UC13 - Industrial Drives for Motion Control

Industrial drives are the backbone of every automated industrial process. Motion control is an essential part for machinery construction and industrial automation. Motion control platforms aim to precisely and timely control electric motors (e-motor) under consideration of safety and security requirements. They are usually realized as Programmable Logic Control (PLC) applications based on microcontroller, FPGA and ASIC solutions. Industrial drives might be operated in insecure and safety-critical environment. Typical applications are wood/ceramics/glass/stone processing, handling systems, packaging, plastics and textile machines, milling machines, lathes, handling systems, grinders, laser processing, storage and retrieval machines, extruders, winders, rolling machines, tooling machines and many more .

Use Case Number

Use Case Domain Use Case target domain

Use Case Provider

Partners

Use Case Description

Industrial Drives Motion Control systems are often built with PLCs (Programmable Logic Controller) and power inverters for controlling electrical motors. Modern motion control systems have strict requirements on precise and timely control. These requirements are accompanied by mandatory compliance with safety standards (IEC 61508:2010) and security standards (IEC 62443 ).

The baseline of this use case is an Industrial Drives for Motion Control prototype realized in two ways, namely a real-world system and a digital twin.

The physical Prototpye consist of an FPGA-based legacy controller, power board, PMSM (Permanent Magnetic Synchronous Motor), Remote Control Terminal, Ethernet Switch.

Physical Prototype

While the digital twin virtualizes the real-world system behavior by modelling and simulation with SystemC, QEMU (legacy microcontroller , Linux, FreeRTOS (Free Real Time Operating System), AMESim.

‎With this digital Twin a PMSM motor is modelled in the multi-physics simulation tool AMESim. The Motor Control Platform has hardware peripherals (for digital-analog conversion, encryption/decryption, etc.). One core, based on an microcontroller with QEMU, runs Field-Oriented Control software on top of FreeRTOS. It is separated from the second core running a server application software in Linux for handling Remote Control Application commands (ethernet interface) that are exchanged with the first core via Shared Memory. The simulation engines for QEMU, SystemC and AMESim are synchronized.

Industrial Drives Digital Twin

In the evaluation scenario, the underlying CPU Subsystem is exchanged from a legacy CPU towards RISC-V, which is a very promising open processor architecture . The VALU3S project and especially the collaborations planned perfectly complements the baseline work with respect to the focus on V&V. Especially the change towards the new processor architecture causes significant verification efforts of safety and security features where effective fault and attack injection techniques can bring high value.

Use case Evaluation Scenarios

Evaluation Scenarios List

Workflows

Used V&V Workflows

VALU3S Framework

Evaluation Environment Type Type of environment where the method is applied. It can be more than one type of environment.(Dimension 1)

Evaluation Type Type of evaluation performed with that method. If a method is hybrid, more than one type can be selected.(Dimension 2)

Type of Component Under Evaluation Type of components that can be evaluated with that method. It can be more than one type.(Dimension 3)

Evaluation Stage The evaluation stage where the method is used.(Dimension 5)

Purpose of the Component Under Evaluation The type of purpose that can be evaluated by a method. It can be more than one type.(Dimension 6)

Type of Requirement Under Evaluation The type of requirements that a method is able to evaluate. It can be more than one type.(Dimension 7)

Evaluation Performance Indicator The type of evaluation criteria or KPI that a method is able to improve. It can be more than one type.(Dimension 8)

Contents

Picture2.png

Picture3.png

Picture4.png

Picture6.png

an example

this is an example

Sensor data is analysed for plausibility

Sensor data (motor shaft angle) must be within the specified data range.

Motor Control Platform fault-tolerance

Motor Control Platform is fault tolerant to erroneous position sensor data (1-out-of-3, 2-out-of-3, 3-out-of-3) (IEC 61508)

Motor Control Platform is hardened against manipulation of position sensor data

The Motor Control Platform is hardened against maliciously altered sensor data (motor position).

Platform goes into Safe Stop without position sensor data

Safe stop (motor) when no position motor sensor data is available (IEC 61800)

Motor keeps running as long as there is valid position data available

The motor keeps running at the specified RPM as long as there is still at least 1 position value channel providing valid values. When three channel fail the motor must go into 0 RPM. * Preconditions: During runtime. * Input conditions / steps: Motor is commanded to run at specified RPM. Fault injection is used to change the sensor data values: One channel fail, two channel fail, three channel fail.

Position data measured at the motor must be within a specified range

Position data measured at the motor must be within a specified range (0…360 degree). Turning the motor must result in corresponding sensor position values. * Preconditions: During runtime. * Input conditions / steps: Command motor to run arbitrary RPM.

Fault tolerance for motor position sensor data

Motor keeps running if redundant sensor data channel information is erroneous

Safety Behavior for missing motor position sensor data

The electric motor must show safe behavior if sensor data are missing

Motor Speed Control

Motor runs at specified RPM

Safety Behavior for Remote Control Terminal connection failure

Motor stops when the Remote Control Terminal disconnects

Safety Behavior for corrupted data from Remote Control Terminal

Motor stops when the Remote Control Terminal sends corrupted data

use_case_13_legacy_processor.png

Workflow