Fail-safe IWLAN communication controls the “Flying machines according to Leonardo da Vinci” in the Europa-Park amusement park
Flying machines built according to plans devised by Leonardo da Vinci centuries ago are one of the latest attractions in Germany’s largest amusement park, Europa-Park, in Rust outside of Freiburg. Industrial automation technology with wireless and fail-safe Industrial Wireless Local Area Network (IWLAN) and PROFINET communication provides the required safety for the rail-guided “sightseeing flight.” Da Vinci would be impressed!
Even though he was worlds ahead of his time, Leonardo da Vinci would not have imagined this in his wildest dreams: Several of his flying machines, accelerated by passengers with their feet and guided with wireless and fail-safe technology, flying through the Italian landscape in Europa-Park. How could he? After all, there was no electricity, no omnipresent wireless LAN, no Europa-Park, no ETF Ride Systems and no Siemens when Leonardo da Vinci was alive; these are all the key players involved in this success story.
Interactive along the flight path
Leonardo’s biggest dream was to be able to fly. One of his ideas in this respect, the aerialscrew flying machine, is a precursor of modern-day helicopters. This invention has now become a reality at the Europa-Park – with the family attraction “Volo da Vinci” ((Figure 1)). The journey starts and ends in da Vinci’s studio, where the master greets visitors personally and where they can view a collection of interactive models and designs. Visitors board the gondolas designed in the form of the aerial screw flying machine to start their rail-guided, 300 meter long “sightseeing flight” at an altitude of 7 meters over the Italian and German park section. Because there were no motors back then, passengers have to use their legs to help propel the flying machine. One gondola holds up to four passengers: Those who pedal faster will travel at higher speeds. Depending on the pedaling power, the basic speed of 0.6 m/s is continuously increased or reduced to stay in a range from 1.2 m/s to 1.8 m/s. The issue of safety comes up here: How can we prevent collisions and damage or injury under all conceivable scenarios?
Fail-safe automation and IWLAN communication
This fun ride was realized by ETF Ride Systems of Nederweert, Netherlands. The flight path is almost completely automated with Siemens technology. The automation and safety concept was developed in cooperation with the operator, the manufacturer, and the German Technical Inspectorate, TÜV.
The main controller is a PROFINET-capable, fail-safe Simatic S7‑300F PLC, located in the central control cabinet of the equipment room in the station. It communicates via an Industrial Wireless LAN system (IWLAN) in wireless and fail-safe mode with the Simatic ET 200S controllers and drives installed on the gondolas. In addition, different IWLAN access points along the path are connected to the main controller by means of a managed switch, Industrial Ethernet FastConnect modular outlets, and hybrid cables. Antenna segments of various lengths made from RCoax cables are routed along the entire path. These radiating cables emit the radio signal in a defined range to minimize possible interference.
Their counterparts in the distributed control boxes on the gondolas are IWLAN clients ((Figure 2)) with omnidirectional antennas which travel in short distances along the RCoax cable. One of these antennas is always operational, and the client selects automatically and without interruption the antenna with the better signal. This ensures uninterrupted communication, even during segment transitions or when traveling through the diverter gate ((Figure 3)) in the station.
The position of the gondolas is detected by code readers along the route and transmitted to the central safety controller via PROFINET and IWLAN. This safety controller checks the values for plausibility, monitors the specified minimum clearances and initiates the prescribed safety mechanisms via PROFINET and PROFIsafe profiles, if necessary. The maximum travel speed and the direction of travel are also centrally monitored. Sitop power supply units from Siemens supplied by contact conductors ensure reliable power supply to the equipment of the traveling components.
iFeatures for fastest possible transfers and continuous safety
The iPCF capability of the IWLAN access points and clients is a key requirement for consistent real-time communication and therefore approval for safety-related applications. This iFeature – meaning a function specifically designed for industrial use – makes use of the so-called industrial Point Coordination Function[1] and implements a seamless transfer of the mobile clients between two access points within no more than 16 milliseconds. This is more than enough time given the slow travel speeds of up to 1.8 m/s. This feature brakes the gondolas if they do not keep the specified minimum clearance or stops them when they do not keep the safety-related block zone distance, for example when a gondola fails, in order to prevent material damage or injury. This means that the entire system meets Safety Integrity Level SIL3 according to IEC 61508 as prescribed by TÜV.
The described IWLAN infrastructure provides a reliable connection between the main controller and the controllers installed on the gondolas. These consist entirely of interface modules in the form of a distributed I/O system with fail-safe CPU installed in small control boxes. The PROFINET I-device function provides easy integration and fast communication among all controllers, which means that each distributed controller can be PROFINET I/O controller as well as PROFINET I/O device. The gondolas are driven and, when necessary, stopped safely by distributed frequency converters with fail-safe control units. These are connected to motors driving the chassis as well as another motor for the rotary motion of the spiral rotor.
Among other things, the fail-safe frequency converter integrates the safety functions Safe Torque Off, STO, and Safe Stop 1, SS1. This means that the required safety mechanisms can also be implemented locally very quickly if the IWLAN communication were to fail. The STO safely prevents a start-up of the drive when passengers embark and disembark in a purely electronic and thus contactless manner. The safety function SS1 monitors the stop of the gondola drive when the safety-related block zone distance is not observed – all without motor encoder or other encoders and therefore very cost-efficiently.
The safety-related stop is usually initiated by the central CPU. If a gondola fails, all other gondolas are automatically stopped by the central processing unit. If IWLAN communication were to fail – which has not happened once so far – the distributed CPUs would shut down; the motor brakes would be applied in the case of a power failure.
The automation supplier has also provided a Simatic touch panel in the conductor cabin – the control room – connected via Industrial Ethernet for operator control and monitoring. This means that the operating states and positions of the gondolas are displayed during operation. It also lets you select and move individual gondolas to a specific destination, for example, to the maintenance/vacant position via the gate in the station and vice versa.
Problem-free from the start
“Since we commissioned the Volo da Vinci last summer, the operation of the new and first IWLAN-based controller system in the Europa-Park has been better and more stable than we had anticipated for an initial application”, says Markus Spoth, the head of electrical engineering. “So far, there has not been a single failure since the start-up phase that could be traced back to IWLAN technology”, continues Spoth, “neither at high outside temperatures in the summer, wet weather in the fall nor cold temperatures in the winter. We are very happy with the solution and its implementation”. If a failure should ever occur, however, the managed switch permits fast access and convenient troubleshooting by means of Simatic Step 7. Furthermore, there is the option of checking the status of the switch or sending out an alarm automatically, for example, when a connector has been pulled. The PROFINET device is integrated in the controller network and has its own IP address. This means that remote access and web-based management, for example via VPN tunnel, are possible so that any potential problem can be quickly remedied with the help of the Dutch manufacturer ETF Ride Systems.
[1] an expansion of the IEEE 802.11 standard