Automotive ECU Design with Functional Safety for Electro-Mechanical Actuator Systems

In this paper, we propose a hardware and software
design method for automotive Electronic Control Units (ECU)
considering the functional safety. The proposed ECU is considered for
the application to Electro-Mechanical Actuator systems and the
validity of the design method is shown by the application to the
Electro-Mechanical Brake (EMB) control system which is used as a
brake actuator in Brake-By-Wire (BBW) systems. The importance of a
functional safety-based design approach to EMB ECU design has been
emphasized because of its safety-critical functions, which are executed
with the aid of many electric actuators, sensors, and application
software. Based on hazard analysis and risk assessment according to
ISO26262, the EMB system should be ASIL-D-compliant, the highest
ASIL level. To this end, an external signature watchdog and an
Infineon 32-bit microcontroller TriCore are used to reduce risks
considering common-cause hardware failure. Moreover, a software
design method is introduced for implementing functional
safety-oriented monitoring functions based on an asymmetric dual
core architecture considering redundancy and diversity. The validity
of the proposed ECU design approach is verified by using the EMB
Hardware-In-the-Loop (HILS) system, which consists of the EMB
assembly, actuator ECU, a host PC, and a few debugging devices.
Furthermore, it is shown that the existing sensor fault tolerant control
system can be used more effectively for mitigating the effects of
hardware and software faults by applying the proposed ECU design
method.

• Kyung-Jung Lee
• Young-Hun Ki
• Hyun-Sik Ahn

• BBW (Brake-By-wire)
• EMB (Electro-Mechanical Brake)
• Functional Safety
• ISO26262.

[1] Maron, C., Dieckmann, T., Hauck, S., and Prinzler, H.,"Electromechanical Brake System: Actuator ControlDevelopment System," SAE Technical Paper 970814, 1997,doi:0.4271/970814.
[2] Schwarz, R., Isermann, R., Bohm, J., Nell, J., andRieth P.,"Clamping Force Estimation for a Brake-by-WireActuator,"SAE Technical Paper 1999-01-0482, 1999, doi:10.4271/1999-01-0482.
[3] Zhai, Z. and Corbiere, T., "Achieving ASIL D for Microcontroller in Safety-Critical Drive-by-Wire System," SAE Technical Paper 2009-01-0759, 2009, doi:10.4271/2009-01-0759.
[4] ISO 26262-3 Road Vehicles - Functional safety — Part10: Guideline on ISO 26262, 2011.
[5] ISO 26262-3 Road Vehicles - Functional safety — Part3: Concept Phase, 2011.
[6] Cheon, J., Kim, J., Jeon, J., and Lee, S., "Brake By Wire Functional Safety Concept Design for ISO/DIS 26262,"SAE Technical Paper 2011-01-2357, 2011, doi:10.4271/2011-01-2357.
[7] Van Eikema Hommes, Q., "Review and Assessment of the ISO 26262 Draft Road Vehicle - Functional Safety,"SAE Technical Paper 2012-01-0025, 2012, doi:10.4271/2012-01-0025.
[8] Christiaens, S., Ogrzewalla, J., and Pischinger, S., "Functional Safety for Hybrid and Electric Vehicles,"SAE Technical Paper 2012-01-0032, 2012, doi:10.4271/2012-01-0032.
[9] ISO 26262-SRoad Vehicles - Functional safety — PartS: Product development at the hardware level, 2011.
[10] Sundaram, P. and D'Ambrosio, J., "Controller Integrity in Automotive Failsafe System Architectures," SAE Technical Paper 2006-01-0840, 2006, doi:10.4271/2006-01-0840.
[11] Ki, Y., Ahn, H., and Cheon, J., "Fault-Tolerant Control of EMB Systems," SAE Int. J. Passeng. Cars - Electron. Electr. Syst. 5(2):579-589, 2012, doi:10.4271/2012-01-1795.