System Safety Design of the SIRIUS 2001 Drive-by-Wire Car In Retrospect. Per Johannessen; Volvo Car Corporation; Goteborg, Sweden

Transcription

1 PROCEEDINGS of the 21t INTERNATIONAL SYSTEM SAFETY CONFERENCE Sytem Safety Deign of the SIRIUS 2001 Drive-y-Wire Car In Retropect Per Johanneen; Volvo Car Corporation; Goteorg, Sweden Jan Torin; Chalmer Univerity of Technology; Goteorg, Sweden Keyword: Deign Method, Ditriuted, Electrical Architecture, Redundancy Strategie Atract In the automotive indutry, drive-y-wire technology implemented in vehicle i rapidly increaing Preently thee ytem have fail-afe tate or mechanical ackup The next tep in the evolution i the removal of mechanical ackup and the introduction of y-wire ytem with no fail-afe tate, eg teery-wire Thi technology i y nature afety-critical and require pecial attention in the deign proce Since afety i a ytem iue, it i et implemented y taking a holitic view of the application Traditionally, redundancy to increae the dependaility of the ytem i added at component level However, thi give a cotly implementation By applying a holitic top-down approach when implementing redundancy, it i poile to etter utilize ytem reource, in term of redundancy Thi paper decrie the development of the electrical ytem architecture of one drive-y-wire car that wa uilt y tudent at Luleå Univerity of Technology together with Volvo Car Corporation The car uytem; four wheel teering, rake, throttle, and clutch are electrically controlled In the electrical ytem there are ix computer node; one for each wheel and two central node for driver interface The deign proce ued tart with a functional failure analyi of the intended ytem, which generate ytem afety requirement Next, electrical node are added where enor and actuator are located in the car uing the aumption that wherever there are electronic the additional cot for adding a microproceor i low Thi give the non-redundant electrical architecture Further, y applying a pecial allocation patter and roadcating aic enor data, the communication andwidth i kept at a minimum Finally, thi nonredundant architecture i made dependale y uing the three different redundancy pattern It i the author opinion that thi deign proce i uitale for mot control-y-wire application It advantage are a high degree of redundancy uing a minimal amount of hardware and low requirement on communication andwidth Introduction There i an ever-increaing demand on the automotive indutry in area like afety, driving pleaure and environment Thi require new complex functionality to e implemented in car The automotive indutry i cloe to a reakeven point, where the cot for implementing more functionality in traditional mechanical ytem i comparale to implement it in drive-y-wire ytem When further introducing more functionality, y-wire ytem will e the mot cot-effective alternative In a y-wire ytem, there are no mechanical linkage etween the different uytem, eg there i no teering column etween the teering wheel and the front wheel in a teer-y-wire car Intead of the mechanical linkage there are electrical ignal Therefore, there are new dependaility requirement on the electrical ytem Mot y-wire ytem will e realized in ditriuted real-time ytem with high requirement on dependaility and cot One of the mot critical component in a ditriuted ytem i the communication ytem, which require pecial attention However, a ditriuted ytem can e made more dependale than a centralized ytem y allocating the functionality to the ditriuted node in certain way For the automotive indutry there are trict requirement on ytem cot and ytem dependaility On the other hand, more reource can e pent on development due to the high numer of produced unit 319

