Application of safety principles for a guidance system in public transport H. Schäbe TÜV Rheinland InterTraffic, Cologne, Germany H. Vis & R. Bouwman Advanced Public Transport systems, Helmond, The Netherlands 10/12/2009 1
Content 1. Introduction 2. Decription of the Phileas 3. Guidance system and guidance computer 4. Front axle steering 5. Rear axle steering 6. Power supply 7. Sensors 8. Bus system 9. Additional advantages 10.Conclusions 10/12/2009 2
1. Introduction In Gayen & Schäbe (2008), safety principles have been discussed.i In this paper: Application of safety principles to the design of technical systems. Demonstration with the help of the Phileas, aguided bus, developed and manufactured by Advanced Public Transport systems in Helmond, The Netherlands. The vehicle is developed for use in Douai (France) and has to fulfill several safety requirements. The applicable standards are the CENELEC railways standards EN 50126, EN 50128 and EN 50129. Safety principles can help to efficiently construct a safety architecture. Main safety principles: Safe life Redundancy Diversity 10/12/2009 3
2. Decription of the Phileas Single-articulated 18,5 m length or double-articulated with a length of 24,5 m. Width of 2.55 m and maximum height of 3.24 m. Highly manoeuvrable with limited swept path because all wheels are steered. Large doors both at left and right side New concept for comfortable passenger transport on high frequency dedicated bus lanes and for mixed traffic, for SMTD (Douai, France) Phileas meets all legal requirements for city buses and has unlimited access to the public road. The electronic guidance and precision docking system will be approved according to the rail standards EN 50126, 50128 and 50129. with automatic side selection during guided mode. 30 cm high platforms for step and gap free entry and exit of the passengers, allowing short stopping times and high average operational speed. Public road on both sides of the concrete bus lane, stop platforms in the centre of the bus lane (requires doors at left side), or at the right side of the bus lane (requires doors at right side). 10/12/2009 4
3. Guidance system and guidance computer Safety integrity level 4 (SIL 4) required. The bus is guided with a computer-based system consisting of a central guidance computer system (GCS), front axle steering and rear axle steering. Sensors measuring angles of the axles and articulations, counting the revolutions of the wheels and the jaw rate between different vehicle compartments, the position and orientation of the bus are determined. Magnets placed in the bus lane used to precise the position. Guidance function must be realized as a safe life function (no safe state that can be reached instantaneously) Guidance computer: 2-out-of-3 computer system. Three computers are crosschecking each other permanently; When inconsistencies of results are detected, the deviating computer is turned off (majority vote) and automatic braking is initiated until standstill. Automatic braking is part of the safety concept. Sufficient measures to be implemented to protect the system from common cause failures and common mode failures: sufficient degree of diversity for the three computers. 10/12/2009 5
The guidance control computer is the master of the guidance control system. It is responsible for diagnosis and bringing the system in the safe state in case of failure. The guidance system requires sufficiently reliable power supply and sufficiently reliably communication with high detection probability of faulty messages. 10/12/2009 6
4. Front axle steering Part of the guidance system, therefore a safe life system. Three servo controllers are applied. Each servo controller provides sufficient torque to steer the front axle. In case of failure of one servo controller, there are always two other servo controllers to fight the wrong servo and provide sufficient torque. Safe-life architecture using the redundancy principle. Any reactive fail safety approach would be too slow The safe guidance computer is responsible for fault diagnosis (comparing the set points with achieved steering angles and checking the current of the electric motors). Upon force fighting, the guidance computer would diagnose a fault and initiate automatic braking. Thoroughly applied diversity principle to the three servo controllers and motors, including the transmission of the torque to the steering column. This includes sufficiently different servo controllers, motors and transmission, allowing the use of many standard components. Supported by an analysis for common cause failures and common mode failures. 10/12/2009 7
5. Rear axle steering The same principles as for the front axle could not be applied to the rear axle, for the high energy consumption For a rear axle steering system the reaction time must not be that short as for the front axle. A redundant hydraulic steering system has been applied. Only one steering sub system is active, the other being in hot standby. Each hydraulic steering sub-system is supervised by itself and by the guidance control system (active and the hot-standby sub-systems): verifying axle position, execution of set points, availability of hydraulic pressure etc. Faulty steering sub-systems are detected and control is passed to the hot standby system. Both systems are tested thoroughly according to a test procedure several times during one trip. Both hydraulic subsystems are made different (sensors, pressures to be applied for control etc.) to avoid common mode failures, applying the principle of diversity. 10/12/2009 8
6. Power supply In order to protect the guidance system from loss of power, a single power supply system is not sufficient. Power supply is not a safety issue, it is an availability issue, but necessary for the safe life system A fully redundant power supply system buffered with one battery each has been applied. In order to protect the Phileas from common cause failures of other subsystems caused by the power supply, all systems have been connected to both power supply systems in such a manner, that failure of one power supply will not cause a critical combination of failing systems: 10/12/2009 9
a) Sensors; no critical configuration of sensors fails when one power supply system fails b) Guidance control computers: Two computers are connected to one power supply each and the third is connected to both. c) Failure of one power supply only causes the failure of one CAN open communication bus. d) Failure of one power supply causes failure of only one hydraulic steering circuit per axle; e) Failure of a power supply system always leaves at least one servocontroller of the front axle steering systems in a working state (sufficient to steer). Upon failure of one power supply system, automatic braking of the Phileas is initiated. 10/12/2009 10
7. Sensors To reduce safety requirements for sensors, the diversity principle has been applied. Sensors measuring according to different physical principles have been applied (different angle sensors and gyroscopes). Such a combination of sensors has been applied that the guidance computer is able to crosscheck the values in order to detect possible failures. After determining the faulty sensor and isolating it, the bus can still be used until such a number of sensors has failed that the following two failures could be dangerous, i.e. the second of them could lead to loss of the steering function of the bus. Principle of redundancy has been used. Application of both principles allowed to use as much as possible standard components (diversity) and enhance reliability of the sensor system (redundancy). 10/12/2009 11
8. Bus system Information needs to be passed between different systems in the bus (sensor information, set points for front axle steering system and rear axle steering system etc.) A CANopen communication system has been applied. Measures have been implemented to detect communication failures (Bit errors, delayed messages, lost messages etc. ) IEC 62280 applied (use of time stamps, cyclic redundancy checks etc.) Faults on the CAN bus can be detected. The redundancy principle has been applied using a second CANopen bus for communication. Both buses are connected in such a manner to sensors, guidance control computers and axle steering systems that upon failure of one CAN open bus, the Phileas can still be safely steered. In case of failure of one CANopen, the guidance control computer initiates automatic braking. 10/12/2009 12
9 Additional advantages It is necessary that the guidance control system is able to initiate an automatic braking. For brake initiation the safe brake has been separated from the service brake. The safe brake has been designed using the principles of redundancy and diversity, i.e. activating the pneumatic brake using different mechanisms to prevent that double safety-critical failures occur simultaneously. 10/12/2009 13
Conclusions We have shown how safety principles cane be efficiently applied to design a safe system. Safety principles allow to bypass a trial and error phase in development. They allow to design a safe architecture in a straightforward manner. We have demonstrated how to apply principles as safe-life, redundancy, diversity and others. This shows clearly, how safety principles can be applied and how they allow to simplify a design, compared with an approach not using these principles. Future: The authors hope to come up with new applications of safety principles in the near future. 10/12/2009 14