Vector Congress 2016 PSI5: Safety & latest developments Juan Pontes, Robert Bosch GmbH 29.11.2016
Vehicle as networking platform Networking between different systems in the vehicle Networking between different vehicles Networking between vehicle and infrastructure Page 2
Overview of wired interfaces Networking between different systems in the vehicle Digital UART/USART RS-485 RS-232 PWM SENT Automotive digital Peripheral device interfaces Main bus interfaces Voltage Current On-board (ECU) sensor Interfaces USB I 2 C SPI LIN PSI5 DSI3 CAN Flexray 100Base-T1 Analog Page 3
Overview of automotive wired digital interfaces Sensors & Embedded Control 1G 100M Data rates [bit/s] 10M 1M 100k 10k SENT LIN 3-wire 3-wire DSI3 PSI5 2-wire 2-wire SPI 6-wire I2C 4-wire CAN FD CAN high 3/4-wire CAN low 3/4-wire FlexRay wire/optical Implementation costs Page 4
Evolution of PSI5 Standard Focus on Airbag Systems Autoliv Bosch Continental Siemens VDO PAS3 / PAS4 only asynchron Peer 2Peer PEGASUS synchron, Bus capability PSI5 V1.2 June 2007 open Standard PSI5 V1.3 June2008 open Standard Focus extended on Powertrain and Chassis PSI5 V2.0 June 2011 V2.1 October 2012 V2.2 August 2016 Page 5
PSI5 Governing body Page 6
PSI5 specification structure Application specific substandard - Airbag - Chassis and Safety - Powertrain + Base standard Latest release v2.2 (August 2016) Page 7
Basic functionality Sensor Data communication with Manchester-Coding - high Data Rate with 125kbit/s (commercial options: 83kbit/s, 189kbit/s) - flexible Payload Range (10 28bit) with Parity or 3bit CRC Different bus topologies possible asynchron Peer2Peer transmission synchronized Master-Slave Bus communication Parallelbus Daisy-Chain Page 8
Basic implementation Physical layer Simple & safe circuitry Twisted pair cable Specified I/F networks for maximum flexibility and compatibility Page 9
PSI5 interface requirements Costs - Cost efficient components - Cable and Harness - Low weight, little required space, low power Functionality - Flexible system fulfilling different needs and applications - Scalable and extendable (for different data rates) Safety - Reduced emmision - Signal robustness - Error handling Availability - Allows reuse/adaptation of existing developments for/in automotive - Keeps being mantained Robustness - Stable networking, fast start- up - Data availability Page 10
PSI5 physical layer scope for safety & robustness uc Receiver Cable Sensor sync generation sensor supply receiver logic receiver (external interface supply, control logic, ) PSI5 data Control and timing supply shift register sensor (see of gates, mechanic, analog, ) depends partly on specific implementation PSI5 GND depends partly on specific implementation proposed scope of PSI5 safety consideration within PSI5 consortium Measures for data reliability Simple robust circuit Twisted pair cable (recommendation) Large SNR (determines raw failure rate ) Page 11
PSI5 data link layer scope for safety & robustness 0 1 0 0 1 0 NRZ Manchester 1st half bit 2nd half bit evaluation by receiver 0 0 detected failure 0 1 data bit = '0' 1 0 data bit = '1' 1 1 detected failure Non Return to Zero Simple receiver / Manchester decoder with over-sampling factor 2 Redundant Transmission Measures for data reliability Manchester encoded signal (corresponds to full redundant data transmission) pre-defined start bit pattern failure detection by parity check / CRC check (cyclic redundancy check code) gap bit (defined period of no transmission) Page 12
PSI5 safety concept Error probability P E error Probability of Halfbits P RES residual frame error probability P RES, Sys Residual system error probability physical data link application Signal distortion half bit errors bit errors frame errors random and systematic faults system errors residual system failure current modulation, deterministic timing Manchester Encoding start bits, frame gap, parity/crc error frames, initialization sequence signal plausibility, redundant sensors, oversampling PSI5 interface specification Page 13
Aspects of functional safety in system context P RES : Residual error probability for one undetected corrupted data word System goal? What is critical on system level? Final judgement on safety goals can only be done on system level: residual failures regarding the LSBs might not be significant Are there plausibility checks with other sensor signals? How many subsequent data words cause a system failure? Have filtering methods been implemented to supress wrong data? Is oversampling being used? further improvement of data reliability on system level Page 14
ISO26262 Fault Model and Failure Modes fault systematic fault random fault random hardware fault random environmental fault A systematic fault is a fault whose failure is manifested in a deterministic way that can only be prevented by applying process or design measures design and safety measures of PSI5 interface A random fault can occur unpredictably during the lifetime of a hardware element and follows a probability distribution Implementation specific consideration necessary Source: ISO26262, BL18 FDIS Page 15
