1 - EA3-x NTC 0x0AA(0) LOA Rapid Shutdown

Slide 1

NTC Overview
NTC 0x0AA.0 LOA Rapid Shutdown

Description:

SF049A Loss of Assist Manager tries to avoid system shutdown when safe sensor redundancy is still in tact.  However, in the event that conditions do not allow continued operation, it is LoaMgr’s responsibility to request system shutdown.

Diagnostic Overview:
LoaMgr includes many calibrations used to determine correct system response.  Some of them  can be given values to intentionally trigger this fault.  LoaMgr reacts instantly because all debounce operations are assumed to happen in outside functions that feed intputs to LoaMgr.

Typical Fault Response: F3 Notification Only
The diagnostic is set to an F1.  The fault is intended to produce immediate shutdown of the system.  

Probable Sources (Most to Least Probable):

  • One of LoaMgr’s “Independent Signals” inputs has a runtime value that matches up with one of the “Response” calibrations whose cal value is set to 5. 

  •  One of LoaMgr’s “Independent Signals” inputs is receiving an initial value has a value that matches up with one of the “Response” calibrations whose cal value is set to 5. 

  • Two or more issues exist in the system simultaneously, which automatically promotes LoaMgr response from calibrated values to a hardcoded response of 5 (Rapid Shutdown Requested).  Example:  System was already using TLOA due to lost handwheel torque signals, and then the system loses motor current signals.  Each response (HwTq and MotCurr) by itself might be cal’d to engage software-based mitigation (TLOA and Voltage Mode), but together they are deemed an illegal combination.  Illegal combinations result in F1 shutdown. 

Initialization

 

Periodic

 

Event

X

Date

Revision

Initials

3/27/2015

Initial Release

Kevin Derry

   
   
   
   
   
   
   
   
   

Description of Unusual Event setting NTC

Root Cause / Explanation

  
  
  

Date

FDD & Rev

Modifications to Diagnostic Function

3/27/2015

SF049A v1.0.0

Initial Implementation

   
   
   

Algorithm Changes / Lessons Learned / Revision Log

2 - EA3-x NTC 0x0AB(0) LOA Controlled Shutdown

Slide 1

NTC Overview
NTC 0x0AB.0 LOA Controlled Shutdown

Description:

SF049A Loss of Assist Manager tries to avoid system shutdown when safe sensor redundancy is still in tact.  However, in the event that conditions do not allow continued operation, it is LoaMgr’s responsibility to request system shutdown.

Diagnostic Overview:
LoaMgr includes many calibrations used to determine correct system response.  Some of them  can be given values to intentionally trigger this fault.  LoaMgr reacts instantly because all debounce operations are assumed to happen in outside functions that feed intputs to LoaMgr.

Typical Fault Response: F3 Notification Only
The diagnostic is set to an F2.  The fault is intended to produce shutdown of the system and apply damping to control handwheel kick.  

Probable Sources (Most to Least Probable):

  • One of LoaMgr’s “Independent Signals” inputs has a runtime value that matches up with one of the “Response” calibrations whose cal value is set to 4. 

  •  One of LoaMgr’s “Independent Signals” inputs is receiving an initial value has a value that matches up with one of the “Response” calibrations whose cal value is set to 4. 

Initialization

 

Periodic

 

Event

X

Date

Revision

Initials

3/27/2015

Initial Release

Kevin Derry

   
   
   
   
   
   
   
   
   

Description of Unusual Event setting NTC

Root Cause / Explanation

  
  
  

Date

FDD & Rev

Modifications to Diagnostic Function

3/27/2015

SF049A v1.0.0

Initial Implementation

   
   
   

Algorithm Changes / Lessons Learned / Revision Log

3 - EA3-x NTC 0x0AC(0) Handwheel Torque Independent Signals Too Low

Slide 1

NTC Overview
NTC 0x0AC.0 Handwheel Torque Independent Signals Too Low

Description:

SF049A Loss of Assist Manager tries to avoid system shutdown when safe sensor redundancy is still in tact.  However, customers want to prevent EPS from operating when issues occur repeatedly across ignition cycles.  Nexteer’s strategy is to provide NTCs for each issue to be tracked.

Diagnostic Overview:
Input signal HwTqIdptSig_Cnt_u08 represents the currently active number of Handwheel Torque signals.  When the number of independent signals is equal to or less than a calibration in LoaMgr, the fault status is set instantly to Failed.  LoaMgr can react instantly because the function providing the input signal is expected to debounce before dropping to a lower value.

