With roots in Zagreb, Croatia stretching back to January 1921, the name of KONČAR is recognized around the world. Railway and power generation equipment installations in more than 100 countries on all continents provide lasting evidence of the high level of quality and reliability typical of the KONČAR Group, and their cross-sector capabilities. This case study focuses on KONČAR – Electrical Engineering Institute (KEEI), one of the group’s member organizations, and their project to achieve functional safety in embedded software for a modular software platform.
KEEI’s modular software platform, Grap® Suite, is composed of a proprietary Real Time Operating System (RTOS), a graphical application development environment that encompasses a Function Block Diagram (FBD) editor, a service & diagnostics tool, and target support packages composed of block libraries and code generation tools for specific target controllers. Grap® Suite is ideally suited to accommodate the diversity of the disparate safety critical sectors serviced by the company, and the varying degree of autonomy on the part of KEEI’s customers.
The projects supported by KEEI generally fall into one of two categories. The first involves the delivery of a Grap® Suite platform, possibly with project-specific extensions, to an expert customer who will then develop their system. Examples of such projects include power converter control systems, main and auxiliary computers in trains, trams and locomotives, primary equipment monitoring systems, and railway signalling systems.
The second category involves the development of a complete custom solution based on the customer’s requirements. These also reuse as much as possible, but are less constrained by the platform. Several railway signalling systems and a safety system for machinery have been developed in this way.
IEC 61131-3:2013 specifies the syntax and semantics of a unified suite of programming languages for programmable controllers (PCs, also known as PLCs). The Function Block Diagram (FBD) language is one of five languages nominated by the standard. Its graphical nature appeals to many engineers’ affinity for graphical information.
Historically, KEEI wrote their software in assembler to support their three lines of controllers – main CPU, small auxiliary controller, and digital signal controller. But unless hardware constraints make assembler essential, writing in C is preferable because it makes applications both more portable (should the processor ever need to be changed) and maintainable (because far more C programmers exist than assembly programmers). The decision was therefore taken to port the platform’s system software to the C language.
Josip Babić is the Head of the Software Platforms department at KEEI. He observed, “Writing everything in a different programming language was a huge undertaking with many opportunities to introduce bugs. To improve code quality and prepare it for safety certification we chose to enforce MISRA C coding guidelines.”
For C programmers working on safety- or security-critical applications, restrictions and guidelines to ensure safe coding practices can be painful. Features of the C language are designed to make work easier and more efficient and to provide work-arounds for obstacles. But, these are often just the features that the “language subset” guidelines disallow.
Because life-critical applications require code to be developed to the most stringent best practice, compliance with these guidelines are a common theme in functional safety standards across the sectors. For example, the guidelines in the MISRA C standard brings a wide range of benefits to a code base by:
To retain these benefits while making restrictions less onerous for developers, MISRA has long made consistent efforts to make rules more precise so that the standard will not prevent reasonable uses or behaviours that have no undesirable consequences. For instance, in the past, macros were prohibited because of the many difficulties they can introduce. However, developers were prevented from using them in circumstances where they provide a neat, convenient and technically sound solution. The current updated MISRA rules allow macros, but limit their use to ensure they are only used properly.
Despite its motor industry roots and its association with safety-critical applications, the influence of the MISRA organization continues to grow cross-sector, and for mission- and security-critical projects. In April 2016, MISRA released a summary of the extent to which MISRA C:2012 could be mapped to ISO/IEC TS 17961:2013, a technical specification outlining coding rules for secure C. That showed that most of the 46 C Secure rules were covered by the MISRA C:2012 guidelines, and that correlation was improved further with the introduction of MISRA C:2012 Amendment 1 and its 14 additional guidelines.
The more recent release of MISRA C:2012 (Edition 3, Revision 1) sees a welcome continuation of the informative and educational approach adopted by the original version of MISRA C:2012. MISRA C:2012 (Edition 3, Revision 1) is the first revision of MISRA C:2012, and consolidates the original MISRA C:2012 document with the security guidelines established in Amendment 1, and the corrections outlined in Technical Corrigendum 1.
