This article discusses the trends in vehicle electrification as we move towards semi-autonomous and fully autonomous driving, in particular, in order for Electronic power steering (EPS) and electronic braking systems to meet the necessary safety standards to ensure the safety of driverless cars Provides some insight into the changes that need to be made when it comes to robustness and reliable control.
Analog Devices (ADI) offers magnetoresistive (MR) position sensor products and shunt-based current sense amplifier products that enable high performance commutation and safe operation of brushless motors used in EPS and electronic braking systems.
In recent years, as more emphasis is placed on improving vehicle safety, active advanced driver assistance systems (ADAS) have continued to be developed and promoted as a complement to traditional passive systems that rely on airbags to protect driver and passenger safety. These emerging systems are initially designed to help drivers make the right decisions in safety-critical situations and, in the long term, to replace driver decisions. These technological advancements are also leading the shift towards semi-autonomous and fully autonomous driving. Let the electronic control unit (ECU) make decisions on behalf of the driver, and let the actuators take care of the steering and braking of the vehicle, thus handing over the task of driving the vehicle to the sensors, ECU, and electronic actuators. This trend has driven us to start developing more reliable, smarter, higher-performance redundant electronic actuator solutions that meet the ISO 26262 functional safety standard. This is a risk-based safety standard that qualitatively assesses the risk of hazardous operating situations and incorporates safety measures into the design of components and systems to avoid or manage system failures, as well as to detect or control random hardware failures or mitigate them influences. These actuator systems are typically driven by brushless DC (BLDC) motors, and because these systems are safety-critical, designers must ensure that the hardware and software of the solution can meet the Automotive Safety Integrity Level (ASIL) D-grade high standard.
BLDC Motor Commutation and Control
As the name suggests, brushless DC motors have no brush contacts and require a motor position sensor (MPS) to measure the relative position between the stator and rotor to ensure that the stator coils are energized in the correct order. The motor position sensor is critical at start-up, when the microcontroller has no back EMF available to determine the relative position of the rotor and stator.
Traditionally, blocking commutation (see Figure 1a) consists of three Hall switches used to indicate the position of the rotor in a brushless DC motor. Blocking commutation is gradually being replaced by sinusoidal commutation control due to demands to improve the performance of BLDC motor drives, including EPS systems, especially to reduce their noise, vibration and harshness (NVH), and to improve their operating efficiency. The Hall switches can be replaced by MR angle sensors mounted in front of the bipolar magnets at the end of the motor shaft (see Figure 1b). In a typical application the MPS is also mounted on the ECU assembly, which is integrated into the motor housing and mounted on the end of the motor shaft.
Figure 1. (a) BLDC blocking commutation control and (b) BLDC sinusoidal commutation control.
Figure 2. ISO 26262 ASIL rating matrix.
Functional Safety for Safety-Critical Applications (Example EPS)
ISO 26262 was introduced in 2011 as a safety standard to address the hazards that can result from electrical safety-related system failures, before being superseded by the 2018 edition.
A safety and risk analysis must be performed on the system to determine the ASIL level of the system. ASIL levels are determined by reviewing the severity, exposure, and controllability of potential hazards during system operation (see Figure 2).
For example, if we performed a risk and hazard analysis of an EPS system, we might conclude that based on the severity, controllability, and exposure of these events (eg, stuck steering, automatic steering, etc.) ASIL D rating. Likewise, for the upcoming electronic braking system, the same logic can be applied to determine the severity of uncontrollable events, such as brake sticking or automatic braking.
According to the EPS or braking system example, the rating of the ASIL D system can be achieved by decomposing the subsystems as shown in Figure 3a, Figure 3b and Figure 3c.
Figure 3. ASIL decomposition scheme for ASIL D systems.
Not every system component is required to be developed to ASIL D standards and processes for ASIL D systems to be compliant; however, when a system level audit is performed, it is required that the entire system must meet the requirements and can integrate QM, ASIL A, Subcomponents at levels B, C, and D are part of the system.
System decomposition should also ensure sufficient independence and take into account the possibility of dependent or common cause failures.
EPS system topology
A typical EPS system topology is shown in Figure 4. The EPS ECU calculates the required assist power based on the steering torque applied to the steering wheel by the driver, the position of the steering wheel and the speed of the vehicle. The EPS motor applies force to turn the steering wheel, reducing the torque required by the driver to steer the steering wheel.
Figure 4. Typical EPS topology.
Motor shaft position (MSP) angles combined with phase current measurements are used for commutation and control of EPS motor drives. The basic typical EPS motor control loop is shown in Figure 5. The level of torque assist required varies with driving conditions and is determined by wheel speed sensors and torque sensors, which measure the torque applied to the steering wheel by the driver or the motor actuators in driverless cars. The microcontroller then uses the MSP data and the phase current data to control the current load supplied to the motor (providing the required auxiliary).
Figure 5. Typical EPS motor control loop.
