下载文档原格式
Advanced Control Systems Advanced Control Systems play a crucial role in modern engineering and technology, enabling precise and efficient control of complex systems across various industries. From aerospace and automotive to manufacturing and robotics, the application of advanced control systems has revolutionized the way we design, operate, and optimize processes and machinery. In this discussion, we will explore the significance of advanced control systems, their key components, challenges, and future prospects from multiple perspectives. From an engineering standpoint, advanced control systems encompass a wide range of methodologies and techniques aimed at regulating the behavior of dynamic systems. These systems can be as simple as a thermostat controlling room temperature or as complex as a self-driving car navigating through traffic. One of the fundamental components of advanced control systems is the use of mathematical models to describe the dynamics of the system and develop control algorithms. These algorithms can be implemented in hardware or software, utilizing sensors and actuators to measure and manipulate the system's behavior in real-time. In the field of aerospace, advanced control systems are instrumental in ensuring the stability and maneuverability of aircraft and spacecraft. Flight control systems utilize a combination of autopilots, gyroscopes, and control surfaces to maintain stability and respond to pilot commands. With the advent of unmanned aerial vehicles (UAVs), advanced control systems have become even more critical in enabling autonomous flight and navigation, opening up new possibilities for surveillance, delivery, and exploration. In the automotive industry, advanced control systems have revolutionized vehicle dynamics and safety. Electronic stability control (ESC) systems use sensors to detect and prevent skidding and loss of traction, enhancing the overall safety of vehicles. Moreover, the development of autonomous vehicles relies heavily on advanced control systems, enabling cars to perceive their environment, make decisions, and navigate without human intervention. The integration of sensors, actuators, and control algorithms in modern vehicles represents a significant leap forward in the quest for safer and more efficient transportation. The manufacturing sector has also benefited significantly from advanced control systems, particularly in the realm of robotics and automation.Industrial robots equipped with advanced control systems can perform a wide array of tasks with precision and repeatability, ranging from assembly and welding to painting and inspection. The seamless integration of robots into manufacturing processes has not only improved efficiency but also created new opportunities for customization and flexibility in production lines. Despite the numerous advantages offered by advanced control systems, several challenges and considerations must be addressed to ensure their effective implementation and operation. One of the primary concerns is the robustness and reliability ofcontrol algorithms, especially in safety-critical applications such as autonomous vehicles and medical devices. The need to account for uncertainties, disturbances, and unforeseen events poses a significant challenge in the design and validation of advanced control systems. Another critical aspect is the ethical and societal implications of advanced control systems, particularly in the context of autonomous technologies. The deployment of autonomous vehicles, for instance, raises questions regarding liability, decision-making algorithms, and the impact on traditional modes of transportation. Furthermore, the potential displacement of human workers in various industries due to automation calls for a thoughtful and inclusive approach to the adoption of advanced control systems. Looking ahead, the future of advanced control systems holds immense potential for further innovation and integration across diverse domains. The emergence of cyber-physical systems, enabled by the Internet of Things (IoT) and cloud computing, presents new opportunities for interconnected and intelligent control systems. The ability to collect and analyze vast amounts of data in real-time opens up avenues for adaptive and predictive control strategies, enhancing performance and resilience in dynamic environments. In conclusion, advanced control systems represent a cornerstone of modern engineering and technology, driving advancements in aerospace, automotive, manufacturing, and beyond. The convergence of mathematical modeling, sensors, actuators, and computing has paved the way for unprecedented levels of precision, efficiency, and autonomy in controlling complex systems. As we continue to navigate the opportunities and challenges associated with advanced control systems, it is essential to prioritize safety, ethics, and inclusiveinnovation to realize their full potential in shaping the future of technology and society.。
Intelligent Control Systems Intelligent control systems are becoming increasingly popular in today's world, with the rise of automation and smart technologies. These systems are designed to use artificial intelligence (AI) and machine learning (ML) algorithms to control and optimize various processes, from manufacturing and logistics to energy management and building automation. While the benefits of intelligent control systems are numerous, there are also some concerns and challenges that need to be addressed. One of the main advantages of intelligent control systems is their ability to improve efficiency and productivity. By using AI and ML algorithms, these systems can analyze large amounts of data and make real-time decisions based on that analysis. This can lead to faster and more accurate decision-making, which in turn can lead to increased productivity and reduced costs. For example, in a manufacturing plant, an intelligent control system can optimize the production process by adjusting the speed of machines, reducing waste, and minimizing downtime. Another benefit of intelligent control systems is their ability to improve safety and security. By using sensors and cameras, these systems can monitor and detect potential hazards or security threats in real-time. They can also automatically take action to prevent or mitigate these risks, such asshutting down a machine or alerting security personnel. This can help prevent accidents and reduce the risk of theft or other security breaches. However, there are also some concerns and challenges associated with intelligent control systems. One of the main concerns is the potential impact on jobs. As these systems become more advanced and widespread, there is a risk that they could replace humanworkers in certain industries. This could lead to job losses and economic disruption, particularly in industries that rely heavily on manual labor. Another challenge is the potential for these systems to malfunction or be hacked. While intelligent control systems are designed to be secure and reliable, there isalways a risk of technical glitches or cyber attacks. If a system were to malfunction or be hacked, it could cause serious damage or disruption to the processes it controls. This highlights the importance of ensuring that these systems are properly designed, tested, and secured. Another concern is the potential for these systems to be biased or discriminatory. AI and ML algorithmsare only as good as the data they are trained on, and if that data is biased or incomplete, the resulting system could also be biased. This could lead to unfair or discriminatory outcomes, particularly in areas such as hiring, lending, or criminal justice. It is therefore important to ensure that these systems are designed and trained with fairness and inclusivity in mind. In conclusion, intelligent control systems have the potential to revolutionize many industries and improve efficiency, productivity, safety, and security. However, there are also some concerns and challenges that need to be addressed, such as the potential impact on jobs, the risk of malfunctions or cyber attacks, and the potential for bias or discrimination. To ensure that these systems are used responsibly and ethically, it is important to involve a diverse range of stakeholders in the design and implementation process, and to prioritize transparency, accountability, and fairness.。
criticality术语
"Criticality"是一个科学术语，通常用于描述一个系统或事件的重要性和紧急性。
在不同的领域中，criticality的含义和重要性有所不同。
在核物理学中，criticality是指一个核反应堆达到临界状态，此时反应堆中的核燃料能够维持自持链式反应。
在这种情况下，反应堆会释放大量的能量，如果控制不当，可能会导致灾难性的后果。
因此，核反应堆的设计和操作必须非常精确，以确保它们始终保持在安全的状态下。
在计算机科学中，criticality可以指代一个任务或操作的紧急性或重要性。
例如，某些任务可能需要立即完成，否则可能会导致系统故障或数据丢失。
在这种情况下，这些任务就被认为是高criticality任务，需要优先处理。
在医学中，criticality通常用于描述患者的病情严重程度。
例如，某些疾病或状况可能会导致患者的生命处于危险之中，这些情况就被认为是高criticality情况，需要立即采取行动进行治疗或干预。
除了上述领域外，criticality还广泛应用于其他领域，如工程、化学、环境科学等。
在这些领域中，criticality通常用于描述一个系统或事件的关键性或紧急性，需要采取适当的措施来确保安全和稳定。
总之，"criticality"是一个通用术语，用于描述一个系统或事件的重要性和紧急性。
在不同的领域中，criticality的具体含义和重要性有所不同，但都是为了强调需要采取适当的措施来确保安全和稳定。
