AVL SCHRICK project summary GA05 / final meeting 18./19. September 2014 Gothenburg, Sweden
AVL SCHRICK work packages and deliverables overview Work Package 5 Functional Safety (WP lead) D 5.1 - Item Definition D 5.2 - Hazard & Risk Analysis D 5.3 - Concept powertrain system FMEA D 5.4 - Functional Safety Concept Work Package 3 Calibration Process definition (WP lead: VCC) WPs have been modified during project due to changes in work split between VCC, Getrag and SCHRICK D 3.3 - Initial Calibration Process D 3.4 - Calibration Process and Generic Test Planning (D3.5 - removed) Work Package 4 Electric Car / City Car (WP lead: AVL) D 4.2 - Industrialized OS software package 18/19-09-2014 OPTIMORE - Final Meeting 2
Functional Safety Development Intro, Aim and Objectives Why Functional Safety? Each function has a potential risk to fail and might cause harm Risk: Combination of probability and severity of potential harm Harm: Injury or death of persons Functional Safety Development means identification and avoidance of unacceptable risks for powertrain design and operation strategy 3
Functional Safety Development Intro, Aim and Objectives In our case: Avoidance of unacceptable risks due to hazards caused by mal-functional behavior of safety related Electrical / Electronic / Programmable Electronic (E/E/PE) Systems Generic approach to generate a functional safety concept which can be applied for all 3 REEVs of the OPTIMORE partners As SOP not in project focus, limitation to functional safety analysis of concepts 4
Functional Safety Development Intro, Aim and Objectives IEC 61508 Functional safety E/E/PE systems IEC 61508 is universal standard for safety related E/E/PES Documentation Overall safety lifecycle Requirements Fault avoidance Calculation Safety Parameters Requirements Safety Integrity Specification of Process: Avoid systematic errors during entire development phases (design, implementation, integration, production ) Methods (safety analysis, e.g. FMEA, FTA ), Tools, Traceability Specification of Technical Implementation: Adequate HW/SW architectures to achieve the agreed safety goals Coding rules, fault injection test, diagnostic mechanism 5
Functional Safety Development Technical Approach ISO DIS 26262 has been derived from IEC 61508 for automotive industry EN 50128 Railway ISO FDIS25119 Tractors and agricultural machinery IEC 61800-5-2 Electrical drives IEC 61508 ISO/DIS 26262 Automotive IEC 61511 Process industry IEC 60601 Medical ISO 26262 is applied to safety-related systems that include one or more E/E systems* and that are installed in series production passenger cars with a max gross weight up to 3,5 t. * E/E system: System that consists of electrical and/or electronic elements, including programmable electronic elements 6
Functional Safety Development Technical Approach Overview about functional safety process according to ISO 26262 Functions overview Preliminary architecture Misuses Hazard Analysis & Risk Assessment according ISO 26262 Initial Functional Safety Concept Review by OPTIMORE partners Analysis & Review (Review, Fault Tree Analysis, FMEA, etc.) Detailed Functional Safety Concept Derivation of requirements, ASIL and countermeasures for SW and electronic HW Derivation of requirements, ASIL and countermeasures for the vehicle, service, HV system, instruction manual, etc. Technical safety concept Derivation of component specifications from functional safety concept Derivation of vehicle, service, etc. specifications from functional safety concept Implementation and Testing (DVP) Integration & System tests Software & Electronic (HiL, SiL, Fault-injection, etc) HW-Tests Detailed test planning for Hardware and whole vehicle Requirement Management and Coordination of the Safety Activities 7
Content Functional Safety Development Task details / activities 8
Functional Safety Development - Task details / activities Outcome of the functional safety development: Deliverables # Description Deliverable # 1 2 Item definition according to ISO 26262 with respect to functional safety and HV safety Generic hazard and risk analysis (H&R) on powertrain level D5.1 D5.2 3 Powertrain system FMEA D5.3 4 Functional safety concept (Definition of functional safety requirements and HV safety requirements) D5.4 9
Content Functional Safety Development Item Definition 10
Functional Safety Development - Task details / activities Item definition according to ISO 26262: Aim: Description of the system and fixation of its boundaries for the safety activities Adequate understanding of the system for safety analysis Proceeding: Description of the system under consideration of information coming from the different partners Selection of the safety functions for which safety activities will be carried out Detail description of the selected functions and receive a review by AVL, CRF and VOLVO Implementation of review results and creation of final version 11
Functional Safety Development - Task details / activities Item definition according to ISO 26262: Contents of item definition: Standards to be applied Environmental requirements Content of the item (overall vehicle architecture including sensors/actors) Functional requirements Mechanical interfaces Context of the item (boundaries to other systems) Human machine interface Manufacturing and service requirements (if available and needed) 12
Content Functional Safety Development HRA Hazard & Risk Analysis 13
Functional Safety Development - Task details / activities Generic hazard and risk analysis (H&R) on powertrain level: Aim: Identification the potential hazards of the system Classification the hazards Specification of safety goals Proceeding: Functional description completion (based on the Item definition) Identify operational situations setting (operation modes) Evaluation of risk parameters S (Severity), E (Exposure), C (Controllability) Determination of ASIL (QM, A, B, C or D) Formulation of a safety goal for each identified hazard and receive a review by CRF and VOLVO Implementation of review results and creation of final version 14
