Bosch Appliances manual Praesideo 3.5 Installation and User Instructions EN54-16

Praesideo 3.5 Installation and User Instructions EN54-16: 2008

en 56

Clause / Requirement	Compliance	Signature
c details of any software tools used in the preparation of	The list can be composed on request and contains
the program (e.g. high level design tools, compilers,	high level design tools, compilers for various processors,
assemblers).	syntax validation tools, build tools, test tools, performance
	validation tools, version control tools, defect tracking tools.
14.3 Software design	Praesideo is compliant.
In order to ensure the reliability of the VACIE the following
requirements for software design shall apply:
a the software shall have a modular structure;	The modular structure of the Praesideo software is
	documented in the software architecture documents.

bthe design of the interfaces for manually and automatically generated data shall not permit invalid data to cause an error in the program execution;

cthe software shall be designed to avoid the occurrence of a deadlock in the program flow.

The interfaces between the modules and to external components are well defined and described in the design documents and external interface documents (Open Interface). Asserts are used to validate inputs on component boundaries.

Design guidelines are in place to avoid deadlocks. Multi threading within components is avoided where feasible and components have an input command queue for safe decoupling of threads.

14.4 Program monitoring (see also Annex C) Praesideo is compliant.

14.4.1The execution of the program shall be monitored as under 14.4.2 or 14.4.3. If routines associated with the main functions of the program are no longer executed, either or both of the following shall apply:

a the VACIE shall indicate a system fault (as in 8.3);	Upon activation of a watchdog, a fault is reported after
	restart of the failing component indicating the failing unit
	and processor. If a restart of the failing component is not
	possible, a less detailed fault will be reported. A system
	fault is indicated when entering the fault condition.

bthe VACIE shall enter the fault warning condition and indicate faults of affected supervised functions (as in 8.2.3, 8.2.4, 8.3, 8.4 and 8.5), where only these functions are affected.

14.4.2If the program executes in one processor, the execution of the routines in 14.4.1, it shall be monitored by a monitoring device as in 14.4.4.

14.4.3If the program executes in more than one processor, the execution of the routines in 14.4.1 shall be monitored in each processor. A monitoring device as in 14.4.4 shall be associated with one or more processors, and at least one such processor shall monitor the functioning of any processor not associated with such a monitoring device.

Upon activation of a watchdog, a fault is reported after restart of the failing component indicating the failing unit and processor.

All processors used in the Praesideo system are either guarded by a hardware watchdog or are monitored by a processor that is guarded by a hardware watchdog.

All processors are either guarded by a hardware watchdog or are monitored by a processor that is guarded by a hardware watchdog:.

The network controller is responsible for monitoring all processors in the system. Upon failure of one of the processors, either due to a watchdog failure or due to a communication failure a fault is generated. Failure of the network controller itself will cause the system fault output contact to be de-energized to indicate a system fault.

14.4.4 The monitoring device of 14.4.2 and 14.4.3 shall	All processors are either guarded by a hardware watchdog
have a time-base independent of that of the monitored	or are monitored by a processor that is guarded by a
system. The functioning of the monitoring device, and the	hardware watchdog.
signaling of a fault warning, shall not be prevented by a
failure in the execution of the program of the monitored	Additionally the correct operation of the main processor of
system.	all system elements is validated by adding execution
	checks on relevant locations in the code. This to assure that
	no important flow is excluded from execution.
	The network controller multi-threaded environment is
	validated on correct operation by monitoring the threads: all
	relevant threads must report to a single thread that is
	responsible for resetting the watchdog. If threads do not
	report within a given time frame the watchdog feeding
	process is halted. This monitoring thread itself is
	supervised by a hardware watchdog.

14.4.5In the event of a system fault as specified in 14.4.1 a) or 14.6, those parts of the VACIE affected shall enter a safe state not later than the indication of the system fault. This safe state shall not result in the false activation of mandatory outputs.

Upon restart of a unit other than the Network Controller, the unit will be reinitialized and reordered to its expected state.

Upon restart of the network controller and subsequent loss of the audio and communication network, all units will assume a safe state. The network controller orders the units to their initialization state and is responsive to new stimuli when restarted.

Information about errors and fatal errors (those resulting in a reboot) are saved in SRAM for post mortem analysis. Additionally to the display, a fault indicator can be supplied that indicates the presence of a fault.

Bosch Security Systems 2011-02