vv+ 1A4++•+•÷, I

~.7ec4&at ;ZO44No. 13548

SYSTEM HAZARD ANALYSIS

OF TACOM 'S CREW STATION/

TURRET NOTION EASE SIMULATOR

JANUARY 1992

Alexander A. Reid

U.S. Army Tank-Automotive CommandATTN: AMSTA-RYA

By Warren, MI 48397-5000

[0 3APPROSESTFOR PUBLICARELEASE

TUISTRIBUTION BISEUNLIMITED

U.S. ARMY TANK-AUTOMOTIVE COMMANDRESEARCH, DEVELOPMENT & ENGINEERING CENTER (p-Warren, Michigan 48397-5000 ,

NOTICES

This report is not to be construed as an official Department of theArmy position.

Mention of any trade names or manufacturers in this report shall notbe construed as an official endorsement or approval of such productsor companies by the U.S. Government.

Destroy this report when it is no longer needed. Do not return itto the originator,

REPORT DOCUMENTATION I L. RVPORT NO. IS. i.Itelpleat Accession l41.

4. is afd Uub•Mfe IL Repot Doate

SYSTEM HAZARD ANALYSIS OF TACOM'S CREW STATION/TURRET MOTION Jan 1992BASE SIMULATOR (CS/TMBS) 6

7.. Peuftrming Organization lal Ne.

Alexander A. ReidIL. PaIPwming Oapnlzaiot Nam, em d WAddres s. Ps*1ct60/T-,ksW Unit Me

U.S. Army Tank-Automotive CommandATTN: AMSTA-RYA £1. c trctfC • at eWarren, MI 48397-5000

(C)

iS. Spoew Orpanfztlon Name and Adress IS3 Typ" of RePort & Period CV*eMd

FINALI4.

IL Suppnementary Hot..

14. AIutret (u.mit 200 woe,)

This is a System Hazard Analysis of TACOM's Crew Station/Turret Motion Base Simulator.This report presents a general overview of system hazards as well as a detailed breakdownof all hazards, their severity and probability of occurring, and an explanation of thesafety backups.

I 17. Docament Analysis a. Descriptors

b. Mentlmttl/Open-.nd4d Terms

. COSATI fietllOmup

1L. Availability Statement It. Security CUaS (his RTpotA 21. Ho. of Pages

Unclassified 3920. Security Class (Tis Page) 2L PriceUnclassified

Me* t~tz .1)S mtrveflom9g am Reverse OPTIONAL FORM 27,2 (4-77)

2

TABLE OF CONTENTS

Section Page

1.0. INTRODUCTION ................... ...................... 9

2.0. OBJECTIVES ................... ....................... 9

3.0. CONCLUSIONS .................. ...................... 9

4.0. RECOMMENDATIONS .................. .................... 10

5.0. DISCUSSION ................... ....................... 105.1. System Description. .............. ................... 105.2. Malor Subsystems and Components .......... ............ 105.3. Analysis Summary ............... .................... 115.4. Assignment of Risk Assessment Codes ...... .......... 115.5. Safety and Interlock System .......... .............. 125.6. System Hazard Analysis ........... ................. .23

LIST OF REFERENCES .................... ........................ 37

DISTRIBUTION LIST ................. ....................... Dist-1

3

4

LIST OF ILLUSTRATIONS

Figure Title Page

1. Safety and Interlock System Block Diagram ....... .. 13

2. Safety Monitor Software Block Diagram .......... .. 21

5

6

LIST OF TABLES

Table Title Page

1. Status Summary Display .......................... 24

7

8

1.0 INTRODUCTION

This report provides a System Hazard Analysis (SHA) of the CrewStation/Turret Motion Base Simulator (CS/TMBS) located at the UnitedStates Army Tank-Automotive Command (TACOM) in Warren, Michigan. Italso provides the U.S. Army Test and Evaluation Command with componentdescriptions and hazard analyses of the CS/TMBS.

The Crew Station/Turret Motion Base Simulator was designed to includeprovisions for safeguarding personnel and equipment. Safety deviceshave been located on the equipment where necessary and are describedin the Contraves USA Manual No. IM-27751, "INSTRUCTION MANUAL FORTACOM."

This System Hazard Analysis (SHA) is submitted concurrently with aSafety Analysis Report (SAR) in an effort to obtain a safety releasefor the Crew Station/Turret Motion Base Simulator.

The scope of this System Hazard Analysis is the systematic assessmentof real and potential hazards associated with the subsystems of theCrew Station/Turret Motion Base Simulator. This SHA was conducted onthe available system concept data in an attempt to identify hazards andto then direct design efforts toward the elimination or control of theidentified hazards.