OBJECTIVESOLIDWORKS® Flow Simulation is a powerful Computational Fluid Dynamics (CFD) solution fully embedded within SOLIDWORKS. It enables designers and engineers to quickly and easily simulate the effect of fluid flow, heat transfer and fluid forces that are critical to the success of their designs.OVERVIEWSOLIDWORKS Flow Simulation enables designers to simulate liquid and gas flow in real-world conditions, run “what if” scenarios and efficiently analyze the effects of fluid flow, heat transfer and related forces on or through components. Design variations can quickly be compared to make better decisions, resulting in products with superior performance. SOL IDWORKS Flow Simulation offers two flow modules that encompass industry specific tools, practices and simulation methodologies—a Heating, Ventilation and Air Conditioning (HVAC) module and an Electronic Cooling module. These modules are add-ons to a SOLIDWORKS Flow Simulation license. BENEFITS• Evaluates product performance while changing multiple variables at a rapid pace.• Reduces time-to-market by quickly determining optimal design solutions and reducing physical prototypes.• Enables better cost control through reduced rework and higher quality.• Delivers more accurate proposals.CAPABILITIESSOLIDWORKS Flow SimulationSOLIDWORKS Flow Simulation is a general-purpose fluid flow and heat transfer simulation tool integrated with SOLIDWORKS 3D CAD. Capable of simulating both low-speed and supersonic flows, this powerful 3D design simulation tool enables true concurrent engineering and brings the critical impact of fluid flow analysis and heat transfer into the hands of every designer. In addition to SOL IDWORKS Flow Simulation, designers can simulate the effects of fans and rotating components on the fluid flow and well as component heating and cooling. HVAC ModuleThis module offers dedicated simulation tools for HVAC designers and engineers who need to simulate advanced radiation phenomena. It enables engineers to tackle the tough challenges of designing efficient cooling systems, lighting systems or contaminant dispersion systems. Electronic Cooling ModuleThis module includes dedicated simulation tools for thermal management studies. It is ideal for companies facing thermal challenges with their products and companies that require very accurate thermal analysis of their PCB and enclosure designs.SOLIDWORKS Flow Simulation can be used to:• Dimension air conditioning and heating ducts with confidence, taking into account materials, isolation and thermal comfort.• Investigate and visualize airflow to optimize systems and air distribution.• Test products in an environment that is as realistic as possible.• Produce Predicted Mean Vote (PMV) and Predicted Percent Dissatisfied (PPD) HVAC results for supplying schools and government institutes.• Design better incubators by keeping specific comfort levels for the infant and simulating where support equipment should be placed.• Design better air conditioning installation kits for medical customers.• Simulate electronic cooling for LED lighting.• Validate and optimize designs using a multi-parametric Department of Energy (DOE) method.SOLIDWORKS FLOW SIMULATIONOur 3D EXPERIENCE® platform powers our brand applications, serving 12 industries, and provides a rich portfolio of industry solution experiences.Dassault Syst èmes, t he 3D EXPERIENCE® Company, provides business and people wit h virt ual universes t o imagine sust ainable innovat ions. It s world-leading solutions transform the way products are designed, produced, and supported. Dassault Systèmes’ collaborative solutions foster social innovation, expanding possibilities for the virtual world to improve the real world. The group brings value to over 220,000 customers of all sizes in all industries in more than 140 countries. For more information, visit .Europe/Middle East/Africa Dassault Systèmes10, rue Marcel Dassault CS 4050178946 Vélizy-Villacoublay Cedex France AmericasDassault Systèmes 175 Wyman StreetWaltham, Massachusetts 02451-1223USA Asia-PacificDassault Systèmes K.K.ThinkPark Tower2-1-1 Osaki, Shinagawa-ku,Tokyo 141-6020Japan©2018 D a s s a u l t S y s t èm e s . A l l r i g h t s r e s e r v e d . 3D E X P E R I E N C E ®, t h e C o m p a s s i c o n , t h e 3D S l o g o , C A T I A , S O L I D W O R K S , E N O V I A , D E L M I A , S I M U L I A , G E O V I A , E X A L E A D , 3D V I A , B I O V I A , N E T V I B E S , I F W E a n d 3D E X C I T E a r e c o m m e r c i a l t r a d e m a r k s o r r e g i s t e r e d t r a d e m a r k s o f D a s s a u l t S y s t èm e s , a F r e n c h “s o c i ét é e u r o p ée n n e ” (V e r s a i l l e s C o m m e r c i a l R e g i s t e r # B 322 306 440), o r i t s s u b s i d i a r i e s i n t h e U n i t e d S t a t e s a n d /o r o t h e r c o u n t r i e s . A l l o t h e r t r a d e m a r k s a r e o w n e d b y t h e i r r e s p e c t i v e o w n e r s . U s e o f a n y D a s s a u l t S y s t èm e s o r i t s s u b s i d i a r i e s t r a d e m a r k s i s s u b j e c t t o t h e i r e x p r e s s w r i t t e n a p p r o v a l .• Free, forced and mixed convection• Fluid flows with boundary layers, including wall roughness effects• Laminar and turbulent fluid flows • Laminar only flow• Multi-species fluids and multi-component solids• Fluid flows in models with moving/rotating surfaces and/or parts• Heat conduction in fluid, solid and porous media with/without conjugate heat transfer and/or contact heat resistance between solids• Heat conduction in solids only • Gravitational effectsAdvanced Capabilities• Noise Prediction (Steady State and Transient)• Free Surface• Radiation Heat Transfer Between Solids • Heat sources due to Peltier effect• Radiant flux on surfaces of semi-transparent bodies• Joule heating due to direct electric current in electrically conducting solids• Various types of thermal conductivity in solid medium • Cavitation in incompressible water flows• Equilibrium volume condensation of water from steam and its influence on fluid flow and heat transfer• Relative humidity in gases and mixtures of gases • Two-phase (fluid + particles) flows • Periodic boundary conditions.• Tracer Study• Comfort Parameters • Heat Pipes • Thermal Joints• Two-resistor Components • PCBs•Thermoelectric Coolers• Test the heat exchange on AC and DC power converters.• Simulate internal temperature control to reduce overheating issues.• Better position fans and optimize air flux inside a design.• Predict noise generated by your designed system.Some capabilities above need the HVAC or Electronic Cooling Module.SOLIDWORK Design Support• Fully embedded in SOLIDWORKS 3D CAD• Support SOLIDWORKS configurations and materials • Help Documentation • Knowledge base• Engineering database• eDrawings ® of SOLIDWORKS Simulation results General Fluid Flow Analysis• 2D flow • 3D flow • Symmetry• Sector Periodicity • Internal fluid flows • External fluid flowsAnalysis Types• Steady state and transient fluid flows • Liquids • Gases• Non-Newtonian liquids • Mixed flows• Compressible gas and incompressible fluid flows •Subsonic, transonic and supersonic gas flowsMesher• Global Mesh Automatic and Manual settings • Local mesh refinementGeneral Capabilities• Fluid flows and heat transfer in porous media • Flows of non-Newtonian liquids • Flows of compressible liquids •Real gases。
GMPMay 2011EMA/CHMP/ICH/425213/2011ICH/ Committee for medicinal products for human use (CHMP)ICH guideline Q11 on development and manufacture of drug substances (chemical entitiesand biotechnological/biological entities)ICH 指导原则 Q11 原料药的开发和生产(化学实体和生物技术/生物实体)Step 3翻译/审核：谢永/ChankTransmission to CHMP May 2011 Comments Should be provided using this template. The Completed comments form7 Westferry Circus ● Canary Wharf ● London E14 4HB ● United KingdomTelephone +44 (0)20 7418 8400 Facsimile +44 (0)20 7418 8416E-mail ich@ema.europa.eu Website www.ema.europa.eu An agency of the European Union© European Medicines Agency, 2011. Reproduction is authorised provided the source is acknowledged.T ABLE OF CONTENTS目录1.I NTRODUCTION 介绍 (4)2.S COPE 范围 (4)3.M ANUFACTURING P ROCESS D EVELOPMENT 制造工艺开发 (5)3.1. General Principles 总则 (5)3.1.1. Drug Substance Quality Link to Drug Product将原料药质量与制剂药品联系起来 (5)3.1.2. Process Development Tools 工艺开发工具 (5)3.1.3. Approaches to Development 开发的方法 (6)3.1.4. Drug Substance Critical Quality Attributes 原料药的关键质量属性（CQA） (7)3.1.5. Linking Material Attributes and Process Parameters to Drug Substance CQAs 将物料属性和工艺参数与原料药的关键质量属性相关联 (8)3.1.6. Design Space 设计空间 (9)3.2. Submission of Manufacturing Process Development Information 制造工艺开发信息的注册递交 (10)3.2.1. Overall Process Development Summary 全面的工艺开发总结 (10)3.2.2. Drug Substance CQAs 原料药的CQAs (11)3.2.3. Manufacturing Process History 制造工艺历史 (11)3.2.4. Manufacturing Developmental Studies 制造开发研究 (12)4.D ESCRIPTION OF M ANUFACTURING P ROCESS AND P ROCESS C ONTROLS 制造工艺描述和工艺控制. 