Programmable Logic Controller

The software for the ABB Safety PLC consists of three Safety I/O modules (one for analog inputs, one for digital inputs, and one for digital inputs / outputs) and one Safety CPU module. The Safety CPU module is equipped with two microcontrollers. All functions were module tested with TESSY.

During testing, three different measures of code coverage were measured with TESSY: (1) Branch Coverage, (2) Modified Condition / Decision Coverage (MC/DC), and (3) Multiple Condition Coverage(MCC). The latter is not mentioned by IEC 61508, but was used because it provides the highest reliability with respect to condition coverage. [MCC subsumes MC/DC; MCC exercises all possible input combinations for Boolean expressions.] For all coverage measures a percentage of 100% or near 100% (> 98%) was reached. When 100% was not reached, Hitex manually checkedand verified that the code was actually unreachable. The paramount reason for unreachable code was defensive programming.

For all test objects requiring more than a single test case, the tests were specified by Hitex using the Classification Tree Method. The method is based on analysis of the requirements and also incorporates equivalence partitioning and boundary value analysis. The big advantage of this method is the visualization of the testing ideas. This makes it easy for the other party to understand therationale behind each test case and to check that all test relevant aspects were covered by the test specification. This eased the communication between the project partners ABB and Hitex a lot.

The testing team of Hitex had up to nine testers in the course of the project; with an average of about four testers assigned to the project all the time. During testing development still continued, hence the test objects were not stable (i.e. a moving target). However, this could be handled by a well-defined communicationprocess between Hitex and ABB. From earlier projects Hitex had learned the lesson that it is advantageous to route the communication between the project partners through a single point of contact (i.e. an identified person) in each company. This guarantees quick response and avoids dangling questions. More than 500 issues were raised during the project and got clarified quickly and efficiently.