Power Distribution and Functional Safety in the Context of Highly Automated Driving

Transcription

1 Power Distribution and Functional Safety in the Context of Highly Automated Driving Dr. Peter Grabs, Intedis GmbH&Co. KG Udo Hornfeck, LEONI Bordnetz-Systeme GmbH The Quality Connection

2 Outline Automated Driving Functions Hazard Analysis and Risk Assessment (HRA) for Highway Assist Functional Safety Concept Concepts for Energy Distribution Impact on Energy Distribution System Summary 2

3 Outline Automated Driving Functions Hazard Analysis and Risk Assessment (HRA) for Highway Assist Functional Safety Concept Concepts for Energy Distribution Impact on Energy Distribution System Summary 3

4 Automated Driving Functions NVIDIA Automated driving is one of the main trends Every company in the automotive industry is working on this 4 4

5 Automated Driving Functions Priority use cases: Parking Traffic Jam Highway 5

6 Outline Automated Driving Functions Hazard Analysis and Risk Assessment (HRA) for Highway Assist Functional Safety Concept Concepts for Energy Distribution Impact on Energy Distribution System Summary 6

7 Highly Automated Highway Driving Highway driving V= 130 kph Curve radius min> 900 m 1); typical ~2000m Highly automated driving ~ 5s takeover time to regain vehicle control Distance travelled 181m Lateral deviation for curves 18m (R=900m); 8m (R=2000m) 1) 2) Hackenberg, Bennewald, Othersen VW; Bongartz Carmeq Licht oder Sound? Evaluation von diffusen Modalitäten zur Fahrerunterstützung während des teilautomatischen Fahrens, VDI Kongress Elektronik im Fahrzeug, Baden-Baden, Germany, 16th 17th November

8 Concept phase activities (HRA) HRA = Hazard analysis and risk assessment Method to identify and categorize hazardous events of items and to specify safety goals and ASILs related to the prevention or mitigation of the associated hazards in order to avoid unreasonable risk. (ISO ) 8

9 Severity Percentage classifications of the potential direct and cascaded / propagated injuries S0 S1 S2 S3 Description No injuries Light and moderate injuries Reference for single injuries (from AIS scale) AIS 0 and less than 10% probability of AIS 1-6 more than 10% probability of AIS 1-6 (and not S2 or S3) Severe injuries, possibly lifethreatening, survival probable more than 10% probability of AIS 3-6 (and not S3) Life-threatening injuries (survival uncertain) or fatal injuries more than 10% probability of AIS 5-6 ISO : Table B.1: Rear/front collision with another passenger car with medium speed S=3 9

10 Exposure Probability of a human s exposure to a hazard in terms of time and location in particular scenarios during expectable (mis-)use cases. Description Incredible Very low probability Frequency of situation Duration (% of average operating time) E0 E1 E2 E3 E4 Not specified Less often than once a year Low probability A few times a year Not specified Not specified < 1% of average operating time Medium probability Once a month or more often 1%-10% of average operating time High probability Almost every drive > 10% NOT: Probability of product fault/failure occurrences that lead to the hazard ISO : Table B.2: Highway drive E=4 10

11 Controllability Probability of being able to withdraw oneself from the severity impact, thereby avoiding or alleviating the injury, once exposed to a hazard. May not reflect: warning concepts, implementations of safety goals Description C0 C1 C2 C3 Controllable in general Simply controllable 99% or more of all drivers Normally controllable 90% or more of all drivers Difficult to control or uncontrollable Less than 90% of all drivers Average driver needs > 5s! C=3 11

12 HRA for Highly Automated Highway Driving Hazard: Loss of lateral control Severity S3 Controllability C3 Exposure E4 ASIL D Controllability C1 C2 C3 Exposure Severity S0 S1 S2 S3 E1 QM QM QM QM E2 QM QM QM QM E3 QM QM QM A E4 QM QM A B E1 QM QM QM QM E2 QM QM QM A E3 QM QM A B E4 QM A B C E1 QM QM QM A E2 QM QM A B E3 QM A B C E4 QM B C D Safety Goal: Prevent loss of lateral control for highly automated driving! Fail safe fail operational 12

13 Outline Automated Driving Functions Hazard Analysis and Risk Assessment (HRA) for Highway Assist Functional Safety Concept Concepts for Energy Distribution Impact on Energy Distribution System Summary 13

14 ASIL D Requirements An awful lot of process requirements! Some requirements related to technical realization (Not all are listed here!): ISO Table 4 & 5 Possible source for the derivation of the target singlepoint fault metric value & latent-fault metric value ASIL B ASIL C ASIL D Single-point fault metric 90 % 97 % 99 % Latent-fault metric 60 % 80 % 90 % Redundancy! ISO Table 6 Possible source for the derivation of the random hardware failure target values. ASIL Random hardware failure target values D < 10-8 h -1 Challenge! 14

15 Functional Safety Concept Derive safety concept Transfer safety concept into system architecture No loss of lateral control ASIL D No loss of actuators ASIL D No loss of power supply ASIL D ASIL D Actuator 1 Actuator 2? Allocation of safety requirements to system elements 15

16 Outline Automated Driving Functions Hazard Analysis and Risk Assessment (HRA) for Highway Assist Functional Safety Concept Concepts for Energy Distribution Impact on Energy Distribution System Summary 16

17 Concepts for Energy Distribution - Strategies - Mechanical Fall-back Driver is out of the loop! No longer feasible! Duplication Two power sources, storages and wiring harnesses Additional weight and components Freedom from interference to be shown! Failure isolation One power distribution system Switching elements needed Can be combined with decentralized power distribution 17

18 Concepts for Energy Distribution - Isolation Topologies - Linear Direct connection between battery (trunk) and current source (engine compartment) DC DC PDN Engine PDN Front PDN Middle PDN Rear DC DC PDN Engine PDN Front Right PDN Front Left PDN Rear Right PDN Rear Left Ring Connection between battery (trunk) and current source (engine compartment) Ring shape to reduce individual wire diameter Inherent redundancy for loss of one connection Triangle, Pentagram, Chaos, etc. DC DC? 18

19 Outline Automated Driving Functions Hazard Analysis and Risk Assessment (HRA) for Highway Assist Functional Safety Concept Concepts for Energy Distribution Impact on Energy Distribution System Summary 19

20 Impact on Energy Distribution System - Idea to Vehicle - Requirements Vehicle Integration Simulation HIL Test Model Test HW-Prototype 20

21 Impact on Energy Distribution System - Simulation Results - Simulation Matlab/Simulink model using Intedis Energy Simulation Utilizing generic models for loads, wires, battery, and DC/DC converter Worst Case Scenario + AES maneuver Results Low voltage due to internal resistance in battery High voltage drop between PDNs due to reversed current path Use Li-Ion battery Reduce base load Increase wire diameter 21

22 Impact on Energy Distribution System - Model Testing

23 Impact on Energy Distribution System - Model Testing - Model Test 1:5 model Fault injection of shorts to ground in main wires Results Results fit very well to expected behaviour 23 23

24 Outline Automated Driving Functions Hazard Analysis and Risk Assessment (HRA) for Highway Assist Functional Safety Concept Concepts for Energy Distribution Impact on Energy Distribution System Summary 24

25 Summary Highly automated driving imposes fault tolerance requirements Relevant for energy distribution system as well Presented a power distribution concept answering these challenges Utilizing power redundancy Fault tolerance by isolation of failures Flexible ring-topology with inherent redundancy Lower extra cost and weight Holistic concept needed and mandatory for platform-wide rollout of automated driving functions 25

26 Thank you for your attention! 26