125.S ELECTION OF S TARTING M ATERIALS AND S OURCE M ATERIALS 起始物料和源物料的选择 (13)5.1. General Principles 通则 (13)5.1.1. Selection of Starting Materials for Synthetic Drug Substances 化学合成原料药的起始物料的选择 (13)5.1.2. Selection of Starting Materials for Semi-synthetic Drug Substances 半合成原料药的起始物料的选择 (14)5.1.3. Selection of Source Materials for Biotechnological/Biological Products生物产品的起始物料的选择 (15)5.2. Submission of Information for Starting Material or Source Material 起始物料或源物料的信息申报 (15)5.2.1. Justification of Starting Material Selection for Synthetic Drug Substances 合成原料药的起始物料的选择的合理解释 (15)5.2.2. Justification of Starting Material Selection for Semi-Synthetic Drug Substances 半合成原料药的起2 / 37始原料选择的合理解释 (16)5.2.3. Qualification of Source Materials for Biotechnological/Biological Products 生物产品源物料的确认 (16)6. C ONTROL S TRATEGY控制策略 (16)6.1. General Principles 通则 (16)6.1.1. Approaches to Developing a Control Strategy 开发控制策略的方法 (17)6.1.2. Considerations in Developing a Control Strategy 开发控制策略中的考虑 (17)6.2. Submission of Control Strategy Information 控制策略信息的注册申报 (18)7. P ROCESS V ALIDATION/E VALUATION工艺验证/评估 (19)7.1. General Principles 一般原则 (19)7.2. Principles Specific to Biotechnological/Biological Products 生物制品的特殊原则 (20)8. S UBMISSION OF M ANUFACTURING P ROCESS D EVELOPMENT AND R ELATED I NFORMATION I N C OMMONT ECHNICAL D OCUMENTS (CTD)F ORMAT生产工艺开发及相关信息在CTD格式的递交 (21)8.1. Quality Risk Management and Process Development 质量风险管理和工艺开发 (21)8.2. Critical Quality Attributes (CQAs) 关键质量属性（CQAs） (21)8.3. Design Space 设计空间 (21)8.4. Control Strategy 控制策略 (22)9. L IFECYCLE M ANAGEMENT 生命周期管理 (22)10. Illustrative Examples 实例 (23)10.1. Example 1: Linking Material Attributes and Process Parameters to Drug Substance CQAs - ChemicalEntity 将物料属性和工艺参数与原料药的关键质量属性（CQA）相关联—化学药部分 (23)10.2. Example 2: Use of Quality Risk Management to Support Lifecycle Management of Process Parameters使用质量风险管理支持工艺参数的生命周期管理 (27)10.3. Example 3: Presentation of a Design Space for a Biotechnological Product Unit Operation 例3：生物产品单元操作设计空间的介绍 (28)10.4. Example 4: Selecting an Appropriate Starting Material 例4：选择一个恰当的起始物料 (30)10.5. Example 5: Summary of Control Elements for select CQAs 选择CQA 的控制要素的小结 (31)11.G LOSSARY术语 (35)3 / 371.I NTRODUCTION 介绍This guideline describes approaches to developing process and drug substance understanding and also provides guidance on what information should be provided in CTD sections 3.2.S.2.2 ¨C 3.2.S.2.6.It provides further clarification on the principles and concepts described in ICH guidelines on Pharmaceutical Development (Q8), Quality Risk Management (Q9) and Pharmaceutical Quality Systems (Q10) as they pertain to the development and manufacture of drug substance.此指南描述了开发原料药工艺及理解的方法，也提供了那些信息需要在CTD 章节 3.2.S.2.2 和3.2.S.2.6 中提供的指南。
s Dramatically reduced development costsThe wide range of outdoor modules with flexible I/O available with IQAN ensures complete machine manage-ment. The system offers a building-block approach that simplifies component design and installation while also reducing development time and expenses.u Rugged design and excellent ergonomicsIQAN hardware is thoroughly tested for robust operation and compatibility with all kinds of mobile hydraulic equipment. In addition, it meets industry and government standards for operation in severe conditions, including extremely high or low temperatures, vibrations, mechanical impact and electromagnetic interference.Efficiency in focus – throughout the entire machine life cycle Electronic control made easyThe state-of-the-art IQAN systemis a unique, totally electronicapproach that replaces mechani-cal and electromechanical systemsfor controlling and monitoringhydraulics in mobile machines.With Parker’s IQAN, you havecomplete freedom to design cus-tomized software without the needfor advanced programming skills.The flexible functions availablewithin the IQAN system allowsophisticated applications to beprogrammed and optimized veryquickly, enabling huge savings ondevelopment time – and cost.The IQAN software tools cover allphases of a machine’s life cycle,from development through pro-duction to after sales.NTA L E SsEasy installationThe design philosophy behind the IQAN system is based on simplicity in every way. The modular CAN bus structure offers total freedom in machine development – the rugged IQAN units can be placed in any area of the mobile machine, enabling a more compact design and/or minimised wiring, while reducing installation time to an absolute minimum.RO DU C T I O NPsNo programmingskills requiredIQAN is user-programmable via an advanced, highly intuitive graphic design tool, which dramatically simplifies development. Simulation of the control system can be carried out in parallel with the programming of machine functions.u Advanced diagnosticsThe IQAN control units have an advanced built-in diagnostics system that will help to minimize down-time in the case of failure in the field. Problems can be located either by the default system diagnostics delivered with the standardproduct, or by customer designed diagnostics functionality.s Intelligent display/control The IQAN master modules incorp- orates powerful computing capacity with high processing speeds and multiple CAN bus interfaces. These features make the units extremely flexible and adaptable to a variety of applications with a wide range of hydraulic components and input devices such as joysticks, pedals and sensors.s Sensors forevery type of needThe IQAN sensors have been deve-loped specifically for mobile appli-cations and are designed from the ground up to excel in the demanding physical, regulatory and commercial environment of the mobile machine sector.Intelligent software – the way ahead40 years of motion control experience – ready to plug and playParker’s experience in hydraulic motion control is second to none, with over forty years of experience in close collaboration with custo-mers world-wide. What started with basic ergonomic demands from machine operators hasdeveloped into highly advancedelectro-hydraulic machine control knowledge, made accessible to everyone in the IQAN product range. An IQAN system will not only offer shorter development time for the machine manufactu-rer, but also maximum functiona-lity and up-time for the machine owner once it enters the market.Illustration shows possible product applications in an agricultural tractor.-image courtesy of Valtra Inc.u Multi master support Complex machine layouts anddemanding machine functionality can be facilitated easily with a multi mas-ter system design. Major benefits of such a system include distribu-ted functionality and diagnostics, a distributed human machine interface (HMI), extended memory capacity, faster cycle time and additional I/Os. With IQAN, a multi master system will feel like a single master system.u Long-life precision controls At Parker, we know what reliability means for profitability. All IQAN control units are thoroughly tested and builtto withstand many years of use and abuse in the toughest environmentsimaginable, while maintaining theprecision needed for maximum productivity.sRugged 32-bit performance The IQAN control units have been designed with 32-bit performance to meet high computing demands. The rugged design of the IQAN hardware is tested for robust operation and compatibility with mobile hydraulic equipment. In addition, it meets industry and government standards for operation in severe conditions that include extremely high or low tempe-ratures, vibrations, mechanical impact and electromagnetic interference.u SafetyAll IQAN modules are designed with the functional safety requirements of mobile machines in mind.Where there is a need to prove the safety integrity of each implemented safety function; the safety controller IQAN-MC3 can be used.It is designed in accordance with IEC 61508, and can be used to implement safety functions of up to SIL2.When applying EN ISO 138489-1 for safety functions, it can be used as a PLd subsystem.u Create advanced functions – in minutes!IQANdesign is an advanced design tool with an intuitive graphic interface, which simplifies application development for your mobile machine and redu-ces development time. This tool is mainly used for general system layout and machine function design. There is a wide range of predefined building blocks available, such as closed loop control, signal processing, math calculations, communication protocols (e.g. SAE J1939) and system diagnostics.IQANdesign can be used to design systems with multiple masters. Multiple master design work is simplified by use of a project file that contains applica-tions for all IQAN masters in the system.In addition to machine function design, IQANdesign also provides a simple way to accomplish display page programming using a simple drag and drop inter-face. The menu system can also be customized .t Increased productivity andreduced environmental impactWith IQAN Software studios, any OEM can create custom functions that optimize a machine’s energy efficiency – the power can easily be made available when needed, and only then.Easier development...Cut time-to-market by several monthsThe IQAN software studios cover all phases of a machine’s life cycle, from development through pro- duction to after sales. The main philosophy behind the IQAN Soft-ware Studios is that the OEM, with their extensive knowledge of their machine’s life cycle, should be able to create software that makestheir product perform at top level, easy to produce and giving the end user maximum up-time.All this can be achieved without any previous programming expe-rience – anyone who knows what functions are needed can learn to build them in a remarkably shorttime.