2.0 OBJECTIVES

The primary goal is to obtain a safety release from the U.S. Army Testand Evaluation Command for the Crew Station/Turret Motion BaseSimulator itself. Different payloads (crewstations) must beindividually safety certified. This report is issued in conjunctionwith TACOM Technical Report No. 13549, "SAFETY ASSESSMENT OF TACOM'sCREW STATION/TURRET MOTION BASE SIMULATOR" and Contraves USA Manual No.IM-27751, "INSTRUCTION MANUAL FOR TACOM" in an attempt to satisfy MIL-STD-882B.

3.0 CONCLUSIONS

All known safety hazards have been evaluated throughout the design anddevelopment of the Crew Station/Turret Motion Base Simulator. Thesystem is considered safe to operate providing the procedures statedin the "INSTRUCTION MANUAL FOR TACOM" are followed.

The safety devices and procedures for the Crew Station/Turret MotionBase Simulator will reduce the probability of injury to occupant ordamage to equipment to the levels dictated in MIL-STD-882B.

There will be communications between the crewstation and the CS/TMBSoperator at all times during a test. The crewstation will also havean emergency stop button in ready access to provide the crew a meansof stopping the test. It will be assumed that the crew will meet allrequirements imposed by the safety certification of the crewstation.

9

4.0 RECOMMENDATIONS

Upon issuance of a safety release for the Crew Station/Turret MotionBase Simulator, it is suggested that the Safety Office at TACOM begiven power to approve various test setups and issue safety releasesfor them.

5.0 DISCUSSION

5.1 System Description

The CS/TMBS is a high-performance, six-axis motion simulator capableof handling payloads of up to 25 tons. It recreates the dynamicmotions a vehicle would experience traveling over cross-countryterrain, while being capable of handling a wide range of crew stationsfrom Ml turrets to smaller crew stations equipped with computer-generated imagery systems.

The simulator is intended to replace costly field testing of vehiclesin development (or being modified) with a controlled laboratoryenvironment in which to conduct testing.

The CS/TMBS is considered a "Stewart Platform," named after theresearcher who developed the concept in the late sixties. The basisof the Stewart Platform was developed for flight simulators and hasbeen used for many applications in laboratory simulation. One featurewhich makes the CS/TMBS unique among the other known Stewart Platformsystems is the capability to handle heavy loads with a bandwidth motionof 5 Hz.

The CS/TMBS was designed and built by Contraves USA and assembledjointly by Contraves USA and TACOM. All control compensation wasperformed by TACOM. The CS/TMBS is expected to open doors to newresearch, development and testing in the areas of gun/turret drivetracking and stabilization systems along with man-in-the-loop testing.One potential feature of the CS/TMBS is the ability to test and studythe soldier-machine interface while in a dynamic environment.

5.2 Major Subsystems and Components

The CS/TMBS is described under the following equipment categories:

o Frame Structure

o Supervisor Computer

o Safety Monitor Computer

o Interlock Chassis

o Motion System

o Inertial Measurement Unit

10

o Analog I/O

o AD-100 Computer Interface

o Array Processor

o Encoder Servo Processors

o Hydraulic System

5.3 Analysis Summary

The analysis results presented in the following pages address thehazard potential to the Crew Station/Turret Motion Base Simulatorshould there be a failure in any of the subsystems.

5.4 Assicinment of Risk Assessment Codes

The accompanying analysis sheets contain hazard severity levels, hazardprobability levels and Risk Assessment Codes (RAC). The hazardprobability levels and RAC are from AR 385-10 Interim Change No. I01.The hazard severity levels are from MIL-STD-882B, so that system damageand personnel injury can be included in the definition and reflectedin the hazard assessment.

HAZARD SEVERITY

a. Category I - Catastrophic. Death or permanent totaldisability; system loss, major property damage.

b. Cateciory II - Critical. Permanent partial disability ortemporary total disability in excess of three months; majorsystem damage, significant property damage.

c. Catecfory III - Marginal. Minor injury, lost workdayaccident, or compensable injury or illness; minor system damage,minor property damage.

d. Catecrory IV - Nealiqible. First aid or minor supportivemedical treatment; minor system impairment.

HAZARD PROBABILITY

a. Freouent. Likely to occur frequently in life of system,item, facility, etc.

b. Probable. Will occur several times in life of item.

c. Occasional. Likely to occur sometime in life of item.

d. Remote. Unlikely, but can reasonably be expected tooccur.

11

e. Improbable. Unlikely to occur, but possible.

RISK ASSESSMENT CODES

1 - Critical

2 - Serious

3 - Moderate

4 - Minor

5 - Negligible

5.5 Safety and Interlock System

The CS/TMBS system has multiple levels of safety interlocks to assurethe safety of both personnel and equipment. The interlock system isdivided into five subsystems with overlapping functions to achieve ahigh level of hazard protection. Figure 1 shows an overall view of thesafety and interlock system.

The safety interlocks are distributed between:

"o Interlock Chassis

"o IMU Chassis

"o ESP Cards

"o Safety Monitor Equipment

The CS/TMBS control system supports two types of aborts when a faultis detected.

