Prüfbericht - Handicare AS

TÜV SÜD AUTOMOTIVE GMBH Phone: +49 (0)89 5791 – 1393
Ridlerstr. 57 Facsimile: +49 (0)89 5791 – 4438
80339 München / Munich
Germany
Audit report no.:
377‐0023‐07‐TAES‐A
Manufacturer: Paravan GmbH, 72539 Pfrontstetten‐Aichelau, Germany
Model: Space Drive Page 5 of 19
1.3 Components: • Information Center (touchpad including liquid
crystal display (LCD).
• Vehicle Interface Module.
Safety-relevant system components:
• Drive Module
• Input Device (steering wheel, lever, joystick or
similar)
• Steering DC disk armature motors
• Gas / brake DC disk armature motors
• Backup power supply
2. Safety concept: The Drive Modules are provided with four (4)
homogeneous microprocessors each. The processors are
grouped in two pairs. One (1) Basic Controller and one (1)
Safety Controller each are called a pair. Each pair works in
parallel in what is called the master / slave arrangement,
with the master pair selecting the motor, and the slave pair
being an active backup without access to the motor. The
respective allocation of the master and slave is
automatically changed each time the system is started
(generation via the primary signal). Within the pair, the
Basic Controller selects the motor, and the Safety
Controller monitors the function of the Basic Controller
through evaluation of the setpoints and the actual values of
the sensors or actuators. In the case of an error, it can
switch over the motor selection to the slave pair via an
independent path (error & reset signal) and arbitration
logic. The Basic Controller has also an error & reset path
to switch over the activation onto the slave pair in the
event of a detected error. There is no direct data
interchange between the processors, both within the pair
and between the pairs. Switch-over from the master pair to
the slave pair can only occur from the master pair. The
error & reset lines from the slave pair will only be
accepted by the arbitration logic once the slave pair is in
active control, viz. acts as the master.
An arbitration logic (programmable AND gate), which is
coupled to a switch-over (four relays), waits for the signal
for switch-over of activation between the master and slave
(primary signal line) after each system start and the reset
& error line. While a boot-up routine runs up, the
arbitration logic is tested for activation switch-over.
Accredited under DAR registration no. KBA‐P‐00001‐95 by the Akkreditierungsstelle Kraftfahrt‐Bundesamt / accreditation
agency of the (German) Federal Motor Transport Authority
Federal Republic of Germany.