Functional Safety Development - Task details / activities Generic hazard and risk analysis (H&R) on powertrain level: ASIL Example: S3 explosion and fire E4 car is parked in garage during charging C3 uncontrollable since no driver/ passenger in vehicle S1 S2 S3 C1 C2 C3 E1 QM QM QM E2 QM QM QM E3 QM QM A E4 QM A B E1 QM QM QM E2 QM QM A E3 QM A B E4 A B C E1 QM QM A E2 QM A B E3 A B C E4 B C D 15
HV Fuse HVIL Source L1 N Gnd 3 1 3 4 Pre Charge Circuit 3 4 1 3 1 Caption Hybrid CAN HV cable + HV cable - HVIL Chassis Grounding 4 1 2 2 2 4 2 Bat. Current Bat. Cool. Temp. Cell Voltage Cell Temp. Bat. Voltage Bat. Temp. BMS CAN HVIL HV Bus Plug HV Bus Plug Signal Plug HVIL DC/DC CU Kl. 15 CH MCU - GEN MCU - TM TM control TM control TM Temp. AC/DC Inverter TM Temp. TM speed TM speed LV Bordnet CH HVIL 3 HV Fuse 4 1 2 Traction Motor OPTIMORE - Optimised Modular Range Extender for every day customer usage Identification and evaluation of 83 hazards 40 hazards rated with QM 17 hazards rated with ASIL A 11 hazards rated with ASIL B 2 hazards rated with ASIL C 3 hazards rated with ASIL D AC Chagring Socket HV Battery Pack Charger AC/DC Inverter Passive Discharge Compressor PTC Heater DC/DC Converter Passive Discharge CH HVIL HVIL Generator Service Disconnect CAN TM position TM Inv. Output Voltage TM Inv. Output Current TM Inv. Input Voltage TM Inv. Input Current TM Inv. Temp. DCDC Output Voltage DCDC Output Current DCDC Input Voltage DCDC Input Current DCDC Conv. Temp. Hazard & Risk Analysis Results CAN TM position TM Inv. Output Voltage TM Inv. Output Current TM Inv. Input Voltage TM Inv. Input Current TM Inv. Temp. Passive Discharge These safety goals, extracted from the H&R analysis, are used for the FSC form sheet. 16
Content Functional Safety Development FMEA 17
Functional Safety Development - Task details / activities Powertrain system FMEA: Aim: Identification of potential failure modes using systematic approach based on system and sub-system functions Rating of severity and likelihood to estimate effects and define countermeasures Cross-referencing with H&R results Proceeding: Identification of powertrain components on system and sub-system level Identification of functions and failure modes Rating of each failure mode and cross-check with H&R Review by CRF and VOLVO Implementation of review results and creation of final version 18
Powertrain system FMEA: The system FMEA is performed with APIS IQ-FMEA tool: Structure is based on vehicle topology: Powertrain level System / Subsystem level Component level 19
Output FMEA form sheets Example 20
Output Report with summary of all preventive and detection action clustered for each component Example HV 3-Phase Power Cabling of Traction Motor Heat shielding Insulation / connector specification Monitoring of HV insulation Monitoring of xcu state by HCU Specification of 3-phase cable insulation requirements Specification of 3-phase cabling efficiency Specification of traction motor 21
Content Functional Safety Development FSC 22
Functional Safety Development - Task details / activities Functional safety concept : Aim: Derive safety goals in functional safety requirements Allocation to the elements of the safety architecture concept Proceeding: Definition attributes for each safety goals: (ASIL), operating mode, fault tolerant time spans, safe state, emergency operation times, functional redundancy Decomposition of safety goals in safety measures and mechanisms (safety requirements) Development of safety architecture concept Allocation of each safety requirements and receive a review by CRF and VOLVO Implementation of review results and creation of final version Implementation of safety concept by OPTIMORE partners (CRF, IVECO, VOLVO, AVL) 23
Safety Goal from HRA These combined safety goals, extracted from the HRA analysis, are used for the FSC form sheet. SG Safety goal from HRA SG1 Avoid unintended Boost-Mode of DC/DC converter SG2 Ensure proper separation of HV battery and remaining HV system in case of accident Avoid unintended power up Ensure proper power down of the HV system SG3 Avoid start of RE when driver not in vehicle SG4 Avoid unintended torque in creep mode Avoid unintended negative torque in creep mode Avoid unintended deceleration when vehicle in motion Avoid unintended torque loss Avoid unintended acceleration when vehicle in motion Ensure stable vehicle operation during acceleration Ensure stable vehicle operation during constant driving Ensure demanded torque direction during acceleration Ensure demanded torque direction during constant driving Safety goal in FSC Avoid unintended Boost-Mode of DC/DC converter Avoid unintended HV voltage Avoid unintended Range Extender run Avoid unintended torque ASIL (max. value) B B B C 24
How to handle ASIL D s in our Functional Safety Concept According to the ISO 26262 part 9, the ASIL decomposition allows the apportioning of the ASIL of a safety requirement between several elements. The following decomposition scheme was chosen: 25
Output of the Functional Safety Concept For the nine identified safety goals, in total 71 safety requirements were defined (excluding requirements with QM rating, which are defined to be not safety critical). The requirements were split on the different control units. Control unit / Component Number of safety requirements with ASIL A, B, or C HCU 25 BMS and HV battery 21 ECU 6 MCU 5 DC/DC 5 TCU 4 LV battery and supply system 2 Brake Control Unit 1 Onboard Charger Control Unit 1 HV system and components 1 26
Output of the Functional Safety Concept Functional Safety Concept Includes: Introduction Functional Safety Concept Methodology Derivation of Functional Safety Requirements 27
Content Functional Safety Development WP / Deliverables timing 28
WP 3/5 - Completion Status WP5 D5.1 Item defintion completed D5.2 Hazard and Risk Analysis completed D5.3 Generic System FMEA completed D5.4 Functional Safety Concept WP3 D3.3: Calibration Process (Sept. 2013) D3.4: Detailed Hybrid Calibration Process (Dec. 2013) 29
Contact: Martin Baum AVL Schrick GmbH Phone: +49 2191 950-355 E-Mail: martin.baum@avl.com Thank you for your attention!