Control technology that
Control technology that moves aircrafts on the ground safely Continuously increasing air traffic volumes are a constant challenge for ground operations at the airports. The aircraft tow tractors from the company Goldhofer, fitted with STW’s control technology are a big help - providing safe, economical and flexible movement of the aircrafts on the ground. At “Inter Airport Europe 2015”, the world’s largest trade fair for airport equipment and technology, the company ‘Goldhofer’ presented the ‘AST-2P/X’, its new generation of high speed aircraft towing tractor. Using the AST-2P/X, a wide range of aircrafts from Embraer170 up to the Boeing B777-300ER and the Airbus A340 can be moved. The AST 2 of the fourth generation is characterized by a new, compact and modular vehicle concept. The hydrostatically driven steering mechanism and axle delivers optimum traction, even in case of low superimposed load. For airport management companies that require the towing tractors, they can choose between two engine powers for the vehicle which offers a 3-circuit braking system which optimally distributes the braking force for maximum stability and safety. The engines fulfill all required international emission stan- dards, Euro IIIa or IVf. The airplane power supply during towing operation is ensured via a Ground Power Unit (GPU), which can be retrofitted into each of these vehicles. Ground operations at airport entail a lot of waiting periods. The automatic start-stop function which is installed in the AST 2 provides a high cost savings potential. This function provides not only a substantial reduction in the diesel consumption but it also brings down the maintenance costs, as maintenance intervals depend directly on the operating hours. These factors help in reducing the “Total Cost of Ownership” (TCO). Drive Line Controller (DLC) The AST-2P/X has a diesel-hydraulic drive system as its central component. It is built on a pump and two hydraulic engines, which drive a differential steering axle via a summation gearbox. The pump and the engines are controlled with electrical proportional adjustment. The energy for the drive system is supplied by a 231 KW (optional: 283 KW) Cummins QSL9 diesel engine. The drive system is controlled by the DLC or the Drive Line Controller. The DLC is responsible for managing the entire drive and limiting the tensile forces depending on the type of the aircraft. During the towing process, only a limited tensile force may be applied to the nose wheel (Fig. 1). The tensile force limitation in the DLC is realized through a dynamic, high pressure regulation, which again varies from aircraft to aircraft. In addition, the DLC is also responsible for the automatic start-stop function. MACHINE ELEMENTS ESX-3XL – Freely programmable control unit by STW
Selection of the DLC control platform During the towing operation, DLC is the heart of the towing tractor. Therefore selecting the right DLC is extremely crucial. For the selection of the drive control, focus was mainly on a flexible and high power control unit which would be in a position to reliably execute the functionalities related to safety. The control unit should be adaptable to other types of aircraft tractors and provide the required performance to safely cover the current and future requirements. The 32-bit control unit ESX-3XL Safety from the company Sensor-Technik Wiedemann (STW) seems like a perfect solution that caters to all the requirements. The ESX-3XL is certified according to the DIN IEC 61508: SIL 2 and DIN EN ISO 13849: PL d standards (Fig. 2). The control unit is based on a 32-bit Tri-Core controller with a 150 MHz core, 4 MB RAM, 6 MB Flash and 32 kB EEPROM. In addition to the flexible adaptation possibilities in the basic version – e.g. all inputs can be configured via the functions in it as current/ voltage/digital or rpm inputs – the possibility to extend the device via expansion boards represents an outstanding feature of the ESX- 3XL. Because the control unit can be configured with up to six of these boards, it simply provides more flexibility to the operation. At the moment, 14 expansion board versions featuring different inputs and outputs, in addition to RS232 / RS485 / CAN interfaces and a programmable Linux system including Ethernet and USB are available. Generally, development environments for programming in “C”, Matlab and Codesys are available. For the development of the DLC, the development environment Codesys in version Codesys Safety SIL2 was chosen (Fig. 3). DLC: safety functions and standards In accordance with the applied standards, a risk analysis for the drive functionalities was carried out, which required several functions to be in a safety level of AgPLr ≥ c. Safety-orientated development represents a substantial cost factor during product development and during maintenance of the subsequent product. Therefore, particular attention was paid during drafting of the technical safety concept to a clear and unambiguous definition of the safety functions and their assignment to the appropriate software components. The focus was placed on keeping safetyrelevant parts as simple as possible and creating clear interfaces About Sensor-Technik Wiedemann GmbH (STW) The company Sensor Technik Wiedemann, based in Kaufbeuren Germany, develops a wide range of products in measurement technology, control and automation systems, telematics and machine connectivity. The company also offers services in system design, implementation support and software solutions for communication and control functionality. STW caters to companies that are manufacturers of mobile machines and industrial vehicles both on and off-road. The company has subsidiaries in UK and USA, and employs more than 440 people. between safety-relevant and non-safety-relevant software parts. In the software architecture, this is presented in appropriate safety-relevant and non-safety-relevant modules (Fig.4). The clear assignment of functionalities and the precise definition of the interface between the two software worlds is always meaningful. But it will only lead to cost reductions for development and maintenance if the separation of different software components is supported by the hardware. IEC 61508-3, 7.4.2.9 defines that software parts with different safety classifications are to be developed on a control unit in accordance with the highest safety level, unless they are suitably independent through temporal and spatial separations. The ESX- 3XL control unit supports temporal and spatial independence of application parts by providing appropriate memory protection and watchdog functionalities. With the supplied safety mechanisms software with different safety requirements can be independently executed on the ESX-3XL. This opens up the possibility for the development team to develop non-safety-relevant parts of the application in accordance with a simplified development and verification process. Optimum DLC parameterization reduces costs and complexity The objective was to guarantee a standard compliant parameterization of the DLC. In addition, it was necessary to verify that parameter changes to non-safety-relevant application parts would not have any effects on the safety relevant application parts, in order to keep the required validation and verification expenses as low as possible here, too. Basically, every additional parameterization provides additional complexity, additional error sources and therefore increased validation and verification expenses. Accordingly, attention was paid in the specifications and design of the safety relevant modules to limit the number of parameters to a minimum. The process of safe parameterization is supported via the ‘ESX-Kefex’ toolchain. This Toolchain is part of the ESX- 3XL development environment and comes with a detailed user and safety manual. The ‘ESX-Kefex’ toolchain has been certified for use in projects with safety requirements in accordance with DIN IEC 61508: SIL 2 and DIN EN ISO 13849: PL d. The entire development process including risk analysis, hardware assignment, preparation of safety concept, software architecture, implementation and verification has been realized in close coordination between STW and Goldhofer, which has resulted in a safe, maintainable and optimally tuned drive system. Photographs: Lead Photo Goldhofer AG, 01-03 STW GmbH Disconnection of safety-relevant / non-safety-relevant components www.sensor-technik.de/en WORLD OF INDUSTRIES – MOTION, DRIVE & AUTOMATION 2/2017
