Homework 11: Reliability and Safety Analysis Due: Friday, April14, at NOON

Transcription

1 Homework 11: Reliability and Safety Analysis Due: Friday, April14, at NOON Team Code Name: Motion Tracking Camera Platform Group No. 9 Team Member Completing This Homework: Craig Noble Address of Report Author: cnoble@purdue.edu NOTE: This is the third in a series of four professional component homework assignments, each of which is to be completed by one team member. The completed homework will count for 10% of the team member s individual grade. It should be a minimum of five printed pages. Evaluation: Component/Criterion Score Multiplier Points Introduction and Summary X 1 Reliability Analysis X 2 Failure Mode, Effects, and Criticality Analysis X 3 Appendix A X 1 Appendix B X 1 List of References X 1 Technical Writing Style X 1 TOTAL Comments:

2 1.0 Introduction The Motion Tracking Camera Platform design project provides a system for capturing image data from a CMOS image sensor and performing a simple, and therefore relatively time efficient, image processing algorithm to detect and track motion real-time within the field of view. The module automatically translates the motion location into a target point within the object bounds, and provides servo control signals that cause properly calibrated motors to aim a pan/tilt platform toward that target point. For the purpose of proof of concept, a laser pointer is activated atop the platform to verify correct target locations, but the system provides a backbone for many applications such as security devices, basic sight emulation robotics, or automatic video recording devices. In addition to the autonomous operation of the motion tracking system, a user interface is provided in the form of pushbuttons and an LCD module to display useful information such as the timestamps of significant events. As with any new design, special care must be taken with respect to safety and reliability issues. Not only is every design at risk of causing a fire or serious injury and damage upon malfunction, but the specifics of each design introduce additional safety considerations into the analysis. With the Motion Tracking Camera Platform, the intended use of the system plays a large role in determining the severity of each failure and must be kept in mind throughout the analysis. For the purpose of this study, the Military Handbook 217F (MIL-HDBK-217F) [1] is used to determine failure rates for several key components in the design, and then a failure mode, effects, and criticality analysis (FMECA) is preformed to include all potential failures. 2.0 Reliability Analysis To better understand the overall reliability of the entire design without an exhaustive analysis of each individual component, a focused approach is used to examine a few of the critical components which are most likely to fail. Chosen based on complexity and operating temperature, four devices are selected for this analysis and their failure rates will be quantified by procedures developed by the United States Department of Defense and detailed in the MIL- HDBK-217F [1]. The selected components are summarized in Table

3 Part Number Description MC9S12DP512 (U1 * ) Microcontroller, 16-bit, 112 pin SMT LTC (U3 * ) Step Down DC-DC Converter, 8 pin DIP OV6620 CMOS Image Sensor, 16-bit, 48 pin SMT PC 1202-A 24 Character LCD Display Controller, 8-bit, 80 pin SMT *Refer to schematic in Appendix A Table 1 Selected Reliability Analysis Components Each of the parts listed in Table 1 fall under the Microcircuits category (section 5.0) of the military handbook. The following sections in the document outline the values and associated assumptions used to compute the failure rate for the given device using the following formula: where: λ p C 1 π T C 2 π E π Q π L λ p = (C 1 *π T + C 2 *π E )*π Q *π L Failures/10 6 Hours is the part failure rate, is the die complexity failure rate, is the temperature factor, is the package failure rate, is the environmental factor, is the quality factor, and is the learning factor. Mean time to failure (MTTF) is then calculated as the inverse of the failure rate, or 10 6 / λ p. 2.1 MC9S12DP512 Reliability Analysis Parameter Value Justification * C bit CMOS Microcontroller (5.1) π T 1.5 Digital MOS with T j = 100 C (5.8) C pin SMT device, assume nonhermetic (5.9) π E 2.0 Assumed ground fixed (5.10) π Q 10 Commercial component (5.10) π L 1.0 Greater than 2 years in production (5.10) * Corresponding MIL-HDBK-217F Section Reference in Parenthesis -2-

4 λ p MTTF Failures/10 6 Hours Hours ( years) Table 2 MC9S12DP512 MTTF Parameters The microcontroller [2] is an obvious weak point of the design due to its complexity and importance to the circuit. As one of the components that is setting the upper bound on the lifecycle of the system, it is being considered for the reliability analysis. Most of the parameters are clearly defined by the given information about the chip including junction temperature, pin count, package type, and production phase. The only assumption made with the MC9S12DP512 is that it falls into the nonhermetic packaging category, which produces a higher approximation for failure than the other options. It is also worth noting that the maximum junction temperature, T j, is used in the analysis to provide the worst-case failure rate, which is the case for all components considered. As seen in the resulting failure rate values, the microcontroller poses a moderately significant threat to the reliability of the system, even more so considering that a failure with the microcontroller will result in complete loss of system functionality. In the event of such a failure, the entire device would likely have to be replaced. 2.2 LTC Reliability Analysis Parameter Value Justification * C Linear MOS, assume 1 to 100 transistors (5.1) π T 58 Linear MOS with T j = 125 C (5.8) C pin DIP device, assume nonhermetic (5.9) π E 2.0 Assumed ground fixed (5.10) π Q 10 Commercial component (5.10) π L 1.0 Greater than 2 years in production (5.10) * Corresponding MIL-HDBK-217F Section Reference in Parenthesis λ p MTTF Failures/10 6 Hours Hours ( years) Table 3 LTC MTTF Parameters The linear regulator [3] is arguably the most critical component on the board as it provides power to all components and has the highest failure rate of any device in the design. A -3-

