General Programming Guidelines - ABB AC500-S Safety User Manual

Configuration and programming
CODESYS Safety programming guidelines > General programming guidelines
Keyword
TIME
ADR
INDEXOF
SIZEOF
ROL, ROR, SHR, SHL
4.4.3.11 Language constructs
The following ST language control elements are suitable for creating safety applications:
Keyword
IF
CASE
FOR
WHILE
REPEAT
EXIT
RETURN

4.4.4 General programming guidelines

In addition to language-specific guidelines, errors should be avoided through compliance with
additional general guidelines. These guidelines are listed here in no particular order:
● Few states
States in the form of variables that retain their value beyond a control cycle hamper the tes-
tability of an application. This can be avoided with the following measures:
–
–
–
● No warnings
A safety application must not generate compiler warnings!
● Limited number of rows (500) per block
In the interest of transparency, a block should have no more than 500 rows.
● Limited number of characters per row (150)
In the interest of transparency, a row should have no more than 150 characters
● No re-use of variables
Each variable should only be used for one purpose. Application in another context, even if
the previous purpose is no longer important, involves a significant fault potential, particularly
for modifications.
● Variables as local as necessary
Variables that are only described in one block must be declared locally. The only exception
is variables that are linked with addresses. These should be declared globally in order to
avoid multiple assignments.
180
Suitable (yes / to a limited extent / no) (comment)
Yes
To a limited extent. (Required for POINTERS that may be used to a limited extent.)
To a limited extent. (Only used as parameter for runtime system functions. The
function used should be treated like an independent task.)
Yes
Yes
Suitable (yes / to a limited extent / no) (comment)
Yes
Yes
Yes
To a limited extent. (Proof of avoidance of an infinite loop is required.)
To a limited extent. (Proof of avoidance of an infinite loop is required.)
To a limited extent. (Exits a loop immediately. A loop should only be exited through
its end condition leave.)
To a limited extent. (Exits a subroutine immediately. A subroutine should only be
exited once all instructions have been processed.)
Avoidance of states wherever possible
A state variable should only be described once per cycle. This facilitates tracing of
errors if a state has an invalid value.
If a state consists of several variables it should be encapsulated in a function block.
State transitions should only be affected by calling the block.
3ADR025091M0208, 12, en_US 2020/06/19