|
|
|
|
|
|
 |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Validating Software in Commercial Smart Transmitter for Safety-Critical Applications
Gopinath Karmakar, Ashutosh Kabra, Jose Joseph and R. K. Patil
Bhabha Atomic Research Centre Mumbai, India Abstract Industries, including nuclear industries, depend on the transmitters (for monitoring process parameters) that are available in the market from reputed manufacturers. This work aims at answering the question of how to validate and qualify a smart transmitter, containing pre-developed software (PDS) in it, for its suitability in safety-critical application when there is no access to the software development process documentation. The answer lies in the feasibility of exhaustive black box testing with inputs that covers the entire input set. We have argued over the feasibility of validating a commercial smart transmitter, by means of testing only and established our claim with the test results carried out on a commercial Off-The-Shelf Smart Temperature Transmitter. The key point of the whole argument is taking advantage of the resolution of the ADC (Analog to Digital Converter) that makes the set of test inputs a finite one and yet exhaustive. 1. INTRODUCTION It is a fact that conventional analog electronic transmitters will soon become a thing of past as it is getting replaced by the Smart Transmitters. Nuclear industries depend on the transmitters that are available in the market from the reputed manufacturer viz. Rosemount, Honeywell, Endress-Hauser etc. It is the long history of industrial use and its performance and the reliability of analog electronics that gave us confidence to use conventional transmitters in nuclear applications. But, a Smart transmitter is a microprocessor or microcontroller-based system and it contains software. Therefore, the question is how we can evaluate a smart transmitter, which contains pre-developed software in it, for its suitability in safety/safety-related application when there is neither any access to the documentation pertaining to the software development process nor to the source code? In this paper, we propose a method so that an exhaustive yet finite number of test cases can be generated to evaluate the capability of the transmitter to meet the functional and performance requirement demanded from it for safety applications. It may be noted that in this paper the discussion is mainly on smart temperature transmitter and our validation technique has been applied on a COTS (Commercial Off-The-Shelf) smart temperature transmitter, for which the test results have been reported. But, same methodology will be applicable for pressure transmitter also, as the software in a smart transmitter will only see the output of the ADC (Analog-to-Digital Converter) inside the transmitter and is unaware of the type of field input (temperature, pressure etc.) that causes the ADC to generate output. 2. REVIEWING A SMART TRANSMITTER Smart transmitters, like any conventional analog electronic transmitters, takes the process parameters like temperature, pressure etc. as inputs (through transducers), convert them into standard 4-20mA signal, and transmit it to plant control and monitoring systems. A Smart Transmitter is a microprocessor/microcontroller based system, which has the facility of configuration of various parameters and provides digital communication mainly with HART (Highway Addressable Remote Transducer) protocol. All adjustments and operational settings are implemented through Smart Hand-Held Field Interface or remotely wired communicator. We have studied a range of smart temperature transmitter manufactured by the market leaders that includes [1], [2], [3] and concluded that the basic operation is same for smart transmitters of all makes. Figure 1 shows the functional block diagram of a smart temperature transmitter. The temperature sensor (thermocouple, RTD etc.) output is fed to the transmitter as input. The Analog-to-Digital Converter (ADC) in it converts the analog (mV or ohm) signal into digital one. The software running in the microcontroller uses this raw digital input data to generate digital output. Digital-to-Analog Converter (DAC) at the output stage converts the digital output into 4-20 mA analog output. A number of configuration parameters like, LRV (Lower Range Value), URV (upper Range Value), engineering units, zero-point adjustment, pattern/type of input filtering etc. are configured before use.
Figure 1: Smart temperature transmitter block diagram After studying the material architecture [4] according to IEC 60770-3, applicable to smart transmitters and the technical documents from Honeywell, Rosemount and Endress+Hauser, statechart modeling the dynamic behavior of smart transmitter is presented in Figure 2. It is admitted that there is no way to generate a detailed statechart for the software inside a commercial transmitter. But, the first level of statechart can be inferred. The statechart presented here is based on the following facts.