Systematic Failures within PSI5 Interface electric faults mechanic faults operation faults design faults resistive (incl. short/ open), inductive and capacitive errors wrong voltage and/or current levels wrong timing for single bits, frames or sync periods detection Manchester decoding parity/crc, start/stop-bits deterministic data* Systematic failures can be safely detected by means of PSI5 specification on system level *) Within the design of a PSI5 interconnection, it is predefined which data must be available (deterministic), missing data should be handled on system level. Page 16
Random (Env.) Failures within PSI5 Interface burst continious noise S1 S0 D0 Dn P 0 0 1 0 1 S1 S0 D0 Dn P 0 0 1 0 1 sinosidal S1 S0 D0 Dn P 0 0 1 0 1 S1 S0 D0 Dn P 0 0 1 0 1 offset S1 S0 D0 Dn P 0 0 1 0 1 S1 S0 D0 Dn P 0 0 1 0 1 Error models to evaluate PSI5 robustness have been investigated PSI5 capable withstanding all different error types. Page 17
Residual error rate with gaussian noise 10-2 P E 1 u = SNR = erfc Q 2 2 2 bit error probability 10-4 10-6 10-8 10-10 10-12 P E Manch (10 bit) 10 bit P 20 bit CRC 10-14 10-16 2 4 6 8 10 12 14 16 SNR [db] Residual error probability <10-14 for SNR >14dB Comparable results for 10bit parity and 20bit CRC frames for SNR > 8dB Page 18
Safety overview PSI5 interface provides means for systematic error detection and avoidance The PSI5 interface shows very high data reliability residual error probability <10-14 for SNR >14dB system design defines raw bit error rate P E parity check sufficient for small data words, CRC recommended for large data frames 10bit parity and 20bit CRC frames have comparable P RES for SNR > 8dB Presented methods and argumentations support conformity considerations regarding ISO26262 for systems rated up to ASIL D. Page 19
Influence of disturbances on PSI5 signal For standard signal levels ( I S =22 30mA) typical noise distortions (Gaussian type, as considered) are uncritical Margin can be used to compensate implementation dependent effects: Resonant Worst Case" Long wires = High inductance Current modulation leads to current oscillations & overshoots "Capacitive Worst Case" High capacitive bus load Limitation of slope steepness Page 20
Critical implementation parameters Comparator Sampling Digital Decoder Page 21
Critical implementation parameters Undershoot I Undershoot Data Transmission Parameters: Sending current amplitude Data rate / bit length Slope steepness (20% - 80% rise- & fall-times) Undershoot current Current Amplitude Rise / Fall Times Hardware Parameters: Sensor(s) capacitive load & resistance ECU capacitive load & resistance Cable inductance & resistance Page 22
PSI5 2 nodes 1.94m / 2.64m ECU 1.94m 2.64m S1 S2 189kbps Nominal case: rise time: 557 ns over- & undershoot: 0% Capacitive worst case: rise time: 1144 ns Resonant worst case: overshoot: 3.6% undershoot: -3.6% rise time: 373 ns Robust system operation expected Page 23
PSI5 2 nodes 4.08m / 1.30m ECU 4.08m 1.3m S1 S2 189kbps Nominal case: rise time: 533 ns over- & undershoot: 0% Capacitive worst case: rise time: 1144 ns Resonant worst case: overshoot: 12.8% undershoot: -6.6% rise time: 361 ns Robust system operation expected Page 24
PSI5 3 nodes 3.22m / 2.74m / 2.04m ECU 3.22m 2.74m 2.04m S1 S2 S3 189kbps Nominal case: rise time: 533 ns overshoot: 1.3% undershoot: -3.35% Capacitive worst case: rise time: 1395 ns Resonant worst case: overshoot: 24.6% undershoot: -11.4% rise time: 352 ns Robust system operation expected Page 25
PSI5 4 nodes 2.25m / 3.65m / 3.60m / 5.54m ECU 2.25m 3.65m 3.60m 5.54m S1 S2 S3 S4 189kbps Nominal case: rise time: 520 ns overshoot: 11.2% undershoot: -1.8% Capacitive worst case: rise time: 1618 ns Resonant worst case: overshoot: 43.3% undershoot: -21.3% rise time: 339 ns Robust system operation expected Page 26
PSI5 outlook Costs - Cost efficient components - Cable and Harness - Low weight, little required space, low power Functionality - Flexible system fulfilling different needs and applications - Scalable and extendable (for different data rates) Safety - Reduced emmision - Signal robustness - Error handling Availability - Allows reuse/adaptation of existing developments for/in automotive - Keeps being mantained Robustness - Stable networking, fast start- up - Data availability Page 27
PSI5 outlook Costs - Cost efficient components - Cable and Harness - Low weight, little required space, low power Availability - Allows reuse/adaptation of existing developments for/in automotive - Keeps being mantained Functionality - Flexible system fulfilling different needs and applications - Scalable and extendable (for different data rates) Data rates [bit/s] 1G 100M 10M 1M 100k 10k SENT LIN 3-wire 3-wire DSI3 PSI5 2-wire 2-wire SPI 6-wire I2C 4-wire CAN FD CAN high 3/4-wire CAN low 3/4-wire FlexRay wire/optical Implementation costs Page 28