1. Hard Abort - Hard aborts are implemented through the InterlockChassis andcause an immediate shutdown of the simulator by abortingthe hydraulic control circuits. Hard aborts are used for faultconditions that could be an extreme or immediate hazard. Conditionsthat could cause the system to be uncontrollable also warrant a hardabort. The following action occurs when a hard abort is initiated:

"o Actuator abort valves open, limiting actuator pressures.

"o Servo shutoff valves close, isolating the actuators from the servovalves.

o System supply valves close, isolating the CS/TMBS system from thehydraulic power supply.

2. Soft Abort - A soft abort is a computer controlled shut-down in

12

HYDAULICSTY1 DRIVE DEFAULT POSITIONHYDRAUUCS FEEDBACK FAULT FORCE

ASAFEY ACTUATORS

INTERLOCKOPTERCHASSIS ENCODERSSERVO

PROCESSORS

IMU POWERCHASSIS SUPPLIES

.• COMPUTER

ANAL SUPERVISOR

ANALUOG IPO

Figure 1. Safety and Interlock System Block Diagram

13

response to a nonimminent hazard or recoverable error. When a soft

abort error condition occurs, the CS/TMBS controls cause the system to:

"o Return the platform to a neutral position and orientation.

"o Lower the platform to the settled position and abort hydraulics.

5.5.1 Interlock chassis. The Interlock Chassis directly controls theCS/TMBS system hydraulics to ensure a safe and rapid shutdown in theevent of a system fault. Various function cards in the InterlockChassis form the hardware interlock string, a relay ladder thatcontrols the hydraulic solenoid valves via the Interlock Control box.The hydraulics cannot be energized until the hardware interlock stringis closed (satisfied). A hard abort occurs when the interlock stringopens due to a fault detected by one of the interlock function cards.

The Interlock Chassis contains three types of printed circuit cards,such as:

o Interlock Card (4)o Analog Limit Card (6)o Control and Status Card (3)

Not all of these cards are in the hardware interlock string, however,they all serve a function in the safe control of the CS/TMBS.

5.5.1.1 Interlock Card Functions. The Interlock Cards connect tovarious contact closures and TTL signals in the CS/TMBS system. Thefollowing functions are in the hardware interlock string:

o Retract Limit Switches (6)o Extend Limit Switches (6)o Solid State Relay (SSR) Faulto IMU Linear Acceleration Limito IMU Angular Acceleration Limito IMU Angular Rate Limito Inertial Switcho 115 VAC Power Failo 24 VAC Power Failo ESP Interlock Stringo Console Emergency Stopo Facility Emergency Stopo Crew Emergency Stopo Facility Pressure Switcho Return Pressure Higho Return Valve Closedo Service Jack Interlocko Connector Interlocko System Pressure Critical

Interlock hardware overrides the Retract Limit switches until thesystem is out of the retract limits. Likewise, the System PressureCritical (<1500 psi) interlock is bypassed until after the hydraulicpressure is stabilized. The SSR fault shows a failure in one of the

14

Solid State Relays that drive the hydraulic solenoid valves. The IMUlimits indicate excessive acceleration or rate has been detected in theIMU Chassis. Provision is made for a multi-axis inertial switch to bemounted in the crew compartment as a back-up inertial interlock. Theswitch is calibrated to trip at a preset G level along its X, Y, andZ axis. The 115 volt AC Power Fail aborts the hydraulics and controlsystem before the DC power supply voltages drop to a critical level.A 24 volt AC power failure inherently aborts all solenoid valves, butits inclusion in the interlock string assures that the ESP's and SafetyMonitor Computer detects the failure. The ESP Interlock String inputis from a series connection of the ESP interlock relays. This directpath to the Interlock Chassis provides redundancy in case of a multi-bus communication failure. Section 5.5.2 details the ESP interlocks.The Emergency Stop buttons allow the system operator at the console,facility personnel near the simulator or the tank crew to affect animmediate CS/TMBS system abort. Prior to starting the system, facilitypressure must be sensed on the HPS side of the CS/TMBS supply valves.The absence of facility pressure while the system is active will causean abort. The CS/TMBS system is supplied with a shutoff valve at thereturn manifold to facilitate hydraulic maintenance operations. TheReturn Valve Closed switch and Return Pressure High switch guaranteethat the system cannot be operated without full return flow capacity.Provisions are made for the placement of service jacks in lieu of thehydraulic actuators to support the platform while maintenance andrepair procedures are performed. The Service Jack Interlock preventssystem operation while the service jacks are in.

