International TÜV Rheinland Symposium in China Functional Safety in Industrial Applications 18 19 October 2011, Shanghai - China Hiperface DSL Combined with Safety 1
Safety Implementation Hiperface DSL Protocol overview Safety architecture Safety function of DSL encoders Safety implementation Failure modes Motor requirements Drive requirements Documentation 2
Safety Implementation Hiperface DSL Protocol overview Safety architecture Safety function of DSL encoders Safety implementation Failure modes Motor requirements Drive requirements Documentation 3
Protocol Overview Hiperface DSL (Digital Servo Link) SICK protocol for motor-feedback systems / encoders Point-to-point connection drive - encoder Variant 1: One cable Variant 2: Classical - two cables Drive One cable for motor & encoder 2 wires for encoder connection Drive One cable for motor One cable for encoder 4 wires for encoder connection Power electronics Motor housing Power electronics Motor housing Motor Motor Drive controller up to 100 m Encoder Drive controller up to 100 m Encoder 4
Protocol Overview Hiperface DSL (Digital Servo Link) Cyclic communication Synchronized to drive cycle (500 Hz ~ 80 khz) 5
Protocol Overview Hiperface DSL (Digital Servo Link) Multiple communication channels Fixed framing Fast position frame: 12 24 µs length Safe position frame: 96 192 µs length 6
Safety Implementation Hiperface DSL Protocol overview Safety architecture Safety function of DSL encoders Safety implementation Failure modes Motor requirements Drive requirements Documentation 7
Safety Architecture Hiperface DSL (Digital Servo Link) Safety protocol Safe position channel 1 & 2 Diverse, redundant transmission Dual CRC check 8
Safety Architecture Safety architecture SIL2 1 sensor channel with diagnostics ( 1oo1D architecture) Redundant data transmission of same sensor data 9
Safety Architecture Safety architecture SIL3 2 sensor channels with diagnostics ( 1oo2D architecture) Data transmission of 2 sensor values OK SIL3 Encoder Customer responsibility Drive Controller 1 Drive Controller 2 SICK responsibility Safe position channel Safe position channel 2 Interface Interface 1 Diagnostics (µc) Interface 2 Sensor 1 Sensor 2 Drive 10
Safety Architecture Diagnostics for safety functions Sensor signal monitoring (sin 2 + cos 2 check) Redundant sensor signal digitizing CRC for parameter storage CRC for data transmission Frame counter for data transmission ( toggle bit ) Supply voltage, sensor current, ambient temperature monitoring Mission-time counter 11
Safety Implementation Hiperface DSL Protocol overview Safety architecture Safety function of DSL encoders Safety implementation Failure modes Motor requirements Drive requirements Documentation 12
Safety Function Encoders with Hiperface DSL are safe in drive applications only Drive System (User) Encoder System AC Synchronous / Asynchronous Motor Mechanical Connection (Shaft/Housing) Sensor Sensor Interface Drive Interface Analysis, Diagnostics Safety Function Motor Stop in case of Error (STO) 13
Hiperface DSL Safety function Supported safety functions (acc. IEC 61800-5-2) Mode SOS SLS SS1 SS2 SLA SAR SSR SDI SLI SLP STO (informative) Function Safe Operating Stop Safely Limited Speed Safe Stop 1 Safe Stop 2 Safely Limited Acceleration Safe Acceleration Range Safe Speed Range Safe Direction Safely-limited Increment Safely-limited Position Safe Torque Off Remarks Only if indicated for specific product STO is generally selected in case of error detection 14
Safety Function Safety Parameters Target for all future DSL encoders Specific values found in product datasheet SIL2 encoders SIL3 encoders Characteristic parameter according to DIN EN 62061 / IEC 61508 Characteristic parameter according to DIN EN ISO 13849 Characteristic parameter according to DIN EN 62061 / IEC 61508 Characteristic parameter according to DIN EN ISO 13849 Structure Corresponds with category 3 (in connection with drive systems only) Structure Corresponds with category 3 (in connection with drive systems only) Classification Use in safety-relevant functional chains according to SIL 2 Use in safety-relevant functional chains according to PL d Classification Use in safety-relevant functional chains according to SIL 3 Use in safety-relevant functional chains according to PL e Fraction of available PFHd allotted to encoder system < 10% of SIL 2 resp. PFHd < 10-7 [1/h] < 10% of PL d resp. PFHd < 10-7 [1/h] Fraction of available PFHd allotted to encoder system < 20% of SIL 3 resp. PFHd < 2 * 10-8 [1/h] < 20% of PL e resp. PFHd < 2 * 10-8 [1/h] Mission Time > 20 years 20 years Mission Time > 20 years 20 years Proof Test Interval Not required - Proof Test Interval > 4 years - Diagnostic Test Interval 1 hour 1 hour Diagnostic Test Interval 1 hour 1 hour MTTFd - > 30 years MTTFd - > 30 years DCavg - > 90% DCavg - > 90% Safe Failure Fraction > 90% Safe Failure Fraction > 90% 15