Typical Fault Response: F3 Notification Only
The diagnostic is set to an F3.  The fault is intended to produce not immediate change in system behavior.  Its purpose is to allow disabling of EPS at the beginning of the Nth ignition cycle.  

Probable Sources (Most to Least Probable):

  • An individual handwheel torque sensor is offline, due to being out of range or perhaps a protocol issue.  This should result in an upstream F3 in an ES function. 

  • A pair or more of sensors do not correlate with one another.  This should result in an additional F3 fault from the upstream ES function: Handwheel Torque Correlation. 

Initialization

 

Periodic

 

Event

X

Date

Revision

Initials

3/27/2015

Initial Release

Kevin Derry

   
   
   
   
   
   
   
   
   

Description of Unusual Event setting NTC

Root Cause / Explanation

  
  
  

Date

FDD & Rev

Modifications to Diagnostic Function

3/27/2015

SF049A v1.0.0

Initial Implementation

   
   
   

Algorithm Changes / Lessons Learned / Revision Log

4 - EA3-x NTC 0x0AD(0) Motor Angle Independent Signals Too Low

Slide 1

NTC Overview
NTC 0x0AD.0 Motor Angle Independent Signals Too Low

Description:

SF049A Loss of Assist Manager tries to avoid system shutdown when safe sensor redundancy is still in tact.  However, customers want to prevent EPS from operating when issues occur repeatedly across ignition cycles.  Nexteer’s strategy is to provide NTCs for each issue to be tracked.

Diagnostic Overview:
Input signal MtrPosIdptSig_Cnt_u08 represents the currently active number of Motor Position signals.  When the number of independent signals is equal to or less than a calibration in LoaMgr, the fault status is set instantly to Failed.  LoaMgr can react instantly because the function providing the input signal is expected to debounce before dropping to a lower value.

Typical Fault Response: F3 Notification Only
The diagnostic is set to an F3.  The fault is intended to produce not immediate change in system behavior.  Its purpose is to allow disabling of EPS at the beginning of the Nth ignition cycle.  

Probable Sources (Most to Least Probable):

  • An individual motor position sensor is offline.  This should result in an upstream F3 in an ES function. 

  • A pair or more of sensors do not correlate with one another.  This should result in an additional F3 fault from the upstream ES function: Motor Angle Correlation. 

Initialization

 

Periodic

 

Event

X

Date

Revision

Initials

3/27/2015

Initial Release

Kevin Derry

   
   
   
   
   
   
   
   
   

Description of Unusual Event setting NTC

Root Cause / Explanation

  
  
  

Date

FDD & Rev

Modifications to Diagnostic Function

3/27/2015

SF049A v1.0.0

Initial Implementation

   
   
   

Algorithm Changes / Lessons Learned / Revision Log

5 - EA3-x NTC 0x0AE(0) Motor Current Independent Signals Too Low

Slide 1

NTC Overview
NTC 0x0AE.0 Motor Current Independent Signals Too Low

Description:

SF049A Loss of Assist Manager tries to avoid system shutdown when safe sensor redundancy is still in tact.  However, customers want to prevent EPS from operating when issues occur repeatedly across ignition cycles.  Nexteer’s strategy is to provide NTCs for each issue to be tracked.

Diagnostic Overview:
Input signal MotCurrIdptSig_Cnt_u08 represents the currently active number of Motor Current signals.  When the number of independent signals is equal to or less than a calibration in LoaMgr, the fault status is set instantly to Failed.  LoaMgr can react instantly because the function providing the input signal is expected to debounce before dropping to a lower value.

Typical Fault Response: F3 Notification Only
The diagnostic is set to an F3.  The fault is intended to produce not immediate change in system behavior.  Its purpose is to allow disabling of EPS at the beginning of the Nth ignition cycle.  

Probable Sources (Most to Least Probable):

  • For EA3 single-inverter applications, the input signal is coming from SF031A Current Reasonableness. 