• 32-bit technology • Outstanding motion control experience • User-friendly• Software-based development• World-wide supportt Endless possibilitiesToday, an OEM’s engineering depart-ment wants to design and prototype new machines or features quickly and easily. The production depart-ment wants to automate, log and trace the delivery status. The service department wants to handle warran-ties, offer proactive maintenance and download machine upgrades. Finally, the machine owner wants a reliable machine with high productivity and low downtime. To meet all of these demands, IQAN Software Studios were designed to fulfill the needs of the machine life cycle model. IQAN tools give an extraordinary value over the product life cycle. A product generation that lives for 5-10 years can be easily be updated to remain competitive until it is replaced by the next product generation.sVirtual simulation speeds up developmentIQANsimulate is a simulation tool, which simplifies function testing andvalidation, reducing development time. It simulates all of the hardware modules in an IQAN application. Software simulation is a safer way to test new app- lications than on an actual machine. Simulation of all input values in your application is easy using the on-screen sliding bar interface. While simulating inputs you can simultaneously measure the resulting output values. T ogether with module and I/O error simulation you will be able to perform machineFMEA (Failure Modes and Effects Analysis). The simulator will behave just like the ‘real thing’, meaning you will be able to look at your display pages,adjust parameters, view logs, test your user interface and much more.p Speed up production Getting a machine design into production is time consuming. Testing equipment and procedures have to be developed and machine start-up and delivery status needs to be recorded. Fortunately, IQAN Software is tailor-made to fulfill all of these demands. Software tools from IQAN can be adapted to feature machine-specific procedures for maintenance, fault finding and web supported machine upgrades, while the machine owner can access spare parts manuals, maintenance videos, service intervals and service sugges-tions by the software.t Fine-tune in the real world During the development phase you can use IQANrun to optimize your machine’s performance with the help of IQANrun’s advanced graphic measuring and machine statistics collection functions. IQANrun also of-fers a convenient way of developing the basic machine settings during theprototyping phase.s Fewer components, easier installationIQANscript allows you to design machine startups with secured and standard-ized procedures. This increases manufacturing productivity and initial machine quality. By creating troubleshooting scripts you can guide both production and service personnel during the fault finding process. This decreases the fault finding time and makes it possible for less trained personnel to find problems that otherwise would require expert knowledge....easier production...Set-up and customise in minutes – not days!With IQANscript you create scripts using simple drag and drop ope-rations. Each script is a sequence of actions that can be executed in IQANrun. A wide range of script actions are available to build scripts for different ing flow control actions such as conditions and loops you can control how the script is executed. With the different measure andotherwise complex operations. Input from the user can also be collected and used by the script. To provide traceability you can include a customized report in the script. When the script is executed the results will be recorded in the report, making it possible to get a good overview as well as saving the report for future use.t Real-time adjustmentsThe user-friendly IQANrun software is makes fine-tuning functions easy. Any changes can be followed on-screen in real-time for maximum control. The result for the end-user is a better performing mobile machine – andperformance means profitability.log actions, information can be re- trieved from the master units to be analyzed by the script or displayed to the user. Setting actions provide full control of the master settings, making it possible to fine tune the machine using a script. IQANs-cript provides powerful building blocks for the script user interface. Using formatted text and imagesthe script user is guided throughThe script concept was developed to help OEM production departments create routines for testing, tuning, setting options, logging, delivery sheets, etc.• Easy to install and set-up quickly• Customize as desired • I ncrease your delivery capacitysUpgrade anywhereFunctions can be easily tweaked to perfection on a laptop computer, and then downloaded to the IQAN master module – in a workshop or out in thefield, in a matter of minutes.t Remote diagnosticsWith a modem connected to the master module, remote diagnostics on a machine out in the field becomes possible. Trouble-shooting and updating of application software can be done remotely. There is no need to get to the machine for a first diagnosis, and if a physical repair is needed, the service technnician is well prepared with advance information and can bring all the necessary spare parts and tools needed to get the machine running quickly....and easier maintenanceCutting down-time with intelligent diagnostics systemsToday, service technicians have a large number of tools and docu- ments to keep track of. Someti-mes, it is hard for them to find the right information and to be sure they use the correct version of a software or document. The cus-tomize feature in IQAN Productive Studio was developed to solve this problem. It allows you to collect all machine software and informa-tion in one user interface and to distribute it to your users quickly and easily via the web. Machine downtime is minimised since the service technicaian have all the information needed in one place and the information is always up to date.IQANcustomize is a tool that enables customization of the IQANrun software functions and appearance to create a unique ser-vice and production tool. This is done by creating one or more pa-ges using the graphical page editor in IQANcustomize. The pages can contain specific information for each machine type and will be displayed when IQANrun is star-ted. Your company logo, graphics, links and information may all be integrated in the user interface of IQANrun. Using IQANcustomize you can also show or hide IQAN-run functions, or make them avai-lable as links on any page, to assist users through a troubleshooting ortuning process.IQAN product range Everything you need for complete controlIQAN by Parker offers a completerange of control products to meetyour needs. No matter what yourneed is, Parker can offer anythingfrom the most basic valve driverapplication to a complete controlsystem for larger, more complica-ted machines.11Your local authorized Parker distributorParker WorldwideE d . 2015-04-21EMEA Product Information Centre Free phone: 00 800 27 27 5374(from AT , BE, CH, CZ, DE, DK, EE, ES, FI, FR, IE, IL, IS, IT , LU, MT , NL, NO, PL, PT , RU, SE, SK, UK, ZA) US Product Information Centre Toll-free number: 1-800-27 27 537Europe, Middle East, AfricaAE – United Arab Emirates, DubaiTel: +971 4 8127100 ********************AT – Austria, Wiener Neustadt Tel: +43 (0)2622 23501-0 *************************AT – Eastern Europe, Wiener NeustadtTel: +43 (0)2622 23501 900 ****************************AZ – Azerbaijan, Baku Tel: +994 50 22 33 458****************************BE/LU – Belgium, Nivelles Tel: +32 (0)67 280 900*************************BG – Bulgaria, Sofia Tel: +359 2 980 1344**************************BY – Belarus, Minsk Tel: +48 (0)22 573 24 00 ************************CH – Switzerland, Etoy Tel: +41 (0)21 821 87 00*****************************CZ – Czech Republic, Klecany Tel: +420 284 083 111*******************************DE – Germany, Kaarst Tel: +49 (0)2131 4016 0*************************DK – Denmark, Ballerup Tel: +45 43 56 04 00*************************ES – Spain, Madrid Tel: +34 902 330 001 ***********************FI – Finland, VantaaTel: +358 (0)20 753 2500 *************************FR – France, Contamine s/Arve Tel: +33 (0)4 50 25 80 25 ************************GR – Greece, Athens Tel: +30 210 933 6450 ************************HU – Hungary, Budaoers Tel: +36 23 885 470*************************IE – Ireland, Dublin Tel: +353 (0)1 466 6370 *************************IT – Italy, Corsico (MI)Tel: +39 02 45 19 21 ***********************KZ – Kazakhstan, Almaty Tel: +7 7273 561 000****************************NL – The Netherlands, Oldenzaal Tel: +31 (0)541 585 000 ********************NO – Norway, Asker Tel: +47 66 75 34 00************************PL – Poland, Warsaw Tel: +48 (0)22 573 24 00 ************************PT – Portugal, Leca da Palmeira Tel: +351 22 999 7360**************************RO – Romania, Bucharest Tel: +40 21 252 1382*************************RU – Russia, Moscow Tel: +7 495 645-2156************************SE – Sweden, Spånga Tel: +46 (0)8 59 79 50 00 ************************SK – Slovakia, Banská Bystrica Tel: +421 484 162 252**************************SL – Slovenia, Novo Mesto Tel: +386 7 337 6650**************************TR – Turkey, Istanbul Tel: +90 216 4997081 ************************UA – Ukraine, KievTel: +48 (0)22 573 24 00 ************************UK – United Kingdom, Warwick Tel: +44 (0)1926 317 878 ********************ZA – South Africa, Kempton Park Tel: +27 (0)11 961 0700*****************************North AmericaCA – Canada, Milton, Ontario Tel: +1 905 693 3000US – USA, Cleveland (industrial)Tel: +1 216 896 3000US – USA, Elk Grove Village (mobile)Tel: +1 847 258 6200Asia PacificAU – Australia, Castle Hill Tel: +61 (0)2-9634 7777CN – China, Shanghai Tel: +86 21 2899 5000HK – Hong Kong Tel: +852 2428 8008ID – Indonesia, Tangerang Tel: +62 21 7588 1906IN – India, MumbaiTel: +91 22 6513 7081-85JP – Japan, Fujisawa Tel: +81 (0)4 6635 3050KR – South Korea, Seoul Tel: +82 2 559 0400MY – Malaysia, Shah Alam Tel: +60 3 7849 0800NZ – New Zealand, Mt Wellington Tel: +64 9 574 1744SG – Singapore Tel: +65 6887 6300TH – Thailand, Bangkok Tel: +662 186 7000TW – Taiwan, New Taipei City Tel: +886 2 2298 8987VN – Vietnam, Ho Chi Minh City Tel: +84 8 3999 1600South AmericaAR – Argentina, Buenos Aires Tel: +54 3327 44 4129BR – Brazil, Cachoeirinha RS Tel: +55 51 3470 9144CL – Chile, Santiago Tel: +56 2 623 1216MX – Mexico, Toluca Tel: +52 72 2275 4200© 2010-2015 Parker Hannifin Corporation. All rights reserved.Bulletin HY33-8368/UK. POD 08/2015 EMDC。
