Download 2. abbreviation

Document:
Software description
Version
1.0
Issue date:
29.05.2012
Page
5 of 12
Figure 1: FTA complete system
If the SC fails with this system setup, the system function depends on the pilot’s reaction.
Because of these safety reasons we want to avoid the full dependency of the HMI-panel as
much as possible.
3.4. MCC2 Backup
Description of Table 2:
When SC is working it will send a message to MCC2, telling it that MCC1 or MCC3 is
operational. Then if the SC were to break down, the MCC2 will lose the message from the
SC and it will assign itself as operational. When MCC1 or MCC3 lose contact with SC they
will go in standby mode. This way the system will automatically assign MCC2 as the
operational MCC if the SC breaks down. And we will avoid four of the seven events resulting
with HMI.
EVENT:
SC
MCC1
MCC2
MCC3
1
V
V
V
V
2
X
V
V
V
3
V
X
V
V
4
X
X
V
V
MCC2 is chosen if contact with SC is lost, or SC has failed
5
6
7
8
9
10
11
12
13
V
X
V
X
V
X
V
X
V
X
V
V
X
X
V
V
X
X
V
V
X
X
X
X
V
V
V
V
X
X
V
V
V
V
X
X
X
X
X
X
RESULT MCC1 MCC2 MCC2 MCC2 MCC1 HMI
Table 2: MCC2 Backup
MCC3 HMI MCC1 MCC2 MCC2 MCC2 MCC1 HMI
14
15
16
V
X
X
X
X
X
X
X
SYSTEM FAIL
SYSTEM FAIL