Initialization

 

Periodic

 

Event

X

Date

Revision

Initials

3/27/2015

Initial Release

Kevin Derry

   
   
   
   
   
   
   
   
   

Description of Unusual Event setting NTC

Root Cause / Explanation

  
  
  

Date

FDD & Rev

Modifications to Diagnostic Function

3/27/2015

SF049A v1.0.0

Initial Implementation

   
   
   

Algorithm Changes / Lessons Learned / Revision Log

6 - EA3-x NTC 0x0AF(0) Inverter Independent Signals Too Low

Slide 1

NTC Overview
NTC 0x0AF.0 Inverter Independent Signals Too Low

Description:

SF049A Loss of Assist Manager tries to avoid system shutdown when safe sensor redundancy is still in tact.  However, customers want to prevent EPS from operating when issues occur repeatedly across ignition cycles.  Nexteer’s strategy is to provide NTCs for each issue to be tracked.

Diagnostic Overview:
Input signal IvtrIdptSig_Cnt_u08 represents the currently active number of Inverters.  When the number of independent signals is equal to or less than a calibration in LoaMgr, the fault status is set instantly to Failed.  LoaMgr can react instantly because the function providing the input signal is expected to debounce before dropping to a lower value.

Typical Fault Response: F3 Notification Only
The diagnostic is set to an F3.  The fault is intended to produce not immediate change in system behavior.  Its purpose is to allow disabling of EPS at the beginning of the Nth ignition cycle.  

Probable Sources (Most to Least Probable):

  • This fault should never get used in single-inverter EA3 programs because the IvtrIdptSig_Cnt_u08 input port of LoaMgr will remain disconnected.  There is no upstream function to send this signal into LoaMgr. 

  • Fault may be active because the threshold calibration value is set too high.  For a single-inverter design, threshold cal should be zero.  For a dual-inverter design, threshold cal should be zero or one. 

  • Fault may be active because LoaMgr input port was not stubbed out with the correct Initial Value.  Should be stubbed with a value of 2. 

Initialization

 

Periodic

 

Event

X

Date

Revision

Initials

3/27/2015

Initial Release

Kevin Derry

   
   
   
   
   
   
   
   
   

Description of Unusual Event setting NTC

Root Cause / Explanation

  
  
  

Date

FDD & Rev

Modifications to Diagnostic Function

3/27/2015

SF049A v1.0.0

Initial Implementation

   
   
   

Algorithm Changes / Lessons Learned / Revision Log

7 - SF049A_LoaMgr_DeliveryExceptions

PowerPoint Presentation

SF049A_LoaMgr_v1.0.0

  • Data Dictionary report shows errors due to bug in VerifyDD tool.  DataDict.Constants are named in ALL CAPS, so the tool thinks that units are spelled wrong (CNT instead of Cnt). 

8 - SF049A_LoaMgr_Peer Review Checklist Design

Nexteer_Template_V1.0

Overview

Peer Review Instructions
Technical Review Checklist
Template Change Log


Sheet 1: Peer Review Instructions

Instructions for Functional Design Package Peer Review




PRE-MEETING


Function OwnerConfirm that requirements are reviewed and approved PRIOR to the FDP peer review

Function OwnerStart with latest version of the template for any "first reviews" - Continue to use existing temmplate for re-reviews

Function OwnerProvide the functional design package (changed documents) to the invited attendees 1-2 working days in advance of review

Function OwnerNotify the assigned peer reviewer and make sure they are prepared to do their function in the meeting

Function OwnerIdentify necessary attendance and invite to meeting

Function OwnerComplete the "Author" column information for sections 1 through 3 prior to the review

Function OwnerComplete the attendance invitation list in section 5

Function OwnerFor Re-reviews only: Complete the column "remarks by author" to identify actions taken to address items found in earlier reviews.



DURING MEETING


Function OwnerPresent document changes to the review team

Peer ReviewerCapture attendance of the review

Peer ReviewerCapture actions and issues in section 4. Identify issue summary, Document type, Reference (Requirement ID, section number, etc), Defect Type and indicate status as "OPEN"



POST MEETING


Function OwnerFollow up on all "open" items. Update "Summary of Resolution" to indicate what was done or decided.