5 critical assumption was made with the LTC1174-5, that it contains 1 to 100 transistors, an approximation made based on the function block diagram provided in the datasheet. Similar to the microcontroller, it is also assumed nonhermetic and a worst-case approximation is made with the junction temperature. The results show that the linear regulator is slightly less reliable than the microcontroller, but enough so that it is the most likely component to fail. A typical failure would likely cause the device to have to be replaced, however the DIP package makes it easier to diagnose and repair if possible. 2.3 OV6620 Reliability Analysis Parameter Value Justification * C Closest to 16-bit CMOS Microcontroller (5.1) π T 1.5 Digital MOS with assumed T j = 100 C (5.8) C pin SMT device, assume nonhermetic (5.9) π E 2.0 Assumed ground fixed (5.10) π Q 10 Commercial component (5.10) π L 1.0 Greater than 2 years in production (5.10) * Corresponding MIL-HDBK-217F Section Reference in Parenthesis λ p MTTF Failures/10 6 Hours Hours ( years) Table 4 OV6620 MTTF Parameters A significant subsystem involved in the motion tracking project is the camera module [4]. Instead of analyzing the entire module, just the image sensor chip is considered. The sensor is assumed to be similar to a 16-bit microcontroller with a conservative assumption of junction temperature, matching the specifications for the microcontroller itself. This analysis is closely related to the microcontroller, with the exception of the number of pins, so the reliability issues are similar. Different from the microcontroller, however, is that a failure of the image sensor can be fixed by simply replacing the camera module PCB. This result of having a modular design is an attractive feature of the system in the case of device failure. -4-

6 2.4 PC 1202-A Reliability Analysis Parameter Value Justification * C Closest to 8-bit CMOS Microcontroller (5.1) π T 1.5 Digital MOS with assumed T j = 100 C (5.8) C pin SMT device, assume nonhermetic (5.9) π E 2.0 Assumed ground fixed (5.10) π Q 10 Commercial component (5.10) π L 1.0 Greater than 2 years in production (5.10) * Corresponding MIL-HDBK-217F Section Reference in Parenthesis λ p MTTF 2.92 Failures/10 6 Hours Hours ( years) Table 5 PC 1202-A MTTF Parameters The LCD panel and associate driver circuit [5] is not necessarily a mission critical subsystem, but is deserving of reliability analysis due to the similarity to other devices considered. The segment driver, a Samsung S6A0069X, is essentially an 8-bit microcontroller and the junction temperature assumption is made similar to the camera module. Since this controller is relatively simple compared to the rest of the components analyzed it has the lowest failure rate, with an MTTF just short of 40 years. As with the image sensor, the modular design allows an LCD failure to be corrected by replacing the inexpensive LCD module. 2.5 Reliability Analysis Conclusions A simple analysis of the four major components provides good insight into the reliability of the entire system. Under assumptions that over exaggerate actual operating conditions, the results summarized in Table 6 indicate an approximate failure rate for the entire system. The most critical component in terms of shortest failure rate is the linear regulator, which is unfortunate due to the difficulty of repair, but expected nonetheless. Close behind is the microcontroller, which is also a difficult component to service. The gaps between failure rates continuously increase with the image sensor being next, followed by the LCD controller. These values are acceptable due to the general ease of replacement, and in reality are even lower when actual junction temperatures and loading conditions are taken into account. -5-

7 Component Failures/10 6 Hours MTTF MC9S12DP LTC OV PC 1202-A Table 6 Summary of Reliability Analysis Results 3.0 Failure Mode, Effects, and Criticality Analysis (FMECA) In order to facilitate the failure mode, effects, and criticality analysis (FMECA), the schematic is divided into several blocks by function. This breakdown is summarized in Table 7 and a visual representation is available as appendix A. Two criticality levels are appropriate for the design, referred to as high and low. A high criticality is defined as any failure in which physical injury is a possible result. This includes, but is not limited to, the possibility of fire, explosions, or excessive heating. A low criticality is defined as any failure that does not have the potential to cause physical harm, but one which would render at least part of the system unusable and cause customer dissatisfaction. In a final system design, failure probabilities would be set to λ < 10-9 for a high criticality level, and λ < 10-5 for a low criticality level, standard accepted industry values. It is important to note that the motion tracking camera system can be potentially more harmful if it is specified for use in a security setting. Although this use is not recommended under the current design, the criticality level is defined as low/high for these cases. The completed FEMCA table is found in appendix B [6]. Block Description Main Component Color Reference A Power supply circuit LTC Red B Microcontroller circuit MC9S12DP512 Orange C Camera module and header OV6620 Yellow D LCD module and header PC 1202-A Green E Calibration circuit Potentiometers Blue F Motor circuit GWS NARO STD Purple G Human interface circuit Pushbuttons Pink Table 7 Functional Block Breakdown -6-

