Simulation-Based Development of Safety Related Interlocks - Simulation and Modeling Methodologies, Technologies and Application - page 162

Fig. 1. The essential additions to UML AP metamodel to support the definition of interlocks
vendor has been selected. In the process, the diagrams are used for depicting the acti-
vating and disabling conditions of the functions, and possibly overriding control values
for locked actuators or devices. Logic diagrams suit well to this purpose because they
are familiar to developers and unambiguous. Logic diagrams, as a semi-formal method,
are also highly recommended by IEC 61508 to detailed design of safety-critical soft-
ware [7]. Logic diagram based approach for defining the interlocks is thus both sound
and already familiar to developers of the domain.
The purpose of UML AP is to cover both the specification of requirements and func-
tionality of automation and control applications. Logic diagrams may aid in supporting
both of these features but used from separate points of view. Especially, in the devel-
opment of safety-related applications, requirements must be defined clearly and in an
unambiguous manner. On the other hand, formal or semi-formal specification of func-
tionality is a necessity in enabling simulation of design or in automating generation of
code. In our approach, the logic diagram concepts were added to be used with both the
Requirements Modelling sub-profile and functional Automation Concepts sub-profile
of UML AP and the UML AP tool (see [17]). The concepts and some related existing
modelling concepts of the profile are presented in figure 1. Existing UML AP and UML
metamodel elements are highlighted with grey colour.
In UML AP, requirements are structured concepts that can be connected to other
requirements with port-like requirement interfaces in order to model dependencies be-
tween required functions. The purpose of the logical operations and logic connections,
on the other hand, is to enable the modelling of required activations of interlocks and al-
gorithms to compute control values inside requirements. Required interchange of com-
puted signals and values can then be modelled with the requirement interfaces that
extend the same UML::Connectable concept than logical operations and can be thus
connected together with logic connections. The operations include familiar operations,
such as AND and OR, but also delay, constant, Activation gate (that lets its input flow to
output when control input is activated), comparison operator and a UserOperation with
which the developer can specify the logic to output from inputs with a textual equation.
Examples of use of part of the concepts will be provided in section 5.
The functional modelling concepts of UML AP, Automation Functions, constitute
a hierarchy of function-block-like concepts. The hierarchy is based on their purpose,