英文翻译原稿.pdf

Annual Reviews in Control 27 (2003) 5561ReviewImplementation of safety critical logic controller by means of FPGAMarek WegrzynUniversity of Zielona Gra, Institute of Computer Engineering and Electronics, ul. Podgrna 50, 65-246 Zielona Gra, PolandAbstractIn the paper, a synthesis method of logic controllers for safety critical systems into field programmable logic is presented. The specificationof the system in the form of symbolic, if-then or if-then-else conditional decision rules is used for directly mapping to netlist format, ortransformed into a HDL format that is accepted by standard FPGA simulators and synthesis tools. In addition, models of Logic Controllers areverified using the well-developed Petri net theory, and then they are translated through automated processes into selected FPGA specificationformat. 2003 Elsevier Ltd. All rights reserved.Keywords: Process control; Programmable logic controllers; Petri nets; Rule-based systems; Digital systems; Logic arrays; FPGA; HDL1. IntroductionThe main aim of this paper is a presentation of two meth-ods of synthesis of Logic Controller (LC) programs for Pro-grammable Logic (PL) for safety critical systems.The behavioral specification of Logic Controller programs(Halang & Jung, 1994), related with subset of IEC 1131-3standard, is modeled as Petri net. The textual, rule-based de-scription of Petri net, called Petri Net Specification Formatversion 2PNSF2 (Wegrzyn & Adamski, 1999), is usedas an entry format for dedicated CAD tool. In another ap-proach, controllers are described by state tables, and thenthey are modeled in HDL. Finally, in both methods, LCs areimplemented into PL as a dedicated Reprogrammable LogicControllers.In the first of presented methodologies, a rule-basedbehavioral specification of Petri net model is directly trans-formed into hardware library (on the netlist level) by meansof Xilinx implementation system (Wegrzyn & Adamski,1999; Wegrzyn, Adamski, & Monteiro, 1998). The if-thendecision rules (non-procedural conditional statements) aremapped into Xilinx XNF format after some simple addi-tional symbolic transformations. From the conceptual pointof view, a set of event-oriented (Petri net transition-oriented)if-then conditional statements (Adamski, 1999) is easilyreplaced by the equivalent local state-oriented (Petri netplace-oriented) if-then-else decision rules. In such a way,Tel.: +48-68-328-2484; fax: +48-68-324-4733.E-mail address: M.Wegrzyniie.uz.zgora.pl (M. Wegrzyn).the Petri net image in FPGA structure is straightforward andsimple. Standard design tools perform the final multi-level,combinational optimization, placement and routing.A control unit, represented by state table (or decision ta-ble), can be also behaviorally specified by means of usinghardware description languages (HDLs). Its specification,modeling, validation and FPL synthesis can be directed to-wards modern, well-accepted VHDL or Verilog-based syn-thesis tools. The second proposed method of structured im-plementation of state table is based on self-evident mappingof decision rules into HDL. The if-then-else conditionalsmay serve as both flexible and formal intermediate forms.2. Background and motivation2.1. Field programmable gate arraysField Programmable Logic is an electronic circuit, whichcan be configured by a user to perform particular combi-national or registered logic functions. The design processis greatly simplified by FPL compilers by some new CADtools, which are recently available, like Xilinx FoundationExpress (supporting VHDL and Verilog). The effective sim-ulation allows the Logic Controller to be debugged beforethe device is programmed. If a design change is needed, it isa simple matter to reedit the original specification and thenre-program or exchange the old device. The most flexibleand high density FPL devices are Field Programmable GateArrays (FPGAs). Fig. 1 depicts a conceptual diagram of atypical FPGA.1367-5788/$ see front matter 2003 Elsevier Ltd. All rights reserved.doi:10.1016/S1367-5788(03)00007-556 M. Wegrzyn / Annual Reviews in Control 27 (2003) 5561Fig. 1. A conceptual FPGA.FPGAs were introduced in 1985 by the Xilinx company,and since then, many different FPGAs have been devel-oped by a number of companies: Actel, Altera, Plessey,AMD, QuickLogic, Algotronix, Concurrent Logic, Cross-point Solutions, and others. As shown in Fig. 1, FPGAconsists of a two-dimensional array of logic blocks thatcan be connected by general interconnection