue)
Redo the same
with other platform(s) OK
Execute all formal tests
using PLC Verif
RELEASE
NOK OK
Execute all unit tests
using the Win CCOA automatic script (test catalog)
NOK
Meeting 21/09/2016: We need to extend the test catalogue for a better testing confidence OK
Peer review
With experts in the PCS section
NOK OK
Today, we are here
UNICOS PLC BASELINE END 2016