8 4.0 Summary The Motion Tracking Camera Platform performs as expected when analyzed for reliability and safety, but with much room for improvement. The modular design makes many components replaceable without replacing the entire system, even for some of the ones identified as most critical. Absent from this analysis are suggested additions to improve the overall safety, but with the addition of such redundancies, including more extensive software based system health checks, safety can be improved to meet the desired standards. One such improvement would be to have the microcontroller help monitor the power supply, a critical circuit block, and safely shut down the system if set tolerances are exceeded. Just this one modification would reduce the failure rates of the high criticality failure modes, and can be done at almost no additional cost or circuit complexity. Other solutions are outside the scope of this analysis, but by considering them they show that the motion tracking camera system is potentially able to meet acceptable standards of safety and reliability. -7-

9 ECE 477 Digital Systems Senior Design Project Spring 2006 List of References [1] Reliability Prediction of Electronic Equipment, MIL-HDBK-217F, 1991 Dec 2 [2] MC9S12DP512CPV Device Guide, July [3] LTC DC/DC Converter Data Sheet, Linear Technologies, [4] OV6620 CIF Color Digital Camera Data Sheet, OmniVision, Ver 1.4, 2000 May 13 [5] S6A0069X Product Page, Samsung Semiconductors, [cited 2006 Apr 13] [6] G. Novacek, Designing for Reliability, Maintainability, and Safety, Circuit Cellar, issue , Jan

10 Appendix A: Schematic Functional Blocks -9-

11 Schematic Functional Blocks Details Figure A1.1 Power Circuit (Block A) -10-

12 Schematic Functional Blocks Details Figure A1.2 Microcontroller Circuit (Block B) -11-

13 Schematic Functional Blocks Details Figure A1.3 Camera Module (Block C) Figure A1.4 LCD Module (Block D) -12-

14 Schematic Functional Blocks Details Figure A1.6 Motor Control Circuit (Block F) Figure A1.5 Calibration Circuit (Block E) Figure Al.7 User Interface Circuit (Block G) -13-

15 Appendix B: FEMCA Worksheet Failure Failure Mode Possible Causes Failure Effects Method of Criticality Remarks No. Detection A1 Output = 0V Failure of any component within None of the circuit components will function Observation High Voltage Regulator set to trip at current over 600mA functional block A or an external short (system will be 'off') A2 Output > 5V Failure of U3 or V1 Potential damage to microcontroller, camera, LCD, or related components, unpredictable behavior Observation High Voltage Regulator set to trip at current over 600mA A3 B1 C1 Output out of Tolerance Output Stuck High/Low Faulty Image Transmitted C2 Image Sensor Fails to Respond D1 Blank LCD / Failure to Initialize D2 "Random" or Incorrect LCD Output E1 Potentiometers Have No Effect During Calibration C10, C11, C12, C13, C14, D1, L1, U3 Failure of any component within function block B Camera Module, Software, I2C failure Camera Module, Software, I2C failure R3, C9, Software, port pin stuck high or low C9, Software, port pin stuck high or low High ripple or out-of-spec operating voltage, unpredictable effects Depending on pin, I2C failure, camera communication failure, LCD communication failure, servo failure Failure to detect/follow motion, seemingly random servo movements Failure to acquire any image data Loss of method to display information to user Loss of method to display information to user R1, R2, U1, Software Loss of method of calibration Observation High Ripple could potentially destroy components, resulting in injury Observation Low/High Criticality high if system is being used in a potentially harmful way Observation Low/High Criticality high if system is being used in a potentially harmful way Observation Low Microcontroller could detect, but not correct, this failure Observation Low Observation Low Observation Low/High Criticality high if system is being used in a potentially harmful way -14-

16 FEMCA Worksheet (continued) Failure No. E2 F1 Failure Mode Possible Causes Failure Effects Method of Detection Criticality Remarks Jerky or R1, R2, U1, Software, Difficulty calibrating, Observation Low/High Criticality high if system is Inconsistent Servo Motors possible loss of calibration being used in a potentially Calibration method harmful way Movements Laser Does Not Move Port pin stuck high or low, Software, Servo Motors, Image Sensor Loss of method of targeting Observation Low/High Criticality high if system is being used in a potentially harmful way F2 Laser Does Not Follow Target Properly Software, Servo Motors, Image Sensor Loss of method of targeting Observation Low/High Criticality high if system is being used in a potentially harmful way F3 Servo extends to rotation limit Software, Servo Motors, U1, Power supply failure Excessive power consumption, temporary loss of targeting Observation Low/High Microcontroller should not allow PWM cycle to exceed bounds G1 Button Irresponsive SW1, SW2, SW5, R4, R5, R6, U1, Software Loss of user interface, calibration Observation Low Criticality low because system never gets out of startup mode G2 Laser Pointer Never On SW5, port pin stuck low, R6 Loss of laser pointer use Observation Low G3 Laser Pointer Always On SW5, port pin stuck high Additional power consumption, laser remains on Observation High Microcontroller could detect stuck port pin and turn off system -15-