Function OwnerSchedule follow up review OR review open items with peer reviewer and obtain agreement to close

Peer ReviewerClose change request in system and confirm all associated tasks are complete. Upload peer review checklist (this document) with any FDP updates

Sheet 2: Technical Review Checklist

Technical Review Checklist - Template Version 02.00.00







Product NameSF049A_LoaMgrElectrical Arch.
Review ScopeDefect TypeNumbers




YesClosedFR
Function IDSF049A

EA4#5999 Design ImplementationRequirement0




NoRejectedFDD
Long Name


Interface0




NAOpenModel
Version that you started from. NOT the version you hope to release. If this will be v1.0.0, enter NA. Starting BaselineNAEffortDesign0






Model and m file
AuthorNimmy MathewsReview Effort(Hrs.)0.20Standards0






*.m File


Corr+Verf effort(Hrs.)3.00Documentation0









Total Effort (Hrs.)3.20Others0













Total0







Checklist No.Description of CheckAuthor: This column is for Self review. Author shall fill Yes/No/NA against each point in checklist. AuthorAuthor: This column is for reviewer. Reviewer shall fill Yes/No/NA against each point in checklist. ReviewerAuthor: Detailed Description of the finding shall be provided by the reviewer. Description of finding by reviewerAuthor: Defect type to be selected. Defect TypeAuthor: What action is taken to fix the comment & other remarks need to be filled by author. Remarks By AuthorAuthor: Data in this column shall be filled by reviewer after checking whether the rework is completed. Status







1Section 1: Data Dictionary














Is Filename of Data Dictionary in correct format?YesYes












Is the FDD.Version property correctly updated?YesYes












Is the Data Dictionary Verification report error free?NoNo

There are two errors which is neglected after discussion with Peers which is an acceptable violation.Closed








Does FDD Long Name, Short Name, and Description match requirements?YesYes












Are all runnables defined?YesYes












Do runnables have the correct time step?YesYes












Do server runnables correctly define arguments?NANA












Are all clients defined?NANA












Do client definitions match the corresponding server runnable?NANA












Does name and metadata of every signal match its corresponding interface signal?YesYes












Do output signal ranges match requirements (check DOOR min/max attributes too)?NANA












Are calibration tables named correctly (e.g. AssiX and AssiY)?NANA












Do all calibrations have correct values for all metadata?NANA












Is NVM defined in the appropriate number of blocks?NANA












Are constants defined with proper scope (local vs global)?NANA












Are all dependent constants and calibrations included in one file?NANA












Does FDD.DesignASIL match requirements?NANA



























2Section 2: ModelAuthor: This column is for Self review. Author shall fill Yes/No/NA against each point in checklist. AuthorAuthor: This column is for reviewer. Reviewer shall fill Yes/No/NA against each point in checklist. ReviewerAuthor: Detailed Description of the finding shall be provided by the reviewer. Description of finding by reviewerAuthor: Defect type to be selected. Defect TypeAuthor: What action is taken to fix the comment & other remarks need to be filled by author. Remarks By AuthorAuthor: Data in this column shall be filled by reviewer after checking whether the rework is completed. Status








Is filename of model in correct format?YesYes












Is Top level of model annotated with Requirements Baseline?YesYes












Is the Top level of the model annotated with Tool Dependencies?YesYes












Is Top level of model annotated with Change Log or History?YesYes












Does the Component shortname match data dictionary FDD metadata?YesYes












Is the 2nd level of model free from subsystems that are not Function-Call Subsystems?NANA












Is the 2nd level of model free from arithmetic and logic operations?NANA












Are the Runnable trigger signals named as "call_<Runnable>"?NANA












Does 2nd level of model have a properly updated annotation with name, description, and intended baseline number?YesYes












Are all data flow layers free of Function-Call Subsystems and Memory Store blocks?NANA












Does the Model have the confidentiality and copyright information inside all its Subsystems?NANA












Are all the Memory Store blocks for PIM and Display Variables located on the 2nd level of model?NANA












Do all Memory Store blocks for PIM and Display Variables have the "Data store name must resolve to Simulink signal object" setting checked to true?NANA












Is each diagnostic (NTC) capable of being set to "PASS"?NANA












Does non-zero intialization of PIM occur in the function's Init runnable?NANA












Does design properly include Set Ram Block Status when NVM RAM values change?NANA












Does model include appropriate logic for dealing with missing or corrupted NVM data?NANA












Does model execute without errors/warnings after loading NxtrMBDConfig configuration set?YesYes



























3Section 3: Requirements LinkingAuthor: This column is for Self review. Author shall fill Yes/No/NA against each point in checklist. AuthorAuthor: This column is for reviewer. Reviewer shall fill Yes/No/NA against each point in checklist. ReviewerAuthor: Detailed Description of the finding shall be provided by the reviewer. Description of finding by reviewerAuthor: Defect type to be selected. Defect TypeAuthor: What action is taken to fix the comment & other remarks need to be filled by author. Remarks By AuthorAuthor: Data in this column shall be filled by reviewer after checking whether the rework is completed. Status








