This documentation is related to the following software version:
See MultiAxis-Steer firmware revision in Document references
Warning
Identifies information about practices or circumstances that can lead
Identifies a typical use of a functionality or parameter value. Use
process of the system.
Document references
Software reference
Errata information
Literature
Document Revision
PVED-CLS KWP2000 protocol Revision 1.79 02 May 2018
PVED-CLS User manual Revision 1.7 14 Jan 2019
EHi steering valve technical information BC00000379
The latest errata information is always available on the Danfoss homepage: www.danfoss.com
It contains errata information for:
• PVED-CLS boot loader
• PVED-CLS application
• Documentation
• PLUS+1® Service tool
• Other topics related to the steering system
If further information to any errata is required, please contact your nearest Danfoss Product
Application Engineer
Important User Information
Danfoss is not responsible or liable for indirect or consequential damages resulting from the use or application of
this equipment.
The examples and diagrams in this manual are included for illustration purposes. Due to the many variables and
requirements associated with any particular installation, Danfoss cannot assume responsibility or liability for the
actual used bases on the examples and diagrams.
Reproduction of whole or part of the contents of this safety manual is prohibited.
The following notes are used to raise awareness of safety considerations.
Identifies information about practices or circumstances that can
cause a hazardous situation, which may lead to personal injury or
death, damage or economic loss.
Attention
to personal injury or death, property damage, or economic loss.
Attentions help you identify a hazard, avoid a hazard, and recognize
the consequence.
Important
Recommendation
Identifies information that is critical for successful application and
understanding of the product.
recommendations as a starting point for the final configuration
Important User Information ...................................................................................................................................... 3
Terms and abbreviations 4
Contents 5
Introduction 9
N-Axis system principal 10
N-Axis system configurations.................................................................................................................................. 10
N-Axis master [hydrostatic] steering system ................................................................................................ 10
N-Axis master [electro hydraulic] steering system ..................................................................................... 10
N-Axis slave function ................................................................................................................................................. 11
Man Machine Interface (MMI) ................................................................................................................................. 11
Active de-energize (immediate) ....................................................................................................................... 12
Active de-energize (automatic return to straight) ...................................................................................... 12
Full electrical de-power/de-energize .............................................................................................................. 12
Advise for system integrators ........................................................................................................................... 12
Service tool ................................................................................................................................................................... 12
N-Axis CAN network ................................................................................................................................................... 13
CAN message data flow ...................................................................................................................................... 13
N-Axis CAN messages .......................................................................................................................................... 13
Operation state machine .................................................................................................................................... 14
States .................................................................................................................................................................. 14
Operation state machine – fault handling .................................................................................................... 17
States .................................................................................................................................................................. 17
System integrator responsibility ............................................................................................................................ 18
Safety function overview .......................................................................................................................................... 19
Safe state ................................................................................................................................................................. 20
N-Axis steering operation while in safe state ......................................................................................... 20
Safe state leakage performance ................................................................................................................. 20
Reset and recovery from safe state.................................................................................................................. 20
Safety function response time .......................................................................................................................... 20
Monitoring function response time ................................................................................................................ 21
Safe EH-steering / N-Axis closed loop cylinder position control ...................................................... 22
N-Axis safety related control functions ................................................................................................................ 24
Operation when number of slaves > 1 ..................................................................................................... 39
System Architecture 40
System diagrams ......................................................................................................................................................... 40
DC Power supply ................................................................................................................................................... 40
Safety requirements for additional circuitry for SIL3/PL e ........................................................................ 48
Input - Sensor sub-system and monitoring ........................................................................................................ 49
N-Axis master - CAN interface ........................................................................................................................... 49
CAN interface ................................................................................................................................................... 50
Vehicle speed sensor – CAN interface ............................................................................................................ 50
CAN interface ................................................................................................................................................... 51
Man Machine Interface – CAN interface ........................................................................................................ 52
CAN interface ................................................................................................................................................... 53
Input range check ........................................................................................................................................... 55
WAS channel cross-check ............................................................................................................................. 56
Micro-controller cross-check of scaled wheel angle ............................................................................ 56
Out of calibration check ................................................................................................................................ 56
Wheel Angle Sensor (WAS) – CAN interface ................................................................................................. 56
CAN interface ................................................................................................................................................... 57
Input range check ........................................................................................................................................... 58
Micro-controller WAS channel cross-check ............................................................................................ 58
Out of calibration check ................................................................................................................................ 59
Output - Valve sub-system and monitoring ....................................................................................................... 59
Sensor 5V DC power supply............................................................................................................................... 59
EH-valve main spool control principle ..................................................................................................... 61
EH-valve main spool monitoring –EHi-E valve sub-systems .............................................................. 61
Environmental control measures ........................................................................................................................... 63
PCB average over-temperature warning ....................................................................................................... 63
DC power supply ................................................................................................................................................... 63
LED diagnostic ....................................................................................................................................................... 65
System integration and testing .............................................................................................................................. 65
Service part handling and repair instruction ...................................................................................................... 66
Safety validation steps after replacing a PVED-CLS with a service part ............................................... 66
Service Tool (detailed) ............................................................................................................................................... 67
Appendix 68
Component identification via CAN bus ............................................................................................................... 68
Boot Data ....................................................................................................................................................................... 73
Sector CRC Sign Data ................................................................................................................................................. 74
Valve Calibration Data ............................................................................................................................................... 78
CAN WAS Calibration Data ....................................................................................................................................... 78
Analog Sensor Calibration Data ............................................................................................................................. 79
N-Axis Protocol Data .................................................................................................................................................. 80
Production/Calibration Flag .................................................................................................................................... 84
Auto Calibration Config ............................................................................................................................................ 84
OEM Data ....................................................................................................................................................................... 93
MultiAxis vehicle steering is adding steering functionality to have steering on one or more steering axis
than the master axis.
Throughout this document, and in referenced documentation, N-axis or NAXIS are used as
synonyms for MultiAxis steering mainly referencing one or more additional (n) “slave” axis.
Any possibly vehicle steering mode can be achieved with N-Axis steering by the N-Axis MMI command
CAN message, containing the Virtual Axis Position (VAP) and the Virtual Axis Angle (VAA). See Figure1.
The data set, given by VAP and VAA, can result in steering modes such as:
• 2-wheel steering (normal)
• Round/4-wheel steering
• Crab steering
• Dog steering
• Customized steering modes
The steering modes can be altered dynamically and seamlessly by the operator during operation by
transmitting VAP and VAA data set which results in the requested steering mode.
The blue line is the Virtual Axis which can be shifted horizontally along the wheel base (VAP) and
angled relative to the wheel base (VAA). Shifting VAP to the physical slave axis position in a single slave
system will result in 2-wheel steering.
MultiAxis-Steer technical information
N-Axis system principal
Wheel an gle
sensor
N-axis s lave
PVE D
-CLS
EHi Valve
Man machine
int erfac e
CAN bus
Slave axis
Mas ter axi s
Road mode
swi tch
Steering wheel
OSP
Wheel an gle
sensor
N-axis m aster
(OEM )
Veh icle speed
ON/ OF F
Service tool
ON/ OF F
Veh icle speed
Wheel an gle
sensor
N-axis s lave
PVED-CLS &
EHi valve
Man machine
int erfac e
CAN bus
Slave axis
Mas ter axi s
Road mode
swi tch
Steering wheel
OSP (E)
Wheel an gle
sensor
N-axis m aster
PVED-CLS &
OSPE/EHi valve
SASA
Service tool
ON/ OF F
N-Axis system principal
A N-Axis slave steering sub-system may work with both a N-Axis master [hydrostatic] and N-Axis
master [electro hydraulic]. The below functions shall be performed by the system components outlined
in N-Axis system configurations.
N-Axis system configurations
N-Axis master [hydrostatic] steering system
In a N-Axis master, [hydrostatic] steering sub-systems, the master axis is actuated by a hydro-static
steering unit. All N-Axis master functions must be provided by the OEM controller working as N-Axis
master.
N-Axis master [electro hydraulic] steering system
In a N-Axis master [electro hydraulic] steering system, both the master and slave axis are electrohydraulic steering sub-systems e.g. by applying a PVED-CLS with an OSPE valve or a PVED-CLS with an
OSP and EHi inline valve enabling auto-guidance or other high level steering functionalities.
Refer to [PVED-CLS User manual ] for high-level electro-hydraulic steering master axis functionalites.
An N-Axis master performs the following functions:
• Actuate the master steering axis
• Measure the master axis wheel angle and transmit it onto the CAN bus
• Transmit N-Axis master status information onto the CAN bus to the N-Axis slave
N-Axis master functionality shall be realized in the target system by the OEM or by applying a PVEDCLS in ‘N-Axis master’ mode (planned software extension).
Refer to [PVED-CLS MultiAxis-Steer communication protocol].
An N-Axis slave performs the following functions:
• Actuate the slave axis
• Receive N-Axis Man Machine Interface (MMI) commands
• Perform closed-loop steering control of the slave axis cylinder
• Inputs for closed-loop steering control are:
o Master axis wheel angle
o Virtual Axis Position (VAP) from MMI
o Virtual Axis Angle (VAA) from MMI
o Wheel angle limitations from other N-Axis slaves (n > 1)
o Vehicle speed data
• Execute N-Axis safety related control functions
• On-road operation mode
• Apply wheel angle limitation on demand
• Apply self-centering (graceful degradation)
• Transmit N-Axis slave network status CAN message
• Auto-calibration functionality
Man Machine Interface (MMI)
The MMI performs the following functions:
The MMI functionality shall be realized in the target system by the OEM.
Refer to [PVED-CLS MultiAxis-Steer communication protocol].
Vehicle speed sensor
The vehicle speed sensor sub-system performs the following function:
The vehicle sensor sub-system shall be shall be realized in the target system by the OEM.
Refer to [PVED-CLS MultiAxis-Steer communication protocol].
Wheel angle sensor
A wheel angle sensor shall acquire the wheel angle of the front and slave axis respectively.
The wheel angle sensor may:
The vehicle sensor sub-system shall be shall be realized in the target system by the OEM.
Refer to [PVED-CLS MultiAxis-Steer communication protocol] for CAN based wheel angle sensors.
• Cyclically transmission of the N-Axis MMI control message
• Control of the N-Axis steering mode set-point (VAP and VAA)
• Control of wheel angle limit on-demand
• Aqcusition and transmission of the vehicle propulsion speed onto the CAN bus
• Redundant analog 0-5V with crossed output characteristic
The road switch performs the following functions in respect to slaves axis:
• Activate N-Axis slave steering
• De-activate N-Axis slave steering
More activation/de-activation options are possible:
Active de-energize (immediate)
Disable N-Axis slave steering for reaching a safe operation mode for public road usage.
PVED-CLS will remain powered and transmit status and sensor information on the CAN bus.
See [Road-switch de-power / de-energize architectures
ON/OFF switch interface - Active de-energize (immediate)] on page 41.
Active de-energize (automatic return to straight)
Disable N-Axis slave steering with auto-centering to straight and subsequent reaching a safe operation
mode for public road usage
PVED-CLS will remain powered and transmit status and sensor information on the CAN bus.
See [ON/OFF switch interface - Active de-energize (automatic return to straight)] on page 44.
Full electrical de-power/de-energize
Full electrically de-power/de-energize the N-Axis slave to assume a safe state. The PVED-CLS and valves
are not powered. No slave axis functionality is available.
See [ON/OFF switch interface - Full electrical de-power/de-energize] on page 45.
Applications which require lower rear axis drift while N-Axis is inactive or de-energized, require
additional zero-leakage check valves. See [Zero-leakage valve configuration (option)] on page 46.
Advise for system integrators
Important
For systems, where a road switch is required, it must be analysed if cylinder drift, while de-energzied, is
acceptable. If cylinder drift cannot be tolerated, additional check valves may be needed for zeroleakage performance.
Service tool
The service tool provides a mean to perform calibration and diagnostic during installation and
performs the following functions:
• The road switch is optional in N-Axis steering systems.
• The OEM system integrator shall take the decision on the need for a road switch based on the
hazard and risk analysis for the particular vehicle.
•Factors such as maximum vehicle speed, weights, vehicle use profiles may be part of the
considerations.
• The road switch may also operate on N-axis master [electro-hydraulic] steering systems.
• See [Safe state leakage performance] on page 20 for cylinder drift during de-activation.
The system integrator shall ensure that the PVED-CLS and valve sub-system are used in a
suitable mode while the vehicle is being used on public roads.
The MMI message contains the VAP and VAA which sets the vehicle steering mode.
Refer to [PVED-CLS MultiAxis-Steer communication protocol].
N-Axis master net work message
The N-Axis master message contains the master axis steering angle and the operation
Refer to [PVED-CLS MultiAxis-Steer communication protocol].
N-Axis slave network message
The N-Axis slave network message(s) contains the identifier of the slave which has
Refer to [PVED-CLS MultiAxis-Steer communication protocol].
N-Axis master/slave operation
Primary and redundant master and slave(s) operation status message [STAT_MSG_OP]
N-Axis operation status messages are for information only.
N-Axis CAN network
CAN message data flow
Four levels of CAN messages are flowing in an N-Axis steering system.
Figure 2 N-Axis CAN message network
N-Axis CAN messages
A pre-configured wheel angle limit can be enabled/disabled by the MMI which will take
priority over other wheel angle limitations in the N-Axis.
The N-Axis MMI message is only received by the N-Axis slaves (one or more).
reached its wheel angle limit (R/L) and the operation mode or safe state indication from
that particular N-Axis slave.
Any N-Axis can at some point reach a wheel angle restriction which limits the entire NAxis steering behavior i.e. not allowing further N-Axis steering to the direction which has
reached a limit.
A slave shall receive and forward the received wheel angle limit from a slave or transmit
its own limit if this is the tightest wheel angle limit.
Note that the N-Axis slave network messages are only sent when the number of N-Axis
slaves is > 1.
Power-on-self-tests are executed to ensure that the hardware, software and valves work to the
10 seconds after address claim, the application shall enter the safe state.
Prior to executing closed-loop slave axis position control in Operation state, the slave axis angles are
N-Axis operation
Operation state machine
Figure 3 N-axis operation state machine
States
State # Description
Initialization
POST
1
specifications.
If a fault is detected the PVED-CLS enters the safe state (fail state) and issue a DTC on the CAN bus.
After transmitting the address claim message, the application shall wait up to 10 seconds for N-Axis
slave input signals:
MMI messages, vehicle speed CAN messages, analogue WAS signals, CAN based WAS signals (if
configured), N-Axis master messages, N-Axis master wheel angle limit messages (when the number
of slave axis > 1) and road switch signals.
Monitoring is applied on each signal/message upon reception of the first valid signal or message.
After a fixed 10 seconds time-out period, the software assumes that all signal and messages are
present and starts individual monitoring of these. Should one or more sensors fail to be ready within
2
aligned to the master axis steering angle for the current N-Axis steering mode set-point (VAP, VAA).
MultiAxis-Steer technical information
N-Axis system principal
State
#
Description
The alignment is performed by letting master axis steering motion work as a gate for closed-loop
parameter P3910. Hereafter the N-Axis resumes to operational state.
stable information status on displays etc.
On-road state is an intermediate state where the slave axis is controlled to its straight position. Once
The surrounding system shall take appropriate action in case the slave axis enters safe
position control of the N-Axis slave; the slave axis steering angle will not change position unless the
master axis is changing position similar to “inching” the slave axis to the correct position.
This operation is continued until the slave axis position is inside a tolerable range given by the
Operational 3 Active closed-loop control of the slave axis position.
The control parameters shall undergo tuning to achieve a controllable steering for any N-Axis
steering mode change.
