HV Crash Detection Redundancy With Transient Error Healing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing high-voltage on-board electrical systems in electric vehicles fail to meet the stringent ASIL D safety requirements for autonomous driving, particularly in crash scenarios, as current crash line disconnection mechanisms are insufficient.
Innovation Solution
A safety apparatus comprising a monitoring unit, processing unit, error collection device, and healing module, utilizing both hardware and software mechanisms for crash detection, with ASIL decomposition to ensure redundancy and transient error healing, ensuring safe energy transfer in HV components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a simple crash line disconnection mechanism is used, then the device complexity is reduced, but the safety reliability does not meet ASIL D requirements
Solution Approach 1:
The safety apparatus segments the crash detection function into multiple independent channels: a first crash detection channel with a monitoring unit that detects voltage drops on the crash line, and a second crash detection channel with a processing unit that receives crash messages from other control units. This segmentation provides functional redundancy required for ASIL D compliance while keeping each individual detection channel relatively simple.
Solution Approach 2:
The error collection device acts as an intermediary that collects error signals from both crash detection channels and determines the overall crash status. It mediates between the multiple detection channels and the final safety response, coordinating their outputs to achieve the required safety integrity level without requiring complex integration logic in each individual channel.
2Reliability
If crash detection is activated, then safety response is triggered, but false detections cause unnecessary shutdowns
Solution Approach 1:
The healing module implements a feedback mechanism that continuously monitors the crash detection signals and can trigger healing actions when transient errors are detected. When a crash signal is generated but subsequently proven to be spurious (e.g., when voltage recovers or conflicting channels disagree), the healing module activates to restore normal operation, providing feedback that prevents permanent shutdowns due to transient faults.
Solution Approach 2:
The system performs preliminary validation of crash detection signals by requiring agreement from multiple independent detection channels before triggering a definitive safety response. The error collection device collects and evaluates signals from both the monitoring unit and processing unit, and only triggers a safety response when both channels confirm a crash, preventing false detections from single-channel anomalies.
3Reliability
If permanent shutdown is triggered, then safety is ensured, but cost-effective recovery is reduced
Solution Approach 1:
The healing module changes the operational parameters of the system by triggering healing actions that attempt to restore normal operation after transient errors. This involves changing the state of safety signals from activated (crash detected) to deactivated (normal operation), allowing cost-effective recovery without permanent shutdown when the underlying issue was a transient fault rather than a genuine crash.
Data Source
Figure 1
Figure 2
AI summary
A safety apparatus for a high voltage (HV) component for an at least partially electrically powered vehicle comprises a monitoring unit, a processing unit, an error collection device, and a heating module. The monitoring unit is configured to check a crash line and to provide a first shut-off signal which is activated when the monitoring unit detects a crash. The processing unit is configured to provide a second shut-off signal which is activated when the processing unit receives the crash message. The error collection device is configured to control the energy transfer of the HV component dependent on the first shut-off signal and the second shut-off signal. The heating module is configured to detect transient errors within the crash detection dependent on the status of the first shut-off signal and the second shut-off signal and to provide pre-defined heating steps for the detected transient errors.