Certain Interlock Card inputs are not connected to the hardwareinterlock string, but provide status to the Safety Monitor Computer(SMC) to:

1. Determine the current operational mode.

2. Provide status information to the operator.

3. Initiate soft aborts through the Safety Monitor Computer.

These Interlock Card status inputs are:

"o Cylinder Enable (6)"o Pressure Higho Pressure Lowo Temp Higho Temp Lowo Oil LowO Filter Cloggedo Deadman Switcho Gate Openo Crane Proximityo Remote Enable

The Safety Monitor Computer (SMC) initiates a soft abort when thePressure High, Pressure Low, Oil Temperature High, Oil Reservoir Low,Filter Clogged, Deadman Switch, Gate Open, Crane Proximity, Access

15

Platform Retracted or Remote Enable interlocks are not satisfied.Temperature Low is for operator information only. It aids in thediagnosis of problems that might be related to the oil being belownormal operating temperature.

The Motion Consent switch in the crew compartment must be pressedsimultaneously with the Hydraulic Start switch at the control consolein order to open the supply valve and commence system operation. Whenthe system is to be used without a crew, the Crew Disable keyswitch atthe Interlock Control Box bypasses the Motion Enable switch. TheRemote Enable switch is an optional contact closure provided bycustomer equipment to enable system start-up and initiate soft aborts.

5.5.1.2 Analog Limit Card Functions. The Analog Limit cards controlthe safety interlock system based on absolute high and low limits ora tracking comparison between two signals. These interlock functionsrespond based on preset high and low voltage limits:

o +5 volt supplyo +15 volt supplyo -15 volt supply.o +15 volt backup supplyo -15 volt backup supplyo +28 volt supplyo +12.8 volt Moog Rack 1 supplyo -12.8 volt Moog Rack 1 supplyo +12.8 volt Moog Rack 2 supplyo -12.8 volt Moog Rack 2 supplyo +12.8 volt Moog Rack 3 supplyo -12.8 volt Moog Rack 3 supplyo Actuator Force Limit

Note: Moog Controls Inc. is the actuator supplier.

All of the above limits are safety critical and therefore in thehardware interlock string except the ±15 volt backup supplies and the+28 volt supply for the IMU angular rate sensor. These two interlockscause soft aborts through the Safety Monitor Computer. The ActuatorForce limits may be thought of as absolute positive and negative(extend and retract) force limits.

The following analog limits are designed as tracking window comparisonsof two signals. They are used to detect actuator transducer failuresand are included in the hardware interlock string.

o Actuator Drive Fault (18)o Actuator Feedback Fault (6)

An Actuator Drive Fault occurs if the servo valve spool position doesnot correspond with the valve drive signal. Spool position is measuredby an LVDT on the last stage of the servo valve. The valve drivesignal for each group of three servo valves is subtracted from thethree demodulated spool position signals. The resultant signal is lowpass filtered to compensate for the valve bandwidth and the high and

16

low limits are set to allow an error window. The Drive Faults arebypassed until pressure is applied to the valves so that the hydraulicscan be started. With pressure applied, the valve drives and feedbackshould track regardless of whether the valve is enabled (servo shutoffvalves open). All servo valves are exercised to detect failures priorto opening the servo shutoff valves.

An Actuator Feedback fault occurs if the force measurement from theactuator strain gauges does not compare with the actuator differentialpressure (i.e., force measurement). The difference signal is filteredto compensate for transducer bandwidth and high and low tracking limitsare set. The redundant force and pressure transducers detecttransducer failure as well as excess friction in the actuator.Actuator friction causes the differential pressure to exceed the forceapplied to the platform. The Actuator Feedback faults are bypasseduntil after platform liftoff because the comparison is not valid untilthis time.

5.5.1.3 Control and Status Card Functions. The Control and Statuscards have power drivers to control lamps, relays, and solenoids. Theyalso have status inputs that can be read by the Safety MonitorComputer, but are not part of the hardware interlock string.

All of the Operator Panel indicators are computer controlled via theControl and Status Card. These lamps are:

o Low, Med, High Dynamicso Interlock GOo HPS ON"o Hydraulic Start (2)"o Hydraulic Stop (2)"o Cylinder Mode Indicators (6)"o Axis Mode Indicators (6)

Each lamp is also connected to a corresponding status input thatdetects filament continuity when the lamp is turned off. This featureis used for the computer controlled lamp test. The Safety MonitorComputer also tests to verify that the lamp drivers are functional.

The following relays used in the safety interlock system are controlledby Control and Status card power drivers:

o Solenoid Power Enableo HPS Start"o Supply valve"o Audible Warning"o Retract Access Platform"o Servo A Enable"o Servo B Enableo Servo C Enable"o Test Abort A"o Test Abort B"o Inertial Switch Test

17

Solenoid Power Enable energizes a solid state relay (SSR) that enablesthe 24 VAC solenoid valve power transformer. The Safety MonitorComputer (SMC) enables the 24 VAC prior to hydraulic startup. Whenthis is enabled, three red warning strobe lights on the platform beginflashing to warn that hydraulic turn-on is imminent. When the systemis ready to start, the SMC issues the Retract Access Platform command.This is used to signal personnel to retract the entry structure. TheSMC sounds an Audible Warning horn (on the Interlock Control Box) priorto enabling the hydraulics. The SMC then issues the HPS start and whenall hardware and software interlocks are satisfied, it opens theCS/TMBS system supply valves. The Inertial Switch Test is a self-testto verify that the inertial switch safety interlock device is installedin the crew compartment.