resources. Theinterconnection comprises segments of wire. The segmentsmay be of various lengths. In the interconnection thereare programmable switches that enable one to connect thelogic blocks to the wire segments, or one wire segmentto another. Logic circuits are implemented in the FPGAby partitioning the logic into individual logic blocks, andthen interconnecting the blocks as required via the switches(Xilinx, 2003).To facilitate the implementation of a wide variety of cir-cuits, it is important that an FPGA is as versatile as possible.This means that design of the logic blocks, coupled withthat of the interconnection resources, should facilitate theimplementation of a large number of digital logic circuits.There are many ways of designing an FPGA, involvingtrade-offs in the complexity and flexibility of both logicblocks and interconnection resources. Logic-block archi-tectures can be designed in many different ways: as simplegates (e.g. 2-input NAND gates), or as more complexstructures, such as multiplexors or look-up tables. In someFPGAs, a logic block corresponds to an entire PAL-likestructure. Fig. 2 shows a Xilinx Virtex FPGA logic blockwith more details. The variety and complexity of currentlyproduced FPGAs make them suitable for use in a wide setof applications. Two significant advantages of FPGAs areas follows: lower prototype costs and shorter productiontime.As user-programmable application-specific integrated cir-cuits, they provide a valuable compromise which combinesthe benefits of standard microcontrollers with many of thebenefits of other semi-custom logics. The design process isgreatly simplified, due to the powerful FPGA compilers, aswell as some new modern and effective CAD tools, whichFig. 2. Example of a logic block structure.have recently become available. The effective simulation al-lows a logic controller to be simulated and debugged beforethe device is programmed. If design changes are needed, it isa simple matter to re-edit the original specification and thenre-program the former device. It could be expected that af-ter some time industrially oriented complex PLD and FPGAwould be introduced. Advanced PLDs or FPGAs, togetherwith modern CAD tools, may easily replace some of the oldfashioned programmable controllers (Mandado, Marcos, &Perez, 1996). The Xilinx design software is called XilinxFoundation Series, and it supports design entry, design sim-ulation, and design implementation. Design entry occurs byschematic capture or HDL specification.However, devices address the issues that are essential tothe safety critical systems market (e.g. aerospace and de-fense): Commercial manufacturing strengths result in more effi-cient process flows. Reliability of supply. Controlled mask sets and processesinsure the same quality devices, every time, without vari-ation, which remain in production for an extended time.The Xilinx QPRO family of ceramic and plastic QMLproducts (Qualified Manufacturers Listing), certified toMIL-PRF-38585 and complemented by ISO-9000 certi-fication, provides system designers with advanced pro-grammable logic solutions for next generation designs.The QPRO family also includes select products that areradiation hardened for use in satellite and other space ap-plications. Designers can confidently design with Xilinxfor High-Reliability systems with the knowledge they aregetting unsurpassed quality and reliability, and long-termcommitment to the safety critical applications market.M. Wegrzyn / Annual Reviews in Control 27 (2003) 5561 57The QPRO family provides a wide variety of devices. Thebroad range of devices is available in various speed and pack-age options. Both military temperature and full QML/SMDversions are available as standard off-the-shelf products. TheVirtex members of the QPRO family offer FPGAs withhigh-performance up to 200 MHz, and densities greater than3,000,000 system gates, and even larger devices plannedfor the future. Dramatic increases in silicon efficiency resultfrom optimizing the new architecture for place-and-route ef-ficiency and exploiting an aggressive 8-layer-metal 0.15H9262mCMOS process. These advances make QPRO Virtex FPGAspowerful and flexible alternatives to mask-programmed gatearrays.2.2. Safety critical control applicationsProgrammable electronic systems for safety critical con-trol and regulation applications are rather a new scientificand engineering research field that stands at the beginningof its treatment.Control unit of