Functional Safety simulation using SaberRD

Transcription

1 Functional Safety simulation using SaberRD April 7, 2016 Michael McDermott/Thomas Hedges Electrical Simulation and Analysis

2 Megatrends drive our technology portfolio Safe Green Connected - Active Safety Systems - Driver State Alerts - Safety Electronics - Battery Disconnects - Human Machine Interface - Occupant Classification Systems - Gasoline Direct Injection - Diesel Fuel Injection Systems - Fuel Economy & Performance Technologies - Hybrid & Electric Vehicle Technologies - Vehicle Infrastructure Interface (VII) & Vehicle-to-Vehicle Interface - Telematics - Digital Receivers - Connected Vehicle - Satellite, Audio, Video & Data Systems Focused on solutions to customers problems

3 Delphi the Innovation Inside your vehicle 1 Automated Driving Features 2 Advanced Powertrain Technologies 3 GDi Fuel System 4 Aluminum Cable 2 3 The most sophisticated electronic device you own, your vehicle, has more computing power than the Space Shuttle, with up to 50 computers beneath its skin. 1 5 Safety Restraint System Connectors 6 HEV/EV Power Systems 7 Electrical Architecture

4 Insuring Product Safety Automotive industry is requiring... Compliance to ISO26262 Component Level DFMEA. (Design Failure Mode Effects Analysis)

5 What is ISO26262? Component failures evaluated for impact on safety goal Multiple faults per component Open/short/value change Analysis of Safety Measures Is fault detected by diagnostics?

6 Component Level DFMEA/DFMEDA Design Failure Mode Effects Analysis/ Design Failure Mode Effects and Diagnostic Analysis Component by component evaluation of system impact of fault. Evaluation of diagnostic strategy to detect the faulted component Requires evaluation of multiple faults per component (i.e. open, short, change in value...) Required for all components, not just functions with safety goals. Longer analysis and report

7 Example : DFMEDA Switched Mode Power Supply Power Rating Exceeded 12V 12V Voltage regulation maintained. 12V Voltage ratings not Is it a safe exceeded. state? Will component damage occur? Can we detect it & compensate? What other features/functions are effected by this fault? 12V The fault is detectable & can be mitigated. Primary Function is to maintain 13V <= SMPS_OUT <= 15V SMPS_OUT > 15V is a high-risk, unsafe state. SMPS_OUT < 13V is a low-risk, undesirable but safe state.

8 Resource requirements for fault analysis Typical automotive electronics module can contain 3k+ components Components may have 3-7 failure modes Teams consists of Hardware, Software, Mechanical, Systems, etc Assuming 5 minutes/ item, this task would take about 1000 work-hours, (125 total work days)

9 This is a large task!

10 The Solution...

11 5V_LV 5 v_dc prbit_l4 BIT STREAM HV_OUT_CURR_SENSE 12V_LV 12 i_pwl f_rst v_dc HV_OUT_CURR_SENSE_RET R R conv_d2var d2var R R R R var2v prbit_l4 + Control to Voltage BIT STREAM pwl:[0,0,20m,0,20.001m,0.5,100m,0.5, m,0,120m,0,12m,5,170m,5,17m,0.5,1,0.5] OVERCURRENT OVERVOLTAGE SET 1 - C18 100n U37D oct_en 750 R sig_out_h:5 R262 R260 1k V_LV conv_d2var d2var 1k U37A lm2902_3 U36 R FLT_RESET var2v + Control to Voltage v ee vcc C19 100n 5V_LV DCDC_ENABLE DCDC_ENABLE - OC_TEST IDC_FDBK R268 10k R k U37B U37C R577 1k C99 1u D77 baw56 C22 100n HV_OUT_I_SENSE 5V_LV conv_d2var d2var sig_out_h:1 R265 1k R k R k DCDC_IC_ENABLE PFC_IC_ENABLE conv_d2var d2var sig_out_h:1 u2_in u2_ip c16 100n R k lm2903_3 U35 12V_LV vcc v ee u2_o 5V_LV R271 2k 1u R44 1k C166 R270 10k D36 bas45_sl U34A nand2_l4 U34B nand2_l4 10n C112 R nand2_l4 buf_l4 conv_d2var d2var sig_out_h:1 OVERCURRENT SET 1 d c lk SET 1 s r q D FF qn Fault Simulation Overview 1. Simulation Design Transformer Primary Current Normal Operation : 1A to 15A +/-2% Overcurrent Fault : 2 A (Nom) The transformer has a ratio of 1:100. Overcurrent Detect Circuit Normal Operation : 10mA to 150mA +/-2% Overcurrent Fault : 201 ma (Nom) Fault Reset is armed when high ('1') & requires a low pulse to clear the latched state. The OC_Test is used to force the OVERCURRENT fault when the input current is zero. i.e. it verifies that the H/W OC detect is operational. Gain is 725 V/A setn resetn tau=10ms OVERCURRENT Goes to the up & indicates that a OC condition has been detected. TSR78: HVDC Output overcurrent shall be detected by software implementation within 2ms. These signals go to the driver IC's to disable the hardware. TSR464: HVDC Output overcurrent shall be detected by hardware implementation. asserted low Mimics software overcurrent test If test fails, Driver is disabled. Simulate with Functional Safety Tool Pass/Fail Results for Each Failure Mode 2. Component Failures 3. Measures Of results 4. Pass/Fail Criteria