The Servo A, B, and C Enable commands open the corresponding servoshutoff valves at the output side of the servo valves. The quantityand selection of active servo valves is controlled by the SMC throughrelays on the Control and Status Card, which are wired into thehardware interlock string. For safety reasons, (redundancy) eachactuator has two independent sets of abort valves. The Test Abort Aand Test Abort B outputs allow the SMC to test each groupindependently.

Three of the Control and Status Card drivers are wired to the IMUchassis:

o IMU Self Testo IMU Linear Testo IMU Limit Reset

IMU Self-Test is activated to perform either the linear or angular selftests. When the IMU Linear Test output is active, the IMU electronicssimulate simultaneous X, Y, and Z acceleration. The angular self testis performed when the IMU Linear Self Test output is inactive. Thistest mode simulates simultaneous yaw, pitch and roll acceleration.

The SMC monitors the following Operator Panel switches through statusinputs on the Control and Status Card:

o Remote/Local Keyswitcho Motion Enableo Hydraulic Stopo System On/Off Keyswitch"o Hydraulic Start"o Power On/Off Switch

The system response to these switches is entirely under softwarecontrol. The Power On switch is interlocked with the CS/TMBS systempressure switch to prevent the system from being turned off while thehydraulics are on. Without pressure, the Power OFF will turn the PowerSupply Chassis off. If the hydraulics are on, Power OFF will cause asoft abort and the Power Supply will remain on until system pressurehas dropped.

18

5.5.2 ESP Interlocks. Each of the six Encoder Servo Processor (ESP)cards has a relay contact which is part of the safety interlock string.The ESPs will close their portion of the interlock string only ifunsafe conditions have not been detected. When an ESP detects anunsafe condition, the relay will open, breaking the interlock string.Only after the platform has settled to the level degrees position willthe ESP then allow the supervisory processor to reset the error whichopened the interlocks. After the error has reset, the ESP will onceagain close its portion of the interlock string.

The following software interlocks are implemented in the Encoder ServoProcessor:

"o Position Feedback Limit"o Force Feedback Limit"o Power Supply Limits"o Watchdog Timer"o Rate Estimate Limit"o Actuator Friction Limito DAC to ADC Feedback

The position feedback, rate estimate, and force feedback are softwarelimits. The position feedback limit is a backup to the actuator limitswitches. In operation, the position feedback, actuator rate estimate,and force feedback are compared against upper and lower limits. If anyprogrammed limit is exceeded, an abort routine is initiated to open theESP interlock relay.

The actuator friction is computed as the difference between the forcefeedback and the pressure feedback. If the actuator friction becomesunacceptably large, or a sensor failure occurs, an abort will beinitiated.

The power supply voltages presented to the ESPs are periodically readby the onboard analog to digital converter and compared against upperand lower limits. If a supply voltage is found to be out of tolerance,the ESP will initiate an abort.

Additionally; the output of the digital to analog converter isperiodically read by the analog to digital converter. If thedifference exceeds a programmed limit, the ESP will abort the system.

The software watchdog is a re-triggerable one-shot that must beperiodically triggered by the ESP software. If the ESP softwaremalfunctions, the watchdog will time out and open the interlock string,aborting the system.

5.5.3 IMU Chassis. The IMU Chassis hardware is designed to open thesafety interlock string if any of the following faults occur:

o Linear Acceleration Limito Angular Rate Limito Angular Acceleration Limit

19

The linear and angular acceleration limits are derived from the IMUoutputs as described in Section 5.1.1.4 of the TACOM InstructionManual. The IMU outputs are processed by circuits in the IMU Chassisto produce voltages proportional to the linear and angular accelerationvectors. If these voltages exceed a preset limit proportional to avalue greater than 4g or 30 rad/sec 2 , the interlock string is opened.The IMU accelerometers are mounted equidistant from the turret axis sothat the IMU electronics can measure accelerations at the turretcenter. The Safety Monitor Computer performs self-tests and continuousoperational monitoring of the IMU outputs.

The IMU Chassis also processes the signals from the IMU angular ratesensor and aborts the system if excess angular rate is detected.

5.5.4 Safety Monitor Computer. The Safety Monitor Computer (SMC) isa single board computer that resides in the Control Chassis Multibuscard cage. The function of the safety monitor is to gather operationalstatus and data from the control system commands and feedback todetermine if the system is operating properly. Among other things, thesafety monitor checks the CS/TMBS positions, rates, and accelerationsto determine that the platform is operating within the design and man-rating limits. Figure 2 shows a simplified block diagram of the SMCsoftware.