Robust Control and Estimation Robust control and estimation are critical components in the field of engineering and technology. These concepts play a crucial role in ensuring the stability and performance of various systems, ranging from aerospace and automotive to industrial and biomedical applications. As an engineer, I have encountered numerous challenges and complexities in implementing robust controland estimation techniques, which have significantly impacted the success and reliability of the systems I have worked on. One of the primary challenges in robust control and estimation is the inherent uncertainty and variability presentin real-world systems. This uncertainty can arise from various sources, such as environmental conditions, component variations, and external disturbances. As a result, designing controllers and estimators that can effectively handle these uncertainties is a daunting task. It requires a deep understanding of system dynamics, as well as advanced mathematical tools such as robust control theory, stochastic processes, and optimization techniques. In my experience, I have often found myself grappling with the trade-off between performance and robustness in control and estimation design. While it is essential to achieve high performancein terms of speed, accuracy, and responsiveness, it is equally important to ensure that the system remains stable and robust in the face of uncertainties. Balancing these conflicting objectives requires a careful and meticulous approach, involving extensive simulations, analysis, and testing to validate the effectiveness of the designed control and estimation algorithms. Moreover, the integration of robust control and estimation techniques into practical engineering systems poses its own set of challenges. Implementing complex algorithms on real-time embedded platforms, ensuring compatibility with existing hardware and software, and addressingpractical constraints such as cost, power, and size, are all critical considerations that engineers must navigate. These practical challenges often demand innovative solutions and a multidisciplinary approach, involving collaboration with experts in control theory, signal processing, electronics, and software engineering. From a personal standpoint, the pursuit of robust control and estimation has been both intellectually stimulating and emotionally taxing. The thrill of overcoming technical hurdles and witnessing the successfuldeployment of robust control and estimation solutions is often accompanied by moments of frustration and self-doubt. The iterative nature of design, the needfor continuous refinement, and the unpredictability of real-world systems can take a toll on an engineer's morale. However, the sense of accomplishment and the knowledge that these efforts contribute to the advancement of technology and the betterment of society serve as powerful motivators to persevere in this challenging field. Looking ahead, the future of robust control and estimation holds both promise and uncertainty. The rapid advancement of technology, the emergence of new application domains, and the increasing complexity of engineered systems present exciting opportunities for innovation and discovery. However, these developments also bring new layers of complexity and challenges, requiring engineers to continually push the boundaries of knowledge and capability. As we navigate this ever-changing landscape, it is crucial to embrace a mindset of lifelong learning, collaboration, and adaptability, while remaining steadfast in our commitment to ensuring the robustness and reliability of the systems that shape the world around us.。
Advanced Control Theory and Applications Advanced control theory and applications are an essential part of modern engineering and technology. It encompasses a wide range of techniques and methodologies that are used to design and implement control systems for various applications, such as robotics, aerospace, automotive, and industrial automation. The field of control theory has seen significant advancements in recent years,with the development of new algorithms, methods, and tools that haverevolutionized the way control systems are designed and implemented. One of the key challenges in advanced control theory and applications is the need to develop control systems that are robust, reliable, and efficient. This requires a deep understanding of the underlying dynamics of the system being controlled, as wellas the ability to design control algorithms that can effectively deal with uncertainties, disturbances, and variations in the system. Advanced control techniques such as model predictive control, adaptive control, and nonlinearcontrol have been developed to address these challenges, and they have been successfully applied to a wide range of real-world systems. Another important aspect of advanced control theory and applications is the integration of control systems with other technologies, such as artificial intelligence, machine learning, and data analytics. This integration allows for the development of intelligent control systems that can learn from data, adapt to changing conditions, and optimize their performance over time. This has led to the development of advanced control systems for autonomous vehicles, smart grids, and industrial processes, among others. In addition to the technical challenges, there are also practical considerations that need to be taken into account when applying advanced control theory to real-world systems. These include issues such as cost, safety, and regulatory compliance, which can have a significant impact on the design and implementation of control systems. For example, in the automotive industry, advanced control systems need to meet stringent safety standards and regulatory requirements, while also being cost-effective and reliable. From a research perspective, advanced control theory and applications present a wide range of exciting opportunities for further exploration and development. There are still many open problems and unanswered questions in the field, and researchers areconstantly working on new approaches and methodologies to address these challenges. This includes the development of new control algorithms, the integration ofcontrol systems with emerging technologies, and the application of advancedcontrol techniques to new and emerging application areas. In conclusion, advanced control theory and applications play a crucial role in modern engineering and technology, and they have the potential to revolutionize the way we design and implement control systems for a wide range of applications. The field presents a number of technical and practical challenges, as well as exciting opportunitiesfor further research and development. By addressing these challenges and opportunities, researchers and engineers can continue to advance the state of the art in control theory and applications, leading to the development of more robust, reliable, and efficient control systems for the future.。
Developing Critical Systems with PLDComponentsAdrian J.Hilton1and Jon G.Hall21formerly of Praxis High Integrity Systems,20Manvers Street,Bath BA11PX,Englandadi@2Computing Research Centre,The Open University,Walton Hall,Milton KeynesMK76AA,EnglandJ.G.Hall@Abstract.Understanding the roles that rigour and formality can havein the design of critical systems is critical to anyone wishing to contributeto their development.Whereas knowledge of these issues is good in soft-ware development,in the use of hardware–specifically programmablelogic devices(PLDs)and the combination of PLDs and software–theissues are less well known.Indeed,even in industry there are many differ-ences between current and recommended practice and engineering opin-ion differs on how to apply existing standards.This situation has led togaps in the formal and rigorous treatment of PLDs in critical systems.In this paper we examine the range of and potential for formal specifica-tion and analysis techniques that address the requirements for verifiablePLD programs.We identify existing formalisms that may be used,andlay out the areas of contributions that academia and industry in collab-oration can make that would allow high-integrity PLD programming tobe as practicable as high-integrity software development.This paper also touches briefly on some important practical,technical,organisational,social,and psychological aspects of the introduction offormal methods into industrial practice for hardware and system design.It also provides an update and summary of the recent