digital circuits can be described in severalforms. However, for safety critical controls only very-wellverified methods can be applied (Cullyer & Pygott, 1987),e.g. interpreted Petri nets, cause/effect tables, decision ta-bles, and HDL models.Control oriented, 1-bounded Petri net is considered as aformal model for the set of decision rules. It is used alsoas a distributed, local state-based model for the generatedHDL descriptions. In the considered interpreted Petri netmodel, a particular combination of Boolean external inputs,and eventually some internal conditions have to be true, forthe transition to be fired.Conditional logics is treated as an intermediate behav-ioral level language for the description of concurrent digitalsystems. Implicitly, it gives the procedural specificationof distributed, concurrent digital system, implemented inFPL as a single State Machine with Data Path. The globalstates (Petri net markings) of Concurrent State Machine(direct hardware implementation of Petri net) are formedfrom local states (Petri net places). The places are en-coded in such a way, that the global state code is implic-itly obtained by superposition of the local state codes. Arule-based specification, considered in the paper, is com-posed from discrete local state symbols (places P), inputsignal symbols (X) and output signal symbols (Y) of thecontroller. The name of transition (t) is treated only as a rulelabel.The textual description of developed implementation inField Programmable Logic is not procedural, as Petri netevidently is, but rather declarative. The designed controlpart of a digital system is treated as a reasoning systemimplemented in the regular structure (for example, array)that is built from logic cells. The decision rule specification,as a textual equivalent of Petri net, is easily represented byusing HDLs, and then mapped into hardware. The manualor automatic translation is straightforward.Fig. 3. General architecture of the controller.The simplest and most effective technique for state encod-ing of state machines for FPGAs implementation is one-hotstate assignment. On the other hand, as a Petri net placeencoding there is used one-to-one mapping of places ontoflip-flops (Wegrzyn et al., 1998).3. Programmable logic-based design3.1. General architecture of the controllerSafety critical applications require very rigorous designprocess and its realization. Each step should be formallyverified. For this purpose, two models are used: Petri netmodel and HDL model. Implementation of those compatibleblocks (Fig. 3) is based on such models. For better testingof correctness each output is in complementary form, i.e.affirmation Y and negation Y. Comparator compares outputsfrom two control units; the same values on both Y and Youtputs indicate error.The final outputs are provided from the comparator.Higher reliability could be met by using separate chips foreach control unit.3.2. ExampleFig. 4 depicts the controlled part of a designed simplereactive system. The controlled system consists of two car-riages 1 and 2 that go on the left (L) and right (R) sides. Thecarriages start on signals M1 and M2, respectively. Whenboth carriages go concurrently, they can reach points D andE. Because, the carriage 1 has higher priority, it goes to pointB, and then goes back to A, where it waits for next pressingof bottom M1. In this time, carriage 2 waits in point E untilcarriage 1 reaches point D in return way. Then the carriage2 goes to B and back to C, where it waits for next pressingof bottom M2. At the time, on the common way only onecarriage can be located.58 M. Wegrzyn / Annual Reviews in Control 27 (2003) 5561Fig. 4. The controlled parts of reactive system.3.3. Controller designIn this section, the specification of industrial controllerthat is related with interpreted Petri net (Fig. 5), and stateor decision table (Table 1), is developed.There is one fundamental difference between a state dia-gram and a state table, a difference that makes state diagramdesign simpler but also more error prone (Wakerly, 1994): A state table is an exhaustive listing of the states for eachstate/input combination. No ambiguity is possible. A state diagram contains a set of arcs labeled with transi-tion expressions. Even when there are many inputs, onlyone transition expression is required per arc. However,when a state diagram is constructed, there is no guaranteethat the transition expressions written on the arcs leavinga particular state