Emergency Operation in the Power Supply Domain Focusing on Warm Redundancy
To cope with the megatrends electrification, automated driving, and connectivity, new functionalities and E/E systems must be developed, which require a safe power supply. This leads to increased functional safety requirements for the power supply system, particularly regarding availability. Fault t...
| Main Authors: | , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2022-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9956811/ |
| _version_ | 1811214297590661120 |
|---|---|
| author | Philipp Kilian Patrick Van Bergen Oliver Koller Carsten Gebauer Frederic Heidinger Martin Dazer |
| author_facet | Philipp Kilian Patrick Van Bergen Oliver Koller Carsten Gebauer Frederic Heidinger Martin Dazer |
| author_sort | Philipp Kilian |
| collection | DOAJ |
| description | To cope with the megatrends electrification, automated driving, and connectivity, new functionalities and E/E systems must be developed, which require a safe power supply. This leads to increased functional safety requirements for the power supply system, particularly regarding availability. Fault tolerance measures can be implemented to comply with an SG specifying a SaRA requirement. In this case, EO may be necessary to reach a defined safe state. However, there is some ambiguity in ISO 26262 regarding the necessary integrity with which the EO shall be implemented – this becomes in particular obvious in the case of warm redundancy. According to ISO 26262, the EO is entered once the failure of an element is controlled by an explicit fault handling, i.e., prevented from violating an SG, and the remaining ASIL capability of the item after the failure is lower than the required ASIL capability for the allowed VOS. However, in the context of warm redundancy, the EO can be automatically entered in the case of an element failure without an explicit fault handling. The objective of this paper is to transfer the concept of EO, as defined in ISO 26262, to warm redundancy use cases because warm-redundant power supply systems have a high level of market penetration. Besides a detailed evaluation of time dependencies, new guidelines concerning the required systematic integrity for SMs implementing EO are provided. |
| first_indexed | 2024-04-12T06:00:54Z |
| format | Article |
| id | doaj.art-d7bd34e79bd64ba38efac582cdfb50da |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-04-12T06:00:54Z |
| publishDate | 2022-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-d7bd34e79bd64ba38efac582cdfb50da2022-12-22T03:45:02ZengIEEEIEEE Access2169-35362022-01-011012347412348810.1109/ACCESS.2022.32236689956811Emergency Operation in the Power Supply Domain Focusing on Warm RedundancyPhilipp Kilian0https://orcid.org/0000-0002-5012-7259Patrick Van Bergen1https://orcid.org/0000-0002-0422-6838Oliver Koller2Carsten Gebauer3Frederic Heidinger4Martin Dazer5https://orcid.org/0000-0002-5314-5874Institute of Machine Components, University of Stuttgart, Stuttgart, GermanyCross-Domain Computing Solutions, Product Area Integrating Devices–Engineering Vehicle Systems (XC-AN/EPI1), Robert Bosch GmbH, Stuttgart, GermanyCross-Domain Computing Solutions, Product Area Integrating Devices–Senior Expert Powernet Strategy (XC-AN/PAI), Robert Bosch GmbH, Stuttgart, GermanySystems Engineering, Bosch Center of Competence Vehicle Safety (M/ENG-CVS), Robert Bosch GmbH, Ludwigsburg, GermanyCross-Domain Computing Solutions, Product Area Integrating Devices–Engineering Vehicle Systems (XC-AN/EPI1), Robert Bosch GmbH, Stuttgart, GermanyInstitute of Machine Components, University of Stuttgart, Stuttgart, GermanyTo cope with the megatrends electrification, automated driving, and connectivity, new functionalities and E/E systems must be developed, which require a safe power supply. This leads to increased functional safety requirements for the power supply system, particularly regarding availability. Fault tolerance measures can be implemented to comply with an SG specifying a SaRA requirement. In this case, EO may be necessary to reach a defined safe state. However, there is some ambiguity in ISO 26262 regarding the necessary integrity with which the EO shall be implemented – this becomes in particular obvious in the case of warm redundancy. According to ISO 26262, the EO is entered once the failure of an element is controlled by an explicit fault handling, i.e., prevented from violating an SG, and the remaining ASIL capability of the item after the failure is lower than the required ASIL capability for the allowed VOS. However, in the context of warm redundancy, the EO can be automatically entered in the case of an element failure without an explicit fault handling. The objective of this paper is to transfer the concept of EO, as defined in ISO 26262, to warm redundancy use cases because warm-redundant power supply systems have a high level of market penetration. Besides a detailed evaluation of time dependencies, new guidelines concerning the required systematic integrity for SMs implementing EO are provided.https://ieeexplore.ieee.org/document/9956811/Automotive electronicsautomotive engineeringemergency power suppliesfunctional safetyISO 26262power supplies |
| spellingShingle | Philipp Kilian Patrick Van Bergen Oliver Koller Carsten Gebauer Frederic Heidinger Martin Dazer Emergency Operation in the Power Supply Domain Focusing on Warm Redundancy IEEE Access Automotive electronics automotive engineering emergency power supplies functional safety ISO 26262 power supplies |
| title | Emergency Operation in the Power Supply Domain Focusing on Warm Redundancy |
| title_full | Emergency Operation in the Power Supply Domain Focusing on Warm Redundancy |
| title_fullStr | Emergency Operation in the Power Supply Domain Focusing on Warm Redundancy |
| title_full_unstemmed | Emergency Operation in the Power Supply Domain Focusing on Warm Redundancy |
| title_short | Emergency Operation in the Power Supply Domain Focusing on Warm Redundancy |
| title_sort | emergency operation in the power supply domain focusing on warm redundancy |
| topic | Automotive electronics automotive engineering emergency power supplies functional safety ISO 26262 power supplies |
| url | https://ieeexplore.ieee.org/document/9956811/ |
| work_keys_str_mv | AT philippkilian emergencyoperationinthepowersupplydomainfocusingonwarmredundancy AT patrickvanbergen emergencyoperationinthepowersupplydomainfocusingonwarmredundancy AT oliverkoller emergencyoperationinthepowersupplydomainfocusingonwarmredundancy AT carstengebauer emergencyoperationinthepowersupplydomainfocusingonwarmredundancy AT fredericheidinger emergencyoperationinthepowersupplydomainfocusingonwarmredundancy AT martindazer emergencyoperationinthepowersupplydomainfocusingonwarmredundancy |