UK Defence Stan-dard00-56,as it relates to hardware.Key words:FPGA,PLD,survey,programmable logic,parallel,process al-gebra,programming languages,CSP,programmable hardware1IntroductionProgrammable Logic Devices are increasingly important components of high integrity systems.By offloading tasks from the main CPU onto a PLD,higher system performance goals can be attained.They can be used to implement safety-specific functions that must be outside the direct address space of the main CPU.Technological changes mean that PLD development has become more like software development in terms of program size and complexity,as well as in the need to clarify a program’s purpose and structure.Standards for safety-related electronic hardware design and development have,since1999,explicitly targeted Field Programmable Gate Arrays—such as the Xilinx Virtex family—and Complex Programmable Logic Devices(CPLDs)—such as the Altera FLEX10K family.The practices which they recommend vary in rigour and in practicability.Adherence to these standards is currently hindered by the immature state of PLD program design,development and anal-ysis techniques and tools relative to those available to safety-related software developers.There are now signs that the move towards the high-level program-ming of PLDs,coupled with the adoption of existing specification notations and proof techniques,may enable more formal and rigourous PLD program develop-ment(for a brief survey,see Section2.4).This paper will focus on the existing standards and techniques primarily used in European countries,although several of the standards examined have Amer-ican origin or usage too.Section2of this paper summarises the characteristics of PLDs and describes how and where they are used.In Section3we describe and analyse the main safety and security standards relevant to PLD program development.Section4summarises recent research relevant to safe or provably correct PLD program development.Finally,Section5summarises the paper, suggests a joint agenda for academia and industry,as well as other future work. 2Programmable Logic DevicesPLDs were a development of the simple Programmable Logic Array(PLA)which has been available in electronics design since the early1980s.The early history offield-programmable logic is reviewed by Moore in[1].The most common(and interesting)form of PLD currently in use is a Field Programmable Gate Array (FPGA)which form the focus of this paper.2.1Device design characteristicsThe key characteristics of an FPGA are that it can have its program con-tents changed upon power-up(hence“field-programmable”)and that its internal structure is a regular array of logic cells(hence“gate array”).An FPGA provides a logic device of relatively low complexity that can compute some function of the set of its digital inputs to produce a set of digital outputs.This is done in a highly-parallel manner.FPGAs have semi-permanent state,held in programmed lookup tables,typically implemented as static random access memory(SRAM). These tables are programmed by the download of lookup table data from an external source.FPGAs differ from other programmable logic devices(PLAs,PROMs or CPLDs)by allowing more complex internal dataflows.They differ from Ap-plication Specific Integrated Circuits(ASICs)by trading speciality of design for speed of development and economy of small-scale production.2.2Use of PLDsPLDs are typically used in building a prototype system in place of a custom ASIC.It is significantly cheaper and quicker to use PLDs when the alternative is a minimum production run of5000ASICs in a fabrication plant(“fab”).A small-scale single run of ASIC production can easily cost$750,000and take months from the submission of a VHDL design to the fab to the delivery of the silicon.There are many current examples of successful mission critical PLD use. Actel[2]reported that their radiation-tolerant and radiation-hardened FPGAs are continuing to perform critical functions in the Mars Exploration Rovers, Spirit and Opportunity,after a year on the surface of Mars.There can be sig-nificant commercial gain in using PLDs rather than ASICs.Because they are field-programmable,time-to-market can be reduced,since there is not the delay in setting up and making the ASIC production run,and there is little overhead if an error is subsequently found in the device.Their characteristics also increase the potential for longer time-in-market,through mid-life upgrades to the PLD code(without having to replace the hardware).Kevin Morris[3]emphasises these benefits:Reconfigurable programmable logic devices offer the added advantage of post-launch design modification that could make the difference between a working system and orbiting space junk.The critical systems industry would like to implement systems based on PLDs for all the reasons stated above,but cannot if the resulting systems exhibit the common failure modes of PLDs.Gibbons and Ames[4]report on the use of an FPGA in a space-based tethering experiment where an unanticipated power-up characteristic of the chosen FPGA caused the effective loss of the satellite incorporating it.This occurred despite extensive testing,and one reason was that it was not possible to reproduce the transient spike twice within several hours–a classic transient fault.It is clear from this experience that FPGAs suffer many of the traditional failure modes of other devices and,therefore,that extensive testing is not sufficient for mission-or safety-critical FPGAs.As well as demonstrating correctness,then,the role of formality is to assess the suitability of PLDs for such systems.2.3Programming PLDsThe implementation of a PLD-based system can be done in many ways.The equivalent of microprocessor object code will be a device-specific“netlist”which specifies the data to be loaded into each cell and router of the device.To reach netlist form,several intermediate compilation steps are normally required;the place-and-route work involved in this compilation is NP-hard.The majority of PLDs are programmed in VHDL[5]or Verilog[6],either di-rectly or with a higher-level design language being compiled through them.These Hardware Description Languages(HDLs)have substantial standard libraries,al-lowing a certain amount of code reuse.They model the PLD as interconnectedblocks rather than providing higher-level functions such as iteration or proce-dure call.Even if a higher-level language or design tool is used,it will normally compile its input into VHDL or Verilog.There is a subset relation between behavioural and synthesizable VHDL.The former is an expressive imperative language incorporating explicit iteration,al-ternation and a constructive type system.The latter is a small and simple subset (Register Transfer Level)which can be compiled directly into combinations of logic gates and latches.Going from the former to the latter is non-trivial,and in general it is too difficult to automate the translation process.Design languages at a level of abstraction above HDLs have three main vari-ants:1.explicitly parallel general-purpose languages,such as occam[7];2.domain-specific languages designed to solve a certain class of problems in aninherently parallel way,such as Esterel[8];or3.modifications of existing imperative languages,such as System-C[9]andHandel-C[10].The programming model underpinning occam,a development of CSP[11], has been developed initially into the Handel language,embedded in a functional programming syntax[12],and more recently into the commercially-supported Handel-C language[10].Although Handel-C has a C-like syntax,it incorporates explicit parallelism has a semantic model much closer to that of occam than to that of C,which may counter some of the arguments against using C for criti-cal system development.Another example,this time a compositional hardware language is Ruby[13],based on the idea that circuits are built from parts by a process of composition,which has mathematical properties similar to that de-fined on functions and relations.A modern development of Ruby is Lava[14],a prototype HDL developed by and in use at Chalmers University in Sweden.It trades offthe expressiveness of behavioural VHDL or Verilog for compactness and simplicity of descriptions of common circuit layouts.An example of a domain-specific language is the synchronous programming language Esterel[8],used to specify and implement action systems.This has been applied by Hammarberg et al.