Therefore, it is evident from the statechart that the state of the software can only be changed by i) Sensor Input, ii) Test input or iii) Configuration data via communication.
Figure 2: Statechart of a smart temperature transmitter 3. COTS SMART TRANSMITTER AND SAFETY APPLICATIONS A smart transmitter has software in it. Therefore, the immediate and obvious reaction of the nuclear Control and Instrumentation (C&I) community is that Commercial Off-The Shelf (COTS) software cannot be used in safety/safety-critical application and the argument goes like this.
In this paper, we discuss, whether, a single-input-single-output system like a smart transmitter can be qualified by testing alone. In the following sections, we will discuss that exhaustive testing can be performed even with finite number of test cases. 4. FINITE TEST CASES From, the functional block diagram (Figure 1) of the smart temperature transmitter, it is easy to conclude that though actual field input is a continuous analog signal, the input values that will be seen by the processor in the transmitter is limited by the resolution of the ADC. Therefore, the effective set of sensor input values is a finite one Notations:
So, taking advantage of the resolution of ADC we can claim that no. of test cases required to test all possible inputs are N=2r and for the ADC to detect two consecutive discrete inputs as different ones, the required step difference is δ = (Ihi - Ilo ) / (N-1) Therefore, over the entire range [Ilo-,Ihi], the input values (I) that need to be considered for testing are I 5. EFFECT OF ADC ERRORS The effect of ADC errors viz. a) Differential non-linearity (DNL), b) Integral Non-Linearity (INL), c) Offset and Gain errors, and d) Temperature Drift has been studied [5]. It is found that ADC errors (a, b, c) have their fixed values and they do not change with time. Therefore, if any particular transmitter passes the tests with the finite test input set (Section 4), we need not worry about these hardware errors including temperature drift, when the environmental temperature is maintained within specified limits. 6. FIXED CONFIGURATION DATA For a particular application the following configuration data are set to fixed values for the particular transmitter involved.
Therefore, before putting the transmitter into test, the above parameters can be configured for their fixed values, using hand-held configurator. 7. EFFECT OF ADDITIONAL SOFTWARE MODULES Effect of the software modules that perform additional functions are discussed in this section. 7.1 Diagnostics Smart transmitters usually provide diagnostics in two modes viz. automatic self-diagnostics and on-demand device test. Self-diagnostics is carried out automatically and repeated periodically. Therefore, its affect will be validated during the test carried out with the finite input set mentioned in Section 4. On-demand diagnostics is carried out using digital communicators, which can be barred during operation. 7.2 LCD Display LCD display is one-way display message to the LCD. All possible combinations of messages can be tested, as it will be a finite number of tests. 7.3 Digital Communication This paper has not considered the effect of digital communication module, because digital communication will be used only for writing/updating configuration data. Once configured, the transmitter will be put under validation test and communication can be administratively prevented by disconnecting the communication cable. 8. SUMMARY To summarize the above discussions, it can be stated that once a Smart Temperature transmitter is configured for all its parameters before use and the digital communication is barred by not allowing any physical communication connection, the software functionality is reduced only to reading a single field input signal and processing it to generate 4-20 mA output. Therefore, once a transmitter is configured and we are equipped with a finite set of test input data that will fully cover its single-input single-output transformation process carried out by the software, i.e., there will be no unpredictable states in the transmitter software, which may invoke a software module whose response is unpredictable and not covered by testing. 9. TEST SET-UP To validate a temperature transmitter, we developed a set-up and generated test results to establish our claim. The block diagram of the test set-up is given in Figure 3.