The input for the closed-loop control algorithm is:
• Master axis wheel angle
• Virtual Axis Position (VAP) from MMI
• Virtual Axis Angle (VAA) from MMI
• Wheel angle limitations from other N-Axis slaves (n > 1)
• Vehicle speed data
The closed-loop control performance is configurable by the parameters listed in [Safe vehicle speed
dependent closed loop gain limitation].
Typically the closed-loop control of the slave axis is configured to approach a sole front axis steering
system (VAA=0 and VAP = slave axis position) proportionally to increasing vehicle speed.
The maximum vehicle speed where N-Axis operation shall revert to a sole front axis steering system
is set by parameter P3908. Exceeding this speed + 0.5·P3907 (half of the vehicle speed hysteresis
band) will result in a jump to on-road state.
The hysteresis band shall be configured to avoid state bouncing which may be useful for displaying
On-road
state
4
straight position is reached, the software automatically transits to ‘On-road locked state’ which is the
state suitable for higher vehicle speeds.
Two conditions trigger a transition to on-road state:
1) A transition from Operation state (described above)
2) Commanding ‘on-road’-mode by means of the manually operated road switch
(parameter P3237)
On-road state operation:
•Command straight position by forcing VAA is forced to 0 and VAP is forced to the slave
axis position (P3896).
•A timer (P3094) is started to open a time window in which the slave axis shall reach
straight position
Setting P3094 = 0 will, on switching to on-road mode, disable closed-loop slave axis operation and
result in an immediate transition to On-road locked state regardless of the slave axis position. No alarm
will be raised if the slave axis angle is not centered. This setting shall be used when the road switch
immediately cuts power to the cut-off solenoid valve and thus makes closed-loop control impossible.
Important The surrounding system shall observe the slave axis position and take appropriate action
in case the slave axis is not in a position which is suitable for operation at higher speeds.
Setting P3094 to a time (e.g. 5000ms) in which it can be expected that the slave axis has been steered
to the straight position, enables achieving automatic slave axis self-centering and transition to onroad locked state. If a road switch is present in the system (P3237=255), then cutting power to the cutoff solenoid valve shall be equally delayed e.g. by applying timed delay relays.
If timer P3094 (set to a non-zero value) times out and the slave axis is not inside a configured straight
range (P3909), then the N-Axis slave will enter safe state and issue a diagnostic trouble code.
Important
state.
Exit from on-road safe state:
•If the vehicle speed drops below P3908 – 0.5·P3907 (half of the vehicle speed hysteresis
band), the software will exit and resume N-Axis operation by jumping to Pre-operational.
5 In on-road locked state, both the EH proportional valve and the cut-off valve are de-energized, to
block steering flows to the slave axis. The hardware is powered but N-Axis closed-loop control is
suspended. Internal and external monitoring of the electronics and interfacing signals is active.
Sensors are sampled and data is broadcast onto the CAN bus.
The slave axis cylinder position is not monitored and purely hydro-mechanically fixed in its position.
For leakage considerations, see Zero-leakage valve configuration (option) on page 46.
Exit from On-road locked state:
•If the vehicle speed drops below P3908 – 0.5·P3907 (half of the vehicle speed hysteresis
band), the software will exit and resume N-Axis operation by jumping to Pre-operational.
Co nidt ion 1: |wheel angle|≤ (P3909) On-R o ad t o O n -R oad -locked Max WA
OR
Co ndit ion 2: (P3096) Sl av e positi on with re spec t to mast er
Reset, soft-rese t, power
-cycle
External failures
Pre-safe stat e
⑥
Safe st ate
⑦
Int erna l f ail ures
Operation state machine – fault handling
States
State # Description
Pre-safe state 6
Safe state 7
On detecting any failure classified as ‘external’, the slave axis is steered to straight
whereafter the software jumps to safe state.
Operation in Pre-safe state:
•Command straight position by forcing VAA is forced to 0 and VAP is forced to
the slave axis position (P3896).
•A timer (P3096) is started to open a time window in which the slave axis shall
reach straight position.
If timer P3096 times out and the slave axis is not inside a configured straight range (P3909),
then the N-Axis slave will enter safe state.
Failures on the following signals are classified as external:
• N-Axis MMI CAN message
• N-Axis master network CAN message
• N-Axis slave network CAN message
•
The safe state is achieved by at least one of the below two actions:
•De-energizing the EH proportional valve (EH spool is pushed to neutral by a
spring force)
•De-energizing the cut-off valve (COV spool is pushed to closed position by a
The PVED-CLS N-Axis steering valve controller is certified for use in off-road safety applications up SIL2
according to IEC 61508, PL d according to ISO 13849 and AgPL d according to ISO 25119.
Architectures for risk reduction up to SIL3/PL e/AgPL e is specified.
The certificate for the PVED-CLS valve controller can be found in the document PVED-CLS Functional
Safety Annex. The PVED-CLS Functional Safety Annex can be found on the Danfoss homepage:
www.danfoss.com
The certificate scope is for the generic PVED-CLS valve controller for use in safety-related applications
as follows; for off-road applications, safe electro-hydraulic steering is ensured by metering out a safe
steering flow as a function of selected steering mode, input steering command, vehicle speed and
steered wheel angle.
For on-road operation, functional safety is achieved by de-energizing the PVED-CLS valve controller.
Important
The certificate does not cover safe on-road system to SIL 3, PL e and AgPL e in its entirety as it requires
external circuitry, which is not in scope of the assessment.
The certification is not a guarantee for that the realized functional safety is sufficient for any machine.
The OEM system integrator is responsible for analyzing the hazard and risks for a particular machine
and evaluate if the risks are sufficiently reduced by the provided safety functions. The application of
the PVED-CLS and valve sub-system is subject for a separate safety life-cycle.
System integrator responsibility
Attention
It is within the responsibility of the OEM system integrator to:
• Having an organization that is responsible for functional safety of the system.
• Ensuring that only authorized and trained personnel perform functional safety related work.
• Choosing reliable components.
• Completing a system hazard & risk analysis and derive the required risk reduction targets.
• Reassessing the hazard & risk every time the system is changed.
• Ensuring that the derived risks are properly reduced by the safety functions provided by the
PVED-CLS valve controller.
• Certification and homologation of the entire system to the desired risk reduction level.
• Installation, set-up, safety assessment and validation of the interfacing sensor sub-systems.
• Parameter configuration of the application software in accordance with this safety manual.
• Validating that the safety functions reduce the risks as expected.
• Any related non-safety standards should be fulfilled for the application and its components.
• Verify the environmental robustness suitability of the PVED-CLS to installation in the final
system in its surrounding environment.
•Periodically inspect for errata information updates.
Safe on-road mode / active de-energization
(immediate)
Functional safety specification
Safe state
N-Axis steering operation while in safe state
Safe state leakage performance
The safe state is achieved when no steering flow is provided to/from the steering cylinder and the NAxis slave cylinder is fixed at its position.
Achieving the safe state relies on a de-energize/fail safe princicple.
To reach the safe state, all safety controlled outputs, i.e. solid state power switches controlling the EHi
valve, are de-energized.
For the EHi valve, the safe state is achieved by one or both of the following states:
• The EH-valve main spool of the EH steering valve is in neutral position.
• Cut-off valve spool is in blocked position.
If the PVED-CLS hardware or software detects a failure or fails to function, the safe state will be
demanded. One or more diagnostic trouble codes related to the detected failure will be broadcast on
the CAN bus. Refer to [Diagnostic Trouble Codes] on page 96.
If an N-Axis steering system enters safe state, N-Axis angle(s) closed-loop control of all N-Axis stops,
and the respective N-Axis slave steering angles will freeze.
The operator will detect this as a different vehicle steering behavior when steering the vehicle. The
difference in perceived steering behavior will increase with the operators steering input command
change. This property shall be considered for ensuring vehicle steering controllability in N-Axis safe
state.
Important
The surrounding system shall take appropriate action if an N-Axis slave enters safe state e.g. raising the
attention at the operator by means of an acoustic and visual alarm.
In the safe state the cylinder is isolated and fixed in position. External forces on the steered wheels may
cause slow cylinder position drift due to hydraulic leakage.
The maximum leakage is 150ml/min at 150bar cylinder port pressure at ~21cSt (Tellus 32, 50°C).
In application where ~zero cylinder drift is required, additional pilot-operated check valves shall be
considered on the cylinder ports. See page 46.
The PVED-CLS cannot leave the safe state by normal application interaction but requires a reset.
Resetting the PVED-CLS valve controller from safe state can be done by any of the below methods:
• Power-cycling battery supply to the PVED-CLS
• Performing a soft-reset by J1939 CAN command [PVED-CLS MultiAxis-Steer communication
protocol].
•Perform a jump to and out of boot-loader via KWP2000 start and stop diagnostic session
services [PVED-CLS KWP2000 protocol].
All the above-mentioned methods to reset the PVED-CLS from safe state, will force a full Power-on-SelfTest (POST) of the PVED-CLS and valve.
The safety response time is defined as the period of time between a failure is first observed by the
diagnostics and the time by which the safe state has been achieved, e.g. de-energizing the solenoid
valves to bring the valve spool(s) within the hydraulic deadband (no steering flow output).
Safe on-road mode 70 ms
MultiAxis-Steer technical information
Functional safety
Safe EH-steering / N-Axis closed loop
Control loop time: 10ms
Monitoring
mitigation
Monitoring response time
EHi valve
Internal hardware and
software
Safe state
160 ms
External sensor monitoring
(note 1)
160 ms
Valve main spool monitoring
250 ms (note 2)
Solenoid valve connection
monitoring
560 ms
cylinder position control
The safety related control function ‘Safe EH-steering’ is executed every 10ms and executes safe closedloop cylinder position control.
The reaction time for the EHi valve spool to reach neutral position (safe state) from full stroke is
typically 60ms for normal working temperature/viscosity.
The ‘Safe on-road mode’ is demanded by the road switch and switches to safe on-road mode within a
10ms control loop period (react and switch off valve drivers) plus the time it takes for the valve spool to
close the steering flows (maximum spool stroke).
Monitoring function response time
The monitoring funciton response time is defined as the period of time between a failure is first
observed by the diagnostics and the time by which the safe state has been achieved, e.g. deenergizing the solenoid valves to bring the valve spool(s) within the hydraulic deadband (no steering
flow output).
The reaction time for the EHi valve spool to reach neutral position (safe state) from full stroke is
typically 60ms for normal working temperature/viscosity.
Safe state 160 ms
Fault reaction/risk
Note 1: Sensor CAN message time-outs are configurable which has a direct impact on the fault reaction
time.
Note 2: The spool monitoring fault reaction times are valid when the hydraulics has reached normal
working temperature/viscosity.
Calculations are performed at an average
temperature equal to 80 °C
Fault exclusion
Mechanical valve
valve, cut-off spool)
block the EH steering flow to the cylinder.
OSPE EH-valve test
On-line testing
Direct monitoring by a LVDT sensor.
OSPE Cut-off valve test
Intermittent full
stroke test.
Indirect monitoring by test pilot pressure test. Test
road mode and
prior to executing off-road steering functionality.
AgPL/PL
d
Maximum achievable performance level
MTTFd per channel
36 years
ISO 13849, ISO 25119
DCavg per channel
97 % / (95 %)
ISO 13849 / (ISO 25119, lowest of the two channels)
PVED-CLS and valve sub-system
3
ISO 13849, ISO 25119
2
When using with EHPS valve. ISO 13849, ISO 25119
CCF analysis
>65
ISO 13849, ISO 25119
Software Requirement Level
SIL2 / SRL3
IEC 61508, ISO 13849 / ISO 25119
Systematic Capability (SC)
2
IEC 61508
N-Axis safe EH steering
Safe EH-steering / N-Axis closed loop cylinder position control
The safety functions of the N-Axis steering system is to provide :
• “Safe EH steering” (in general) and
• “Safe N-Axis on-road mode”
in multiple axis steering systems.
The probabilistic calculations are based on FMEDA calculations according to IEC 61508.
The calculations are valid for off-road application mode and related safety functions.
All safety functions and related hardware are included.
Sensor sub-systems as well as road switch are not included as it depends on the system.
The CAN bus contributes less than 1% of SIL2 due to the applied safety protocol and is thus omitted in
safety related calculations.
Category
Figure 4 Simplified reliability block diagram
IEC 61508 ed. 1
The FMEDA calculation assumes the use of
redundant analogue WAS with inverted
parts (EH-valve, EHmain spool, cut-off
On demanding the safe state, both valves do not
fail simultaneously. At least one valve will always
Calculations are performed at an average temperature
equal to 80 °C
Fault exclusion
Mechanical valve
main spool,
off spool)
On demanding the safe state, both valves do not fail
test.
OSPE EH-valve test
On-line testing
Direct monitoring by a LVDT sensor.
OSPE Cut-off valve test
Intermittent full
stroke test.
Indirect monitoring by test pilot pressure test. Test
executing off-road steering functionality.
AgPL/PL
d
Maximum achievable performance level
MTTFd per channel
57 years
Optimized value for this Safety function.
ISO 13849, ISO 25119.
DCavg per channel
97 % / (95 %)
ISO 13849 / (ISO 25119, lowest of the two channels)
PVED-CLS and valve sub-system
3
When using with OSPE, EHi-E or EHi-H valve. ISO 13849,
ISO 25119
2
When using with EHPS valve. ISO 13849, ISO 25119
CCF analysis
>65
ISO 13849, ISO 25119
Software Requirement Level
SIL2 / SRL3
IEC 61508, ISO 13849 / ISO 25119
Systematic Capability (SC)
2
IEC 61508
Safe N-Axis on-road mode / N-Axis active de-energize (shut-off)
Additional circuitry is needed for systems where the hazard & risk outcome points to a higher risk
reduction (avoiding unintended steering) than the PVED-CLS can provide. External logic shall be
installed to have the PVED-CLS powered while being in a de-energized state.
The probabilistic calculations are based on FMEDA calculations according to IEC 61508.
Non-relevant safety parts in the PVED-CLS are excluded in the calculation of the safety related
specifications.
Figure 5 Simplified reliability block diagram
The below data is valid for the safe on-road switch channel containing the PVED-CLS and solenoid
valve bridge. For specification on the electro-mechanical channel see section Safety requirements for
additional circuitry for SIL3/PL e on page 48.
IEC 61508 ed. 1
The FMEDA calculation assumes the use of redundant
analogue WAS with inverted characteristics.
All circuitry including circuitry for diagnostics is
included except LED, temperature sensor and JTAG
parts (EH-valve,
EHcut-off valve, cut-
simultaneously. At least one valve will always block the
EH steering flow to the cylinder. Fault accumulation is
addressed by OSPE EH-valve and OSPE Cut-off valve
performed on changing to off-road mode and prior to
The safety related control function ‘Safe vehicle speed dependent Virtual Axis Position limit’ is an
instance of the safety functions for realizing a safe N-Axis MMI interface and work in a coordinated
fashion with
A correctly configured safe MMI interface will allow any random VAP and VAA input value and change
rate while maintaining controllable N-Axis operation. No unintended change will lead to loss of
steering controllability.
The N-axis MMI interface can in such a case be regarded as non-critical for safe N-Axis operation.
The received VAP set-point is limited in accordance with a programmable safe VAP range envelope.
This may be useful in advanced N-Axis steering modes where VAP can be changed dynamically during
N-Axis operation and where there is no expectation to the VAP set-point. In such cases, a safe VAP
envelope can be configured.
The safe VAP range is configurable as a three-piece linear characteristic as shown in Figure 8. The
software performs linear interpolation to calculate the limited VAP set-point which is used by the NAxis control algorithm.