Are all requirements links of the format <FDDNumber>_<ObjectID>?YesYes












Does requirements HTML report reference only the DOORS module of this component for all links in the design?YesYes












Are linked blocks linked to the correct requirements(s)? (watch for problems due to copy/pasted blocks)YesYes












Is the list of unlinked blocks acceptable?NANA



























4Section 4: Model AdvisorAuthor: This column is for Self review. Author shall fill Yes/No/NA against each point in checklist. AuthorAuthor: This column is for reviewer. Reviewer shall fill Yes/No/NA against each point in checklist. ReviewerAuthor: Detailed Description of the finding shall be provided by the reviewer. Description of finding by reviewerAuthor: Defect type to be selected. Defect TypeAuthor: What action is taken to fix the comment & other remarks need to be filled by author. Remarks By AuthorAuthor: Data in this column shall be filled by reviewer after checking whether the rework is completed. Status








Was Model Advisor run with the correct configuration settings?YesYes












Is the Model Advisor report free from "Fails".YesYes












Are Model Advisor report "Warnings" acceptable?YesYes



























5Section 5: Delivery PackageAuthor: This column is for Self review. Author shall fill Yes/No/NA against each point in checklist. AuthorAuthor: This column is for reviewer. Reviewer shall fill Yes/No/NA against each point in checklist. ReviewerAuthor: Detailed Description of the finding shall be provided by the reviewer. Description of finding by reviewerAuthor: Defect type to be selected. Defect TypeAuthor: What action is taken to fix the comment & other remarks need to be filled by author. Remarks By AuthorAuthor: Data in this column shall be filled by reviewer after checking whether the rework is completed. Status








Does Design folder contain only the model, data dictionary, and (optionally) a simulation setup script?YesYes












Does Doc folder contain a zipped HTML webview model?YesYes












Was webview model created without requirements highlighted?NANA












Does Reports folder contain only the data dictionary verification report, zipped Model Advisor report, and zipped requirements traceability report?YesYes



























6Section 6: Other Issus/Actions IdentifiedDocumentReferenceSummary of resolutionAuthor: Defect type to be selected. Defect TypeAuthor: What action is taken to fix the comment & other remarks need to be filled by author. Remarks By AuthorAuthor: Data in this column shall be filled by reviewer after checking whether the rework is completed. Status














Closed














Closed














Closed














Closed














Closed














Closed














Closed














Closed














Closed














Closed














Closed







































7Section 7: APPROVALS













RoleFirst ReviewDateAttendanceApproval?










Function Owner*Matthew Tompkins6/8/2016
Yes










Peer Reviewer*Price LeflerYes










Safety<Name - if invited>











Software<Name - if invited>











ESG / Systems
Yes










EPDT / CSE<Name - if invited>











Hardware<Name - if invited>











Test<Name - if invited>











RoleSecond Review (if required)DateAttendanceApproval?










Function Owner*<Name - if invited>













Peer Reviewer*<Name - if invited>











Safety<Name - if invited>











Software<Name - if invited>











ESG / Systems<Name - if invited>











EPDT / CSE<Name - if invited>











Hardware<Name - if invited>











Test<Name - if invited>











RoleThird Review (if required)DateAttendanceApproval?










Function Owner*<Owner Name>













Peer Reviewer*<Name>












Safety<Name - if invited>












Software<Name - if invited>












ESG / Systems<Name - if invited>












EPDT / CSE<Name - if invited>












Hardware<Name - if invited>












Test<Name - if invited>












RoleFourth Review (if required)DateAttendanceApproval?










Function Owner*<Owner Name>













Peer Reviewer*<Name>












Safety<Name - if invited>












Software<Name - if invited>












ESG / Systems<Name - if invited>












EPDT / CSE<Name - if invited>












Hardware<Name - if invited>












Test<Name - if invited>












RoleAdd more if necessaryDateAttendanceApproval?










































P.S.:Yes indicates adherence














No indicates non-adherence, reviewer shall provide suitable comments at the end of this document for each point.














NA indicates not applicable














Sheet 3: Template Change Log

RevChangeAuthor