Dual AMR motor position sensors help autonomous driving travel safely

In recent years, as people pay more attention to improving vehicle safety, active advanced driver assistance systems (ADAS) have been continuously developed and promoted, which is a supplement to the traditional passive systems that rely on airbags to protect the safety of drivers and passengers. These emerging systems are initially intended to help drivers make correct decisions in safety-critical situations, and in the long run, replace drivers in making decisions.

These technological advances are also leading the transition of cars towards semi-autonomous and fully autonomous driving. The electronic control unit (ECU) makes decisions instead of the driver, and the actuators are responsible for vehicle steering and braking operations, thus handing over the task of driving the vehicle to sensors, ECUs and electronic actuators.

This trend is driving the development of more reliable, smarter, and higher-performing redundant electronic actuator solutions that meet the ISO 26262 functional safety standard. This is a risk-based safety standard that qualitatively assesses the risk of hazardous operating situations and incorporates safety measures into component and system design to avoid or manage system failures, as well as detect or control or mitigate the effects of random hardware failures. These actuator systems are typically driven by brushless DC (BLDC) motors, and because these systems are safety-critical, designers must ensure that the system can meet the high standards of Automotive Safety Integrity Level (ASIL) D when designing the hardware and software of the solution.

Traditionally, blocked commutation (see Figure 1a) consists of three Hall switches to indicate the position of the rotor in a brushless DC motor. Block commutation is being replaced by sinusoidal commutation control as people demand improved performance of BLDC motor drives (including EPS systems), especially reducing their noise, vibration and harshness (NVH) and improving their operating efficiency. The Hall switches can be replaced by MR angle sensors mounted in front of a bipolar magnet at the end of the motor shaft (see Figure 1b). In a typical application, the MPS is also mounted on the ECU assembly, which is integrated into the motor housing and mounted at the end of the motor shaft.

Figure 1. (a) BLDC blocking commutation control and (b) BLDC sinusoidal commutation control

ISO 26262 was introduced in 2011 as a safety standard to address the hazards that could result from system failures related to electrical safety, before being superseded by the 2018 edition.

A safety and risk analysis must be performed on the system to determine the ASIL level of the system. The ASIL level is determined by reviewing the severity, exposure, and controllability of the potential hazards of the system during operation (see Figure 2).

Figure 2. ISO 26262 ASIL rating matrix

For example, if we perform a risk and hazard analysis on the EPS system, we may conclude that these serious events (such as steering sticking and automatic steering, etc.) are rated as ASIL D based on their severity, controllability, and exposure.

Likewise, for upcoming electronic braking systems, the same logic can be used to determine the severity of uncontrollable events, such as brake sticking or automatic braking.

Based on the EPS or braking system example, the rating of the ASIL D system can be achieved by decomposing the subsystems as shown in Figure 3a, Figure 3b, and Figure 3c.

Figure 3. ASIL decomposition scheme for ASIL D systems

It is not required that every system component be developed to ASIL D standards and processes in order for an ASIL D system to be compliant; however, when conducting a system-level audit, the entire system must meet the requirements and sub-components at the QM, ASIL A, B, C, and D levels can be integrated as part of the system.

System decomposition should also ensure adequate independence and take into account the possibility of dependencies or common cause failures.

The typical EPS system topology is shown in Figure 4. The EPS ECU calculates the required auxiliary power based on the steering torque applied by the driver to the steering wheel, the position of the steering wheel, and the speed of the vehicle. The EPS motor turns the steering wheel by applying force, reducing the torque required by the driver to operate the steering wheel.

Figure 4. Typical EPS topology

The motor shaft position (MSP) angle, combined with the phase current measurement information, is used to implement commutation and control of the EPS motor driver. The basic typical EPS motor control loop is shown in Figure 5. The required level of torque assistance varies depending on driving conditions and is determined by wheel speed sensors and torque sensors, which measure the torque applied to the steering wheel by the driver or motor actuator in an autonomous vehicle. The microcontroller then uses the MSP data and phase current data to control the current load provided to the motor (providing the required assistance).

Figure 5. Typical EPS motor control loop.

MPS sensor failures can cause or exacerbate system failures, such as steering lock or automatic steering, so MPS is a critical component in the EPS system. Therefore, it is important that the system be able to comprehensively diagnose sensor failures and redundancy to ensure that normal operation can continue in the event of an MPS sensor error or failure, ensuring that no serious system failure occurs, or in the event of an error, the system can be shut down in a safe manner.

Current sense amplifiers are often used to indirectly and accurately measure motor load, typically on two of the three motor phases, providing additional diagnostic information that can be part of an overall system safety measure.

Additionally, highly accurate motor position and phase current measurement is a critical component in the system as it improves EPS motor control performance at a system level, enabling very efficient, quiet, and smooth steering, improving the entire driving experience.

In EPS or other safety-critical motor control applications, there are different approaches that can be taken to achieve ASIL D compliance. The following example shows that dual anisotropic magnetoresistive (AMR) motor position sensors and ADI’s current sense amplifiers can be integrated into such a system to provide the required performance level and redundancy to achieve ISO 26262 ASIL D compliance at the system level.

In the block diagram shown in Figure 6, the dual AMR sensor is completed and supplemented with another sensor based on a different technology (such as Hall, GMR, or TMR).

Accurate angle measurements continue to be provided by both channels of the dual AMR sensors. Additional system diagnostics, such as motor load and shaft position, can be indirectly inferred from the dynamic state (back EMF) of the accurate phase current sense amplifiers.

Figure 6. Example of motor position and phase current sensing structure for safety-critical applications

If we look at all possible sensor failure modes in this sensor architecture example, we can see that there should always be two position sensor inputs available for plausibility checks. Even in the extremely unlikely extreme case where both AMR channels fail simultaneously due to a common fault cause, the degraded position sensing information from the auxiliary sensor channel and the back EMF information provided by the current sensor in a dynamic state can still be cross-checked to ensure that the basic functionality of the system continues to operate normally.

This system-level diagnostic capability will ensure that critical failure modes do not occur and that the system achieves ISO 26262 ASIL D compliance. The system can then be safely powered down or put into limp home mode to be returned to a dealer for repair.

With the introduction of ADAS to improve automotive safety, and the emergence of fully and semi-autonomous vehicles, people are beginning to demand more reliable, smarter, and higher-performance redundant electronic actuator solutions that meet the ISO 26262 functional safety standard. ADI's motor shaft position and phase current detection products not only meet the requirements for improved performance and smoother and more efficient motor control, but also provide the redundancy required to achieve high ASIL requirements in safety-critical applications such as EPS or braking systems.

The ADA4571-2 dual AMR sensor from ADI is designed for these safety-critical applications that require redundant and independent detection channels. It is a dual-channel AMR sensor with integrated signal conditioning amplifiers and ADC drivers. The product includes two AMR (Sensitec AA745) sensors and two amplifier signal conditioning ASICs.

The AD8410 current sense amplifier from ADI enables bidirectional current measurement across shunt resistors in EPS and other BLDC motor control systems. This is a high voltage, high resolution, and high bandwidth current shunt amplifier designed to provide the accurate measurements needed in harsh environments, provide diagnostics in safety-critical applications, help reduce torque ripple and audible noise, enable smooth, efficient BLDC motor control (such as EPS or braking), and improve the overall driving experience.