How to Implement Functional Safety in Mobile Machinery IQAN MC4xFS Parker Hannifin
•
2 likes•2,168 views
Presentation about Functional Safety in mobile machinery and how this can be implemented by using the latest state of the art solution from Parker. A short overview is given about standards used for implementing safety functions. The presentation contains a technical description of the IQAN-MC4xFS solution and how these mobile controllers are capable of implementing safety functions in applications requiring IEC 61508 SIL2 / EN ISO 13849-1 PLd and how inputs and outputs can be used to meet design targets. For more details: http://solutions.parker.com/IQAN-MC4xFS
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to How to Implement Functional Safety in Mobile Machinery IQAN MC4xFS Parker Hannifin
Similar to How to Implement Functional Safety in Mobile Machinery IQAN MC4xFS Parker Hannifin (20)
More from Parker Hannifin Corporation
More from Parker Hannifin Corporation (20)
Recently uploaded
Recently uploaded (20)
How to Implement Functional Safety in Mobile Machinery IQAN MC4xFS Parker Hannifin
- 1. Achieving functional safety without compromising performance with IQAN-MC4xFS controllers How to implement Functional Safety in Mobile Machinery Gustav Widén Systems Engineer Electronics
- 2. Mobile Applications requiring functional safety Application Application safety standard • Aerial platform EN 280 • Refuse rear loader EN 1501-1 • Refuse side loader EN 1501-2 • Refuse front loader EN 1501-3 • Refuse bin lift EN 1501-4 • Steer-by-wire ISO 5010 • Reach stacker LLMC EN 15000 • Lift truck EN 1175-2 • Loader crane EN 12999 • Telehandler LLMC EN 15000 • Forestry machinery EN ISO 11850 • Construction machinery EN 474-1, ISO 15998 • … 2
- 3. CE marking of machinery EN ISO 13849-1 Safety of machinery – Safety-related parts of control systems Harmonized standard used by machine manufacturers to prove that machinery meets the Directive requirements on safety and reliability of control systems 3 - control system aspects Machinery Directive EMC directive ROHS II Low Voltage Directive Safety and reliability of control systems
- 4. The Machinery directive states: Safety and reliability of control systems – Control systems must be designed and constructed in such a way as to prevent hazardous situations from arising. Above all, they must be designed and constructed in such a way that: • they can withstand the intended operating stresses and external influences, • a fault in the hardware or the software of the control system does not lead to hazardous situations, • errors in the control system logic do not lead to hazardous situations, • reasonably foreseeable human error during operation does not lead to hazardous situations. 4 Directive 2006/42/EC, Annex 1, clause 1.2.1.
- 5. State of the art is evolving The Machinery Directive* states: (14) The essential health and safety requirements should be satisfied in order that machinery is safe; these requirements should be applied with discernment to take account of the state of the art at the time of construction and of technical and economic requirements. Mobile machinery application specific standards evolve; with increased level of detail on control system requirements. Most include reference to EN 13849-1 Performance Levels on specific safety functions. 5
- 6. IQAN-MC4xFS For applications requring IEC 61508 SIL2 / EN ISO 13849-1 PLd – Used where safety relies on de-energizing the coils on hydraulic valves – Normal functions and safety functions can be implemented in the same module Scalable design – MC41FS for one or two safety functions – MC42FS higher number of safe outputs – MC43FS large centralized controller for several safety functions 6
- 7. Safety function “function of the machine whose failure can result in an immediate increase of the risk(s)” 7
- 8. Structure of a safety function Input subsystem Logic subsystem Output subsystem 8 IQAN-MC43
- 9. Examples of safety functions • Examples from EN ISO 13849-1 – start/restart function – hold-to-run function – enabling device function – control modes and mode selection – Emergency stop function (complimentary protective measure). 9
- 10. Standards used for implementing safety functions • IEC 61508 – Used in different industries, including machinery – High focus on development process and detailed analysis – Well suited for developing subsystems with complex electronics and embedded software • EN ISO 13849-1 – Specific to machinery – High focus on hardware architecture, allows for estimates on diagnostics, covers also hydraulics, somewhat limited in requirements on software – Can bring in IEC 61508 subsystems as safety related parts – Well suited for complete safety function 10
- 11. IEC 61508 • The gold standard for functional safety in electrical, electronic and programmmable electronic systems – Foundation for other application area international standards • Safety integrity levels, SIL 1 to SIL 4 – Hardware safety integrity, quantifying effect of random failures (PFHd) • Robust components, architecture, hardware diagnostics – Systematic capability • Development process, software design, EMI, .. 11