EPS Motor Position and Phase Current Sensors
MPS sensor failure can cause or exacerbate system failures such as steering lock or automatic steering, so MPS is a critical component in EPS systems. Therefore, it is important that the system is capable of comprehensively diagnosing sensor failures and redundancy to ensure continued normal operation in the event of an MPS sensor failure or failure, to ensure that no critical system failure occurs, or in the event of an error, the system Can be stopped in a safe manner.
Current-sense amplifiers are often used for indirect, accurate measurement of motor loads, typically on two of the three motor phases, to provide additional diagnostic information (which can be part of overall system safeguards).
In addition, highly accurate motor position and phase current measurements can improve the control performance of EPS motors at the system level, enabling very efficient, quiet and smooth steering, thus improving the overall driving experience, so it is a key component in the system.
Functional Safety for EPS Motor Control
In EPS or other safety critical motor control applications, we can take different approaches to ASIL D compliance. The following example illustrates that dual anisotropic magnetoresistive (AMR) motor position sensors and ADI’s current sense amplifiers can be integrated into such a system to provide the required level of performance and redundancy to achieve ISO 26262 ASIL D integration from the system level. regularity.
In the block diagram shown in Figure 6, the dual AMR sensor is complemented and complemented by another sensor based on a different technology such as Hall, GMR or TMR. Dual AMR sensors are used as the primary (high precision) sensing channel, and a second channel of different sensor technology serves three purposes:
Enables a “two out of three” (2oo3) comparison to verify that one of the sensor channels fails when combined with other system inputs.
• Provides position feedback in the unlikely event that both AMR channels fail.
Provides 360˚ quadrant information to the microcontroller for motor commutation in the case of an odd number of motor poles.
Accurate angle measurements will continue to be provided by both channels of the dual AMR sensor. Additional system diagnostics, such as motor load and shaft position, can be indirectly inferred from the dynamic state (back EMF) of the accurate phase current sense amplifiers.
Figure 6. Example of a motor position and phase current sensing structure for safety-critical applications.
If we look at all possible sensor failure modes in this sensor architecture example, we can see that there should always be two position sensor inputs available for reliability checks. Even in the extremely unlikely extreme case where both AMR channels fail simultaneously due to common failure causes, it is still possible to use the degraded position detection information from the auxiliary sensor channel and the back EMF information provided by the current sensor in the dynamic state. Cross-referenced to ensure that the basic functionality of the system continues to function properly.
This system-level diagnostic capability will ensure that critical failure modes do not occur and that the system achieves ISO 26262 ASIL D compliance. After that, the system can be safely powered off, or put into limp home mode to return to the dealer for service.
With the introduction of ADAS to improve automotive safety, and the emergence of fully and semi-autonomous vehicles, there is a demand for more reliable, smarter, higher-performance redundant electronic actuator solutions that comply with ISO 26262 Functional Safety Standards. ADI’s motor shaft position and phase current inspection products not only meet the demands for improved performance and smoother, more efficient motor control, but also provide high performance in safety-critical applications such as EPS or braking systems. Redundancy required by ASIL requirements.
The ADA4571-2 dual AMR sensor from ADI is designed for these types of safety-critical applications that require redundant and independent detection channels. It is a dual channel AMR sensor with integrated signal conditioning amplifier and ADC driver. The product includes two AMR (Sensitec AA745) sensors and two amplifier signal conditioning ASICs. The sensor provides a very low angular error signal, typically within 0.1 degrees, with negligible hysteresis, high bandwidth, low latency, and good linearity. These features help reduce torque ripple and audible noise for smooth, efficient BLDC motor control. Additionally, the AMR sensor operates at saturation >30 mT, has no upper magnetic field window, and the sensor operates in high magnetic field conditions, so the solution can withstand stray magnetic fields in harsh environments.
The AD8410 current sense amplifier from Analog Devices enables bidirectional current measurement across shunt resistors in EPS and other BLDC motor control systems. This is a high voltage, high resolution and high bandwidth shunt amplifier designed to provide the accurate measurements needed in harsh environments, diagnostics in safety critical applications, helping to reduce torque ripple and audible noise, enabling smooth, efficient BLDC motor control (eg EPS or braking) and improving the overall driving experience.
ISO 26262-1:2018. International Organization for Standardization, December 2018.
Isshi Koyata. “A Solution to Future Operational Failures of EPS Systems in JARI Activities.” Japan Automotive Research Institute (JARI), 2019.
About the Author
Enda Nicholl is Strategic Marketing Manager for Automotive Electrification at Analog Devices’ ERDC (European Research and Development Center) in Limerick, Ireland. Enda holds a Certificate of Secondary Education, a UK Higher Education Diploma, a Bachelor of Mechanical Engineering from the University of Alberta, and has 25 years of experience working in automotive sensors, working in applications engineering, strategic marketing and business development. During this time, he worked for 13 years in Analog Devices’ automotive business unit.