Before the hydraulics can be enabled, the SMC activates the self-testfunction on the IMU accelerometers to assure that they are operatingproperly. After the self-test, the SMC takes readings of the IMU andcompares them against a set of software limits to ensure that theaccelerations are not exceeded. If these limits are exceeded, then asoft abort is initiated.

The SMC also monitors the status of all inputs to the InterlockChassis. The SMC will force an abort if any of the Interlock Chassisinputs that are in the interlock string show incorrect status. In thiscapacity, the SMC provides redundancy to other hardwired systeminterlocks. After each interlock test loop, the SMC is required to re-trigger one-shots in the interlock chassis to keep the interlock stringclosed. This feature prevents software failures from compromising thesystem safety.

The SMC also monitors itself, the supervisor computer and the ESPs toensure that the system is operating properly. The following faultswill cause the SMC to force a hard abort:

20

Powell ,TONJ

SIT FAIL

IUFAIL

REVERS FAAILA

Figure 2. Safety MoTRnitorMSfwr lc iga

TEST

o Multibus watchdog (Multibus access timeout)"o Interprocessor communication watchdog

- Supervisor/Analog I/O checks- SMC check of Supervisor Runtime Counter- Supervisor check of SMC Runtime Counter- ESP communication error

"o Memory Parity Error- Supervisor memory failure- SMC memory failure

o Memory Lost Error- Supervisor code memory failure- SMC code memory failure

The SMC will abort the system based on the following ESP errorconditions:

"o Position change when platform should be motionlesso Rate trip"o Force feedback limito ESP software watchdog (1 ms)"o Multi-bus watchdog"o A/D data not within acceptable limits"o Friction tripo Upper position limito Lower position limito Special lower position limit (when applicable)o CPU traps (any illegal instruction)

The SMC will initiate a soft abort if any of the following conditionsare detected:

"o ESP Command Limit"o Software Rate Limit"o Software Acceleration Limit"o Turret Weight Test Failure"o ID code mismatch during remote scenario"o Array Processor DMA complete timeout"o System command timeout on ADI00 linko 10 ms System-Tick Timeout"O Illegal Mode Change"o Crane Proximityo Power ON/OFF Switch OFFo System ON/OFF keyswitch OFFo Remote Enable Offo Hydraulic Temperature Higho 15 Volt Backup Supply Failureo 28 Volt Supply Failureo Filter Cloggedo Deadman Switch Openo Gate Open"0 Hydraulic Pressure High"0 Hydraulic Pressure Low (not critical).

A secondary function of the Safety Monitor Computer is to log failures

22

as they occur. They may be displayed after a failure to aid in tracingthe cause of a fault. The SMC also displays the status of all thehardware and software interlocks on the operator console CRT. Table1 lists some of the system status information that is available at theoperator console. All "system go" status indicators are green and "no-go" status indicators are displayed in red so the operator can tell ata glance if the system is operational. The first interlock functionto cause the hydraulics to shutdown during system operation will bedisplayed on the CRT screen to aid in fault diagnosis.

The SMC also is used as the operator communication link to the systemby controlling the CRT display and accepting operator commands from thekeyboard.

5.6 System hazard analysis. The following pages outline specificfailures, hazard probabilities and severity and provide a flow-chartshowing related backup systems.

23

Table 1. Status Display Summary

System StatusSystem (OFF)(ON)(Low)(Med)(High) Dynamics(Local)(Remote) Mode

EXT System ReadyX Position Roll AngleY Position Pitch AngleZ Position Yaw Angle

Hydraulic StatusPressure (OFF)(ON)Valve (Closed)(Open)Pressure (Low)(High)Filter Differential PressureOil Temperature HighOil Level Low

Interlock StatusEmergency StopMotion Consent (OFF)Dead Man Switch DisableRemote StopGate OpenStep Stow LockPower Supply LimitCrane ProximityAcceleration Limit

Actuator StatusSubloop TripPosition LimitRate LimitAcceleration LimitPressure LimitValve Drive FaultFeedback Sensor Fault

24

25

.o tnv ,5,ojto ý -. c

m -0-0 t SO U

"I. MO 0 Mto u

m-, .> ma Aýuu" t~m~w , 0

w'4w z 0,

0 0) r ,

tn0v 0t

r

m g

I.. -0

C ~ 0 .4)0ca~LoS ~>

CL

41 c

C, 10

0S0

0(0

0. 0s)is ~ ~ -M~ ,

wS C) USr

(0 ta

C, u - R

15 to 0

P00.. 0 O.1> ' w .- W.wo 9 toto14)0, ~ (.

r. 0

0.

U) o &00 a 0"0(4 0. 1."

w 0 -V -0-a 00

o r-

To

to Oa,'o

lz wo 0 1

'. ' '

,U

v o.rw'

0, u 0 W-, 0

0

"in

ina

W.W

ci0

I . $-V

am0

oo 0

im

urr.