2 PROCEEDINGS of the 21t INTERNATIONAL SYSTEM SAFETY CONFERENCE To develop ytem with uch requirement, there i a need for tructured deign method and deign principle One purpoe of thi project wa to verify deign method and deign principle from reearch carried out at Chalmer Univerity of Technology and Volvo Car Corporation The name of the project i Siriu 2001 (ref 1) Siriu i a final year coure in the MSc program in engineering deign at Luleå Univerity of Technology The coure project are developed together with Volvo Car Corporation Thi year there were 41 tudent working together with two indutrial PhD tudent from Volvo Car The deign tak wa Build a drive-y-wire car with four wheel teering and oth right and left hand ide teering A Lotu Super 7 replica wa choen a the platform ince it i quite mall and ha open wheel houing that are eay to modify Although, there were lot of work in the mechanical tool hop to enale the introduction of y-wire technology The major challenge in the project wa to deign and implement the control ytem in an electrical architecture Thi paper tart y decriing the deign method that wa ued for the electrical ytem architecture in ection 2 The following three ection decrie how thi method wa applied to the SIRIUS car Finally ection 6 decrie the reult of the project and pecifically the electrical architecture Deign Method The ued deign method i pictured in figure 1 By performing a Functional Failure Analyi (FFA) (ref 2) early in the deign proce, everal deign requirement are generated Thi proce, which tart with a deign tak modeled a UML Ue cae and generate deign requirement uing FFA, i decried in ection 21 and originate from the work done in reference 3 Deign Tak Cl a of Function Failure Failure Effect on Sytem Severity Acceleration Acceleration Omiion No acceleration availale Car eventually top Marginal Commiion Sudden acceleration Car increae it peed rapidly Critical Stuck Contant acceleration Car increae it peed Critical Driver Deacceleration Omiion No deacceleration poile Car can't top Catatrophic Deacceleration Commiion Wheel lock Car top during kidding Catatrophic Stuck Contant deaccelerat ion Car continue to rake Critical Steering Omiion No control of teering Car looe taility Catatrophic Commiion Steering when unintended Car change trajectory unintended Catatrophic Steering Stuck Car maint ain it t urning angle Car continue on it t rajectory Critical Ue Cae FFA 4 Deign Requirement 6 Tak Graph 5 Redundancy Strategie Phyical Car Non-redundant Electrical Architecture Figure 1 - The deign method ued in the Siriu 2001 project Redundant Electrical Architecture The development of the electrical architecture i decried in detail in reference 4 In the firt tep, a nonredundant electrical architecture i derived from the ytem functional requirement and a phyical decription of the ytem The ytem functional requirement are roken down from the Ue cae into a tak graph In the non-redundant electrical architecture, a computer node i added wherever there i an actuator or a enor in the car Thi proce i further decried in ection 22 To make the ytem dependale, three different redundancy trategie are ued in a top-down approach, which i introduced in ection 23 The dependale electrical architecture i developed from the non- 320

3 PROCEEDINGS of the 21t INTERNATIONAL SYSTEM SAFETY CONFERENCE redundant electrical architecture Hardware redundancy i added wherever needed to meet the ytem dependaility requirement Thi proce i decried in ection 24 and reult in a dependale redundant electrical architecture Deign Requirement: To get ytem requirement, the work done in reference 3 i ued The ytem functionality i given in the deign tak and it i modeled in UML Ue cae and viualized in a UML Ue cae diagram Ue cae model a top-level view of the functionality that the ytem hould provide to a uer (ref 5) By doing a failure analyi on thi model, the identified failure are the one that the uer will experience Thee are the failure that the ytem hould prevent from occurring One method uitale for the hazard analyi i Functional Failure Analyi, FFA The ojective of the FFA i to identify and claify functional failure at early tage in a ytem development cycle Since FFA conider ytem function and not ytem deign, it i uitale in thee early deign phae The ynthei of FFA and Ue cae i a powerful comination that fulfill the need to do a top-level hazard analyi A reduced et of the guideword wa ued; omiion, commiion and tuck Thee are the poile ytem failure guideword, ie a ytem can only fail in an omiion, a commiion or a tuck tate When uing other guideword, it i often difficult to tell them apart at thi early deign level Each comination of function and guideword i interpreted to a functional failure The failure i further analyzed to get a ytem effect and a failure cla y uing imulation, teting or experience The failure clae that were ued in thi pecific analyi are taken from IEC (ref 6) They are Catatrophic, Critical, Marginal, and Negligile There are everal deign requirement from the FFA analyi The functional failure everity level put dependaility requirement on the ytem function to e deigned and implemented and alo on the deign proce A function with a high everity cla would have to meet tricter dependaility requirement and have a more thorough deign proce, a oppoed to a function with a low everity cla Further, the ytem failing tate are; commiion, omiion and tuck By comparing the functional failure everity level for thee tate, it i poile to put deign requirement on the analyzed function When the function fail, it hould fail in the leat evere tate Thee requirement hould e conidered in all uytem that implement that function, eg the computer, electrical and mechanical uytem One further advantage of FFA i the poiility to ue the identified failure a input to a Fault Tree Analyi, FTA, according to the work done y Papadopoulo in reference 2 Non-redundant Electrical Architecture: With a ditriuted ytem, there are everal poiilitie on where to put computing reource a well a control law and logic In thi tep, which i hown in figure 2, it i the phyical decription of the car together with a functional model of the ytem that i the input to the deign of the allocated non-redundant electrical architecture The architecture i made dependale y adding redundancy at different level in ucceive tep, a decried in ection 23 and 24 Functional model: The functional model i a formal decription of the ytem function that will e implemented, which i derived from the Ue cae It i analyzed and the ytem function are divided into u function until they can e mapped to one of the aic element: enor, actuator or tak The actuator and enor repreent phyical component while the tak repreent oftware component Tak graph: The aic element interrelationhip are hown in the tak graph where the control ytem data flow from enor through tak to actuator i hown Functionality located outide the local network i connected with gateway, which are treated a enor or actuator The data flow in tak graph give important input when deciding on where to locate the communication u a well a where different tak are et allocated The communication u i located uch that communication i kept at a minimum It i alo recommended to ue a roadcat u (ref 4) A preliminary communication and proceing analyi i alo done in thi tep to enure that the function are realizale in a ditriuted network 321

