3.0: Industrial Controller Development

Case Study: Emergency Shutdown System (ESD) for Chemical Processing Plant

Project Overview

Project: Safety PLC for Emergency Shutdown System (ESD) Customer: ChemSafe Industries (Chemical Processing Plant) Safety Standard: IEC 61508 SIL 3 (Safety Integrity Level 3) Target Platform: Siemens S7-1500F Safety PLC Duration: 12 months (planning, development, certification) Budget: €850,000 Team Size: 8.5 FTE (Full-Time Equivalents)

System Description

Emergency Shutdown System (ESD) Purpose

The ESD system monitors critical process parameters in a chemical reactor and automatically:

  1. Shuts down reactor if temperature/pressure exceeds safe limits
  2. Activates emergency cooling to prevent thermal runaway
  3. Closes emergency valves to isolate hazardous materials
  4. Alerts operators via HMI (Human-Machine Interface)

Safety Requirement: SIL 3 - Probability of Dangerous Failure on Demand (PFDavg) < 10⁻⁴

Technology Stack

Hardware Platform

PLC Platform: Siemens S7-1500F Safety Controller
├── CPU: 1515F-2 PN (SIL 3 certified hardware)
│   ├── Performance: 150 ns/instruction
│   ├── Memory: 500 KB work memory, 5 MB load memory
│   └── Interfaces: PROFINET, PROFIBUS DP
├── Safety I/O Modules:
│   ├── 8x SM 1526 DI (Digital Input, F-DI 24x24V DC)
│   ├── 4x SM 1526 DO (Digital Output, F-DO 8x24V DC)
│   └── 2x SM 1531 AI (Analog Input, F-AI 8xRTD/TC for temperature)
└── Communication:
    ├── PROFINET for HMI (SCADA system)
    └── PROFIsafe for safety I/O (black channel)

Why Siemens S7-1500F:

  • Pre-certified for SIL 3 (IEC 61508, IEC 61511)
  • Integrated safety (no external safety relay needed)
  • TÜV Rheinland certified Safety Library (FBs)
  • Extensive industrial automation ecosystem

Alternative Platforms: Other IEC 61508-certified safety PLC platforms include Allen-Bradley (Rockwell) GuardLogix, Beckhoff TwinSAFE, ABB AC500-S, and Schneider Electric Modicon M580. Platform selection typically depends on existing site infrastructure, operator familiarity, and regional supplier preferences.

Software Architecture

Programming Languages (IEC 61131-3):

  • Ladder Diagram (LAD): 60% (safety interlocks, valve control)
  • Function Block Diagram (FBD): 30% (PID control, analog processing)
  • Structured Text (ST): 10% (complex algorithms, diagnostics)

Software Structure: The following diagram shows the PLC software architecture organized by IEC 61131-3 programming languages, with safety-critical Ladder Diagram functions separated from standard Function Block Diagram and Structured Text modules.

Industrial Controller Development

Development Tools and ASPICE Integration

TIA Portal (Siemens Engineering Environment)

Primary Development Tool: Siemens TIA Portal V18

  • LAD/FBD/ST editor (IEC 61131-3 compliant)
  • Safety program configuration (F-CPU, F-I/O)
  • HMI design (WinCC for SCADA)
  • Version control integration (Git via export/import)

ASPICE Integration Challenges:

  • TIA Portal is not Git-friendly (binary project files, not text-based)
  • Solution: Export source code as XML, version control XML files
  • Use TIA Portal Openness API (C# automation) for CI/CD integration

TIA Portal Version Control Workaround: The export/import workflow adds approximately 10% overhead but enables meaningful Git workflows (diff, blame, merge). Alternative approaches include using Siemens Multiuser Engineering (for team collaboration) or third-party solutions like versiondog for binary version control. See Section 26.03 for detailed implementation.

AI Tool Integration

AI Tools Used:

  1. GitHub Copilot (with Structured Text plugin)

    • Generates ST code for complex diagnostics
    • Auto-completes LAD logic based on comments
    • 35% productivity gain for ST programming

  2. ChatGPT-4 (requirements analysis)

    • Extracts safety requirements from Process Hazard Analysis (PHA) documents
    • Generates safety function specifications
    • 40% reduction in requirements analysis time

  3. Claude Sonnet (IEC 61508 compliance checking)

    • Reviews code for SIL 3 systematic capability requirements
    • Suggests defensive programming patterns
    • Validates traceability matrix

Project Metrics

Timeline (12 Months)

Phase Duration ASPICE Processes IEC 61508 Deliverables
Requirements Month 1-2 SYS.2, SWE.1 Safety Requirements Spec (SRS)
Design Month 3-4 SWE.2 Safety Architecture (SAS)
Implementation Month 5-8 SWE.3, SWE.4 LAD/FBD/ST code + Unit tests
Integration Month 9 SWE.5 FAT (Factory Acceptance Test)
Qualification Month 10 SWE.6 SAT (Site Acceptance Test)
Certification Month 11-12 SUP.9 TÜV SÜD assessment, SIL 3 certificate