cover all the input combinations exactlyone.This difference is very important for safety critical sys-tems.In the considered Field Programmable Logic implemen-tation, transitions between local states occur simultaneously.It is realized by means of using the same clock for all logicblocks (synchronous state machine). To implement concur-rent state machine, a global state register can be used toreflect all current, concurrently related, local states. As analternative option it is possible to distribute the local stateregister into several single logic blocks. In such a case, eachPetri net place may be implemented separately as two localstates: activeif the place is marked, passiveif the placeis empty.The direct mapping of Petri net into FPL is based oncorrespondence between a transition and a simple combi-national circuit and correspondence between a place and aclearly defined subset of state register. In dealing with con-Fig. 5. Petri net model.Table 1Decision table for control unitTransition Current local states Conditions Next local statest1 p1 M1 p2t2 p2 Dp3t3 p3, p7 4t4 p4 Bp5t5 p5 Dp6, p7t6 p6 Ap1t7 p8 M2 p9t8 p9 Ep10t9 p7, p10 !Dp11t10 p11 Bp12t11 p12 Ep7, p13t12 p13 Cp8currency, the designer encounters some problems that willnot arise in the logic synthesis of sequential systems. Oneof them is the concurrent local state encoding.The one-hot-like method produces fast designs with asimple combinational part, especially for implementationsin FPGA (Wegrzyn et al., 1998).It is not possible to assume that all flip-flops attachedto places, are set to 0 since several places can be markedM. Wegrzyn / Annual Reviews in Control 27 (2003) 5561 59Fig. 6. A part of PNSF2 specification.simultaneously. Some efficient state assignment techniquesare referred to or presented in (Adamski, 1999). They aresuited to FPGAs, that are register-reached. The encodingprocedure assigns to each place or macroplace a Booleanterm. This is combined from all Boolean terms, which areassigned to higher-level macroplaces it belongs to, and aparticular private part. The state variables could be eventu-ally shared among subnets but all concurrent subnets shouldnot have orthogonal codes (Adamski, 1999).The use of concurrent state machine techniques in FPLdesign has several advantages. They create nearoptimal con-troller implementations (in terms of performance), tailoredto the exact requirements. Practical designs often fit in a sin-gle FPGA package since there are no redundant elements.Any particular function, which is not included in the library,can be effectively implemented. Controller outputs respondto inputs with high speed, in predictable and repeatableway, without glitches. The behavioral specification, which ismapped in the programmable logic can be formally verifiedor validated by means of advanced CAD tools.The standard CAD tools have been combined with dedi-cated design environment PeNCAD (Wegrzyn et al., 1998).As an intermediate format the rule-based textual specifica-tion, called PNSF2, is used (Fig. 6). The design experimentshave been developed by means of using HDL simulators andsynthesis tools and Xilinx implementation tools, and testedon Xilinx FPGA demoboard with XC4005E device.Application Specific Logic Controllers are dedicated de-vices embedded within an application and implemented withprogrammable logic (Mandado et al., 1996; Wegrzyn et al.,1998). To define the behavior of reactive system, it is neces-sary to specify the set of allowed sequences of conditions,actions and events. The importance of this approach lies inits portability to any VHDL simulator, for example, AldecActive-CAD. It makes possible to validate the indented be-havior of the designed microsystem in an user-friendly en-vironment. For example, VHDL description of the logiccontroller is validated using “testbenches”, which modelsroughly the controlled subsystem behavior.The Reprogrammable Logic Controller is considered as anabstract reasoning system (rule-based system) implementedin reconfigurable hardware (FPGA). The mapping betweeninputs, outputs and local internal states of the system is de-scribed in a formal manner by means of logic rules (rep-resented as sequents) with some temporal operators, espe-cially with operator next (Adamski, 1999). The correctnesspreserving synthesis, based on Gentzen calculus, is treatedas a formal transformation of the initial set of compoundrules (Specification) into another set of compound rules (Im-plementation). On