12 SET 1 + Voltage - v ee vcc + Voltage - D77 baw56 vcc v ee buf_l4 SET 1 d c lk SET 1 s r D FF q qn Example: Current Measurement Circuit 5V_LV prbit_l4 BIT STREAM 12V_LV f_rst conv_d2var d2var var2v Control to FLT_RESET Fault Reset is armed when high ('1') & requires a low pulse to clear the latched state. The OC_Test is used to force the OVERCURRENT fault when the input current is zero. 12V_LV i.e. it verifies that the H/W OC detect is operational. 5V_LV 5 v_dc HV_OUT_CURR_SENSE 12 i_pwl v_dc HV_OUT_CURR_SENSE_RET R R R R R R prbit_l4 BIT STREAM pwl:[0,0,20m,0,20.001m,0.5,100m,0.5, m,0,120m,0,12m,5,170m,5,17m,0.5,1,0.5] C18 100n oct_en Transformer Primary Current Normal Operation : 1A to 15A +/-2% Overcurrent Fault : 2 A (Nom) The transformer has a ratio of 1:100. Overcurrent Detect Circuit Normal Operation : 10mA to 150mA +/-2% Overcurrent Fault : 201 ma (Nom) OVERCURRENT OVERVOLTAGE R U37D 750 R262 R260 1k conv_d2var d2var sig_out_h:5 U36 lm2902_3 R Gain is 725 V/A 5V_LV 1k U37A var2v Control to C19 100n 5V_LV DCDC_ENABLE OC_TEST IDC_FDBK R268 10k R k U37B R577 1k C99 1u C22 100n HV_OUT_I_SENSE 5V_LV R265 1k conv_d2var d2var sig_out_h:1 R k R k u2_in DCDC_IC_ENABLE u2_ip c16 100n R k U35 lm2903_3 u2_o R271 2k 1k 1u R44 C166 setn R270 10k D36 bas45_sl resetn U34A nand2_l4 nand2_l4 tau=10ms OVERCURRENT Goes to the up & indicates that a OC condition has been detected. TSR78: HVDC Output overcurrent shall be detected by software implementation within 2ms. C112 10n U34B R nand2_l4 These signals go to the driver IC's to disable the hardware. TSR464: HVDC Output overcurrent shall be detected by hardware implementation. conv_d2var d2var sig_out_h:1 OVERCURRENT asserted low Mimics software overcurrent test If test fails, Driver is disabled. DCDC_ENABLE U37C PFC_IC_ENABLE conv_d2var d2var sig_out_h:1 Safety Requirement is to shut down if load current is too high for a certain period of time.

13 4 Steps for performing fault simulation. 1. Capture Design 2. Create List of Component Faults 3. Create simulation Experiment 4. Run Experiment and view results

14 Step 1: Capture Design Model features Current Measurement Circuit Hardware overcurrent shutdown Sofware overcurrent shutdown Circuit self-test during powerup This is the most time intensive part of this process

15 Step 2. Create List of Component faults Fault list can be auto-generated from simulation schematic For this example, faults were open, short, or stuck at This example had 160 different faults.

16 Steps 3: Create Experiment Loop through fault list Run transient analysis Measurements Pass/Fail criteria: 3 Scenerios identified.

17 4. Run Experiment and View Results No safety measure Hardware Detection Software Detection Pass/fail criteria was defined 3 different ways 160 fault simulation created in a few seconds

18 DFMEA Study Functional Safety add-on tool also evaluated for usefulness in determining the effects of failures in creation of DFMEA document. Advantages Saves significant engineering time. Reduces subjectivity Reduces errors Can provide supporting data (measurement log feature) Auto-generated report

19 Summary Fault simulation is quite useful for compliance to ISO26262 and DFMEA Can greatly reduce engineering resources while improving accuracy of results. Can be used to create data for functional safety calculations Can automate part of generation of DFMEA

20