MultiAxis-Steer technical information
Functional safety
Mast er a xis
Slave axis
P3896 [ mm]
P3898 [ mm]
(+P3864 [mm], 0 [kmph])
(-P3864 [m m], 0 [kmph])
(+P3866 [mm], P3870 [kmph])
(-P3866 [m m], P3870 [kmph])
(-P3868 [m m], P3871 [kmph])
(+P3868 [mm], P3871 [kmph])
N-Axis Virtual Axis Po sition Clamp
Vehicle Speed
P3864
P3870
P3866
P3868
P3871
0
1
2
Address
Name
Unit
Description of parameter
Clamp the Virtual Axis Position at vehicle
value (P3864)
Clamp the Virtual Axis Position at vehicle
value (P3866)
Clamp the Virtual Axis Position at vehicle
value (P3868)
Parameters
The received VAP is limited to the range defined by the envelope shown in Figure 8.
N-Axis - Virtual axis position clamp at
vehicle speed 1
N-Axis - Virtual axis position clamp at
vehicle speed 2
speed 1 to the range defined by N-Axis
mm
center postion (P3898) +/- this
speed 2 to the range defined by N-Axis
mm
center postion (P3898) +/- this
MultiAxis-Steer technical information
Functional safety
N-Axis - Vehicle speed 1 for virtual
axis position clamp
Vehicle speed 1 for Virtual Axis Position
clamp
N-Axis - Vehicle speed 2 for virtual
axis position clamp
Vehicle speed 2 for Virtual Axis Position
clamp
Slave position with respect to the
master
Virtual axis mean position with
respect to the master
Virtual axis mean position with resoect to
the master
P3870
P3871
P3896
P3898
Note: The PVED-CLS performs a plausibility check at start-up on all parameters according to the
following rule: P3864 ≥ P3866 ≥ P3868 AND P3870 < P3871
The ‘VAP clamp at vehicle speed 0 kmph’ -range (P3864) is typically set to the maximum possible VAP
set-point for the vehicle. This value is often determined by the vehicle geometry and the desired
maximum turning radius in N-Axis steering mode at low speeds.
At higher vehicle speeds, it may be desired to change the N-Axis steering to a mode which provides
better steering stability and controllability at higher speeds. This may be achieved by moving the
virtual axis position towards the defined NAXIS_VA_MEAN_POSITION_MM (P3898) as the vehicle speed
increases.
The ‘Virtual Axis Position clamp at vehicle speed VSP1 and VSP2’-ranges (P3866, P3868) shall
progressively made smaller. The resulting VAP set-points are expected to follow this trend.
Setting the ‘Virtual Axis Position clamp at vehicle speed VSP2’-range (P3868) to 0 will clamp any non-0
VAP set-point at vehicle speed = VSP2 (P3871) to 0. Consequently, the clamped VAP set-point will be
equal to the NAXIS_VA_MEAN_POSITION_MM (P3898). If in addition to this the
NAXIS_VA_MEAN_POSITION_MM is identical to the physical slave position the steering behavior will
resemble a traditional two-wheel steering system.
Tests shall be performed to validate the safety of the settings.
Scenario 2 Advanced N-Axis steering – static VAP during operation
For N-Axis steering systems where only one N-Axis steering behavior, e.g. round-steering, is desired,
the MMI may send a static VAP.
If the static VAP is safe at all vehicle speeds, then P3864, P3866, P3868 can be set equal to the expected
static VAP set-point and P3870 and P3871 can be set to the maximum allowed vehicle speed in N-Axis
mode.
If the safety validation tests indicate that N-Axis steering is not safe at all vehicle speeds, then adjust
P3864, P3866, P3868 until steering controllability is reached at all vehicle speeds.
Operation when number of slaves > 1
P3864, P3866, P3868, P3780, P3871 and P3898 shall be set to the same value in all N-Axis slaves.
Safe vehicle speed dependent Virtual Axis Position (VAP) change rate
With the VAP change rate it is possible to set up a relaxed system at high vehicle speed so that any
change from the operator will be accepted but will happen at a slow rate moving the Virtual Axis
position from one point to another more relaxed.
Realizing a safe MMI interface
The safety related control function ‘Safe vehicle speed dependent Virtual Axis Position change rate’ is
an instance of the safety functions for realizing a safe N-Axis MMI interface and works in a coordinated
fashion with:
• [Safe vehicle speed dependent Virtual Axis Position (VAP) limit]
A correctly configured safe MMI interface will allow any random VAP change rate while maintaining a
stable and controllable N-Axis operation.
The N-Axis MMI interface can in such case be regarded as non-critical for safe N-Axis operation after
safety validation testing.
Operation
The safety related control function ‘Safe vehicle speed dependent Virtual Axis Position (VAP) change
rate’ operates on the output of safety related control function [Safe vehicle speed dependent Virtual
Axis Position (VAP) limit]. See also [
A VAP set-point change is limited in accordance with a programmable ‘safe VAP change rate’ -range
shown in [
Figure 10 Safe vehicle speed dependent VAP change range envelop]. This may be useful for advanced N-
Axis steering modes where the VAP set-point can be changed dynamically during N-Axis operation. In
such cases, a safe VAP change rate range can be configured while allowing some freedom to the
generation of the VAP set-point.
The safe VAP change rate range is configurable as a three-piece linear characteristic. The software
performs linear interpolation to calculate the limited VAP set-point change rate limit at any vehicle
speed.
N-Axis - Virtual axis position ramp at vehicle speed 0
mm/s
Virtual Axis Position ramp at Vehicle speed 0.
P3874
N-Axis - Virtual axis position ramp at vehicle speed 1
mm/s
Virtual Axis Position ramp at Vehicle speed 1
P3876
N-Axis - Virtual axis position ramp at vehicle speed 2
mm/s
Virtual Axis Position ramp at Vehicle speed 2
P3878
N-Axis - Vehicle speed 1 for virtual axis position ramp
kmph
Vehicle speed 1 for Virtual Axis Position ramp
P3879
N-Axis - Vehicle speed 2 for virtual axis position ramp
kmph
Vehicle speed 2 for Virtual Axis Position ramp
Parameter
Parameter tuning guideline
Figure 10 Safe vehicle speed dependent VAP change range envelop
Note: The PVED-CLS performs a plausibility check at start-up on all parameters according to the
following rule: P3872 ≥ P3874 ≥ P3876 AND P3878 < P3879
Scenario 1: Dynamically changing VAP during operation
Changing the VAP will alter the vehicle steering mode. A VAP change is typically easier to control at
lower speeds than at higher vehicle speeds. The below tuning guideline may serve as a starting point
for system integrators.
Refer to Figure 10 Safe vehicle speed dependent VAP change range envelop:
1. Adjust point ⓪: The possible range at which the VAP can change is given by ±P3864 (refer to
[Safe vehicle speed dependent Virtual Axis Position (VAP) limit]). Observe, while toggling the VAP
set-point between the outer range values ±P3864, that that the steering mode changes at a
controllable speed for all front axis steering angles. Tune P3872 as high as possible while achieving
the desired steering mode change response when the vehicle is at still-stand.
2. Adjust point ②: As a starting point, set P3876 to e.g. 100 (10mm/s) and set P3879 to the
maximum vehicle speed at which N-axis operation is allowed. The possible range of VAP set-points
are limited (refer to [Safe vehicle speed dependent Virtual Axis Position (VAP) limit]). Observe,
while toggling the VAP set-point between the maximum possible limited values, that that the
steering mode changes at controllable speed for all front axis steering angles. Tune P3876 as high
as possible while achieving the desired controllable steering mode change response while driving
at P3879 kmph.
3. Adjust point ①: As a starting point, set P3878 to 0.5 x P3879 and set P3874 to 0.5 x P3872. The
possible range of VAP set-points are limited by [Safe vehicle speed dependent Virtual Axis Position
(VAP) limit)]. Observe, while toggling the VAP set-point between the maximum possible limited
values, that that the steering mode changes at a controllable speed for all front axis steering
angles. Tune P3874 as low as possible while achieving the desired controllable steering mode
change response while driving at P3878 kmph.
For N-axis steering systems where a constant VAP set-point is applied during operation, the MMI shall
transmit a fixed VAP set-point. Limiting the rate of change for this VAP is only relevant to control an
unintended VAP change. Set P3872, P3874 and P3876 to e.g. 100 [mm/s] to achieve a slow changing
steering system in the event of receiving an unintended VAP set-point.
P3878 and P3879 are not relevant and shall be set to valid values.
Scenario 3: Disable VAP change rate limiting
VAP change rate limitation can be disabled by setting P3872, P3874 and P3876 to 10000.
P3878 and P3879 are not relevant and shall be set to valid values. Any limited VAP set-point change
will take immediate effect.
Operation when number of slaves > 1
P3872, P3874, P3876, P3878, P3879 shall be set to the same value in all N-Axis slaves.
Important
•P3872, P3874, P3876 shall be set to values > 0. VAP rate change limitation will not work when
0 is used.
•The parameter tuning guideline may not apply to all steering systems.
The safety related control function ‘Safe vehicle speed dependent Virtual Axis Angle limit’ is an
instance of the safety functions for realizing a safe N-Axis MMI interface and work in a coordinated
fashion with
• [Safe vehicle speed dependent Virtual Axis Position (VAP) limit],
A correctly configured safe MMI interface will allow any random VAP and VAA input value and change
rate while maintaining controllable N-Axis operation. No unintended change will lead to loss of
steering controllability.
The N-axis MMI interface can in such a case be regarded as non-critical for safe N-Axis operation.
Operation
The received VAA set-point is limited in accordance with a programmable safe VAA range envelope.
This may be useful in advanced N-Axis steering modes where VAA can be changed dynamically during
N-Axis operation and where there is no expectation to the VAA set-point. In such cases, a safe VAA
envelope can be configured.
The safe VAA range is configurable as a three-piece linear characteristic. The software performs linear
interpolation to calculate the limited VAA set-point which is used by the N-Axis control algorithm.
N-Axis - Virtual axis angle clamp at vehicle speed 0
dDeg
Virtual Axis Angle Clamp at Vehicle speed 0
P3882
N-Axis - Virtual axis angle clamp at vehicle speed 1
dDeg
Virtual Axis Angle Clamp at Vehicle speed 1
P3884
N-Axis - Virtual axis angle clamp at vehicle speed 2
dDeg
Virtual Axis Angle Clamp at Vehicle speed 2
P3886
N-Axis - Vehicle speed 1 for virtual axis angle clamp
kmph
Vehicle speed 1 for Virtual Axis Angle clamp
P3887
N-Axis - Vehicle speed 2 for virtual axis angle clamp
kmph
Vehicle speed 2 for Virtual Axis Angle clamp
Parameter
Note: The PVED-CLS performs a plausibility check at start-up on all parameters according to the
following rule: P3880 ≥ P3882 ≥ P3884 AND P3886 < P3887
The ‘VAA clamp at vehicle speed 0 kmph’ -range (P3880) is typically set to the maximum possible VAA
set-point for the vehicle. This value is often determined by the vehicle geometry and the desired
maximum turning radius in N-Axis steering mode at low speeds.
At higher vehicle speeds, it may be desired to change the N-Axis steering to a mode which provides
better steering stability and controllability at higher speeds. This may be achieved by changing the
virtual axis angle towards zero degree (to align the slave axis-steering to straight) as the vehicle speed
increases. In combination with a VAP which is identical to the physical slave axis position this will
resemble two-wheel steering.
The ‘Virtual Axis Angle clamp at vehicle speed VSP1 and VSP2’-ranges (P3882, P3884) shall
progressively made smaller. The resulting VAA set-points are expected to follow this trend.
Setting the ‘Virtual Axis Angle clamp at vehicle speed VSP2’-range (P3886) to 0 will clamp any non-0
VAA set-point at vehicle speed = VSP2 (P3887) to 0. Consequently, the clamped VAA set-point will be
equal to zero degree (no N-Axis operation will be performed) and the steering behavior will resemble a
traditional two-wheel steering system.
Tests shall be performed to validate the safety of the settings.
Scenario 2 Advanced N-Axis steering – static VAA during operation
For N-Axis steering systems where only one N-Axis steering behavior, e.g. round-steering, is desired,
the MMI may send a static VAA.
If the static VAA is safe at all vehicle speeds, then P3880, P3882, P3884 can be set equal to the expected
static VAA set-point and P3886 and P3887 can be set to the maximum allowed vehicle speed in N-Axis
mode.
Figure 12 Safe vehicle speed dependent VAA range envelope
If the safety validation tests indicate that N-Axis steering is not safe at all vehicle speeds, then adjust
P3882, P3884, P3886 until steering controllability is reached at all vehicle speeds.
Operation when number of slaves > 1
P3880, P3882, P3884, P3786, P3887 shall be set to the same value in all N-Axis slaves.
With the VAA change rate it is possible to set up a relaxed system at high vehicle speed so that any
change from the operator will be accepted but will happen at a slow rate moving the Virtual Axis Angle
from one point to another more relaxed.
Realizing a safe MMI interface
The safety related control function ‘Safe vehicle speed dependent Virtual Axis Angle change rate’ is an
instance of the safety functions for realizing a safe N-Axis MMI interface and works in a coordinated
fashion with:
• [Safe vehicle speed dependent Virtual Axis Position (VAP) limit]
A correctly configured safe MMI interface will allow any random VAA change rate while maintaining a
stable and controllable N-Axis operation.
The N-Axis MMI interface can in such case be regarded as non-critical for safe N-Axis operation after
safety validation testing.
Operation
The safety related control function ‘Safe vehicle speed dependent Virtual Axis Angle (VAA) change rate’
operates on the output of [Safe vehicle speed dependent Virtual Axis Angle (VAA) limit]. See also [Figure
6 N-Axis EH safe steering block diagram
A VAA set-point change is limited in accordance with a programmable ‘safe VAA change rate’ -range
shown in [
Figure 14 Safe vehicle speed dependent VAA change range envelope]. This may be useful for advanced
N-Axis steering modes where the VAA set-point can be changed dynamically during N-Axis operation.
In such cases, a safe VAA change rate range can be configured while allowing some freedom to the
generation of the VAA set-point.
The safe VAA change rate range is configurable as a three-piece linear characteristic. The software
performs linear interpolation to calculate the limited VAA set-point change rate limit at any vehicle
speed.
Note: The PVED-CLS performs a plausibility check at start-up on all parameters according to the
following rule: P3888 ≥ P3890 ≥ P3892 AND P3894 < P3895
MultiAxis-Steer technical information
Functional safety
Parameter tuning guideline
Scenario 1: Dynamically changing VAA during operation
Changing the VAA will alter the vehicle steering mode. A VAA change is typically easier to control at
lower speeds than at higher vehicle speeds. The below tuning guideline may serve as a starting point
for system integrators.
Refer to Figure 14 Safe vehicle speed dependent VAA change range envelope:
4. Adjust point ⓪: The possible range at which the VAA can change is given by ±P3880 (refer to
5. Adjust point ②: As a starting point, set P3892 to e.g. 100 (10dDeg/s) and set P3895 to the
6. Adjust point ①: As a starting point, set P3890 to 0.5 x P3888 and set P3894 to 0.5 x P3895. The
Scenario 2: Fixed VAA during operation
For N-axis steering systems where a constant VAA set-point is applied during operation, the MMI shall
transmit a fixed VAA set-point. Limiting the rate of change for this VAA is only relevant to control an
unintended VAA change. Set P3888, P3890 and P3892 to e.g. 10 [dDeg/s] to achieve a slow changing
steering system in the event of receiving an unintended VAA set-point.
P3894 and P3895 are not relevant and shall be set to valid values.
Scenario 3: Disable VAA change rate limiting
VAA change rate limitation can be disabled by setting P3888, P3890 and P3892 to 18000.
P3894 and P3895 are not relevant and shall be set to valid values. Any limited VAA set-point change
will take immediate effect.
Operation when number of slaves > 1
P3888, P3890, P3892, P3894, P3895 shall be set to the same value in all N-Axis slaves.