Safety Function Safety Parameter example EKS/EKM36 encoder (first series product) EKS/EKM36 encoder Characteristic parameter according to DIN EN 62061 / IEC 61508 Characteristic parameter according to DIN EN ISO 13849 Structure Corresponds with category 3 (in connection with drive systems only) Classification Fraction of available PFH allotted to encoder System Mission Time Proof Test Interval Diagnostic Test Interval MTTFd DCavg Safe Failure Fraction Use in safety-relevant functional chains according to SIL 2 2.8% of SIL 2 resp. PFH = 2.77 x 10-8 [1/h] > 20 years Not required 1 hour - - 95% Use in safety-relevant functional chains according to PL d 2.8% of PL d resp. PFH = 2.77 x 10-8 [1/h] 20 years - 1 hour 412 years 90% 16
Safety Implementation Hiperface DSL Protocol overview Safety architecture Safety function of DSL encoders Safety implementation Failure modes Motor requirements Drive requirements Documentation 17
Safety Implementation for Drives DSL Master IP-core Clock frequency 75.0 MHz Logic size (standard variant) 1700 slices (Xilinx Spartan-3) 1500 slices (Xilinx Spartan-6) 3000 LE (Altera Cyclone III) Safe variant: adds +10% logic 18
Safety Implementation for Drives DSL Master IP-core interfaces Interface1 : Drive Controller 1 Serial (SPI) Parallel (EMIFA) Interface2 : Drive Controller 2 For Safety only! Serial (SPI) 19
Safety Implementation for Drives DSL Master IP-core Safety relevance? Grey channel Single channel in safety system Diagnostics from outside (encoder, drive application) 20
Safety Implementation for Drives DSL Master IP-core Safety relevance? Grey channel Single channel in safety system Diagnostics from outside (encoder, drive application) 21
Safety Implementation Hiperface DSL Protocol overview Safety architecture Safety function of DSL encoders Safety implementation Failure modes Motor requirements Drive requirements Documentation 22
Safety Failure Modes Considered failure modes Mechanical failures of encoder Shaft attachment Housing attachment Loss of code disc Electronical failures of encoder Signal shape Static signals Short-cuts, open-circuits Transmission failures Loss, insertion, repetition of frames Data corruption Electronical failures of drive interface Static signals Short-cuts, open-circuits Drive 23
Safety Implementation Hiperface DSL Protocol overview Safety architecture Safety function of DSL encoders Safety implementation Failure modes Motor requirements Drive requirements Documentation 24
Motor Requirements Encoder assembly Defined geometry of shaft connection Defined torque for shaft connection Defined conditions for housing connection Assembly parameters must be monitored and recorded by user Usage requirements Specification for shock/vibration All details in product Operating Manual 25
Safety Implementation Hiperface DSL Protocol overview Safety architecture Safety function of DSL encoders Safety implementation Failure modes Motor requirements Drive requirements Documentation 26
Drive Requirements Handling of encoder and transmission faults in drive Error indicators show detection of faults Severity of fault explained in manual All details in DSL Manual, product datasheet 27
Drive Requirements Example: Diagnostic tests Aim: Fault detection still working? Drive has to send test messages to encoder cyclically Diagnostic test interval: ~ 1h (slow!) Diagnostic test generates fault in encoder Error indication shows that diagnostics are working All details in DSL Safety Implementation Manual 28
Drive Requirements Diagnostics in drive controllers Necessary since IP-Core is grey channel Check of 2 position values Check of CRC values Drive Example: 29
Safety Implementation Hiperface DSL Protocol overview Safety architecture Safety function of DSL encoders Safety implementation Failure modes Motor requirements Drive requirements Documentation 30
Documentation DSL Manual (non-safety) Protocol DSL Safety details Manual Two categories of documentation Hiperface DSL documentation Drive requirements IP-Core (interface) Manual FPGA IP-Core details (interface) datasheet General specification of interface, protocol Target: Drive manufacturer IP-Core characteristics Encoder documentation 31 Specific for each product series Target: Drive and motor manufacturer Example: EKS/EKM36 Operating Manual Motor requirements Datasheet Encoder characteristics