With the decision made to apply MISRA C, there are many options available to KEEI to help them enforce it. So why opt for LDRArules®?
Josip explains, “Our primary criteria in deciding the best tool for our needs were its static analysis capabilities, the completeness of adherence to coding standards, ease of use, and cost. Our projects require certification and so TÜV certification was also important to minimize tool qualification overheads. LDRArules® stood out as the best available option in ticking all of the right boxes.”
The cross-sector nature of KEEI’s business made it essential that the project was compliant with several different functional standards. The ability of LDRArules® to support three particular standards was key:
IEC 61508 describes methods on how to apply, design, deploy and maintain automatic safety-related systems. It is a basic functional safety standard applicable to all industries, and is arguably an ideal standard to work to for a flexible, cross-sector development. It defines functional safety as: “part of the overall safety relating to the EUC (Equipment Under Control) and the EUC control system which depends on the correct functioning of the E/E/PE safety-related systems, other technology safety-related systems and external risk reduction facilities.” The underlying principle is that any safety-related system must work correctly or fail in a predictable, safe way.
IEC 62061 is the machinery specific implementation of IEC 61508. It provides requirements that are applicable to the system level design of all types of machinery safety-related electrical control systems and also for the design of non-complex subsystems or devices.
The railway sector also based their functional safety standard on the industry agnostic IEC 61508. The resulting EN 5012X series has become the dominant railway functional safety standard, and its requirements and processes are becoming increasingly familiar across the world. EN 50128 deals with software for railway control and protection systems, and so was the primary concern within that series for KEEI.
Josip is now very busy overseeing the development of KEEI’s offerings based on the new platform.
“SafeLog was the first project to which we applied the new SW platform and the development process involving LDRArules®”, he said. “It is a Horizon 2020 project that started in 2016 and ended in 2020. In the scope of this project, we developed a very mature prototype of a safety system based on Ultra-Wide Band radio communication technology. “Horizon 2020 is the financial instrument implementing the Innovation Union, a Europe 2020 flagship initiative aimed at securing Europe’s global competitiveness. The goals are to ensure Europe produces world-class science, removes barriers to innovation, and make it easier for the public and private sectors to work together in delivering innovation.
The SafeLog system develops a holistic and certifiable safety concept based on a safety vest, which allows the collaboration of Automated Guided Vehicles (AGVs) and humans. A strong emphasis is given to planning and scheduling algorithms for a heterogeneous fleet manager. Augmented reality-based interaction strategies are developed to support workers in a robotized warehouse system.
“Individuals entering a dangerous area (such as an automated warehouse) wear the vests to enable machines equipped with Emergency Stop Modules to detect them, analyse the distance from them, and stop if necessary” explained Josip. “The project was completed successfully, and a technical report issued by TÜV NORD CERT GmbH confirmed that the development has been in accordance with requirements of relevant functional safety standards.”
The flexibility of the Grap® Suite platform is already in evidence. “Currently we are using the same software platform to develop a new version of Train Control and Management System that will be used for the first time in a set of 21 electric multiple units for Croatian Railways” Josip said, putting the achievement of functional safety in embedded software across multiple sectors into context.
“The move to the C language coupled with MISRA compliance enforced through the use of LDRArules® inspires confidence that our code quality has improved, and will continue to do so. That makes me confident that we will reduce support costs, too!” he concluded.
Mark Pitchford has over 30 years’ experience in software development for engineering applications. He has worked on many significant industrial and commercial projects in development and management, both in the UK and internationally. Since 2001, he has worked with development teams looking to achieve compliant software development in safety and security critical environments, working with standards such as DO-178, IEC 61508, ISO 26262, IIRA and RAMI 4.0.
Mark earned his Bachelor of Science degree at Nottingham Trent University, and he became a Chartered Engineer over 35 years ago. He now works as Technical Specialist with LDRA Software Technology.
Email: info@ldra.com
EMEA: +44 (0)151 649 9300
USA: +1 (855) 855 5372
INDIA: +91 80 4080 8707