Safety Considerations Guide for Trident v2 Systems - TUV ...

86 Appendix C Safety-Critical Function Blocks
* Application
* The APP parameter for a module selects the effect of a fault
* on the vote mode outputs of the shutdown function blocks.
* APP:=RELAY with RELAY_OK:=true
* A sinlge fault (even a voter fault) degrades the mode to DUAL.
* The relay provides a third channel for shutdown,
* so if an output voter fails, there are still
* two independent channels that can de-energize the output,
* i.e., the relay and the other output voter channel.
* APP:=RELAY with RELAY_OK:=false, or
* APP:=DE_ENERGIZED
* A voter fault degrades the mode to SINGLE.
* A non-voter fault degrades the mode to DUAL.
*
* Runtime Errors
* EBADPARAM Bad parameter
* CO=FALSE indicates a programming error.
* See ERROR number parameter for details.
*=F===============================================================================
*)
IF RESET THEN
CO := TRUE ;
TMR := TRUE ;
GE_DUAL := TRUE ;
GE_SINGLE := TRUE ;
NO_VOTER_FLTS := TRUE ;
ELSIF PREVIOUS_RESET THEN
; (* No operation. *)
ELSIF CI AND CO THEN
IO( CI := CI, IOP := IOP, SLOT := SLOT );
IF NOT IO.CO THEN
ERROR := IO.ERROR_NUM ;
U := ReportBadParam(0) ;
CO := FALSE ;
END_IF ;
IF CO THEN
TMR := TMR AND IO.TMR ;
GE_DUAL := GE_DUAL AND IO.GE_DUAL ;
GE_SINGLE := GE_SINGLE AND IO.GE_SINGLE ;
NO_VOTER_FLTS := NO_VOTER_FLTS AND IO.NO_VOTER_FLTS ;
IF APP = RELAY AND RELAY_OK THEN
TMR := TMR AND IO.NO_VOTER_FLTS ;
ELSIF APP = DE_ENERGIZED OR APP = RELAY AND NOT RELAY_OK THEN
TMR := TMR AND IO.NO_VOTER_FLTS ;
GE_DUAL := GE_DUAL AND IO.NO_VOTER_FLTS ;
ELSE
ERROR := -5 ; (* Application number is invalid *)
U := ReportBadParam(0) ;
CO := FALSE ;
END_IF ;
END_IF ;
END_IF ;
IF ERROR = 0 AND NOT CO THEN
ERROR := -6 ; (* Not initialized *)
U := ReportBadParam(0) ;
END_IF ;
IF NOT CO THEN
TMR := FALSE ;
GE_DUAL := FALSE ;
GE_SINGLE := FALSE ;
NO_VOTER_FLTS := FALSE ;
Safety Considerations Guide for Trident v2 Systems