Important
[Safe vehicle speed dependent Virtual Axis Angle (VAA) limit]). Observe, while toggling the VAA
set-point between the outer range values ±P3880, that that the steering mode changes at a
controllable speed for all front axis steering angles. Tune P3888 as high as possible while achieving
the desired steering mode change response when the vehicle is at still-stand.
maximum vehicle speed at which N-axis operation is allowed. The possible range of VAA setpoints are limited by [Safe vehicle speed dependent Virtual Axis Angle (VAA) limit]. Observe, while
toggling the VAA set-point between the maximum possible limited values, that that the steering
mode changes at controllable speed for all front axis steering angles. Tune P3892 as high as
possible while achieving the desired controllable steering mode change response while driving at
P3895 kmph.
possible range of VAA set-points are limited by [Safe vehicle speed dependent Virtual Axis Angle
(VAA) limit]. Observe, while toggling the VAA set-point between the maximum possible limited
values, that that the steering mode changes at a controllable speed for all front axis steering
angles. Tune P3890 as low as possible while achieving the desired controllable steering mode
change response while driving at P3894 kmph.
•P3888, P3890, P3892 shall be set to values > 0. VAA rate change limitation will not work when
0 is used.
•The parameter tuning guideline may not apply to all steering systems.
Safe vehicle speed dependent closed loop gain limitation
Realizing a safe closed-loop position control of the slave axis
The safety function ‘Safe vehicle speed dependent closed loop gain limitation’ is an instance of the
safety functions for realizing a safe N-Axis closed-loop control of the slave axis steering angle and
works in a coordinated fashion with:
The safety function ‘Safe vehicle speed dependent closed loop gain limitation’ shall be configured to
achieve a safe and controllable closed-loop control of the slave steering axis at all vehicle speeds in, all
applicable steering modes. See Figure 15.
The basic proportional closed-loop control gain is set in accordance with a programmable gain
characteristic shown in Figure 16. The proportional gain is configurable as a three-piece linear
characteristic. The software performs linear interpolation to calculate the exact gain to apply at any
vehicle speed. The proportional gain to apply is machine dependent i.e. shall be set relative to the
valve size and rear axis steering cylinder dimensions.
Note: The PVED-CLS performs a plausibility check at start-up on all parameters according to the
following rule: P3900 ≥ P3901 ≥ P3902 AND P3903 < P3904
Parameter tuning guideline
1. Adjust point ⓪: The proportional gain to apply at 0 kmph is set by P3900. Observe, while
2. Adjust point ②: Set P3904 to the maximum vehicle speed at which N-axis steering is used. As a
3. Adjust point ①: As a starting point, set P3901 to 0.5 x P3902 and set P3903 to 0.5 x P3904.
4. Iterate step 1 to 3 until the vehicle controllability criterion is fulfilled in the entire N-axis operation
Important
Figure 16 Safe vehicle speed dependent closed-loop proportional gain
steering the front axis aggressively from side to side, that that the rear axis steers is a responsive
manner. Tune P33900 as low as possible while achieving the desired steering response. Observe
that the closed-loop performance is not suffering from under- and overshoot. No visible steadystate jitter shall be present. Perform the test for all applicable steering modes.
starting point, set P3902 to 10% of P3900. Observe, while steering the front axis aggressively from
side to side, that that the steering of the vehicle is controllable in all applicable steering modes at
P3904 kmph. Incrementally adjust P3902 until the closed-loop performance criterion is met at
P3904 kmph for all applicable steering mode.
Observe, while steering the front axis aggressively from side to side, that that the steering of the
vehicle is controllable in all applicable steering modes at P3903 kmph. Incrementally adjust P3901
until the closed-loop performance criterion is met at P3903 kmph for all applicable steering mode.
vehicle speed range.
•Alternatively, to stimulating the rear axis by the front axis manual steering input, consider
instrumenting the front steering angle input ([Master_WA_P], [Master_WA_R] via a CAN-tool
to simulate step changes from the front steering axis. See [PVED-CLS MultiAxis-Steer
communication protocol].
•Ensure that operation mode is ‘N-axis operational’ while tuning the parameters. Tuning while
the system is in ‘On-road’ or ‘On-road locked’ state may give wrong results.
This safety concept is to allow wider slave wheel angle at low vehicle speed and limit the range for
higher vehicle speed. This is done by reducing the slave wheel angle set point as a function of vehicle
speed.
This makes it possible to obtain a safe 2-wheel steering system at high vehicle speed by centering the
slave wheel angle.
Realizing a safe closed-loop position control of the slave axis
The safety function ‘Safe vehicle speed dependent wheel angle setpoint limitation’ is an instance of the
safety functions for realizing a safe N-Axis closed-loop control of the slave axis steering angle and
works in a coordinated fashion with:
•[Safe vehicle speed dependent closed loop gain limitation]
Operation
The safety function ‘Safe vehicle speed dependent wheel angle setpoint limitation’ shall be configured
to achieve a safe and controllable closed-loop control of the slave steering axis at all vehicle speeds in,
all applicable steering modes. The objective is to avoid entering a too narrow curvature at a too high
vehicle speed. The calculated slave wheel angle set-point is limited in accordance with a
programmable safe wheel angle setpoint range envelope as shown in Figure 17.
The safe wheel angle setpoint range is configurable as a three-piece linear characteristic. The software
performs linear interpolation to calculate the limited wheel angle set-point which is used by the N-Axis
control algorithm.
Figure 17 Safe vehicle speed dependent wheel angle set point limitation
MultiAxis-Steer technical information
Functional safety
N-Ax is Sl av e S et P oin t C la mp
Vehicle Speed
P39 12
P39 18
P39 14
P39 16
P39 19
0
1
2
Addres
Name
Unit
Description of parameter
N-Axis slave wheel angle set point
clamp at vehicle speed 0
N-Axis slave wheel angle set point
clamp at vehicle speed 1
N-Axis slave wheel angle set point
clamp at vehicle speed 2
Vehicle speed 1 for N-Axis slave wheel
angle set point clamp
Vehicle speed 2 for N-Axis slave wheel
angle set point clamp
Slave Position with respect to the
master
Virtual axis mean position with resoect
to the master
Parameters
Parameter tuning guideline
Figure 18 Safe vehicle speed dependent Set Point range envelope
P3912 N-Axis - Slave set point angle clamp at vehicle speed 0 dDeg
P3914 N-Axis - Slave set point angle clamp at vehicle speed 1 dDeg
P3916 N-Axis - Slave set point angle clamp at vehicle speed 2 dDeg
P3918 N-Axis - Vehicle speed 1 for slave set point 1 kmph
P3919 N-Axis - Vehicle speed 2 for slave set point 2 kmph
P3896 Slave position with respect to the master mm
P3898 Virtual axis mean position with respect to the master mm
Note: The PVED-CLS performs a plausibility check at start-up on all parameters according to the
following rule: P3912 ≥ P3914 ≥ P3916 AND P3918 ≤ P3919
1. Adjust point ⓪: The possible wheel angle setpoint range at 0 kmph is given by ±P3912. Observe,
for all configured steering modes, that that the rear axis steering deflection is within the expected
range for all front axis steering angles.
2. Adjust point ②: As a starting point, set P3916 to a low value e.g. 5 degrees and set P3919 to the
maximum vehicle speed at which N-axis operation is allowed/possible. Observe, while steering the
front axis from end-lock to end-lock, that steering the vehicle is safe, controllable and without
uncomfortable side words accelerations. Repeat for all possible steering modes.
3. Adjust point ①: As a starting point, set P3914 to 0.5 x P3916 and set P3918 to 0.5 x P3919.
Observe, while steering the front axis from end-lock to end-lock, that steering the vehicle is safe,
controllable and without uncomfortable side words accelerations. Repeat for all possible steering
modes.
4. Iterate point 2 and 3 until the safety and controllability criteria are satisfied.
P3918, P3919 and P3898 shall be set to the same value in all N-Axis slaves.
It shall be verified that all N-axis slave wheel angles are correctly calculated and that all slaves are in the
respective correct steering angles (no slave misalignment, axis dragging or tire wear etc. shall be
observed).
The wheel angle setpoints for slave N=2,3… shall be observed when slave N=1 is at point ⓪, ① and
② respectively and used as parameter for P3912, P3914 P3916 in the respective slaves.
See [PVED-CLS MultiAxis-Steer communication protocol].
At system start-up the slave axis angles may not be aligned with the front axis for a given steering
mode. The misalignment may be due to switching N-axis operation off or after an auto-guidance workcycle. The software will detect the misalignment and set the operation state to pre-operational state.
The objective with this safety related control function is to avoid an instaneous self-steering movement
of the slave axis when enabling N-axis mode.
A slave steering cylinder “inching” algorithm becomes active while in pre-operational state. The
calculated slave axis steering flow, required to cancel the slave axis wheel angle error, is limited by the
the front axis steering speed. The slave axis wheel angle thus only changes when the front axis steering
angle changes.
The front axis steering speed is derived by differentiating the front axis wheel angle over a period
given by P3905. Only front axis steering speed which exceeds a noisegate (P3906) is used to limit the
closed-loop control output.
When the slave axis wheel angle is inched inside the tolerance range given by P3910, the software exits
pre-operational mode and enters N-axis operation mode.
Parameters
P3905
Time parameter of moving average filter for
calculation of average master WAS speed
P3906 Master WAS Speed Noise Gate Deg/s
P3910 Preoperational to Operational WA Threshold dDeg
Parameter tuning guideline
Leave P3905 at the default value.
Leave P3906 at the default value. If the front axis wheel angle sensor sub-system is noisy and the
problem cannot be solved in the front axis master system, the value shall be increased.
Leave P3910 at the default value. Increasing P3910 may lead to a quicker slave axis angle alignment
but at the cost of self-steering i.e. slave axis steering which is not initiated by the driver.
Operation when number of slaves > 1
P3905, P3910 shall be set to the same value in all N-Axis slaves.
x10mSec
also be used to sample the Master WAS
which Master WAS Speed will be
and the wheel angle setpoint is below this
value, the operational state shifts from pre-
Please see section [PVED-CLS Connector interface].
For information regarding technical specification, please see [PVED-CLS Technical Specification].
The PVED-CLS is designed to operate reliably at battery voltages between 11 and 35.5V. Protection
circuitry ensures that the PVED-CLS electronics can withstand the absolute maximum voltage levels.
Circuitry is in place to perform voltage control with safety shut-off to address over-voltage failure
scenarios which could potentially lead to loss of safety functions.
Important
If the power supply goes below 5.5V, the PVED-CLS will shut down without sending any warning.
If the voltage goes below 9V, the PVED-CLS will stay in operation mode but send out an INFO level DTC.
Note that below 9V the electro-hydraulic functions of an EHPS, EHi and OSPE may work at a reduced
performance.
In case the supply voltage exceeds 35.5V, a DTC is issued on the CAN bus, and the PVED-CLS will enter
safe state.
On detection of internal supply over-voltages, the power to the solenoid valve bridge and the cut-off
solenoid valve will be switched off by discrete circuitry.
Experience shows that excessively low supply voltage may occur during engine cranking in cold
conditions, depending on the state of battery charge, and/or general state of battery.
Refer to [PVED-CLS Technical Specification]for the absolute maximum electrical steady-state voltage
levels.
See [Diagnostic Trouble Codes] on page 96 for details on error codes.
ON/OFF switch interface - Active de-energize (immediate)
The N-Axis slave can be configured to immediate shut-down when the road switch is set to on-road
mode.
A road switch sub-system can be used for bringing the PVED-CLS and EHi-E and EHi-H valve subsystems into a state which is suitable for on-road operation while keeping the PVED-CLS operational.
The below architecture is suitable for achieving SIL 3, PL e for shutting off of EH-steering flows for
public road transportation. The PVED-CLS can remain powered in this state.
To achieve SIL3/PL e with the PVED-CLS, an independent and diverse shut-down channel using two
relays to disconnect the power to the cut-off valve, shall work in parallel with the PVED-CLS.
Input redundancy is achieved by using redundant switch, SW1 and SW2. Redundancy on the logic for
de-powering the valves is achieved by using the PVED-CLS to control the EH-valve and relay logic for
de-energizing the coil for the cut-off solenoid valve.
Redundancy on de-energizing the valves is achieved by de-energizing the solenoid valve bridge and
the cut-off solenoid valve.
To enable the road switch interface for a PVED-CLS and EHi valve, the following parameter settings are
required.
the wheels must get
aligned straight before
going from off road to
OnRoad due to road
BOOL
x10msec
Maximum time allowed for the N-Axis slave to steer to
straight position when commanded in on-road mode.
P3094=0 (default).
When switching from off-road to on-road, the operation state switches to ‘on-road locked’
immediately. The N-Axis wheel angle is not monitored with respect to if it is in the straight position
range. The system integrator shall monitor the N-Axis slave wheel angle and take appropriate action if
the N-Axis slave angle is not in straight position. The PVED-CLS will not issue any trouble code.
MultiAxis-Steer technical information
System Architecture
Attention
Road switch position
PVED-CLS enable (AD3)
Relay
supply
Relay
contacts
Cut-off valve
Off-road
SW1
closed
Battery
supply
Closed
Can be
pressurized
SW2
closed
EH-steering enabled
4700mV < AD3 input < 5300mV
On-road
SW1 open
0V
Open
De-energized
SW2 open
EH-steering disabled/prohibited
AD3 input < 500mV
The system integrator shall:
•Monitor the N-Axis slave angle in ‘on-road locked’ state and take appropriate action if not in
straight range.
• Supply the road switch and relay components.
• Ensure that the switch, relay, wiring and installation enclosure satisfies the requirements in
ISO 13849-2 annex A and D, IEC 60947-5-1 and IEC 60204.
• Ensure that the sub-system components are fit for the purpose.
• Conduct an FMEA to uncover dangerous failures.
• Implement measures against dangerous failures.
• Perform a CCF analysis.
• Carry out verification and validation of the architecture on commissioning and after
maintenance.
Interface
The road switch SW2 controls the PVED-CLS power to the solenoid valve bridge. SW1 controls the
power to the relay logic. The state of SW1 switch position is obtained by the PVED-CLS by measuring
the relay contact state via a current measurement and test pulse monitoring.
•The sub-system shall supply a valid input on AD3 no later than 10 seconds after the PVED-CLS
is powered.
•The requirements in Safety requirements for additional circuitry for SIL3/PL e page 48 shall be
respected.
The SW2 signal supplied to AD3 is range checked. If the voltage is out of the on-road or the off-road
voltage range for more than 100ms, then the PVED-CLS enters safe state.
The 5 V sensor supply line is monitored. If the supply voltage is overloaded or short-circuited causing it
exceeds the nominal voltage, the PVED-CLS enters safe state.
Monitoring of the switch is performed by the PVED-CLS by comparing the output of SW1 and SW2.
SW2 switches the 5V supply voltage to the PVED-CLS AD3 input. The PVED-CLS validates the input
voltage on AD3. If the voltage is in the range 5 V ±300 mV, then SW2 is determined to be in off-road
mode. If the voltage is below 500 mV, then SW2 is determined to be on-road position. The PVED-CLS
will enter safe state if the AD3 input voltage is outside the two voltage ranges for more than 100 ms.
SW2 is monitored via PVED-CLS cut-off output pin 6. When SW2 signals on-road mode, the PVED-CLS
switches off the power to the solenoid valve (sourced from the Cut-off output) and 100 ms after AD3
has changed from off-road mode to on-road mode (see note 1), the PVED-CLS starts a low-power test
pulse pattern to measure that no electrical connection exists to the solenoid valve. If the low-power
test pulse leads to a current build-up, then the PVED-CLS enter safe state. The monitoring principle is
equivalent to cross-monitoring SW1 and SW2. It cannot be determined if the failure is caused by SW1
or one of the relays.