4 PROCEEDINGS of the 21t INTERNATIONAL SYSTEM SAFETY CONFERENCE Function Senor Tak S 1 S A 1 A S N A M S 1 A 1 A 2 A N S N Phyical requirement Figure 2 - The development of a non-redundant electrical architecture Deigning the Non-redundant Electrical Architecture: The phyical location of enor and actuator element in the tak graph give the non-redundant hardware architecture Wherever there i a enor or an actuator, there will alo e a computer node The aumption i that the cot to add a node wherever there already i electronic i low Additional node with gloal deciion are avoided y ditriuting all deciion and data proceing tak to exiting node By doing thi, cot i kept low and there are fewer component that can fail Further, the development of mart enor node with a network interface will upport thi approach Tak allocation: In reference 4 it i hown that y allocating all control functionality to the actuator node, communication i minimized Furthermore, the approach i to allocate all tak redundantly to imilar actuator node, uing the calale oftware redundancy approach a decried in ection 23 Thi give a high degree of hardware fault detection and fault tolerance for tranient fault without extra hardware Redundancy Strategie: Redundancy hould e handled in a top-down approach, tarting at ytem level and ending at component level A ottom-up approach can t utilize the ytem full potential and interacting uytem In thi work there are three variou type of redundancy ued, which are introduced in reference 4 and hown in figure 3 At the top level, there i the intrinic redundancy approach It originate from when there are more actuator or enor in the ytem than degree of freedom The vehicle peed of a car could for intance e meaured directly at the wheel or y the engine rpm together with the elected gear ratio Several poiilitie of controlling the car peed i y uing all four wheel rake, in mot ituation it i enough with two or three out of four wheel rake and to ome extent it i poile to ue the engine of a car to reduce the peed The challenge i to identify and utilize the intrinic redundancy However it provide a high degree of fault tolerance at a low cot It i implemented at the application level The next level i the calale oftware redundancy that i implemented during the oftware allocation proce It i calale to achieve different degree of tranient fault tolerance y allocating oftware redundantly in a ditriuted computer architecture following certain pattern Thi technique i applicale when the ytem ha a gloal control determining how the ytem a a whole hould ehave Thee gloal control deciion are fulfilled y utilizing local actuator with their control loop Thi i the cae for mot y-wire ytem The gloal control could for intance e to determine the trajectory and peed of an aircraft or a car 322

