Functional Safety - Philips Fortimo System. Philips V&A - Lighting Controls May 07, 2013

Transcription

1 Functional Safety - Philips Fortimo System Philips V&A - Lighting Controls May 07, 2013

2 2

3 3

4 4

5 3.3 Example of functional safety (con t.) 5

6 6

7 North American Standards Governing Functional Safety UL 1998 is designed by Underwriters Laboratories Inc. (UL) as a Standard for Safety for Software in Programmable Components and focuses on microcontroller based topologies. UL 991 is designed by Underwriters Laboratories Inc. (UL) as a Test for Safety-Related Controls Employing Solid-State Devices. UL is designed by Underwriters Laboratories Inc. (UL) intended for Automatic Electrical Controls for Household and Similar Use. CSA 22.2 No. 0.8 is an approach taken by CSA to encompass all of the information from UL 1998, UL 60730, and UL 991 in one standard. CSA provides well-designed templates for compliance and testing. 7

8 8

9 UL 1998: Software Classes vs UL

10 UL 1998: Software Design UL 1998 specifies that software design must account for the following: A software fault will not generate a risk. Software will maintain a safe state when a condition occurs that could cause a risk. Failure handling will meet safety requirements. Identify and respond to states that could cause a risk, such as Initialization, Fail-safe and fault-tolerant concepts, Run-time checks Resource allocation should account for scheduling frequency, criticality, etc., and the impact these factors have on ability to address risks. Should employ means for the prevention, detection, and resolution of non-terminating and non-deterministic states and error states such as division by zero and under/overflow that are capable of affecting the intended operation of the software. Finally, all variables shall be set to initial values before being used by any instruction. 10

11 UL 1998: Critical and Supervisory Sections of Software It is important in software design and testing to identify sections of code that could possibly lead to a hazardous situation. Section 7 provides a list of requirements to define how these risks can be mitigated: Always initialize the software to a safe RA state. Critical sections will be in a separate part of memory from the other code, and if not possible, then all software is deemed critical. Provide means to avoid memory issues. 2 layers to provide supervision of critical sections of code. Supervisory and critical sections are kept in non-volatile memory. (NVRAM). 11

12 Problem description. How to investigate software for safety? A voltage divider with a fixed resistor and PTC sense the ballast temperature. An A/D converts the analog signal in a digital signal. The software implemented in the microprocessor compares the input signal with a limit from the memory and signals off if the input is higher than the limit. Is this Thermal protection scheme comparable with the bimetallic thermal protection? 12

13 Comparison of Functional Safety and Traditional Approbations Functional safety investigation has many of the same deliverables and testing as a standard agency listing/recognition investigation. Functional safety can either be done in hardware per UL 991 (CSA 22.2 no. 0.8 for LED and Controls) or in software or a combination of software and hardware protections. The same type of hazard based analysis is used for software and hardware protections Some additional hardware and/or software testing may be required, as highlighted in the following slides. 13

14 Risk Analysis: 14

15 Functional Safety in Lighting Functional safety is relatively term new in the lighting industry but is common in appliances, medical and other industries. However, the protections that we are discussing for Functional Safety have been employed in the lighting industry for over 20 years. For example: Temperature Protection To prevent a fire hazard and/or to extend the life of a product. Using a component outside of its rates: For example using a relay with a zero crossing scheme. Power regulation via software and other functions traditionally done in hardware. The Functional Safety mark allows us to provide value-added products to our luminaire customers, enabling them to introduce their products without the additional time and cost for testing that would be necessary without a functional safety mark. 15

16 16

17 UL Functional Safety The Fortimo System The design of this device takes the existing Foritmo LED driver and module and adds a thermal sensing circuit to increase the life of the product and also help to prevent hazardous conditions caused by overheating. The functional safety system in question is not intended to substitute a UL 873 Insulation Detector device required by UL 1598 for the Abnormal Temperature Test. The functional safety system in question is not intended to operate (fold back) during the UL 1598 Normal Temperature Test. 17

18 Fortimo Example: The Fortimo 39W SmartMate Intellivolt ( V) is a Class 2 LED driver which consists of 2 components: a Power Supply Unit (PSU) and a Lamp Unit. PSU Lamp Unit 18

19 Fortimo NTC Thermal Feedback: Safety design for Overheating This product was designed to sense the temperature of the enclosure of the LED module using a UL listed NTC that would provide feedback to the driver. When an over-temperature condition is detected by the NTC, the driver would adjust the output power. When the power is the reduced the temperature drops and the light dims. As long as the over temperature is detected, the light will continue to dim until the power threshold. Once this is reached, the light will turn off to prevent the temperature from increasing, further, thus preventing the hazardous condition that could have been created by the rising temperature inside of the fixture. The graph below describes the variation of the output current level with RNTC. 19

20 Fortimo System Operation In a Luminaire equipped with a Fortimo functional safety system: If the Insulation Detector operates and there is fold back, the results would be valid. If the Insulation Detector operates and there is no fold back, the results would be valid. Logic: The insulation material is too hot, and triggers the thermal protector 20

21 Fortimo System Operation If the Insulation Detector does not operate and there is no fold back, the results would be valid. Logic: The insulation material is below the trigger temperature, no risk If the Insulation Detector does not operate and there is fold back, the results are indeterminate. Logic: Further investigation is needed to determine the reason of the fold back, perhaps misapplication or other root cause 21

22 The Fortimo System Applicable Standards UL 1998 Applicability: In the case of Fortimo, no software safety was used so this standard did not apply. UL 991 Applicability: In the case of Fortimo, this was a more applicable standard since the product is an LED driver with built in hardware protection to extend product life and reduce temperature in a hazardous situation. UL Applicability: In the case of Fortimo, since the product is an LED driver, this standard was not applicable. 22

23 Fortimo System Achievements First ever UL recognized lighting technology protective function Verified protective function to support long term reliability of the Fortimo system as opposed to a face value declaration Opens the technology path to in-depth application of protective functions 23

24 ETL Functional Safety The functional safety mark will provide the following benefits for a luminaire manufacturer who uses such a component: Faster time to get products certified. Reduced certification costs (due to temperature tests not needed) Reduced number of samples needed for certification Although not yet finalized, this could lead to a modified version of the ETL General Coverage program. 24

25 Functional Safety Going Forward More complex technologies will be built up to replace traditional protective functions by electronic protective functions, the rules are currently under discussion. Provide a path to analyze complex technologies for safety evaluation (hardware and/or software based). 25

26 References: UL 991 UL UL For more information please contact: Thank you! 26

27 Questions? 27