The low-power test pulse cannot lead to pressuring the cut-off valve.
MultiAxis-Steer technical information
System Architecture
When SW2 signals off-road mode, the PVED-CLS cut-off output will stop outputting low-power test
pulses and start to supply current to the solenoid valve to pressurize the cut-off valve. The PVED-CLS
monitors the current that is supplied to the solenoid valve. If the supplied current does reach 50% of
the current set-point, then the PVED-CLS will enter safe state. The PVED-CLS cannot detect a welded
relay contacts while operating in off-road mode. On switching to on-road mode (demanding the safety
function), the current supply to the solenoid valve will stop and the low-power test pulses will detect
the two welded relays or SW1 stuck at off-road position.
Note 1: The delay of 100ms from the mode has changed to on-road mode until low-power test pulse
pattern starts, has been introduced in order to prevent false errors caused by relay-contact bounce.
Important
•The monitoring technique is based on a comparison with a reference sensor technique. A
diagnostic coverage in the range 90-99 % may be claimed provided that the sub-system is
integrated according to the specification.
• Some single faults cannot be detected until a second fault occurs.
• Two undetected faults may be present but the safety function is not lost.
• The two undetected faults will be detected when the safety function is demanded (on-road
ON/OFF switch interface - Active de-energize (automatic return to straight)
The N-Axis slave can be configured to automatically steer to the straight position and shut-down when
the road switch is set to on-road mode. The architecture is identical to on page 59 except for using
timed relays which open-circuits after a pre-set time.
Operation
To enable the road switch interface for a PVED-CLS and EHi valve with automatic steering to straight
position before shut-down, the following parameter settings are required.
P3072 Cut-off valve present BOOL
P3237
the wheels must get
P3094
aligned straight before
going from off road to
OnRoad due to road
P3909
On-Road to On-RoadLocked Max WA
When switching from off-road to on-road, the operation state switches to ‘on-road’ state. A timer is
loaded with the value of P3094 and starts to count down. While counting down, the N-Axis control
algorithm controls the N-Axis slave cylinder to the straight position. When the N-Axis slave angle below
the straight range set by P3909, the operation state changes to ‘on-road locked’.
See also [Operation state machine] page 14.
Figure 20 Active de-energize (automatic return to straight)
BOOL
x10msec
Maximum time allowed for the N-Axis slave to steer to straight
position when commanded in on-road mode.
dDeg
When the wheel angle is equal or less than this range, (0.5 degrees),
• P3094 shall be carefully tuned to allow the N-Axis slave to steer the cylinder to the straight
• P3094 shall be matched with the relay delay time. It is recommended to set P3094 to ~100ms
position within the specified time at all oil visocities.
more than the delay of the relays to avoid too early switch and relay monitoring and thus
false alarms.
MultiAxis-Steer technical information
System Architecture
8
PVED-CLS S5
Battery(+)
6
DOUT
Battery(-)
Battery +
Battery -/GN D
7
F
COV
Solenoid valve
+
Pp
-
Road swi t ch
Internal EH-valve interface
EH-valve
COV
Hydraulic
pressure
N-axis steering cylinder
COV s olenoid valv e
Internal
EH-
Valve
interface
Alter na ti vely o nl y
supply line swit ch
•The requirements in Safety requirements for additional circuitry for SIL3/PL e page 48 shall be
respected.
Monitoring
See on page 59.
Furthermore, if the N-Axis slave angle is not within the straight range given by P3909, then the
operation state changes to ‘safe state’ and an error code is issued.
ON/OFF switch interface - Full electrical de-power/de-energize
De-powering the PVED-CLS and valve sub-systems by disconnection battery power supply will bring
the system in a safe state.
The below architecture de-energizes the PVED-CLS and valve sub-systems by disconnecting any
battery power to the PVED-CLS and valve sub-system.
• Take responsibility for choosing reliable cables and switch/circuit breaking components.
• Regard the standards ISO25119, ISO 13849-2 appendix A and D, IEC 60947-5-1 and IEC 60204.
• Ensure that the road switch performs the safety function i.e. disconnecting battery power to
AgPL/PL e.
• Ensure that the switch is suitable for the purpose and meets the target SIL.
• Perform an FMEA to address dangerous failures and common cause failure modes.
• Fault exclusion: On disconnecting battery power to the PVED-CLS and valves, both valves do
not fail simultaneously. At least one valve will always block the EH steering flow to the
cylinder.
• The EH-valve is tested at power-up and on-line when the PVED-CLS is used in off-road mode.
• The cut-off valve is tested intermittently on every PVED-CLS mode change to off-road
functionality.
•The requirements in Safety requirements for additional circuitry for SIL3/PL e page 48 shall be
respected.
•Refer to [PVED-CLS Technical Specification] for information on electrical characteristics for the
PVED-CLS.
MultiAxis-Steer technical information
System Architecture
Zero-leakage valve configuration (option)
For applications which requires lower drift performance than the EHi-valve can provide, additional
check-valves are required. This option is applicable to all Road-switch de-power / de-energize
architectures described from page 41.
Background
Slow cylinder drift may build up after hours of use when no N-Axis closed-loop control is active, the
valve spool is in neutral, the system is in the safe state or safe on-road mode.
The cylinder drift depends on the external pressure on the steered wheels (and thus the steering
cylinder) due to the vehicle design or usage, the time the external force is applied, oil viscosity and the
leakage properties of the EHi valve. The cylinder under pressure will build up a pressure on one of the
valve cylinder ports. A small amount of oil will leak backwards in the valve either to tank or to the
cylinder side which is not under pressure, and the cylinder piston may drift.
The maximum leakage for an EHi valve is 150mL/min @150bar cylinder port pressure at ~21cSt (Tellus,
50°C) [EHi steering valve technical information]. The specification is for when both the EHi main spool
and the COV spool are in the closed position.
Cylinder leakage will result in rear-axis straight misalignment can result in increased tire wear. Leakage
is not considered safety critical; it builds up slowly and is controllable from a vehicle steering
perspective.
Pilot operated check valves
To address leakage, two pilot operated (PO) check valves (CV) shall be installed between each valve
port (CL, CR) and cylinder port (L, R). The shock valves (protection components) shall be installed
between the valve and the cylinder as shown in Figure 22.
Figure 22 Check valve option for zero-leakage performance (drawing shall be reworked)
When the check valves are energized, the port flows are connected to the cylinder. De-energizing the
check valves will hydraulically isolate the steering cylinder and only allow the leakage specified by the
check valves (typically very small).
If one of the check valves are unintentionally de-energized, the steering cylinder cannot move which is
considered a safe failure in N-Axis applications.
Figure 22 shows the additions to the architecture with the added PO check valves which, from a safety
perspective, will act as additional cut-off valves to block EH-Flow to the cylinder.
The architectures
• ON/OFF switch interface - Active de-energize (immediate),
• ON/OFF switch interface - Active de-energize (automatic return to straight) and
• ON/OFF switch interface - Full electrical de-power/de-energize
MultiAxis-Steer technical information
System Architecture
8
2
PVED-CLS S5
Battery(+)
AD3
6
DOUT
11
5V sensor supply
Battery(-)
Battery +
Battery -/GN D
7
F
COV
Solenoid valve
+
Pp
-
K1
K2
Relay K1
Relay K2
Road switch
SW1
SW2
Internal
EH-Valve
interface
Internal EH-valve interface
EH
-valve
COV
Hydraulic
pressure
N-axis steering cylinder
COV s olenoid valv e
CV-L
CV-R
CV-L solenoid va lve
CV-R solenoid va lve
CV-L
solenoid
valve
+
-
CV-R
solenoid
valve
+
-
SVB
Controller
PVED-C LS
Switc h
( 11, 12 , 14 )
K1SV1
Switc h
(21, 22, 24)
EH-
valve
COV
K2SV2CV-L
SV3CV-R
Cylinder
Ch annel 1
Ch annel 2
with the additional check valve option in figure 7, also conform to a category 4 architecture and meet
PL/AgPL e.
The zero-leakage option can also be combined with the ON/OFF switch interface - Full electrical depower/de-energize architecture on page 45.
Reliability block diagram
Figure 23 Active de-energize with zero-leakage option
The Reliability block diagram in Figure 24 shows the involved safety related parts.
Figure 24 zero-leakage reliability block diagram
The requirements in Safety requirements for additional circuitry for SIL3/PL e page 48 must be
followed.
The architecture is not fully in alignment with a standard category 4 architecture. For alignment with
the category 4 template in ISO 13849 and ISO 25119, it is proposed to not include K2, SV2, SV3, CV-L
and CV-R in the reliability calculation but however ensure that they fullfil the safety requirements to
the channel.
The PVED-CLS requires one or more sensor sub-systems to be present. This section describes the
requirements to each sensor sub-system.
N-Axis master - CAN interface
The N-Axis slave PVED-CLS interfaces to the N-Axis master controller which shall deliver the front axis
steering angle. The below sub-system design supports realizing the N-Axis slave steering function
designed to meet SIL2/PL d/AgPL d.
It is strongly recommended that the system integrator performs a System level Failure
Mode Effects Analysis (FMEA) on the sub-systems and the system in its entireness.
The N-Axis master shall work as a front axis sensor sub-system and transmit the front axis wheel angle
onto the steering CAN bus.
Primary (WA1, ECU1) and redundant (WA2, ECU2) can be two independent channels which both
acquire the N-Axis master steering angle or a dedicated controller can be employed such as the PVEDCLS working in N-Axis master mode (planned functionality).
ECU1 acquires the wheel angle via sensor element WA1, scales it and transmits the wheel angle data
onto the CAN bus via a safe protocol as the Master Primary Message.
The same applies for ECU2 transmits the Master Redundant Message.
See [PVED-CLS MultiAxis-Steer communication protocol] for details on the vehicle master message
protocol.
The functional safety requirement to ECU, working as N-Axis master, and front axis wheel angle sensor,
is that is shall meet SIL2/AgPL/PL d. Alternatively the sub-system can be designed as two independent
channels which shall both have a systematic capability of 1. This can be achieved if both channels meet
QM/SIL1, are sufficiently independent and functionally diverse.
By applying the concept of ‘synthesis of elements', a resulting systematic capability of 2 can be claimed
accordance with safety standard IEC 61508 and thus meeting SIL2/AgPL/PL d requirements.
The system integrator shall:
• Design and supply the N-Axis master sub-system.
• Ensure that the sub-system components are fit for the purpose.
• Conduct an FMEA to uncover dangerous failures.
• Implement measures against dangerous failures.
• Perform a CCF analysis.
The master wheel angle signal is a critical signal for the majority of the safety functions.
MultiAxis-Steer technical information
System Architecture
Address
Name
Unit
Description of parameter
P3318
N-Axis Master Source Address
dec
N-Axis master source address
P3316
PGN offset of N-Axis master message
dec
N-Axis master PGN offset
Address
Name
Unit
Description of parameter
Channel cross-check monitoring - Max
N-axis master wheel angle difference
Channel cross-check monitoring. Maximum
master wheel angle divergence (dDeg).
Channel cross-check monitoring - Max
time
Channel cross-check monitoring. Maximum
[x10msec].
N-Axis master message monitoring -
messages
• Document the sub-system as part of the safety case.
• Failing to supply the PVED-CLS with safe N-Axis master steering angle information will
invalidate the functional safety concept.
CAN interface
The N-Axis slave PVED-CLS main controller receives the Master Primary message and the PVED-CLS
safety controller receives the Master Redundant message.
Important
•The applied safety protocol allows omitting the CAN bus from the safety loop calculation as it
contributes less than 1% of the safety integrity level.
•The applied safety protocol allows the presence of both safety and non-safety related CAN
messages.
•P3316 shall be different in the main and safety controller as two CAN nodes are not allowed
to have the same PGN.
•The sub-system shall begin transmitting CAN messages no later than 10 seconds after the
PVED-CLS is powered.
Monitoring
The PVED-CLS provides monitoring functions for the N-Axis master sub-system.
For both Master Primary and Master Redundant message (see [PVED-CLS MultiAxis-Steer
communication protocol], the following monitoring is in place in both the PVED-CLS main and safety
controller:
• Receive timing check of CAN messages. Single failure leads to safe state.
• Sequence number check on CAN message. Single failure leads to safe state.
• End-to-end CRC on messages. Single failure leads to safe state.
• Data validity check (range check on wheel angle data). Single failure leads to safe state.
• Primary and redundant data are cross-checked as follows: If the absolute primary and
redundant difference is > P3382 dDeg for more than P3380 ms, then enter safe state.
See [Diagnostic Trouble Codes] on page 96 for CAN bus diagnostic trouble codes related to detecting
different failures on the vehicle speed sensor sub-system.
Primary vehicle speed sensor (S1, ECU1) and redundant vehicle speed sensor (S2, ECU2) shall be two
channels which both acquire the vehicle speed independently. The ECU1 acquires a speed signal via
sensor element S1 and scales it to representing a vehicle speed. The vehicle speed data is transmitted
onto the CAN bus via a safe protocol as the VSP primary message. The same applied for the redundant
vehicle speed sensor, where ECU2 transmits the VSP redundant message.
See [PVED-CLS MultiAxis-Steer communication protocol] for details on the vehicle speed message
protocol.
The functional safety requirements to the primary and redundant vehicle speed sensor is that both
channels shall have a systematic capability of 1. This can be achieved if both channels meet QM/SIL1
and the channels are sufficiently independent and functionally diverse. By applying the concept of
‘synthesis of elements', a resulting systematic capability of 2 can be claimed accordance with safety
standard IEC 61508 and thus meeting SIL2/AgPL/PL d requirements.
The vehicle speed is a critical signal for the majority of the safety functions.
The system integrator shall:
• Design and supply the vehicle speed sub-system.
• Ensure that the sub-system components are fit for the purpose.
• Conduct an FMEA to uncover dangerous failures.
• Implement measures against dangerous failures.
• Perform a CCF analysis.
• Document the sub-system as part of the safety case.
• Failing to supply the PVED-CLS with safe vehicle speed information will invalidate the
The PVED-CLS main controller receives the VSP primary message and the PVED-CLS safety controller
receives the VSP redundant message.
Channel cross-check monitoring. Maximum vehicle
speed divergence [km/h].
Channel cross-check monitoring Max vehicle speed divergence time
Channel cross-check monitoring. Maximum vehicle
speed divergence time [x10msec].
Vehicle speed sensor message
between two messages
Address
Name
Unit
Description of parameter
Demanded left wheel angle limit on
indication from MMI
Demanded left wheel angle limit on indication from
MMI
Important
•The applied safety protocol allows omitting the CAN bus from the safety loop calculation as it
contributes less than 1% of the safety integrity level.
•The applied safety protocol allows the presence of both safety and non-safety related CAN
messages.
•P3313 shall be different in the main and safety controller as two CAN nodes are not allowed
to have the same PGN.
•The sub-system shall begin transmitting CAN messages no later than 10 seconds after the
PVED-CLS is powered.
Monitoring
The PVED-CLS provides monitoring functions for the vehicle speed sensor sub-system.
For both VSP primary and redundant message (see [PVED-CLS MultiAxis-Steer communication
protocol] the following monitoring is in place in both the PVED-CLS main and safety controller:
• Receive timing check of CAN messages. Single failure leads to safe state.
• Sequence number check on CAN message. Single failure leads to safe state.
• End-to-end CRC on messages. Single failure leads to safe state.
• Data validity check (range check on vehicle speed data). Single failure leads to safe state.
• Range check on ‘Direction indication’. A single instance of ‘Error condition’ leads to safe state.
• Note: Setting the ‘Direction indication’ to ‘Information not available’ is regarded as ‘Forward’.
• The forward and reverse flags are cross-checked as follows: The ‘Direction indication’ field
determines the sign of the vehicle speed data which is cross-checked.