5 PROCEEDINGS of the 21t INTERNATIONAL SYSTEM SAFETY CONFERENCE Senor A A Intrinic Redundancy Senor B Senor C Senor M Senor Adaption Gloal B C Redundancy N Scalale Software Redundancy Figure 3 - Three different type of redundancy for a y-wire ytem, all ued in the Siriu 2001 project The calale oftware redundancy i mot uitale when the computational reource for calculating gloal control deciion are ignificant large, a compared to the local control calculation, a illutrated in figure 3 With thi prerequiite, it i poile to achieve a high degree of tranient fault tolerance at a low overhead in extra communication and computational reource The calale oftware redundancy allocate gloal control calculation redundantly to all actuator node requiring thee reult and add local control calculation for the local node and redundantly for other node in the network Thee redundant control calculation are ditriuted to and voted on in the pecific actuator node The numer of redundant calculation i determined y the tranient fault tolerance requirement for the ytem See figure 4 for an example where a ditriuted teer-y-wire ytem i implemented The gloal control and oth front wheel local control calculation are allocated redundantly to oth front wheel node Thi redundancy method give a high degree of tranient fault tolerance at a low overhead in communication and calculation reource Senor A Senor B Senor M Senor Adaption Gloal Steer Steer FR Steer FL Steering FR Steering FL N FR Voter G G Voter FL Figure 4 - Example of oftware allocation where calale oftware redundancy i ued in a teer-y-wire car At the ottom level, there i the traditional local redundancy, eg utilizing replicated enor It i required to tolerate hardware failure However it i cotly and increae the failure rate of the whole ytem Redundant Electrical Architecture: The lat tep in the proce of developing the electrical architecture i to add hardware redundancy wherever needed to meet the afety requirement Redundant hardware i mainly added to tolerate permanent failure Whenever oftware can handle fault, it i preferale ince it i more cot-effective (ref 7) Further, y minimizing hardware, maintainaility cot will e low Additional hardware ha a failure rate that add up to the ytem total component failure rate In thi tep, tatitical analyi of ytem failure proaility i ued Hardware replication in form of redundant actuator and enor component together with computer node and network ue i added to the ytem in order to reduce the ytem failure proaility to meet the deign requirement In order to do the tatitical analyi it i neceary to etimate component failure rate and identify reaonale error detection coverage for the node, actuator, enor and communication network Thee etimate will ecome deign requirement, which have to e verified, for the component that are ued in the implementation 323

6 PROCEEDINGS of the 21t INTERNATIONAL SYSTEM SAFETY CONFERENCE Sytem Requirement It wa only the chai functionality of the Siriu car that wa conidered in the deign of the electrical architecture Other functionality of the car wa not in the cope of the project and not a afety critical Ue Cae: A a firt tep in the proce to derive dependaility requirement for the ytem, the given deign tak need to e interpreted and formalized Figure 5 how how the chai functionality wa modeled in a Ue cae diagram The driver hould e ale to control the peed of the car and teer it Speed control i further divided in acceleration and retardation Even if it i a imple ytem, it i ueful to have a common view of what i eing implemented Driver Speed Acceleration Retardation Steering Figure 5 - The chai functionality of the Siriu 2001 car in a Ue Cae Diagram Functional Failure Analyi: An FFA analyi i performed on the chai functionality decried in ection 31 in accordance to ection 21 The reult of the analyi i hown in tale 1 Tale 1 - The FFA analyi on the chai functionality for the Siriu 2001 car Function Cla of Failure Failure Effect on Sytem Severity Acceleration Omiion No acceleration availale Car eventually top Marginal Commiion Sudden acceleration Car increae it peed rapidly Critical Stuck Contant acceleration Car increae it peed Critical Retardation Omiion No retardation poile Car can't top Catatrophic Commiion Wheel lock Car top during kidding Catatrophic Stuck Contant retardation Car continue to rake Critical Steering Omiion No control of teering Car looe taility Catatrophic Commiion Steering when unintended Car change trajectory unintended Catatrophic Stuck Car maintain it turning angle Car continue on it trajectory Critical From the FFA analyi there are nine identified functional failure Thee failure will et requirement on the ytem tate, for which it i leat evere to fail in The requirement for thi ytem are: It i leat evere for acceleration to fail in an omiion tate in cae of a ytem failure It i leat evere for retardation to fail in a tuck tate in cae of a ytem failure It i leat evere for teering to fail in a tuck tate in cae of a ytem failure It i important to note that thee requirement have to e conidered in all uytem, ie the mechanical, electrical and computer uytem Further, thi i how the whole ytem hould ehave and not neceary individual actuator Further, the mot evere functional failure on the three different function will have other requirement on the deign proce and the implementation Both the Retardation and Steering function can have Catatrophic failure, while Acceleration can have Critical failure Thi will e handled in the detailed implementation of the ytem 324