- 12. EN ISO 13849-1 • For functional safety in machinery, applicable to electrical, programmable electronic, hydraulic, pneumatic and mechanical. – Referenced by mobile machinery C-standards, often specifying safety functions with PL c and PL d. • Performance Level (PL) Levels PL a to PL e, evaluated based on: – Quantifiable aspect of PL, hardware reliability modelling based on • Architecture (categories B, 1, 2, 3 or 4) • MTTFd of components • Diagnostics (DC) • Common cause failures (CCF) – Non-quantifiable aspects • Safety related software (SRASW, SRESW) • Avoidance of systematic faults • Environmental robustness 12
- 13. EN ISO 13849-1:2015 Solutions depending on required PL EN 13849-1 PL IEC 61508 SIL EN 13849-1 hardware electronics EN 13849-1 safety related embedded SW a - Basic safety principles (category B) Basic requirements only b 1 MTTFd on controllers and sensors Basic requirements only c 1 Category 2 or 3, MTTFd, DC, CCF or IEC 61508 SIL 1 EN 13849-1 4.6.2 or IEC 61508 SIL 1 d 2 Category 2 or 3, MTTFd, DC, CCF or IEC 61508 SIL 2 EN 13849-1 4.6.2 or IEC 61508 SIL 2 e 3 Category 3 or 4, MTTFd, DC, CCF or IEC 61508 SIL 3 IEC 61508-3 SIL 3 13
- 14. EN 13849-1 Combining safety related parts of control system (subsystems) Sensors initiating safety function Evaluate with EN 13849-1 • Combine two redundant sensors to Category 3 • Component MTTFd from datasheet (e.g. IQAN-SP500) • Evaluate DC and CCF • Calculate PL = 14 Logic unit Already certified to IEC 61508 SIL2 PL = PL d Directional valve Evaluate with EN 13849-1 Reliable non-complex Category 1 PL = PL c S2 S1 V1 IQAN-MC43FS
- 15. EN ISO 13849-1 Overview of PL for safety function 15 MTTFd MTTFd of each channel DCavg DC Category CCF >65 PL (quantifiable) PFHd PL (quantifiable) Systematic Environmental Software PL for subsystems PL for safety function Σ PFHd
- 16. Complete safety function, calculate combined PFHd Probability of dangerous failure per hour The IQAN-MC4xFS gives margins to complete safety function IQAN-MC41FS 7.63 x10-8 IQAN-MC42FS 7.92 x10-8 IQAN-MC43FS 9.29 x10-8 16 < 1x10-5 < 1x10-6 < 1x10-7 < 3x10-6 SIL1, PLb SIL1, PLc SIL2, PLd
- 17. IQAN-MC4xFS, hardware and embedded software Inputs •Monitoring of VREF •Monitoring of ADC •Monitoring of pulse inputs 17 Outputs •Monitoring of power drivers •Monitoring of wiring Core Hardware diagnostics Correct execution of software Application, created in IQANdesign Inputs Use inputs in pair Cross monitor sensors Functionality Correct application logic Outputs Use safe outputs Control hydraulics
- 18. IQAN-MC4xFS Key features for functional safety • Lockstep MCU • Safety related application executed in lockstep core • ECC protected Flash and RAM • Checksums on settings (FRAM) • Independent safety power supply • Monitoring of all voltages and critical temperatures • Using IEC 61508 SIL3 safety certified real-time OS • Isolation using MMU • Running IQAN application interpreter (vmAC) • Automatic error detecton and action on COUT/DOUT • Built to withstand the harsh environment on mobile machinery • Meets and exceeds EMI requirements for mobile machinery • Development process in accordance with IEC 61508:2010 • IEC 61508 functional safety assessment and certification by RISE • 2006/42 EC type examination by RISE as logic unit to ensure safety functions 18
- 19. IQAN Data driven system IQAN is an interpreting system • Called data-driven system with IEC 61508 terminology • All embedded software is built and tested by Parker before each release. • IQANdesign users focus on the application, without running the risk of creating anything that access the wrong parts 19 Application Application interpreter Drivers RTOS Application Settings vmAC Design Project/clone file Target controller
- 20. IQAN-MC43FS inputs 50 input pins • 26 analog inputs use for 0-5V or as digital input • 2 analog inputs for 0-32V • 4 current loop inputs for 4-20mA signals • 6 timer inputs frequency, pulse or digital inputs • 12 digital inputs dedicated All possible to use in safety functions • Any input pin may be used as part of a safety functions • Normal input usage is in pairs for redundant sensors – IQANdesign compare channels recommended 20
- 21. Analog inputs on MC4xFS • VIN, Voltage input 0.5-4.5V – Dual crossed signals recommended for diagnostics on both sensor and inputs – Internal monitoring of AD Converter and reference: • Single signal or dual identical signals possible with wider margins on safe failure 10% – Range limit in application required • CIN, Current loop input 4-20mA – Dual crossed signals recommended for diagnostics on both sensor and inputs – Internal monitoring of AD Converter and reference: • Single signal or dual identical signals possible with wider margins on safe failure 10% – Range limit in application required 21 Raw value [mV]