•Primary and redundant data are cross-checked as follows: If the absolute primary and
redundant difference is > P3358 km/h for more than P3357 ms, then enter safe state.
See [Diagnostic Trouble Codes] on page 96 for CAN bus diagnostic trouble codes related to detecting
different failures on the vehicle speed sensor sub-system.
P3358
P3357
P3287
monitoring - Max time difference
Important
•Setting the value for P3358, P3357 or P3287 too high will reduce the monitoring
performance.
•The monitoring technique is based on a comparison and uses a reference sensor. A
diagnostic coverage in the range 90-99% may be claimed provided that the sub-system is
integrated according to the specification.
• Set value of P3287 to 1.5 ∙ nominal transmission rate.
• Design the sensor sub-system channels to output as equal data as possible.
• Record vehicle speed sensor data in different scenarios and use simulation for optimum
monitoring performance tuning.
Man Machine Interface – CAN interface
The MMI sub-system shall acquire the system’s or operator’s request for different N-Axis steering
modes. The MMI message contains:
• VAP and VAA which sets the N-Axis steering mode.
• A pre-configured wheel angle limit can be enabled/disabled by the MMI which will take
priority over other wheel angle limitations in the N-Axis e.g. for special work scenarios or
Demanded right wheel angle limit
on indication from MMI
Demanded right wheel angle limit on indication from
MMI
Vehicle speed limit for Wheel angle
limit on demand activation
Wheel angle limit on demand activation based on
Vehicle speed
S2
S1
Steering CAN-bus
CAN_H
CAN_L
CAN_L
CAN_H
Batter y po wer and ground
wires are not depicted.
PVED-CL S
DT04-12PA -B016
AD2
AD3
Se nsor GND
CAN H Saf ety
CAN L Saf ety
CutOff o ut
Ba ttery (-)
Ba ttery (+)
CAN L Mai n
CA N H M ain
5V sensor
sup ply
AD1
5
4
3
2
1
10
9
8
7
6
12
11
Pri m ar y d ata
Saf e sen s or data
Sof twa re
Fault (enter safe state)
Prim ary CA N
message
moni tori ng
Redundant data
Fault (enter safe state)
Compar ison
ECU1
CAN_H
CAN_L
Redundant
CAN me ssage
moni tori ng
Fault (enter safe state)
ECU2
CAN_H
CAN_L
Man
machine
interface
Attention
Address
Name
Unit
Description of parameter
P3321
MMI source address
dec
J1939 Source Address of the MMI
P3317
PGN offset to MMI message
dec
MMI message PGN offset
P3921
P3926
deg
Kmph
The basic architecture assumes two MMI messages, one destined for the main controller and one for
the safety controller. This architecture shall be used in architectures where the MMI message is part of
the safety function and where faulty MMI data is not controlled or mitigated by the PVED-CLS.
A single MMI message may also be received by both the main and safety controller. In this case the NAxis slave PVED-CLS is typically configured to limit and ramp the received MMI data in such a way that
the requested N-Axis steering mode change is controllable for the driver.
For implementing a sub-system which supports achieving an overall architecture category 3, primary
MMI (S1, ECU1) and redundant MMI (S2, ECU2) are two channels which independently acquire the
requested N-Axis steering mode. ECU1 acquires the desired steering mode via sensor element S1. The
desired steering mode is transmitted onto the CAN bus via a safe protocol as the primary MMI
message. The same applies for the redundant MMI, where ECU2 transmits the redundant MMI
message. See [PVED-CLS MultiAxis-Steer communication protocol] for details on the MMI message
protocol.
• Ensure that the sub-system components are fit for the purpose.
• Conduct an FMEA to uncover dangerous failures.
• Implement measures against dangerous failures.
• Perform a CCF analysis.
• Document the sub-system as part of the safety case if it analyzed to be part of the safety
function.
•Ensure that an unintended N-Axis steering mode change will not lead to an unsafe situation.
MultiAxis-Steer technical information
System Architecture
Attention
Address
Name
Unit
Description of parameter
Channel cross-check monitoring. Maximum
requests are allowed to be different [x10ms]
Attention
The PVED-CLS main controller receives the primary MMI message and the PVED-CLS safety controller
receives the redundant MMI message. See [PVED-CLS MultiAxis-Steer communication protocol] for
details on the MMI message protocol.
The applied safety protocol allows omitting the CAN bus from the safety loop calculation as it
contributes less than 1% of the safety integrity level.
The applied safety protocol allows the presence of both safety and non-safety related CAN messages.
The sub-system shall begin transmitting CAN messages no later than 10 seconds after the PVED-CLS is
powered.
Monitoring
The PVED-CLS provides monitoring functions for the MMI sub-system. For both primary and redundant
message, the following monitoring is in place in both the PVED-CLS main and safety controller:
•Receive timing check of CAN messages. Nominal transmit rate is 500 ms. Time guard is fixed
to 750 ms.
• Single receive timing failure leads to safe state.
• Sequence number check on CAN message. Single failure leads to safe state.
• End-to-end CRC on messages. Single failure leads to safe state.
• Data validity check (range check). Single failure leads to safe state.
• Primary and redundant steering mode requests are cross-checked as follows: If the absolute
primary and redundant steering mode differ for more than P3374 ms, then enter safe state.
•See [PVED-CLS MultiAxis-Steer communication protocol] for CAN bus diagnostic trouble
codes related to detecting different failures on the vehicle speed sensor sub-system.
Channel cross-check monitoring Max MMI command divergence time
x10msec
allowed time for which MMI steering mode
Important
Setting the value for P3359 too high will reduce the monitoring performance.
If it is assessed that the MMI is part of the safety loop, then the monitoring technique for the category 3
architecture, is based on a comparison and uses a reference sensor. A diagnostic coverage in the range
90-99% may be claimed provided that the sub-system is integrated according to the specification.
A dual channel analogue wheel angle sensor can be connected to the PVED-CLS when a high
diagnostic performance is required for reaching the highest possible safety integrity level or
performance level. The architecture shows how the PVED-CLS can be used as part of a wheel angle
sensor (WAS) sub-system. The sub-system design supports realizing safety function designed to meet
SIL2/PL d/AgPL d by designing the sub-system to a category 3 architecture.
The system integrator shall:
• Design and supply the wheel angle sensor sub-system.
• Ensure that the sub-system components are fit for the purpose.
• Conduct an FMEA to uncover dangerous failures.
• Implement measures against dangerous failures.
MultiAxis-Steer technical information
System Architecture
Batter y po wer and ground
wires are not depicted.
Primary W AS
Address
Name
Unit
Description of parameter
Redundant WAS present.
(0= Not present, 255 = Present (Default))
WAS interface type.
(0 = Analogue (Default), 1 = CAN)
• Perform a CCF analysis.
• Document the sub-system as part of the safety case.
Two independent single-channel WAS sensors or an integrated dual channel WAS shall be installed to
measure the steered wheel angle or articulation angle of the vehicle.
The primary WAS and redundant WAS can be installed on the same kingpin or on each kingpin.
The main and safety controller receive, monitor and scale the input to the internal resolution range.
The WAS can be supplied by any stabilized 5V supply or from the PVED-CLS 5V sensor supply. The
PVED-CLS 5V sensor supply is internally monitored and adjusts for output drift and short-circuits faults.
Analogue interface
The WAS signal on AD1 and AD2 shall be in the range 500 mV to 4500 mV. The safety related
parameters related to dual channel WAS are:
•The WAS steered angle-to-signal characteristic shall be mutually inverted/crossed for the
PVED-CLS to monitor a common 5V sensor supply.
•The PVED-CLS cannot detect if a one WAS output is unintended connected to both AD1 and
AD2. In this situation, the sub-system is not suitable as part of a category 3 architecture.
•Use independent sensor supply sources if WAS with non-inverted output characteristics are
used.
•It is recommended that the steered wheel or articulation angle sensor resolution shall be
better than 20°/V.
•The voltage representing straight shall be approximately in the middle of the achieved
voltage range.
The PVED-CLS provides monitoring function for the WAS sub-system.
AD1 and AD2 input values below 100mV and above 4900mV are detected as short-circuit to ground
and supply respectively.
• Input range check
• WAS channel cross-check
• Micro-controller cross-check of scaled wheel angle
• Out of calibration check
MultiAxis-Steer technical information
System Architecture
Address
Name
Unit
Description of parameter
Channel cross-check monitoring
divergence (internal)
Analogue sensor cross-check monitoring.
internal resolution [IR] i.e. after scaling.
Address
Name
Unit
Description of parameter
Channel cross-check monitoring
time
steering wheel angle divergence time [x10ms]
Channel cross-check monitoring
- Max wheel angle divergence
Channel cross-check monitoring. Maximum
wheel angle divergence [IR]
Address
Name
Unit
Description of parameter
Maximum value which the safe sensor data from
the calibrated range [IR]
WAS channel cross-check
The PVED-CLS will perform cross-check monitoring on the wheel angle signal from the primary and
redundant wheel angle sensor. This check is performed in both micro-controllers.
P3360
- Max analogue sensor
IR
Maximum analogue sensor divergence. Unit is
If the difference is greater than the threshold specified by P3360 for more than 100ms in one of the
micro-controllers, safe state is triggered.
Micro-controller cross-check of scaled wheel angle
After the internal WAS channel cross-check, the primary wheel angle is scaled and cross-checked by
the micro-controllers.
P3351
P3352
- Max wheel angle divergence
x10msec Channel cross-check monitoring. Maximum
IR
If the difference is greater than the threshold specified by P3352 for more than P3351ms, safe state is
triggered.
Important
Setting the value for P3360, P3351 or P3352 too high will reduce the monitoring performance.
The monitoring technique is based on a comparison and uses a reference sensor. A diagnostic
coverage in the range 90-99 % may be claimed provided that the sub-system is integrated according to
the specification.
Danfoss recommends setting P3351 to 100 ms for consistency to the fixed 100 ms WAS channel
internal cross-check divergence time.
Danfoss recommends setting P3360 to 100 if a dual channel WAS is used on one kingpin.
If two single channel WASs are mounted on each kingpin, Danfoss recommends P3375 to be set 150
due to the difference in angles steering left and right, with reference to the turning point.
Record sensor data in different scenarios and use simulation for optimum monitoring performance
tuning of P3375.
Out of calibration check
The out of calibration check is checking that the safe sensor data from the wheel angle sensor, is within
the calibrated range added a threshold specified in the table below. The out of calibration check is
testing if the safe sensor data from the wheel angle sensor is exceeding the nominal range. This may
happen due to changes (wear, tear, stress) in the mechanical or electrical installation of the wheel
angle sensor.
If the safe sensor data from the wheel angle sensor, is outside the calibrated range, by more than
specified by P3369 for longer than 120 ms, safe state is triggered.
MultiAxis-Steer technical information
System Architecture
ECU1
Steering CAN-bus
CAN_H
CAN_L
CAN_H
CAN_L
CAN_H
CAN_L
CAN_L
CAN_H
Batter y po wer and gr ou nd
wires are not depicted.
Steered wheel angle
S2
S1
Attention
Address
Name
Unit
Description of parameter
WAS interface type.
(0 = Analogue (Default), 1 = CAN)
Wheel angle
address
Steering wheel angle sensor source address.
The steered wheel angle can be supplied via the CAN bus. The principle is identical to having a dual
analogue wheel angle sensor except that sampling the angle sensors is now performed by external
controllers. The sampled values in mV are transmitted via a safe protocol.
The architecture shows how the PVED-CLS can be used as part of a CAN based wheel angle sensor subsystem. The sub-system design supports realizing safety function designed to meet SIL2/PL d/AgPL d
by designing the sub-system to a category 3 architecture.
Figure 29: CAN based wheel angle sensor architecture.
S1 and S2 can be installed on the same kingpin or on separate kingpins.
Primary wheel angle sensor (S1, ECU1) and redundant wheel angle sensor (S2, ECU2) shall be two
channels which both acquire the steered wheel angle. The ECU1 acquires the steered wheel position
via sensor element S1 and scales it to a voltage. The voltage, representing a steered wheel angle, is
transmitted onto the CAN bus via a safe protocol as the primary wheel angle sensor message. The
same applies for the redundant wheel angle message, where ECU2 transmits the redundant wheel
angle sensor message. See [PVED-CLS MultiAxis-Steer communication protocol] for details on the
wheel angle sensor message protocol. The main and safety controller receive, monitor and scale the
input to the internal resolution range.
• Design and supply the steering wheel sensor sub-system.
• Ensure that the sub-system components are fit for the purpose.
• Conduct an FMEA to uncover dangerous failures.
• Implement measures against dangerous failures.
• Perform a CCF analysis.
• Document the sub-system as part of the safety case.
The PVED-CLS main controller receives the primary steering angle sensor message and the PVED-CLS
safety controller receives the redundant steering angle message.
P3239 WAS interface dec
P3323
sensor source
dec
MultiAxis-Steer technical information
System Architecture
Vehicle speed
address
Address
Name
Unit
Description of parameter
Channel cross-check
angle divergence
Wheel angle sensor cross-check monitoring.
internal resolution [IR] i.e. after scaling.
Channel cross-check
angle divergence time
steering wheel angle divergence time [x10ms]
Wheel angle sensor
two messages
Maximum message timeout [x10ms]
P3320
sensor source
dec Steering wheel angle sensor PGN offset.
Important
•The applied safety protocol allows omitting the CAN bus from the safety loop calculation as it
contributes less than 1% of the safety integrity level.
•The applied safety protocol allows the presence of both safety and non-safety related CAN
messages.
•P3323 may be equal for both primary and redundant message if they are transmitted by one
CAN node.
• For redundant WAS configurations P3323 for the main and safety controller shall be different.
• The sub-system shall begin transmitting CAN messages no later than 10 seconds after the
PVED-CLS is powered.
• Single channel CAN based WAS configuration is not possible.
• The steered wheel or articulation angle sensor resolution shall be better than 0.023°/mV.
Monitoring
The PVED-CLS provides monitoring function for the WAS sub-system.
• Input range check
• Micro-controller WAS channel cross-check
• Out of calibration check
Input range check
WAS signal values below 100 and above 4900 are detected as short-circuit to ground and supply
respectively.
Micro-controller WAS channel cross-check
The PVED-CLS will perform cross-check monitoring on the wheel angle signal from the primary and
redundant wheel angle sensor by an internal micro-controller data exchange and comparison.
P3352
P3351
P3288
monitoring - Max wheel
monitoring - Max wheel
message monitoring - Max
time difference between
IR
Maximum wheel angle divergence. Unit is
x10msec Channel cross-check monitoring. Maximum
x10mSec
If the difference is greater than the threshold specified by P3352 for more than P3351 ms, safe state is
triggered.
Important
• Set value of P3288 to 1.5 ∙ nominal transmission rate.
• Setting the value for P3352, P3351 or P3288 too high will reduce the monitoring
performance.
•The monitoring technique is based on a comparison and uses a reference sensor. A
diagnostic coverage in the range 90-99 % may be claimed provided that the sub-system is
integrated according to the specification.
• Danfoss recommends setting P3352 to 100 if a dual channel WAS is used on one kingpin.
• If two single channel WASs are mounted, one on each kingpin, Danfoss recommends P3352
to be set 150 due to the difference in angles steering left and right, with reference to the
•Record sensor data in different scenarios and use simulation for optimum monitoring
performance tuning.
Out of calibration check
The out of calibration check is checking that the wheel angle read from both the primary and
redundant wheel angle message, is within the calibrated range added a threshold which is specified in
the table below. The out of calibration check is testing if the safe sensor data from the wheel angle
sensor is exceeding the nominal range. This may happen due to changes (wear, tear, stress) in the
mechanical or electrical installation of the wheel angle sensor.