7 PROCEEDINGS of the 21t INTERNATIONAL SYSTEM SAFETY CONFERENCE Deign of the Non-redundant Electrical Architecture The non-redundant electrical architecture wa developed for the raking and teering ytem together with the clutch and throttle control Both clutch and throttle control are included in the Acceleration functionality Thee ytem are controlled y the driver with the teering wheel and the pedal Tak-graph: The tak graph in figure 6 how the drive-y-wire ytem that hould e implemented At the far left there are the enor; pedal, teering wheel and two witche for teer mode and park rake On the right ide of the picture, there are the actuator in the ytem; clutch, throttle and at each wheel oth raking and teering There are three different teer mode in the car; normal front wheel teering, four wheel teering and parallel teering In the parallel teering mode, all wheel turn identical The park rake i implemented uing the normal rake calliper and a mall magnetic rake to preerve an applied rake force Brake Pedal Clutch Pedal Throttle Pedal SW Steer Angle Steer Switch Park Switch Senor Adaptation Gloal Clutch Throttle Steer FL Brake FL Steer FR Brake RR Clutch Throttle Steering FL Braking FL Steering FR Braking RR Figure 6 - The tak graph for the chai functionality in the Siriu 2001 car Communication Analyi: The data that need to e roadcated to all node are driver enor data and alo actuator data for monitoring An early analyi i hown in tale 2 and give a total of 25,6 kit/ not conidering allocation and redundancy The accuracy of the data ignal range from 10 to 14 it, however they are all implemented uing doule yte To make the implementation leat complex, the update frequency of all ignal wa choen to e identical, in thi cae 100 Hz Thi made communication cheduling imple Since communication andwidth wa not a limiting factor, it did not have any other conequence Non-redundant Electrical Architecture: The non-redundant electrical architecture i developed uing the location of the enor and actuator in the tak graph in ection 41 For thi cae, one node i allocated at each wheel, which i connected to the wheel teering ytem and the wheel rake actuator There i alo one central node for the pedal, the teering wheel, the clutch and the throttle The component connected to the central node are all cloe to it Figure 7 how the non-redundant electrical architecture and the connected component 325

8 t PROCEEDINGS of the 21t INTERNATIONAL SYSTEM SAFETY CONFERENCE Tale 2 - The preliminary communication analyi for the tak graph Meage Size Frequency Data yte Hz kit/ Driver' Senor Brake Pedal ,6 Clutch Pedal ,6 Throttle Pedal ,6 Steering Wheel ,6 Steer Switch ,6 Park Switch ,6 Central Data Clutch Poition ,6 Throttle Angle ,6 Wheel Data (4 wheel) Brake Preure ,6 Steer Angle ,6 Total 25,6 c Node_C Node_FL Node_FR Node_RL Node_RR Figure 7 - The non-redundant electrical architecture for the Siriu 2001 car Tak Allocation: The tak allocation follow ection 224 Thi reult in that oth raking and teering functionality i allocated to all wheel node The clutch and throttle functionality together with enor input are allocated to the central node Redundant Electrical Architecture A the lat tep, local hardware redundancy i added A tatitical dependaility analyi howed that the central node, the teering wheel enor, the rake pedal enor and the communication u needed to e duplicated Thi i reaonale, ince they all repreent ingle point of failure The clutch and throttle actuator were connected to one central node each The reulting architecture i een in figure 8 Reult After 6 month of development, the fully functional car wa firt hown to the pulic Since then, there ha een no ytem failure experienced We elieve, the ued deign method wa a valuale aet in the implementation proce Complexity iue were roken down and handled at the appropriate level, implifying the deign proce A a reult, the project wa uccefully finihed in thi very hort period of time Further, the amount of hardware wa kept at a minimum a a reult of the top-down approach implementing the three type of redundancy trategie 326