Team Structure

Role FTE Responsibility
Project Manager 0.5 ASPICE compliance, TÜV coordination
Safety Engineer 1.0 IEC 61508 compliance, PHA analysis
PLC Programmer (Senior) 2.0 LAD/FBD/ST development, safety logic
PLC Programmer (Junior) 1.5 HMI development, non-safety logic
Test Engineer 1.5 HIL testing, FAT/SAT execution
Systems Engineer 1.0 Hardware selection, I/O design
Quality Assurance 1.0 Code review, ASPICE evidence collection

Total: 8.5 FTE

Budget Breakdown

Category Cost Notes
Hardware €120,000 S7-1500F PLC, F-I/O modules, redundant sensors
Software Licenses €45,000 TIA Portal, WinCC SCADA, S7-PLCSIM Advanced
Engineering Labor €510,000 8.5 FTE × 12 months × €5,000/FTE/month
Testing (HIL Bench) €80,000 dSPACE SCALEXIO for plant simulation
TÜV Certification €75,000 SIL 3 functional safety assessment
Contingency €20,000 2.5% buffer

Total: €850,000

Software Size and Complexity

Code Metrics

Metric Value Notes
Total LOC 8,500 lines LAD (5,100) + FBD (2,500) + ST (900)
Safety Functions 12 SIL 3 certified functions (shutdown, cooling, valve control)
Standard Functions 35 Non-safety HMI, diagnostics, logging
Function Blocks 47 Reusable FBs (e.g., valve control, PID)
Data Blocks 28 Configuration, setpoints, alarms
I/O Points 180 120 DI, 40 DO, 20 AI
Cyclomatic Complexity Avg 3.2 Low complexity (IEC 61508 recommends <10 for SIL 3)

Safety Integrity Level (SIL) Targets

IEC 61508 Compliance

Target SIL: SIL 3 (High integrity for chemical process safety)

SIL 3 Requirements:

  • PFDavg < 10⁻⁴ (Probability of Failure on Demand < 0.0001)
  • Systematic Capability: SC 3 (rigorous development process)
  • Hardware Fault Tolerance: 1oo2 (1 out of 2) for pressure sensors, 2oo3 (2 out of 3) for temperature sensors
  • Diagnostic Coverage: ≥99% (self-diagnostics, PROFIsafe communication checks)

Achieved Metrics:

  • PFDavg = 3.2 × 10⁻⁵ (better than SIL 3 requirement)
  • Diagnostic Coverage = 99.4%
  • Safe Failure Fraction (SFF) = 98.7%

AI-Assisted Development Impact

Productivity Gains

Activity Traditional Time AI-Assisted Time Improvement
Requirements Analysis 160 hours 95 hours 41% faster
LAD Programming 320 hours 280 hours 13% faster (limited AI support for visual LAD)
ST Programming 80 hours 50 hours 38% faster (Copilot effective)
Code Review 120 hours 70 hours 42% faster (AI pre-checks)
Documentation 200 hours 90 hours 55% faster (auto-generated)

Overall: 880 hours → 585 hours (33% reduction)

Key Challenges

1. PLC Tools Not Git-Friendly

Problem: TIA Portal stores projects in binary format (.ap18 files), not text-based.

Impact: Standard Git workflows (diff, merge, blame) don't work.

Solution:

  • Export LAD/FBD/ST source to XML using TIA Portal Openness API
  • Version control XML files in Git
  • Custom scripts for XML diff visualization
  • Trade-off: 10% overhead for export/import automation

2. Limited AI Support for Ladder Logic

Problem: GitHub Copilot trained primarily on text-based languages (C, Python), not visual LAD.

Impact: AI productivity gains minimal for LAD (13% vs 38% for ST).

Solution:

  • Use AI for Structured Text (complex algorithms)
  • Manual development for Ladder Diagram (safety interlocks)
  • Convert LAD comments to detailed pseudocode → AI generates ST equivalent

3. IEC 61508 Certification Overhead

Problem: TÜV assessor requires extensive evidence (30+ work products).

Impact: 25% of project effort spent on documentation/evidence.

Solution:

  • Continuous evidence automation (CI/CD generates test reports, traceability matrix)
  • Reuse ASPICE work products (SYS.2 → IEC 61508 SRS, SWE.4 → Unit Test Report)
  • ASPICE CL2 compliance covers 70% of IEC 61508 requirements

Success Criteria

Project Outcome: [PASS] Successful

  • [PASS] On Time: 12 months (as planned)
  • [PASS] On Budget: €835,000 (€15k under budget)
  • [PASS] SIL 3 Certified: TÜV SÜD certificate issued
  • [PASS] Quality: 0.8 defects/KLOC (excellent for industrial PLC code)
  • [PASS] ASPICE: CL2 compliance (89% BP achievement)

Chapter Structure

This chapter explores industrial safety controller development across 4 sections:

  1. Chapter 26.1: IEC 61508 Context: Safety lifecycle, SIL determination, systematic capability
  2. Chapter 26.2: Hardware-Software Co-Design: Safety PLC architecture, redundancy patterns, I/O design
  3. Chapter 26.3: Certification Path: TÜV assessment, work products, lessons learned

Message: Industrial automation differs from automotive (PLC vs ECU, LAD vs C), but ASPICE principles still apply. AI tools help, but visual programming languages (LAD) benefit less than text-based (ST, C).

Previous
Lessons Learned
Next
IEC 61508 Context