P3372 Wheel angle limit offset (CAN WAS) IR
If the wheel angle read from the primary or the redundant wheel angle message is out of the calibrated
range by more that threshold specified by P3372 for more than 120 ms, safe state is triggered.
Output - Valve sub-system and monitoring
Sensor 5V DC power supply
The PVED-CLS can supply external sensors with a regulated 5V supply voltage. The voltage is internally
monitored by a range check. The PVED-CLS enters the safe state if the voltage exceeds the monitored
sensor voltage thresholds.
A diagnostic coverage of 60% can be claimed by the range check method. For a higher diagnostic
coverage, use the 5V sensor supply for a two channel sensor with inverted characteristics and monitor
the supply voltage indirectly by cross-checking the two sensor channels.
For more details refer to [PVED-CLS Technical Specification].
EHi Cut-off valve
The EHi-valve has an integrated cut-off valve (COV) which blocks the L and R steering flows to the
steering cylinder. The COV is piloted by the COV solenoid valve which is opened by supplying power to
the cut-off coil.
The COV spool has a dual function. In blocked state, it blocks L and R steering flow as well as hydraulic
pilot pressure supply to the solenoid valve bridge (SVB).
Cut-off valve pull current (closed-loop current control).
Cut-off valve CL hold
current
Cut-off valve hold current (closed-loop current control).
Cut-off valve monitoring POST time-out. The COV check
Note: Setting P3078 = 0 will disable COV monitoring.
Valve type.
(0 = OSPE or EHi-E (default)
Interface
The COV solenoid valve shall be connected to the monitored PVED-CLS high-side switch output (pin 6)
and battery –(ground). It is recommended to establish the COV solenoid valve ground connection as
close the PVED-CLS ground (pin 7) as possible to avoid voltage drops and current loops.
Configuration for EHi-E valve sub-systems
Cut-off valve related configuration parameters and recommended values, for systems using EHi-E valve
sub-systems can be seen below.
Figure 30: Cut-off valve architecture for OSPE, EHi-E and EHi-H valve sub-system.
Cut-off valve control
mode
Cut-off valve
monitoring POST
timeout
x10mSec
BOOL
mAmp
mAmp
(0 = not present (EHPS), 225 = present (default)(OSPE,
EHi-E and EHi-H))
Note: For OSPE, EHi-E and EHi-H valve sub-systems,
P3072 shall be 255 to achieve the maximum safety
(0 = Open loop current control,
will fail if started and not succeeded within the set timeout period.
MultiAxis-Steer technical information
System Architecture
Cut-off solenoid valve PWM preload. The current build-
H valve sub-systems.
up can be preloaded when the solenoid valve is
P3093
Cut-off valve PWM
pre-load value
powered, this speeds up the time it takes to pull the
%
armature.
P3097 = 100 % is recommended for OSPE, EHi-E and EHi-
Monitoring for EHi-E valve sub-systems
By utilizing the SVB and the EH-valve main spool position sensor, the following monitoring is achieved:
• Full-stroke testing of the COV.
• Full-stroke testing of the cut-off solenoid valve.
The test checks that the COV can enter blocked state. No EH-steering functionality is possible until the
test has passed.
The COV solenoid valve and COV is tested every time the MMI commands the PVED-CLS from on-road
mode into off-road mode. The monitoring function is designed to work in the full operational
temperature range. The test is designed not to fail due to lack of pump pressure and will wait forever
for the initial spool movement. As a consequence, a stuck closed Cut-Off spool will not be detected. In
this case, the operator will notice that EH-Steering is not possible.
Some examples of test execution times, using oil type Tellus 32, are:
• Oil temp -25 °C (6000 cSt) results in test duration: ~6.0 s
• Oil temp -20 °C (4500 cSt) results in test duration: ~3.1 s
• Oil temp -10 °C (1700 cSt) results in test duration: ~1.3 s
• Oil temp 0 °C (761 cSt) results in test duration: ~0.7 s
• Oil temp 20 °C (203 cSt) results in test duration: ~0.6 s
• Oil temp 40 °C (75 cSt) results in test duration: ~0.6 s
Important
• The monitoring technique is based on an intermittent test pulse principle.
• A diagnostic coverage in the range 90-99 % may be claimed, provided that the sub-system is
integrated according to the specification.
EHi-valve monitoring
The PVED-CLS has an integrated EH-valve main spool position sensor (LVDT-sensor) which is used for 1)
closed-loop EH-valve main spool positioning and for 2) EH-valve main spool monitoring.
EH-valve main spool control principle
The main controller calculates a EH-valve main spool set-point every 10ms. The set-point is input to the
Solenoid Valve Bridge (SVB) which pilots the EH-valve main spool towards the calculated spool setpoint. The actual EH-valve main spool position is measured via the LVDT sensor and fed back to the
software for closed-loop spool position control. When the spool position control error is zero the EHvalve main spool is kept at the set-point.
EH-valve main spool monitoring –EHi-E valve sub-systems
The principle of spool monitoring is depicted in
• The EH-valve main spool shall be within the mechanical neutral position threshold (P3086)
• The spool is positioned at or less than the set-point (green dots) and
• The spool is positioned no further than the |set-point + spool monitoring max threshold
• The spool monitoring max threshold range aremarked with orange arrows.
A spool monitoring fault is detected when the EH-valve main spool position is in the red enclosed
region for more than ‘Spool out of control’ tolerance time equal to 150 ms (P3363). At power-up, the
initial tolerance time is 1000 ms (P3364). The Spool out of control tolerance time is oil viscosity
dependent and will decrease and settle at P3363 ms as the spool dynamics reflects normal operation
conditions. The tolerance time decline rate is determined by an initial tolerance time constant (P3366)
and the observed spool dynamics measured over a 10 ms interval.
Figure 31. The criterion for safe spool control is:
The installation of the PVED-CLS is critical for the machine uptime. In order to respect the absolute
stress ratings of the electronic components, the PVED-CLS must be carefully installed in an area with a
known maximum ambient temperature.
The PCB ambient temperature is measured internally and is a sum of the ambient temperature of the
PVED-CLS installation and the self-heating of the PVED-CLS.
The PVED-CLS must not be installed in areas where the ambient temperature exceeds
85°C.
Contact a Danfoss Product Application Engineer for further information.
For controlling common cause failure, the PVED-CLS features the following functions
• PCB overheating shut-down
• PCB average over-temperature warning
Under normal operation the PVED-CLS must continuously measure the PCB temperature. If the PCB
temperature exceeds 120 °C, the PVED-CLS enters safe state immediately.
For manufacture testing purposes only, it is possible to disable this function by setting the temperature
severity level to INFO. Thereby the PVED-CLS will not to enter safe state if the PCB temperature exceeds
120 °C.
• It is strictly prohibited to set the temperature severity level to other than critical.
• Setting the temperature severity level to other than critical leads to immediate loss of
warranty.
The PVED-CLS maintains a PCB temperature histogram to monitor the average PCB temperature over
the PVED-CLS life-time. A J1939 DM1 Information message will be issue if the average temperature
exceeds 85 °C. The PVED-CLS will continue operation while issuing the info CAN message.
Important
It is recommended that an external ECU is configured to listen the average over-temperature
information. If observed the system integrator should consider revising the PVED-CLS installation
environment.
The temperature histogram can be read out of memory by e.g. the PLUS+1® PVED-CLS service tool.
The PVED-CLS is designed to operate reliably at battery voltages between 11 and 35.5V. Protection
circuitry ensures that the PVED-CLS electronics can withstand the absolute maximum voltage levels.
Circuitry is in place to perform voltage control with safety shut-off to address over-voltage failure
scenarios which could potentially lead to loss of safety functions.
Important
•If the power supply goes below 5.5V, the PVED-CLS will shut down without sending any
warning.
•If the voltage goes below 9V, the PVED-CLS will stay in operation mode but send out an INFO
level DTC.
•Note that below 9V the electro-hydraulic functions of an EHPS, EHi and OSPE may work at a
reduced performance.
•In case the supply voltage exceeds 35.5V, a DTC is issued on the CAN bus, and the PVED-CLS
will enter safe state.
•On detection of internal supply over-voltages, the power to the solenoid valve bridge and the
cut-off solenoid valve will be switched off by discrete circuitry.
MultiAxis-Steer technical information
System Architecture
Experience shows that excessively low supply voltage may occur during engine cranking in cold
conditions, depending on the state of battery charge, and/or general state of battery.
Refer to [PVED-CLS Technical Specification] for the absolute maximum electrical steady-state voltage
levels.
See [Diagnostic Trouble Codes] on page 96 for details on error codes.
The coils supply switch is turned on and the spool
is outside its dead-band
PVED-CLS is in the Safe State, but no
bus-off situation)
PVED-CLS Pinout
Deutsch Connector
1
AD2 7 Power ground (-)
2
AD3 8 Power supply (+)
3
Sensor power ground (-)
9
CAN Low MAIN
4
CAN High SAFETY
10
CAN High MAIN
5
CAN Low SAFETY
11
5V sensor supply (+)
6
Digital output
12
AD1
System set-up
Installation
PVED-CLS Connector interface
LED diagnostic
For a description of the connector interface of PVED-CLS – please refer to [PVED-CLS Technical
Specification].
The PVED-CLS will only be available with connector variant: 12 pin Deutsch DT04-12PA-B016
connector.
The PVED-CLS is equipped with a LED. The LED behavior will inform about the state of the PVED-CLS:
Calibration
Straight heading calibration
System integration and testing
or Main µC detects the Safety µC in the
or is in the on-road mode (electro-hydraulic
about the detected failu r e is available on CAN
Axis operational) and the spool is in its neutral
Blinking between orange and green
Orange
Blinking orange
Green
Blinking gree n
information abou t the detected failure is availabl e
on CAN bus (e.g. the address arbitration has been
lost or the Main µC built-in CAN controller
Red
failed to initialize or is unable to recover from the
This section is pending
As specified in the safety-life cycle; after installation, integration or modification of the PVED-CLS, valve
and other sensors, the system integrator or another representative for the OEM shall validate the
installation, configuration and correct behavior before releasing the vehicle for series production.
System integration testing shall cover the fully integrated system including
• Hydraulic installation
• Mechanical installation including sensor installation
• Systematic safety integrity of the safety channels
The system integration testing shall always be performed before start of
production and after modification of the system.
For further information on validation consult IEC 61508, ISO 13849 or ISO 25119.
The functional safety provided by the PVED-CLS and valve may work differently from vehicle to vehicle
as it may depend on factors such as configuration, vehicle geometry, valve size and cylinder volume.
The system integrator is advised to perform fault insertion testing on the integrated system for failure
modes where the system reaction to a fault cannot be predicted or simulated.
Contact Danfoss Power Solutions PAE for more information.
Validation is the final test of the functional safety before commissioning the system to the end.
This safety validation test activity shall:
• Answer the question if the system is integrated correctly.
• Answer the question if the system is configured as specified.
• Answer the question if the system is working correctly.
• Achieve confidence in that the installation is performed correctly and that the specified
functional safety is working as expected.
Contact Danfoss Power Solutions PAE for more information.
Service part handling and repair instruction
Do not attempt to perform modifications or repair of the PVED-CLS or
valve.
•Do not perform any unauthorized software download or modification of
the PVED-CLS
•If the product is covered by the warranty then it shall be returned to
Danfoss for inspection and root cause analysis
• Repairing a PVED-CLS shall be done by replacing it with a new unit.
• Perform safety validation of the PVED-CLS before commissioning into
the target system/vehicle.
•The replaced PVED-CLS shall be decommissioned by e.g. adequately
marking the part to avoid unintended installation to another vehicle or
modifying the part so re-installation is never possible.
Refer to the [EHi steering valve technical information] for valve repair instructions.
Refer to the[PVED-CLS MultiAxis-Steer firmware release note]for PVED-CLS service part software
operations.
Safety validation steps after replacing a PVED-CLS with a service part
Steps 1-2 may be performed before or after mounting the PVED-CLS to the steering valve.
1. Use the PLUS+1® service tool or read out the Identification data of the PVED-CLS.
2. Compare the following software elements to the customer drawing/specification
a. Bootloader software version
b. Main controller software version
c. Safety controller software version
d. Parameter sector CRCs for the following sectors
The following information identifies the PVED-CLS and valve assembly. The below sections explains the
various methods to perform identification.
Valve assembly barcode label
The valve assembly barcode for the fully assembled valve unit number consists of the order number (8
digit number) and a serial number. The order number specified on the customer drawing, identifying
the final valve assembly (valve, valve controller, software, parameters), is glued onto the valve
assembly (OSP gear set) as well as stored electronically in the PVED-CLS on the following parameter
addresses.
The data can be accessed by uploading the data in boot-loader mode. See [PVED-CLS KWP2000
protocol].
Bootloader and application software identification
The following electronic identification for the embedded software can be retrieved from the PVED-CLS
via the CAN bus.
The boot-load and application software and program date information is stored in flash memory and
generated by Danfoss at compile time for the main and safety controller respectively. The data is
accessible via the KWP2000 Read ECU Identification service. See [PVED-CLS KWP2000 protocol].
Example for main controller:
Sub-string ‘M’ means main controller. Sub-string ‘R198’ means release software version 1.98. Sub-string
‘11153340’ is a Danfoss part number for the main application software. ‘B02’ indicates the build
number.
For the boot-loader software version ‘-rrr’ are reserved characters.
Example for safety controller:
Sub-string ‘S’ means safety controller. Sub-string ‘R100’ means release software version 1.00. Sub-string
‘11153341’ is a Danfoss part number for the safety application software. ‘B02’ indicates the build
number.
For the boot-loader software version ‘-rrr’ are reserved characters.
PVED-CLS component identification and serial number
The PVED-CLS valve controller can be identified by a serial number which is stored in the PVED-CLS
eeprom memory.
The below example shows how the PVED-CLS serial number is encoded:
The data can be accessed by uploading the data in boot-loader mode by the [PVED-CLS KWP2000
protocol].
PLUS+1 Service tool identification page
The software and hardware can also be uniquely identified via the PLUS+1® service tool page
“Identification” in the Diagnostics group.
U8 PVED-CLS Serial number
Example of the information on the Identification page:
J1939 request PGN for software ID and component ID
The software identification and component identification can be retrieved by a request program group
query for software identification (PGN 65242) and component identification (PGN 65259). The data can
be queried while the PVED-CLS is in operation mode.
Requesting Software ID will return the same data as given in section TBD. Both the boot-loader
software version and application software version is output in one Broadcast Announcement Message.
•Modifying behavior includes changing or disabling a safety function or a
Step
Description
Response/result
1
Enter boot-loader mode
PVED-CLS de-energizes all outputs (safe
configuration memory.
2
User identification
The user identifies him/her-self and request
state on the subsequent power-up.
3
Upload data
controller in a diverse data format
The PVED-CLS returns all parameter values to
step 4 and 5.
4
Data modification
and characters)
sector CRC is stored in service tool memory.
5
Download data
When downloading a new sector to the main
the PVED-CLS.
6
Upload data
characters
write procedure in step 5.
7
Data validation
The user inspects that the data is correctly
sector are valid.
8
User approval signature
The PSAC for the modified sector is
memory.
Safety parameterization
Safety parameterization procedure
Note: Sectors with gray background ( ) are for internal purpose only and are not described in the manual
Parameterization or configuration is the process of modifying software parameters in EEPROM which
can modify the behavior of the safety device.
Warning
monitoring function behavior or performance.
•Any parameterization of the PVED-CLS shall follow the be devised safety
parameterization procedure.
The PVED-CLS support protocol services which enable the design of safe parameterization covering the
channel; the service tool user, the service tool hardware and software, the communication channel and
the PVED-CLS eeprom memory.
