DUAL Controller Fault During Firmware Online Upgrade (OLU)
During Execution of the OLU procedure both controllers will fail and stop the OLU.
800xA - Control and I/O, AC 800M High Integrity Controller Firmware, Version 5.0.2/1 – 5.0.2/5 AC 800M Controller Firmware, Version 5.0.2/x and 5.1.0/0 - 5.1.0/1
It can be identified on the controller log with the resulting error message:
E 2012-06-26 10:35:00.631 Fatal error PM: COLUPrimary_ Transfer ToTrainee::PackLen - Corrupt pString element?Symptoms:
control modules during online upgrade
The following function block can cause a dual controller crash during OLU:
--> Alarm Cond
--> System AlarmCond
In particular, when the length of the 'message' string parameter has changed since the last execution of alarm & event object and this alarm & event object has not been executed before performing the OLU
In addition to the above Function Blocks the following Function Blocks can also cause a dual controller crash during an OLU
For these function blocks to cause a crash during an OLU, the above criteria needs to be met along with the criteria: "Parameter: AEConfig has changed from a 1 to any other value"
Possible workaround is to allow alarm blocks that are conditionally executed to execute at least one scan before online upgrade. This is only possible if changed message strings could be identified
This problem will be corrected in rollup for AC 800M Control Software, 5.1 RU2 (5.1.0-2), which will be a part of system version 5.1 Rev C, except for AC 800M High Integrity controller which in this version uses version 5.0 SP2 RU5. The correction will remedy this problem when upgrading from the corrected version.
The issue will also be corrected for installations already using the 5.1 feature pack, in the first feature pack for AC 800M Control Software, 5.1.1. Observe that version number of AC 800M Control Software feature pack is not equal to the version number of the system feature pack it will be a part of.