- 22. Frequency type inputs on MC4xFS Each frequency inputs is connected to two separate processor input ports • PWMIN, PWM input 5%-95% MR – Dual signals recommended for diagnostics on both sensor and inputs – Input monitoring of MR range and frequency • Single signal possible – Range limit in application required • FIN, PCNT, DFIN, DPCNT, Frequency/pulse inputs 0-50 kHz – Dual signals required for diagnostics on both sensor and inputs – Use IQANdesign compare channel 22
- 23. Digital inputs on MC4xFS • DIN, on-off input with pull-up or pull-down – Dual signals are always required for DIN – Use IQANdesign Digital Compare channel – Dual antivalent signals recommended for best diagnostics on both sensor and inputs – Dual identical signal possible, application must consider if sensor diagnostics is reduced 23 High Low Dual opposite signals High Low Dual identical signals
- 24. IQAN-MC43FS outputs 46 output pins • 10 COUT for CAM precision control of up to 10 directional proportional valves, pins combine with • 20 power low side used in COUT or Digital out HS+LS for up to 2.5A • 8 DOUT/PWM high side driver up to 4 A • 8 low current low side for LED lamp control (non safety related) 24
- 25. IQAN COUT Motion control made easy with Parker Hannifin's CAM regulator for proportional control of mobile pumps and valves based on 30+ years of experience. CAM - Parker Hannifin solution for precision control of proportional mobile pumps and valves • No tuning or tweaking CAM regulator circuit guaranties consistent performance • Precision control with a resolution down to 1 mA, a must when there is need for controlling hydrostatic transmissions or precise crane movements • Zero drift control provide the lowest possible output offset current and drift. Parker Hannifin's zero drift CAM offer initial offset current of less than 5mA and almost immeasurable offset current drift over time, temperature and load change 25
- 26. MC4xFS output connections for safety functions COUT, bidirectional 26 COUT, single coil DOUT HS +LS 100-2500 mA 100-2500 mA 60-2500 mA
- 27. Other output connections Not for safety related machine control 27 PWM out HS DOUT HS DOUT HS +LS, multiple low side DOUT LS low current (MC43) ≤ 4000 mA 60-2500 mA ≤ 300 mA
- 28. MC43FS outputs • Combination of high-side and low side switches for handling also external wiring faults • On FS versions, each DOUT HS+LS has exactly one highside switch per coil. • Each unused DOUT HS+LS combination can make one more COUT bidirectional and leave one DOUT HS for non safety related functions 28 5 COUT bidirectional (safe) 5 DOUT HS+LS (safe) 3 DOUT HS, for non safety related functions
- 29. Advantages of using IQAN for functional safety • Safety certification on IQAN design tool for development – No compilation of application or embedded software, all embedded SW and the IQAN application interpreter is compiled and verified by Parker – Highlight and document safety functions, guided by project check – Built-in well defined and secure interface if IQAN master display is used for tuning of a safety related parameter, limits and security handled by safety master. – Design tool that is specific to the needs of mobile machinery, easy to create the intended function – Predictable real-time performance • Safety certification on IQANrun for SW download and parametrization – Security level for tuning/calibration of any safety related parameters • Simulation in IQANsimulate helps when checking the application software, before verification even begins. Bottom line – Enables the machine designer to focus on machine functionality and safety 29
- 30. EC type examination and IEC 61508 SIL2 certification by RISE 30
- 31. WARNING — USER RESPONSIBILITY FAILURE OR IMPROPER SELECTION OR IMPROPER USE OF THE PRODUCTS DESCRIBED HEREIN OR RELATED ITEMS CAN CAUSE DEATH, PERSONAL INJURY AND PROPERTY DAMAGE. This document and other information from Parker-Hannifin Corporation, its subsidiaries and authorized distributors provide product or system options for further investigation by users having technical expertise. The user, through its own analysis and testing, is solely responsible for making the final selection of the system and components and assuring that all performance, endurance, maintenance, safety and warning requirements of the application are met. The user must analyze all aspects of the application, follow applicable industry standards, and follow the information concerning the product in the current product catalog and in any other materials provided from Parker or its subsidiaries or authorized distributors. To the extent that Parker or its subsidiaries or authorized distributors provide component or system options based upon data or specifications provided by the user, the user is responsible for determining that such data and specifications are suitable and sufficient for all applications and reasonably foreseeable uses of the components or systems. 31
- 32. Gustav Widén Systems Engineer Electronics Parker Hannifin Manufacturing Sweden AB Box 222 (Mölnlycke Fabriker 14) · 435 25 Mölnlycke Sweden More information here: IQAN-MC4xFS 32