1..w~co

~ ciio OU. weZ

6 44 r8 44, .0 1 0

ox 40 E-~ 0.4.

a irz

ro4. 4. 1 "'s ?

r Aj .~c~ E E40.tag

u. 2~4 0 CC8 -C

0 j IMJ m ~4

,C10 4 0jCcO

U

0"

14.

(081,Swo 0

&. 01 484 .

614_MO( 2_.i

0148

CU_

0 0

4. 4) "a ra ,4'00 44.

0 (0

4400w( 0084fo u- i--8

.0 . Q,0a -t

0.1 -O1

>, . . .- 0UZUQ 0 .04

mo M ..- 0

~M>W-U w 03'

0>ý

Z a-.j, m 0 0 >1t' 0 to (0~~ >0 .C,

toC( 10 a 0wc R 3 Ow O "

T. 00a-

r0V .00, W00

u'.06,0 c . W

cm>0-.3C -0 *ý .5

10.0

m c a. 0 0 0 c-. (0v(0 M 00 ~0 0mw 0

03FA.0. 0.03. -3

0

(0.u

140

0, 0 m !0.3 V 000* to3o

- 0 0"0 6 1 C6

. 3. 10 to3

N 0(0 1*00. 12.233

0. w033. 0030v W~ M.'o

(00 to

D-. .4W 3.3-

3.353..

00 A 0 0 a'0 O

'0 ~ .0 Go~ O~)C

''w 'M go to $

P~C C: V~. -~ 0,.~ o V o c 0 C4v vc 0" , "0ýS 0 1ý It >0

w 0,'0 IM I 0 0~ .13 0Co6M 0 O~

0y 0 CCo..C~

-C 2 ~ '' os' m Sto a

0 Co'C- - . o W W'0w.o

'0~ ~ wCCC4'o C

-0 Co >c -o vCo5 ~ ~ t' v5

Co~o ~'Co . ~0 C. 0 o 0

0.S r.C u 4' o 2Dx-' oU~ Coo ý G'a W 'C0 o~ 0

4.4.. G . 0~.. g .

0o *'4ru' >o m~ 4.' m Co4Z'55o''0C..4-~Co.044 >ot~ ~ O 4-~.CO ~ Co),4.. o4.>~C .. 0 C~" U 4.004 o -0'4'oo.C

rC 4.~'C S 2 ~ -1:C 40,.. Co.' FoC- 4-0 c - UO w - oC.'- *~44o ~ U.C4 4" C4'

Co 4.46 S w, v

o4-' -' m -o m v '

COo "o.'ý '0-o- VCO '-C M , I4-

oro0 'v . vouoa 4-'

I-oEo 04 w4

Coo .w. w w, o

oC .q OM4.. 4.' wo.U. o S. c oCo v oSCo " vZ-- -o Co 00 04Co.--Co~o "2

CoZ~ ---- ~ ow ao .0 oCL0or ff

,g.'Coa wimar *n 4.4" 04. 0.u

~~O0.Co~l o.C.oU0.

Co v C

Co U >.. Co9 wC v

04.'E ~ Go 0 0.1. o4'-o.. Co 2-~C 00 4

6m C.-L .cOco o gCo. F 2o -"-o r..C C oOC 44oo44w. 44- Co m C.e - = Cotw-U o calwo4. V C 0

w.CCo- Co v

ac t '0 A

S m,aww0 o o $

w v -11 oCC o o- o t

Q8' wo~ 0 00!C ciii2. w

owm0.40.450 4.4>-Cý o m'CCo

0 ad

o

0a >

W 4D r 0

tor t

0

0 4003

rah

14 W h

-n m 44'-MGW

co N

'-m

9.

a-- a

.-4 a.~

0~W 0

o~ - c

a0-0 W! 4 o

or WO-J -Z0',,

0-w UG0'0~i

to) .. Co C0 o - moa

0

00c.

'M~ M' E-

- 04

4. 0 Q

0.9

m -

00- Co 0 -

40 to

,c >

ma0- ma

a..

0-aa,am

to. m w

to Co 04 i

0 to

*, M 0 k

W 0.5

wo 0 0

0 W*5 0Vk M> n m E

9 2Ob2)0

m 0 )

.>0- ý( 0 *'o

o (04,

~ 00

00 .0c" U~

0 . 0 ) U 0

02 /

0 00-

0 0

to

V)0)

l00 M.00

-rzrn 10 r.'0 .0(0.0 0-

2 u : ' 0 0)-to. '00) - -0

N u~. $40 ,

5.4 Q 000 r 0.

m. (0. 00)0 0 r-5. u 14= M

020

.0 0 t

0)-"

xo -0 -0

O0

r 0D3) 00 00

$45. 0 U. .