[15]in a demonstration hydraulicfluid detection system.Another example is CoreFire[16],in which developers write CoreFire programs in a“sticks and bubbles”graphical notation of dataflow,and compile them to high-performance applications which run on Annapolis Wild FPGA boards.Commonly used imperative languages which have been compiled into PLDs include C[17],Java[18]and Ada[17,19].The specific difficulty in using these languages is in expressing PLD-specific concepts such asfine-grain parallelism which is not normally part of the original language.System-C[9](and the already mentioned Handel-C)are examples of how C’s syntax can be extended to express parallel concepts.2.4PLD formalismsSubstantial effort was made in the1980s and1990s to develop a hardware design language that supported formal reasoning and abstraction,two features absent from HDLs such as VHDL and Verilog.A good example of this approach is ELLA[20],a non-proprietary language with a formal basis.ELLA is not a strict competitor to VHDL and Verilog,but in practice it is treated as such:At that time,the relatively small size of hardware designs made design in existing HDLs feasible,if difficult,and this acted against the adoption of ELLA(and similar design languages).It may be that,as hardware designs and PLD dies continue to grow in size,high-integrity requirements will make ELLA et al.more necessary.This change was seen in software with the emergence of structured design methods as program sizes grew beyond what one developer could manage;it is reasonable that a similar effect will eventually be seen in programmable logic program design.The formalisms that apply best to the massively parallel PLD structure are the(parallel)process algebras such as CSP[11]and CCS[21].The main problem in representing small-small digital logic constructs such as AND and OR gates with CSP is that CSP is not receptive;a CSP process representing a logic gate may refuse events representing voltage changes on its input wires,whereas the logic gate may not.A secondary problem is that CSP is asynchronous by design; processes only synchronise through shared events(or communication on chan-nels).Most PLD designs are synchronous,with design blocks sharing a single clock.Therefore the receptive and synchronous aspects of the PLD architecture would have to be represented artificially in a CSP model.A better approach is to use an algebra incorporating these features,and the authors have success-fully applied the synchronous receptive process algebra SRPT[22]in a refinement system for PLD programming[23].Recent work by Boulanger et al.[24]has attempted to use the B method to produce BHDL,a VHDL reformulation in B.This work is early and tool support is limited,but it represents a promising avenue for certain applications.2.5SummaryWe have seen that PLDs present a different programming architecture to con-ventional microprocessors,and have examined different programming methods for this synchronous highly parallel model.We now discuss the demands that safety and security certification make for rigorous development and verification of PLD programs.3Current safety and security standardsThe main safety standards relevant to PLD programming in Europe are:–RTCA DO-254[25]which is an international civil aviation standard;–UK Interim Defence Standard00-56[26]which is a UK standard for defence-related systems,superceding the older UK Interim Defence Standard00-54[27];–IEC61508[28]which is a European standard intended to apply to a wide range of systems;and–the Common Criteria[29]which is an international standard for developing secure systems.The available standards vary significantly in what they prescribe for PLDs and what techniques they suggest are applicable.Defence Standard00-54is the most prescriptive,but as noted above is likely to become less relevant with the new release of Defence Standard00-56.The common requirements of the standards are:1.to operate under an appropriate quality/safety management system;2.to plan the development process and the safety argument in advance;3.to consider both random and systematic failures;4.to qualify tools involved directly in the compilation chain;5.to use analytic techniques(“formal methods”)to verify high-integrity pro-grams;and6.to conduct the verification based on identified system hazards.In this section we analyse the content of each of these standards in detail.3.1RTCA DO-254/EUROCAE ED-80The airborne electronic hardware development guidance document RTCA DO-254/EUROCAE ED-80[25]is the counterpart to the well-established civil avion-ics software standard RTCA DO-178B/EUROCAE ED-12B.It provides a guide to the development of programs and hardware designs for electronic hardware in avionics.It covers PLDs as well as Application-Specific Integrated Circuits (ASICs),Line Replaceable Units(LRUs)and other electronic hardware.As well as being applied to systems aimed for Federal Aviation Authority acceptance,it may be used as a quality-related standard in non-FAA projects.Overview DO-254specifies the life cycle for PLD program development and provides recommendations on suitable general practice.It is not a prescriptive standard;the emphasis is on choosing a pragmatic development process which nevertheless admits a clear argument to the certification authority(CA)that the developed system is of the required integrity.DO-254recommends a simple documentation structure with a set of planning documents that establish the design requirements,safety considerations,planned design and the verification that is to occur.This would typically be presented to the CA early in the project in order to agree that the process is suitable.This plan will depend heavily on the assessed integrity level of the component which may range from Level D(low criticality)to Level A(most critical).Note that the DO-254recommendations differ very little between Levels A and B.High-integrity requirements Appendix B of DO-254specifies the verifica-tion recommended for Level A and Level B components in addition to that done for Levels C and D.This is based on a Functional Failure Path Analysis (FFPA)which decomposes the identified hazards related to the component into safety-related requirements for the design elements of the hardware program. The additional verification which DO-254suggests may include some or all of: architectural mitigation:changing the design to prevent,detect or correct hazardous conditions;product service experience:arguing reliability based on the operational his-tory of the component;elemental analysis:applying detailed testing and/or manual analysis of safety-related design elements and their interconnections;safety-specific analysis:relating the results of the FFPA to safety conditions on individual design elements and verifying that these conditions are not violated;andformal methods:the application of rigorous notations and techniques to spec-ify or analyse some or all of the design.If tools are used for compilation or verification of the PLD software then DO-254requires a certain amount of tool qualification.This may incorporate separate analysis of the tool software,appeals to in-service history of the tool,or direct inspection of the tool output.At higher integrity levels,in-service history alone is likely to be insufficient.3.2UK Defence StandardsThe UK Defence Standards have been rewritten so that the older programmable hardware standard00-54,and its software counterpart00-55,have been rolled together into Issue3of the00-56standard,and so00-56should be seen in the light of00-54.Issue3of00-56was released in January2005as an interim standard.This version[26]explicitly equates regular software and PLD programs as safety-related complex electronic elements(SRCEE)in Part2,§15.1.The older Interim Defence Standard00-54[27]specified safety-related hard-ware development in a similar way to DO-254.The main difference was that 00-54was far more prescriptive than DO-254,and assumed that the develop-ment takes place within a safety management process as described in Defence Standard00-56Issue2[30].Overview00-54makes strict demands on the rigour and demonstrable correct-ness of PLD programs,and that these are significantly stricter than those in DO-254.The new00-56is less prescriptive,instead requiring that“compelling evidence that safety requirements have been met.Where possible,objective, analytical evidence shall be provided.”(Part1,§11.3.1).Risk is regulated(in the UK)on the basis of being reduced ALARP(As Low As is Reasonably Practical).This stems from a UK Court of Appeal decision onthe1949case Edwards vs.The National Coal Board[31]where Judge Asquith noted:“...a computation must be made by the owner in which the quantum of risk is placed on one scale and the sacrifice involved in the measures necessary for averting the risk(whether in money,time or trouble)is placed in the other,and that,if it be shown that there is a gross dis-proportion between them-the risk being insignificant in relation to the sacrifice-the defendants discharge the onus on them.”This is significant because it means that if it is feasible and not dispropor-tionately expensive to do formal analysis,and there is a demonstrable gain in reliability from this,then a UK court is likely to expect it to be done for the system risk to be regarded as ALARP.High-integrity requirements Formal specification and analysis of PLD pro-grams were mandated at all safety integrity levels for00-54.This posed a practi-cal problem for developers since in1999(its year of issue)there were no known tool-supported specification or proof notations which were generally applicable to PLD programming.Each project required a from-scratch selection of,and capability development in,notations and analysis techniques.This is risky and potentially expensive.The new00-56,as noted above,makes no prescription for methods to be used.However,the risk involved in using the SRCEE is required to be ALARP and specifically requires evidence to validate the safety argument including(Part 1,§19.2):1.direct evidence from analysis;2.direct evidence from demonstration(testing and/or operation),includingquantitative evidence;3.direct evidence extracted from the review process;4.process evidence showing good practice in development,maintenance