Set the PVED-CLS in boot-loader mode
Enter the access level (Manufacturer, OEM or
dealer) and the Parameter Sector Access Code
(PSAC)
condition) and enables access to
access rights to the sectors subject for
modification. Failing to set the PSAC or
unauthorized modification attempts will be
detected and bring the PVED-CLS into the safe
Upload the data for the sector which is subject
for modification. Request uploading data in
the diverse data format. Decode and display
the data for both the main and safety
Modify one or more parameters in the sector
and calculate the sector CRC value. Input
values are entered as strings values (numbers
Download the modified sector and the
associated sector CRC from service tool
memory to both the main and safety
controller memory
Upload the data for the sector which is subject
for modification. Request uploading in diverse
data format. Decode and display the data for
both the main and safety controller as ascii
The user shall inspect all parameter values in
the sector
The user approves the data in the sector by
calculating the signature CRC. The signature
the service tool as bit-wise inverted data. The
diverse data enforces realization of a readback and display method in the service tool
which is diverse from the write procedure in
The data is encoded from string-tohexadecimal values. The modified sector and
and safety controller, the previous signature
CRC becomes invalid. The PVED-CLS will be
locked in the safe state until a correct
signature CRC is created and downloaded to
The PVED-CLS transmits all parameter values
as bit-wise inverted data. The diverse data
format enables the realization of a read-back
and display method which is diverse from the
So, this value shall NOT be modified by user at all.
Node-ID used by Boot-loader. Default value is
Node-ID is between {0x20 - 0x2F}.
This EE location is used by the application to
ALWAYS Use a Default value of 0x00.
Default = 250K
This Baud rate value is configured by application
ALWAYS Use a Default value of 0x00.
This EE location is configured by the bootloader
ALWAYS Use a Default value of 0x00.
This EE location indicate SafeUC image is
compatible with MainUC.
SW_RESET_CONTED_TOOL_NO
KWP_DLC_VALIDATION_STATU
S
P14
P19
Boot Data
P0
Name
BL_APP_DOWNLOAD_CHECKS
UM
U8 Hex
Description MIN MAX
calculates and stores after programming the
device with valid application. Boot-loader uses
this value at every boot-up for verifying whether
a valid application is present in the device or not.
00
P1 Reserved / Unused U8 Hex Reserved for use in Future.
00
P2 Network Node ID U8 Hex Reserved for use in Future. 0 255 00
P3 BOOT_NODE_ID U8 Hex
0x20. The actual valid range for this KWP2000
0 255 20
indicate which 'Diagnostic Session' is to be
P4 APP_TO_BOOT_FLG U8 Hex
started in 'Boot-loader mode'; after 'Software-
0 255 00
Reset' is performed from Application.
Initial Baud rate for Bootloader . Can be
configured as
compatible with MainUC.
This parameter is reset by bootloader while
flashing new application.
Application will set the values as follow
U8 Hex
0x02 : Both Application and Bootloader
0 3 00
compatible with MainUC.
0x01 : Bootloader is compatible but Application
is not compatible with MainUC.
0x00 : Both Application and Bootloader not
Connected service tool information
0: Normal mode standard message tool
Important Parameters with gray background ( ) are internal and must not to be changed!
0
MultiAxis-Steer technical information
Appendix
P30-
P39
P42-
P43
Sector CRC Sign Data
Addr Name Type Unit Description MIN MAX Default
This EE location is reserved to store the sector
SVC_PARAM_SECTOR_CRC_
P20
SIGN
SAFETY_DATA_SECTOR_CRC
P22
_SIGN
CALIB_TABLE_SECTOR_CRC_
P24
SIGN
CONTROL_DATA_SECTOR_C
P26
RC_SIGN
U16 dec
U16 dec
U16 dec
U16 dec
signature CRC.
The signature CRC shall be calculated by the
configuration tool. A correct CRC value is
equivalent to approved parameter changes.
This EE location is reserved to store the sector
signature CRC.
The signature CRC shall be calculated by the
configuration tool. A correct CRC value is
equivalent to approved parameter changes.
This EE location is reserved to store the sector
signature CRC.
The signature CRC shall be calculated by the
configuration tool. A correct CRC value is
equivalent to approved parameter changes.
This EE location is reserved to store the sector
signature CRC.
The signature CRC shall be calculated by the
configuration tool. A correct CRC value is
equivalent to approved parameter changes.
0 65535 2920
0 65535 47848
0 65535 13034
0 65535 64557
This EE location is reserved to store the sector
PROTOCOL_DATA_SECTOR_
P28
CRC_SIGN
U16 dec
signature CRC.
The signature CRC shall be calculated by the
configuration tool. A correct CRC value is
0 65535 44206
equivalent to approved parameter changes.
Reserved / Unused U8 dec - 0 255 00
This EE location is reserved to store the sector
HYDRA_CONFIG_SECTOR_C
P40
RC_SIGN
U16 dec
signature CRC.
The signature CRC shall be calculated by the
configuration tool. A correct CRC value is
0 65535 7759
equivalent to approved parameter changes.
Reserved / Unused U8 dec - 0 255 0
This EE location is reserved to store the sector
VALVE_CALIB_DATA_SECTO
P44
R_CRC_SIGN
U16 dec
signature CRC.
The signature CRC shall be calculated by the
configuration tool. A correct CRC value is
0 65535 15743
equivalent to approved parameter changes.
This EE location is reserved to store the sector
CAN_WAS_DATA_SECTOR_C
P46
RC_SIGN
U16 dec
signature CRC.
The signature CRC shall be calculated by the
configuration tool. A correct CRC value is
within which the
wheels must get
aligned straight
before going from
P3094
Timeout within which the wheels must get
aligned straight before going from off road to
OnRoad due to road switch position
U16 x10msec
off road to OnRoad
state due to road
switch position.
0 6500 0
After the timeout
the Safestate will
be triggered. If set
to 0 self alignment
within which the
wheels must get
aligned straight
before entering in
Pre-Safe state or
before entering on
road state due to
100 6500 500
P3096
Timeout within which the wheels must get
aligned straight before in Pre-Safe state or in on
road state
U16 x10msec
VSP. After the
timeout the
Safestate will be
UNUSED 0
P3120 HYDRA_CONFIG_SECTOR_CRC U16 dec
reserved to store
CRC
Application
calculates sector
CRC if new .eep file
is downloded.
Application
verifies the sector
CRC value at every
boot-up, to check
the EEPROM sector
data is valid or not.
This value shall
NOT be modified
P3162 Max spool position, left SIGNED16 x10u Meter Spool left most position -1000 -300 -420
P3164 Max spool position, right SIGNED16 x10u Meter Spool right most position 300 1000 420
P3166 Closed loop dead-band edge, left SIGNED16 x10u Meter
P3168 Closed loop dead-band edge, right SIGNED16 x10u Meter
P3170 Open loop dead-band edge offset SIGNED16 x10u Meter
UNUSED
-300 0 -105
0 300 105
0 150 25
store CRC
Application calculates sector
CRC if new .eep file is
downloaded.
P3183 VALVE_CALIB_DATA_SECTOR_CRC U16 dec
Application verifies the
sector CRC value at every
0 65535 63796
boot-up, to check the
EEPROM sector data is valid
or not.
This value shall NOT be
CAN WAS Calibration Data
Addr Name Type Unit Description MIN MAX Default
P3185 WAS max left position (CAN) U16 mVolts
P3187 WAS max right position (CAN) U16 mVolts
P3189 WAS neutral position (CAN) U16 mVolts
Wheel angle sensor voltage output
for leftmost position over CAN
Wheel angle sensor voltage output
for rightmost position over CAN
Wheel angle sensor voltage output
for neutral position over CAN
Application calculates sector CRC if new
.eep file is downloded.
Application verifies the sector CRC
value at every boot-up, to check the
EEPROM sector data is valid or not.
This value shall NOT be modified by
is no present, i.e. connected to the
analogue input AD3
Valid Values: 0 (NOT PRESENT); 255
(PRESENT)
to store CRC
Application calculates
sector CRC if new .eep file
is downloded.
Application verifies the
sector CRC value at every
boot-up, to check the
EEPROM sector data is
valid or not.
This value shall NOT be
0 253 252
0 253 20
0 253 250
0 32 0
0 255 0
0
0 65535 45750
Internal Monitoring
Addr Name
P3351
P3352
P3354
P3355
P3357
P3358
P3359
Channel cross-check
monitoring - Max wheel angle
divergence time
monitoring - Max wheel angle
Channel cross-check
monitoring - Max calc flow
command divergence time
monitoring - Max calc flow
command divergence
Channel cross-check
monitoring - Max vehicle
speed divergence time
monitoring - Max vehicle
Channel cross-check
monitoring - Max MMI
command divergence time
Unit Description MIN MAX Default
U8 x10msec
U16 IR
U8 x10msec
U16 IR
angle readings between MAIN and
SAFETY micro-controllers are allowed to
difference between MAIN and SAFETY
position set-point between MAIN and
SAFETY micro-controllers are allowed to
in IR between MAIN and SAFETY micro-
0 255 10
0 2000 100
0 255 10
0 2000 100
controllers
U8 x10msec
U8 kmph
U8 x10msec
vehicle speed readings between MAIN
and SAFETY micro-controllers are allowed
difference between MAIN and SAFETY
Flag readings between MAIN and SAFETY
micro-controllers are allowed to be
The CAN Wheel angle sensor output
conversions to internal resolution [IR] is
limited to ±1000 IR, based on the
calibration parameters.
But internally it is checked that the unclamped CAN Wheel angle sensor signal
does not exceeds the range: (-1000 –
P3390 [IR]) < “un-clamped analogue
sensor signal” <(1000 + P3390 [IR])
Maximum WAS Auto-calibrated Cylinder
Stroke Volume Difference
Maximum WAS Auto-calibrated wheel
angle Difference
Max time allowed for N-Axis' Virtual Axis
Angle difference
Max time allowed for N-Axis' Virtual Axis
Position difference
Max time allowed for N-Axis' calculated
(for n=1) or received (for n>1) master
wheel angle limit difference
Bit inverted value for "Calibration
counter - Spool calibration"
Bit inverted value for Spool deadband Calibration counter
Bit inverted value for "Calibration
counter - Analogue WAS"
Bit inverted value Analogue WAS
calibration counter
Bit inverted value for "Calibration
counter - CAN WAS"
Bit inverted value for CAN based WAS
calibration counter
P3777-
This EE location is reserved to store
user at all.
Analogue sensor
allowable analogue sensor
Maximum allowed signal to be captured
sensor auto-calibration
Addr Name
P3380
P3381
P3382
monitoring - Max N-axis'
master wheel angle difference
monitoring - Max N-axis
master wheel angle limit
monitoring - Max N-axis
Unit Description MIN MAX Default
U8 x10msec
U8 dDeg
U8 dDeg
master wheel angle difference
P3383
monitoring - Max time allowed
for N-axis' Wheel angle on
-
UNUSED
U8 x10msec
P3419 INTER_MONITOR_SEC_CRC U16 dec
Max time allowed for N-Axis' master wheel
angle difference
Max difference allowed for calculated (for
n=1) or received (for n>1) master wheel
angle limit
Max difference allowed for master wheel
angle
Max time allowed for N-Axis' Wheel angle
on demand request difference
Application calculates sector CRC if new
.eep file is downloded.
Application verifies the sector CRC value
at every boot-up, to check the EEPROM
sector data is valid or not.
This value shall NOT be modified by user
10 255 10
0 50 20
0 50 20
10 255 10
0
6553
0
51030
5
Production/Calibration Flag
Addr Name Type Unit Description MIN MAX Default
P3771
P3772
P3773 Calibration counter - Analogue WAS U8 dec Analogue WAS calibration counter 0 255 0
P3774
P3775 Calibration counter - CAN WAS U8 dec CAN based WAS calibration counter 0 255 0
P3776
P3788
UNUSED
P3789 PRODUCTION_CALIB_FLAG_SEC_CRC U16 dec
Auto Calibration Config
Addr Name Type Unit Description MIN MAX Default
P3791
calibration - Max
U8 dec Spool dead-band Calibration counter 0 255 0
U8 dec
U8 dec
U8 dec
0 255 255
0 255 255
0 255 255
0
CRC
Application calculates sector CRC if
new .eep file is downloded.
Application verifies the sector CRC
0 65535 0
value at every boot-up, to check the
EEPROM sector data is valid or not.
This value shall NOT be modified by
the auto-calibration function will
measure the time for when moving the
sweep time for the spool calibration
function, to find an acceptable closed
loop dead-band edge. That maximum
sweep time for the spool calibration
function, to find an acceptable closed
loop dead-band edge. The minimum
closed loop dead-band edge within a
given time frame requires more attempts
(to ensure consistency in the
captured/found values).
P3810 defines the vector size for how
many attempts (for left- and right-side
dead-band edge, respectively) should be
attempts (defined by P3810) that needs
to be equal to get an successful spool
5 400 25
10 600 110
10 600 60
1 10 7
1 10 5
MultiAxis-Steer technical information
Appendix
This indicates the additional +/- turn
the +/- turn range specified by P3804
When the auto-calibration function has
P3814 to initial set-point value
WAS calibration - Mapped
at 33% VB
WAS calibration - Mapped
at 67% VB
WAS calibration - Mapped
at 100% VB
WAS calibration - Mapped
left)
WAS calibration - Mapped
at 33% VB
WAS calibration - Mapped
at 67% VB
WAS calibration - Mapped
at 100% VB
WAS calibration - Mapped
right)
WAS calibration - Mapped
33% VB
WAS calibration - Mapped
67% VB
WAS calibration - Mapped
100% VB
WAS calibration - Mapped
WAS calibration - Mapped
33% VB
Addr Name Type Unit Description MIN MAX Default
range which will be added to the value in
P3804. The additional turn range
movement is required to obtain a stable
spool position and also stable wheel
movement of the vehicle. The wheels will
5 400 25
P3812
Spool calibration - +/- turn
range sweep add-on
U16 dDeg
move in between this +/- turn range, but
time will only be measured in between
determined if the last attempt was too
slow or to fast (hence, within the time
frame specified by P3806 and P3808), it
will:
The PVED-CLS performs monitoring/diagnostic of the internal electronics, valve operation as well as
external interfacing signals. Each monitoring function triggers a transition to the safe state in case a
fault is detected.
The controller which detects a given fault first, makes a transition to the safe state and informs the peer
controller to also enter safe state. The detecting controller transmits a diagnostic trouble code related
to the root-cause on to the CAN bus.
The controller which were requested to enter safe state, issues ‘SPN 520208 Demanded safe state’.
J1939-73 DM1, DM2 and DM3 diagnostic protocol is supported.
The list of DTC is divided in 7 sections:
• I/O signals: This section lists all failures related to analog and digital inputs & outputs
• CAN Messages: This Section lists all failures related to CAN messages
• Safety Functions: This Section lists all failures caused by Safety functions and externally
triggered safe state DTC’s
• Diagnostic functions: This section lists all failures detected by diagnostic functions
• Internal Hardware: This section lists all failures found on the internal PCB in PVED-CLS
• Software: This section lists all failures detected inside the software
• Monitoring: This section lists all failures detected by crosscheck input signal and calculation
results on SPI between main and Safety UC
Severity
Analogue sensor
4 - Voltage below normal or
3 - Voltage above normal or
4 - Voltage below normal or
connection (open circuit).
2. Wire connected to AD1 short
circuit to a source higher than
calibrated properly.
2. Sensor characteristics have
changed.
3. If two physical separated
sensors are used, one of them
has lost the mechanical
connection or has increased
hysteresis
4. WAS crosscheck threshold
parameter (P3360) does not
match the wheel angle sensor
calibrated properly.
2. Vehicle geometry has changed
and it’s now possible to steer
the wheels further than the
calibrated max points.