9 t PROCEEDINGS of the 21t INTERNATIONAL SYSTEM SAFETY CONFERENCE c Node_C1 Node_C2 Node_FL Node_FR Node_RL Node_RR Figure 8 - The redundant electrical architecture for the Siriu 2001 car The redundant electrical architecture from ection 5 wa implemented uing TTP (ref 8) a communication protocol and the reulting data traffic i 94 kit/, which i ent redundantly on two channel (ref 1) Thi i a reult of the allocation proce of the control law calculation and conidered very low for a fully functional drive-y-wire car The ued microcontroller were ix Motorola MPC555 running at 40 MHz with 256 kyte of RAM and 448 kyte of flah memory The project ha een very ucceful in everal different area It ha een well received in Swedih media, oth cientific pre and everal TV how In the cientific community, it ha een preented at everal conference and received lot of attention For Volvo Car Corporation, it i an example of an advanced engineering project in cloe collaoration with academia Figure 9 how the finihed car in a parallel teering mode The teering wheel and pedal are detached and placed in front of the car Figure 9 - The Siriu 2001 car with the moveale teering wheel and pedal in front of the car The main reult of the project i the ucceful ue of the propoed deign method, which wa very uitale for thi drive-y-wire project It advantage are low communication requirement, minimal hardware and a high degree of tranient fault tolerance In the future the SIRIUS 2001 car will erve a a development platform, mainly for verifying new deign method and deign principle and alo to develop and evaluate new technology Reference 1 Johanneen, P, SIRIUS 2001 A Univerity Drive-y-Wire Project, Technical Report No 01-14, Department of Computer Engineering, Chalmer Univerity of Technology, Sweden, Papadopoulo, Y and McDermid, J, Hierarchically Performed Hazard Origin and Propagation Studie, Proceeding of SAFECOMP 99, 18th International Conference on Computer Safety, Reliaility and Security, Touloue,

10 PROCEEDINGS of the 21t INTERNATIONAL SYSTEM SAFETY CONFERENCE Johanneen, P, Grante, C, Alminger, A, Eklund, U and Torin, J, Hazard Analyi in Oject Oriented Deign of Dependale Sytem, Proceeding of the 2001 International Conference on Dependale Sytem and Network, Gothenurg, 2001, pp Ahltröm, K, Torin, J and Johanneen, P, Deign Method for Conceptual Deign of By-Wire : Two Cae Studie, Proceeding of the Seventh IEEE International Conference on Engineering of Complex Computer Sytem, Skövde, 2001, pp Boot, G, Jacoon, I and Rumaugh, J, The Unified Modeling Language Uer Guide, Addion Weley Pulihing Company, International Electro-technical Commiion, IEC-61508: Functional afety of electrical/electronic/programmale electronic afety-related Sytem, IEC, Hiller, M, Executale Aertion for Detecting Data Error in Emedded Sytem, Proceeding of IEEE International Conference on Dependale Sytem and Network, New York, June 2000, pp Kopetz, H, Braun, M, Ener, C, Kruger, A, Millinger, D, Noal, R and Schedl, A, The deign of large real-time ytem: the time-triggered approach, Proceeding of 16th IEEE Real-Time Sytem Sympoium, 1995, pp Biography Per Johanneen, Sytem Safety Engineer, Volvo Car Corporation, ELIN, Goteorg, SE , Sweden, telephone , facimile , pjohann1@volvocarcom Per i employed y Volvo Car Corporation and i currently puruing hi PhD in computer engineering at Chalmer Univerity of Technology with Profeor Jan Torin a advior Per reearch focu i on the deign proce of architecture for afety critical automotive ytem The reearch applie a ytematic and holitic approach to meet dependaility requirement For the SIRIUS 2001 car, Per wa a project leader and implemented the electrical ytem He ha a MS in Mechanical Engineering from Georgia Intitute of Technology, a MSc in Automation Engineering from Chalmer Univerity of Technology in Sweden, and a Lic Eng in Computer Engineering alo from Chalmer Jan Torin, Profeor, Chalmer Univerity of Technology, Computer Engineering, Goteorg, SE , Sweden, telephone , facimile , - torin@cechalmere Dr Jan Torin i profeor emeritu at Chalmer Univerity of Technology and ha for almot 30 year een working with dependale computer ytem He wa alo the general chair of the DSN2001 conference in Gothenurg 328