Figure 3: Test setup For test input generation, Temperature Simulator (MCIH Intcal TM-10) has been used to give precise resistance input to the transmitter under test (MOORE XTCTM Series 343).The transmitter was configured using HART communication device for its range and output type before putting it to testing. The digital communication device was removed after configuration. We simulated Pt100 RTD having an input range of 18.56Ω (-2000C) to 390.40Ω (8500C). For a 12-bit ADC, the input resolution of the transmitter will be (390.40 Ω - 18.56 Ω)/212 = 0.09 Ω Because of the ADC resolution of 0.09 Ω, the transmitter will only be able to detect change in input if it is ≥ 0.09 Ω. We generated the test input set separated by 0.05 Ω and recorded the transmitter output continuously in a digital recorder (EUROTHERM Chessell 5000 Series) and the recorded data was accessed by a PC station for analysis. Table 1.Test data
The excerpts from the test data in Table 1 shows that the output remains unchanged when input values lie within two consecutive discrete values separated by the resolution (0.09Ω) of the 12 bit ADC (for Pt100 RTD input range 18.56Ω to 390.40Ω). This test data assures that the transmitter under test gives output as per the requirement specification. The result of the test set for an input range of 0ºC-850ºC is shown in the form of chart in Figure 4. From this chart we can conclude that the transmitter under test will produce output as expected by design for the entire input range for which it will be used. It may be noted that it is assumed that all the configuration data like LRV, URV, engineering units, zero-point adjustment, pattern/type of input filtering etc. will not be altered by the user once configured and tested. The transmitter should be tested again if user wants to change any configuration data.
Figure 4: Temperature Transmitter output for simulated Pt100 sensor 10. INDUSTRIAL APPLICATION For industrial use, the smart transmitter validation test must be automated and should be time and cost-effective. To meet the requirement of automated testing, the temperature simulator shown in Figure 3 must be programmable. The programmability is required to generate test inputs with a fixed time-interval between two successive inputs, without manual intervention. Time interval between two successive inputs will depend on the update time of the transmitter under test, and it should be more than the update time specified. A test setup requires only a programmable and temperature simulator (a standard laboratory product available from multiple vendors), a digital recorder and a PC, which does not involve very high cost. Further, a transmitter with 12-bit ADC and a typical update time of 500 mSec can be tested exhaustively using our technique in less than 45 minutes. 11. CONCLUSION It has been established that exhaustive testing is feasible for a single-input-single-output device like smart temperature transmitter. Presently, the test has been carried out manually but it can be automated by using programmable temperature input simulator. The same principal is applicable for other type of transmitters like pressure, level etc for validation of third party software in it. ACKNOWLEDGEMENTS We thankfully acknowledge Shri G.P. Srivastava, Director, E&I Group, Shri B.B.Biswas, Head, RCnD and Shri Jose Joseph, Head, CSES, RCnD, Bhabha Atomic Research Centre, for giving us the opportunity to work on this project. Our sincere thanks go to Dr. A.P.Tiwari, Head, RCSDS for his encouragement and support and to Shri Ranjit Kumar for his painstaking effort in carrying out the testing. We also thank Shri P.R.Patil, Head, PIDS, RCnD and Shri VIkas Kaushik, SO/F, for the valuable technical discussions, we had with them. REFERENCES [1]. STT 3000, Series STT250 Smart Temperature Transmitter Operator Manual, Issue 7 – 12/00, EN1I-6190, Honeywell. [2]. Model 3144 and 3244MV Smart Temperature Transmitter Manual, Rosemount Measurement. [3]. Functional Safety Manual iTEMP® HART® TMT112 with a 4…20mA output signal Temperature Transmitter, Endress+Hauser. [4]. F. Brissaud et al., “Dependability Issues for Intelligent Transmitters and Reliability Pattern Proposal”, Information Control Problems in Manufacturing INCOM 2009”, Moscow, 2009 [5]. G. Gauffet and J. P. Keradec, “Incidence of the Resolution and the Differential Non Linearity of a A/D Converter on High Dynamic Signal Measurement Experimental Characterization”, Conference record of the instrumentation and measurement technology conference, IMTC/1992, New York, May 12-14, 1992. |
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
|
|
Home | Feedback | Register | Site Map |
|
|
|
All material on this site Copyright © 2017 Design And Reuse S.A. All rights reserved. |
