Redundant ECU Architecture for Power Steering Safety
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current motor electric control units for electromechanical power steering mechanisms face limitations in scalability and cost due to reliance on expensive, ASIL-D qualified components, with limited availability and safety integrity, and cannot utilize commodity components effectively.
Innovation Solution
A motor electric control unit with a redundant architecture using at least two channels, each equipped with steering mechanism sensors and processors, and a voter system to ensure correct sensor outputs and fault tolerance, allowing for fail-arbitrary elements and cost-effective E/E architecture, with optional three-channel configuration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ASIL-D qualified components are used for self-monitoring channels, then safety integrity level is improved, but cost increases and scalability is limited
Solution Approach 1:
The control unit is divided into multiple independent channels (at least two, preferably three), where each channel contains complete sensor sets and processors. This segmentation allows each channel to function independently at ASIL-B level while the overall system achieves ASIL-D through redundancy and voting mechanisms.
Solution Approach 2:
A voter module is introduced as an intermediary component that receives outputs from multiple channels and determines the correct sensor output through voting logic. This intermediary enables fault detection and tolerance without requiring each individual channel to be ASIL-D qualified, thus reducing component complexity and cost.
2Reliability
If redundant channel architecture is implemented, then availability and fault tolerance are improved, but system complexity increases
Solution Approach 1:
The system is segmented into identical, independent channels that can be easily replicated. Each channel is a self-contained unit with sensors and processors, making the redundancy architecture systematic and manageable rather than complex and ad-hoc.
Solution Approach 2:
Each channel performs self-diagnosis and self-monitoring of its own components (torque sensor, rotor position sensor, current sensor). The channels independently assess their own health status and report to the voter, eliminating the need for complex centralized monitoring and reducing overall system complexity.
3Reliability
If fail-silent self-monitoring channels are used, then safety is improved, but cost increases and component availability decreases
Solution Approach 1:
The system uses multiple ASIL-B qualified components (which are more readily available and less expensive than ASIL-D components) arranged in a redundant configuration with voting logic. This approach achieves equivalent safety to single ASIL-D components while using more available, cost-effective parts.
Solution Approach 2:
The voter acts as an intermediary that enables the use of less stringent ASIL-B components by providing system-level fault tolerance through redundancy. This intermediary layer allows commodity and semi-commodity components to be used safely without requiring expensive ASIL-D qualification on each individual component.
Data Source
AI summary
A motor electric control unit (ECU) for an electromechanical power steering mechanism, which controls current through an electric assist motor in response to steering mechanism sensors' signals. The ECU may comprise at least two channels. Each channel has the steering mechanism sensors in a redundancy concept. At least one voter that is assigned to an actuator and is configured to vote on the correct steering mechanism sensors' outputs of the at least two channels. The steering mechanism sensors may include a steering column torque sensor and an RPS sensor for sensing a rotor angle of the electric assist motor. Each of the at least two channels may include processors that have different software to protect against systematic faults.