|
Comment: |
This is a posting from Peter de Jager's list. The author is an assembler programmer -- scarcer than even COBOL programmers. He asks a question at the end of his posting. The background material leading to his question is little short of terrifying.
* * * * * * * * *
Date: Fri, 30 Jan 1998 18:46:15 -0500 To: year2000-discuss@year2000.com Subject: question: Embedded systems: time comparisons in PLCs
My first question, to the embedded systems experts, after over a year of diligently following this discussion group, concerns a line of PLC's that one of our companies distributes. They are controllers (made in the USA, for commercial water treatment) which operate a variety of devices such as water level, pH, temperature and, of most concern, the release of chlorine and/or ozone (both poisonous). The controllers appear to be date-independent, and, on the lower end models, no facility exists to enter a date. However, as an ex-IBM assembler programmer, I have questioned the manufacturer and am still not satisfied with a "no problem" answer. The controllers utilize a 286 processor (cheap, enough power for the application), and the BIOS was custom written by a contract company for the manufacturer.
My concern is that for a lot of on/off, start/stop or open/close type controller actions, an "anti-chatter" requirement means that the possibility exists for BIOS code to do a time comparison such as "wait X seconds or minutes" before taking a new action ... this stops a solenoid or other device from making repeated and immediate on/off type actions in a short time period when the input source being monitored is vacillating around the threshold value. If the elapsed time comparison utilizes the year (in order to wrap around a year end), then a 00 compare could result in an anti-chatter elapsed time period never elapsing (the current RTC value 00/xx/xx/xx:xx will always be less than the saved value stored at the time of the last action, assuming it occured at 99/12/31/23:59 or thereabouts in 1999). This would mean that any new, required corrective actions would not be taken by the controller, and valves/switches etc would remain in a frozen state despite a requirement to change, as the anti-chatter time duration between actions would appear not to have elapsed.
If the above is possible, it appears to me to be almost untestable. It also makes me wonder about the use of this type of logic in other PLCs (especially within utilities); this type of logic is required in a large number of situations and the ramifications could be very serious.
Thoughts from the group??
|