14 - (p(000 )-0 IVc ~ ~ 3 EN~ .. 0 - 0) 0omc

050 ~'U5.2

00w

000 to0

a~~~~ ~cZo0 to

0-0.00)0

- 0( r. 0:

0- (

g) c o(0Sm ) " 0-

Ez~~ ~ ~ -0U.00 41

'uu -0

2Y s w. "0(00

0 10

0-, - - -

o0 12

w) 0 U a,'~

00

000.~~~ r.0C "..~*4W 0000)Z (

o0( Aco 0w. -A wC0 c to

c. o.. Q C-

U -0

.*000c0w- v0o ;

Mo tw C6 0 m ;ý v -C0

r? o ~ r 18 29 f* u

D- m V 0- (1

a,0 ' - ..0m0 0 Cwm

'10 04 -. ' - 0.(0- Ujý --. "0Ro.o 1 4 -04 (014 OX: 14

to .0. :00ca.00

.- OF(0

o .3 0 to C 11

t~o -,;,o wo0"

.. .. Wow-0 - m W-V V

0) 0 ý7z .2 o g' >.

*- a m~0 .o-.2~Q = ,C, - a, t

5,0 q >,c

v) u t ,

'oCo

~14

INNE-c ==I~

.0-. 0 "C .4ul

to owm00a

o. Go

o m

m Q4

0) CCC a

- w GoSL

Cs. .~0 Co .~. .41

C o WO c -

Co o ; C 4 E

Co 00h .0 W

.o Mo. 0. C

Wc w

o ro C vv m

Co W WM .u o 9.4 14D30.

0~ Co

uo 0j MONt

cc Co o DIto~o4 04 OW .0

wo40 Co owe

*MS~. ~ 0 . *-.00 W*M 0 E

u- m ." -, 10 0> vc 01 .0 -i . .a,

0 ~ ~ Lc0 10) m

W'_ -. 02.0 .~3

Hew- gv u -a 0) -M M"M

1 M ~ 3 0 vu5 , .0 A0 r 0

0'' 0) .8 1�A

Wc J.3'0 'A um-1

10 0 0 ta m 0 AO00--

0 0r sa M 0 0 0>. to vgo -- c

r3 0,. O> * Zo -00. a

2 3.. 0 i -0 v 30

~0 Ow0 Wc_ 0 0tn .0

0 00. W= -00 0 t0 00 w 0 ýu .00 -0 C..,OW03

tjo> .00. gUo-, -

0) ~ ~ 9 430 x 00>.," 1D.m03 040.00030. w ~ 3 1 33. 3C3>.

U 0 c~- 0 w_

wCt030

to to03 4) O0-ýlw m

0 000 10o _ oo0. 30) tom 1.,0

u. .- 103. wto'4 vt

S8 e o , L ; l0-- 14W -3Me

0- .. .. VW=0)Jw Cs `42 )0M R

o smotca

0.330.-. O.7. 33> .

m0 3403. 0 .

10 000 ~ -l 0 00 .030) 333.4

0~-. 0>--. .10-. 30 3-3o~ 0-3 00.-4 0.. -3 -31 03.

w.3 -3 to0C 33 330-3 4.-l .3.30 on.3 .0 3 . .

003.33 x03000 o3003 1.3..303 ov.33303

m o0or - 00

o..o r.' = m o

to-3. t'33. to.~ L...

vO o> u D

M~ v0 c wU 1- U C

D0. 000 Cuý Cý U 4 a eN00- c 03 S01 > -e o

c o -31 o_ "W oA0 o 0)3 o ww 140- 2

LIST OF REFERENCES

1) TACOM RDE CENTER Technical Report #13549, "SAFETY ASSESSMENT OFTACOM's CREW STATION/TURRET MOTION BASE SIMULATOR", Alexander A.Reid, April 1991.

2) AR 385-10.

3) MIL-STD-882B.

4) Contraves USA Manual No. IM-27751, "INSTRUCTION MANUAL FORTACOM", August 1990.

37

DISTRIBUTION LIST

Copies

Commander 12Defense Technical Information CenterBldg. 5, Cameron StationATTN: DDACAlexandria, VA 22304-9990

Commander 2U.S. Army Test-Evaluation CommandATTN: AMSTE-TA-RAberdeen Proving Ground, MD 21005-5055

Manager 2Defense Logistics StudiesInformation ExchangeATTN: AMXMC-DFort Lee, VA 23801-6044

CommanderU.S. Army Tank-Automotive CommandATTN: ASQNC-TAC-DIT (Technical Library) 2

AMSTA-CF (Dr. Oscar) 1AMSTA-T (Mr. Culling) 1AMSTA-TBS (Mr. Reininger) 1AMSTA-RYA (Mr. Janosi) 1AMSTA-RY (Dr. Beck) 1AMSTA-RYA (Mr. Reid) 20

Warren, MI 48397-5000

DirectorU.S. Material Systems Analysis Activity 1ATTN: AMXSY-MP (Mr. Cohen)Aberdeen Proving Ground, MD 21005-5071

DIST-1