🎓 Lesson 14
D5
Designing VT-Enforced Safety Locks per ISO 25119
A VT-enforced safety lock is a software-controlled safety mechanism in ISOBUS systems that prevents dangerous machine operations unless the Virtual Terminal confirms it’s safe to proceed.
🎯 Learning Objectives
- ✓ Design a VT-enforced safety lock architecture compliant with ISO 25119 Part 3 requirements
- ✓ Analyze VT-ECU communication sequences to verify diagnostic coverage ≥90% for lock activation paths
- ✓ Calculate required MTTFd and DCavg values for a PL d safety lock using ISO 13849-1 methodology
- ✓ Apply ISO 25119-3 Annex D to assign safety requirements to VT and ECU subsystems
📖 Why This Matters
In mining and blasting operations, misaligned or unauthorized machine movements—like deploying a drill mast during unstable ground conditions or initiating a blast sequence without VT confirmation—can cause catastrophic injury or equipment failure. VT-enforced safety locks are not optional features; they are legally mandated safety-critical functions in ISOBUS-enabled machinery (e.g., Smart Blasters, automated drill rigs). This lesson bridges functional safety theory with real-world ISOBUS implementation—ensuring your designs meet global certification requirements *before* field deployment.
📘 Core Principles
VT-enforced safety locks operate on three foundational pillars: (1) Separation of safety logic from operational logic—safety decisions reside in dedicated, certified safety PLCs or safety-capable ECUs—not in the VT’s GUI layer; (2) Bidirectional, time-stamped, and CRC-secured VT-ECU handshake per ISO 11783-6 Annex A (Safety Lock Protocol), where the VT issues a signed ‘lock release request’ and the ECU validates authenticity, freshness, and authority before enabling output; (3) Continuous diagnostic monitoring—including VT heartbeat timeout (< 200 ms), ECU internal self-tests, and redundant channel comparison—that forces a safe state (e.g., de-energized outputs) on any fault detection. ISO 25119 mandates traceability from hazard analysis (Part 3) through validation (Part 5) and documentation (Part 7).
📐 Diagnostic Coverage & MTTFd Calculation
To achieve PL d (Performance Level d) per ISO 13849-1, designers must calculate Diagnostic Coverage (DC) and Mean Time to Dangerous Failure (MTTFd) for all safety-related components in the lock path—including VT application logic, CAN bus transceivers, safety relay outputs, and ECU diagnostics. The formulas ensure statistical confidence in failure detection.
Diagnostic Coverage (DC)
DC = (N_detected / N_dangerous) × 100Quantifies effectiveness of diagnostics in detecting dangerous failures within a safety function.
Variables:
| Symbol | Name | Unit | Description |
|---|---|---|---|
| N_detected | Number of dangerous failures detected | count | Failures identified by internal diagnostics before causing hazard |
| N_dangerous | Total dangerous failures | count | All failures leading to loss of safety function |
Typical Ranges:
PL d (ISO 13849-1): 60–99%
SIL 2 (IEC 62061): 90–99%
💡 Worked Example
Problem: A VT-enforced lock uses dual-channel ECU outputs with cross-monitoring. Over 1,200 operational hours, 18 dangerous failures were observed; 15 were detected by diagnostics, 3 went undetected.
1.
Step 1: Identify total dangerous failures = 18
2.
Step 2: Identify detected dangerous failures = 15
3.
Step 3: Apply DC = (detected / total) × 100 = (15 / 18) × 100 = 83.3%
Answer:
The diagnostic coverage is 83.3%, which meets the minimum DCmid requirement (≥60%) for PL d but falls short of DC high (≥90%). To reach PL d with higher confidence, add periodic self-test pulses and redundant CAN FD safety channels.
🏗️ Real-World Application
At Rio Tinto’s Gudai-Darri mine, a Smart Blast Rig integrates a VT-enforced safety lock for ‘Blast Initiation Enable’. Before arming, the VT displays georeferenced blast zone clearance status (from LiDAR + RTK-GNSS), verifies all personnel badges are outside exclusion zones (via UWB mesh), and signs a time-limited cryptographic token. The ECU validates the token signature, checks VT uptime (>30 s), confirms no CAN error frames in last 500 ms, then enables the firing circuit only if all criteria pass. This architecture was certified to ISO 25119-7:2018 and approved by TÜV SÜD for SIL 2 operation.
📋 Case Connection
📋 VT Safety Lock Enforcement for High-Speed Corn Harvesting
Operators bypassing manual safety limits leading to mechanical damage and grain quality loss