andoperation;and5.qualitative evidence for good design,including expert testimony etc.The quantitative aspect of item2is significant because work by Little-wood[32]has shown that conventional testing cannot show that a system is highly reliable in a statistically significant way,and so the use of formal meth-ods is justified.This applies to systems at the SIL-3or SIL-4integrity levels,or Levels A and B in DO-254terms.00-56also requires each tool in the compilation chain to have suitable argu-ments or analysis in place to show that it does not introduce significant errors into the system.3.3Other standardsIEC61508“Functional Safety of Electrical/Electronic/Programmable Elec-tronic Safety-Related Systems”[28]is a standard which covers a wide range of systems and their components.Part2in particular gives requirements for the development and testing of electrical,electronic and programmable devices.Here the programmable part of the systems is not addressed in detail;there are re-quirements for aspects of the design to be analysed,but no real requirements for implementation language or related aspects.Because of this,in the experience of the authors,DO-254is more directly usable for developers than is IEC61508 Part2.PLDs have been shown to be particularly useful in implementing crypto-graphic functions,for instance the Advanced Encryption Standard(AES).The Common Criteria guidance for IT security evaluation[29]does not distinguish between software executing on a microprocessor,ASICs or programs executing on PLDs;they may all form part of the Target of Evaluation(ToE)and require equally rigorous reasoning with respect to the security requirements identified in the Protection Profile or Security Target for the ToE.The formal and semi-formal assurance required for ASIC and software designs at Evaluation Assurance Levels 5to7is therefore required for PLD programs too.4Recent researchRecent research relevant to safety-critical PLD program design includes:1.specification and proof of parallel systems,enabling a correct-by-constructionapproach to program design;2.model checking techniques to verify safety properties of an existing PLDdesign at a HDL or netlist level;and3.the design and use of high-level programming languages to enable PLD pro-gramming at a more abstract level,possibly in a domain-specific language or tool.4.1Specification and proof techniquesEstablished parallel specification notations such as CSP and LOTOS[33]are ca-pable of describing the highly parallel structure of a PLD program,but have not yet been applied generally as specification notations for actual PLD programs.A contributory factor is likely to be the over-complexity of the notations compared to the simple synchronous structure of most PLD programs.Earlier work by Breuer et al.[34]on production of a refinement calculus directly targeting VHDL has a solid theoretical base,and(in theory)allows the production of VHDL designs which are demonstrably correct.This work also fell foul of over-complexity,and without tool support was impractical to apply efficiently to PLD program designs.The authors have used the SRPT synchronous receptive process algebra to implement a formal specification and refinement systems for synchronous PLD programs.This work,initially described in[23]and extended in[35],establishes refinement as a practical technique for at least small PLD designs,and indicates that it may scale well for certain classes of design.It is targeted directly at the specification and proof of PLD programs,but currently lacks tool support.Thefirst author has used CSP as a specification language in a high integrity commercial PLD program development.Both developer and customer found that the CSP specifications clarified and identified deficiencies in a well-reviewed English functional requirements document,giving increased confidence in the final program.Additionally,it enabled experimental model checking with the FDR2tool;this identified some errors in the developed program(which had been separately identified by expensive testing).Refinement in parallel systems is an area of active research;the authors anticipate significant developments in techniques and tool support in this area in the next few years.4.2Model checkingModel checking is the application of graph theory andfinite state machines to decide whether a temporal logic formula is maintained across all possible system states.It has become practical to apply it to verifying key properties of complex modern processors,for example the non-floating point operations of the Intel Pentium IV microprocessor as described by Schubert[36].It is effective at deciding whether a design conforms to certain safety properties,but is vulnerable to the state explosion problem where designs of increasing size quickly become impractical to model-check.It is beneficial for checking a complete design but cannot usually be applied until near the end of a development.Model checking tools such as Solidify from Saros Technologies are now start-ing to be used in PLD program verification,and can provide assurance that the design has suitable safety properties across all possible states.This is a more powerful argument for safety than simulation,since it is practically impossible to cover all possible system states for any designs other than the very simple,but there remains the question of tool qualification.As noted in Section3.1,DO-254 requires either direct verification of the tool or in-service history–inspection of the tool output does not help qualification in this case.Neither of these are currently available.Solidify specifications are written in one of several commercial HDL specifi-cation languages,and the tool operates on behavioural VHDL,Verilog or RTL. This removes the need for a test bench simulating a system,allows quick verifi-cation that common errors are absent,and a range of extra checks with increased confidence coming from additional time spent writing specifications to check.It can check against protocols such as the AMBA bus specification.It is a promising approach and sets a baseline for expectations for other model checking tools.Stepney[37]has shown how a subset of CSP compatible with the FDR2 model-checking tool can be transformed into a program in a Handel-C languagesubset,thereby allowing a design to be model-checked for correctness before a compilable version of the design is produced.FDR2has a long in-service history and would be easier to qualify for medium levels of integrity.Note that the use of model checking and other formal techniques by major industrial microprocessor designers such as Intel(Pentium4)and ARM indi-cates that they believe it to provide a commercial advantage.This may be due to the complexity of modern microprocessors precluding effective coverage by conventional testing.In this way the hardwarefield is more advanced than the software or programmable hardwarefields.4.3High-level programmingImperative Since1996there has been a steadily growing interest in compil-ing imperative languages into HDLs(and hence into PLDs).The most popular approaches have been based around C language syntax,presumably for its im-mediate appeal to most developers,although this syntax often hides complex parallel programming issues not present in sequential C.Handel-C is a modern high-level PLD programming language that owes much to the occam parallel programming language[7](which has also been used to tar-get FPGAs[OCCAM to FPGAs,such as R.M.Pell and B.M.Cook,Occam on Field-Programmable Gate Arrays-Fast Prototyping of Parallel Embedded Systems.]).It has been used in a range of industrial applications including mili-tary and aerospace,although the authors do not know of any use of a Handel-C program in a safety-critical function.As noted in Section4.2above,a Handel-C subset can be the target of a compilation from model-checked CSP,and there is a toolset which can perform the usual verification activities at each development stage.However,the Handel-C compiler is complex and as yet is not known to be amenable to qualification.Gupta et al.[38]have described a synthesis process which transforms pointer-free non-recursive ANSI C to VHDL.Unusually,it places much of the paral-lel programming activity within the toolset;the programming language cannot express parallel concepts.Because of this,the approach suffers from the well-documented deficiencies of the C language with respect to safety and correctness. The fundamental question is how the developer can be sure that his program-ming intent has been captured and preserved by the compilation chain.The conventional software programming language Ada95has been examined by the authors[39]and by Audsley and Ward[40]as a design and implementation language for PLDs.Audsley and Ward have addressed the compilation of legacy Ada code into a one-hot state machine,aiming to maintain the existing safety argument for the code by qualifying only the PLD-targeting compiler.This work is in progress but has demonstrated coverage of many Ada constructs including Ada’s parallel programming features(although,at the lower levels of design, SPARK Ada is arguably limited in its ability to model highly parallel code such as pipelined architectures).Ada has the advantage that its syntax is very close to the syntax of behavioural VHDL;however,synthesizable VHDL is more restrictive.。
