GB/T 43254-2023Functional safety requirements and testing methods for drive motor system of electric vehicles (English PDF)

3.2 Drive motor

An electrical device, that converts electrical energy into mechanical energy, to provide driving force for vehicle driving. This device also has the function of converting mechanical energy into electrical energy. [Source: GB/T 19596-2017, definition 3.2.1.1.2.1, modified]

3.3 Drive motor controller

A device that controls the energy transmission between the power source and the drive motor, which is composed of a control signal interface circuit, a drive motor control circuit, a drive circuit power electronic module, etc.

5.1 General requirements

Relevant items shall be defined in accordance with the requirements of GB/T 34590.3-2022.Relevant items refer to systems or system combinations that implement vehicle-level functions or partial functions.

Note: Relevant items and their scope are defined on actual situations Appendix A gives the functional concepts and related item boundaries and interface examples with the drive motor system as the related item.

5.2 Functional concept

In order to meet the safe operation of the vehicle and ensure the safety of people inside and outside the vehicle and the vehicle environment, the drive motor system shall monitor and protect the safe operation of the drive motor. The functional requirements of the drive motor system shall also meet the functional requirements in GB/T 18488 (all parts) and GB 18384-2020.

5.3 Operating conditions and environmental constraints

In order to meet the safe operation of vehicles, it is necessary to clarify the operating conditions and environmental constraints of relevant items, which may include (if applicable).

6.1 General

According to the definition of relevant items in Chapter 5, in accordance with GB/T 34590.3-2022, based on vehicle usage scenarios, analyze and identify hazards caused by failures in the drive motor system and classify the hazards; define the corresponding automotive safety integrity level (ASIL); establish safety objectives to prevent hazardous events from occurring or reduce the degree of hazards, to avoid unreasonable risks.

6.2 Safety objectives

The safety objectives and attributes of the drive motor system, which are determined through hazard analysis and risk assessment, shall at least include the content listed in Table 1.

7.1 Prevent the motor from being unable to output driving torque

7.1.1 General requirements

The vehicle controller unit (VCU) or other controllers (depending on the vehicle electronic architecture) shall ensure the correctness and completeness of signals, such as working mode requests and torque commands, as sent to the drive motor controller unit (MCU).

7.1.2 Operation mode

7.1.3 Fault tolerance time interval (FTTI)

7.1.4 Entry and exit of safe status

When it is confirmed that a related fault that cannot output driving torque occurs, the drive motor system enters the safe state by issuing a fault warning. When the related fault that cannot output driving torque exits or the elimination conditions are not met, it shall not exit the safe status.

7.1.5 Alarm and degrade concepts

When a fault related to the inability to output driving torque occurs, the drive motor system shall feedback fault flag information.

7.2 Prevent the motor from unexpectedly outputting excessive driving torque

7.2.1 General requirements

The vehicle controller unit (VCU) or other controllers (depending on the vehicle electronic architecture) shall ensure the correctness and completeness of signals, such Drive torque less

7.2.2 Operating mode

The drive motor system shall be in working condition.

The drive motor system shall be in driving working condition.

7.2.3 Fault tolerance time interval (FTTI)

The fault tolerance time interval for unexpected excessive output drive torque, as shown in Figure 2, shall be given based on analysis, testing, etc.

Note: The fault tolerance time interval for unexpected excessive output drive torque is determined by the vehicle manufacturer and the drive motor system supplier, through negotiation.

The fault tolerance time interval for failure to output driving torque, as shown in Figure 1, shall be given based on analysis, testing, etc.

7.2.4 Entry and exit of safe status

When it is confirmed that an unexpected fault related to excessive output driving torque occurs, the drive motor system shall enter a safe status by issuing a fault warning and terminating torque output; it shall not exit the safe status, when exiting due to faults related to unexpected excessive output driving torque, or the elimination conditions are not met.

7.2.5 Alarm and degrade concepts

When an unexpected fault related to excessive output drive torque occurs, torque derating and other processing can be performed first on the premise of ensuring that it can enter a safe status. The drive motor system shall feedback fault flag information.

7.3 Prevent the motor torque output direction from being reversed

7.3.1 General requirements

The vehicle controller unit (VCU) or other controllers (depending on the vehicle Unexpected output drive torque

7.3.2 Operating mode

The drive motor system shall be in working condition.

7.3.3 Fault tolerance time interval (FTTI)

The fault tolerance time interval for the reverse direction of the drive motor's output torque, as shown in Figure 3, shall be given based on analysis, testing, etc.

Note: The fault tolerance time interval for the reverse direction of the drive motor output torque is determined by the vehicle manufacturer and the drive motor system supplier, through negotiation.

7.3.4 Entry and exit of safe state

When it is confirmed that a fault related to the reverse direction of the drive motor's torque output occurs, the drive motor system enters a safe state by issuing a fault warning and terminating the torque output. If the fault related to the reverse direction of the drive motor's torque output is exited or shall not be exited.

Note: Fault exit or elimination conditions are determined by the vehicle manufacturer and the drive motor system supplier, through negotiation.

7.3.5 Alarm and degrade concepts

When a fault related to the reverse direction of the drive motor's torque output occurs, the drive motor system shall feedback fault flag information.

7.4 Prevent the motor from unexpectedly outputting driving torque

7.4.1 General requirements

The vehicle controller unit (VCU) or other controllers (depending on the vehicle electronic architecture) shall ensure the correctness and completeness of signals, such as working mode requests and torque commands, as sent to the drive motor controller unit (MCU).

7.4.2 Operating mode

The drive motor system shall be in a non-driving working state and the vehicle shall be in a stationary state.

7.4.3 Fault tolerance time interval (FTTI)

The fault tolerance time interval for unexpected output drive torque, as shown in Figure 4, shall be given based on analysis, testing, etc.

Note: The fault tolerance time interval for unexpected output drive torque is determined by negotiation between the vehicle manufacturer and the drive motor system supplier.

7.4.4 Entry and exit of safe state

When it is confirmed that a fault related to unexpected output driving torque occurs, the drive motor system enters a safe state by issuing a fault warning and terminating torque output. When the conditions for exiting or eliminating the fault related to unexpected output driving torque are not met, it shall not exit safe state.

Note: Fault exit or elimination conditions are determined by the vehicle manufacturer and the drive motor system supplier, through negotiation.

7.4.5 Alerting and degrade concepts

When a fault related to unexpected output drive torque occurs, the drive motor system shall feedback fault flag information.

7.5 Prevent the motor from being unable to output braking torque

7.5.1 General requirements

The vehicle controller unit (VCU) or other controllers (depending on the vehicle electronic architecture) shall ensure the correctness and completeness of signals, such as working mode requests and torque commands, as sent to the drive motor controller

8.1 General requirements

Functional safety verification is to determine the completeness and correctness of functional safety requirements. It shall be verified at the drive motor system level with the purpose of proving functional safety requirements.

8.2 Functional safety verification

8.2.5 Prevent the motor from being unable to output braking torque

8.2.3 Prevent the motor torque output direction from being reversed

8.2.2 Prevent the motor from unexpectedly outputting excessive driving torque

8.2.1 Prevent the motor from being unable to output driving torque

8.2.1.1 Test purpose

When the fault exit or elimination conditions that cannot output drive torque are not met, the drive motor system shall not exit the safe state.

8.2.1.2 Test objects

The test object is the drive motor system.

8.2.1.3 Test requirements

Testing in a simulated environment meets the following requirements. […]

8.2.1.4 Test end conditions

When any of the following conditions are met, the test in the simulation environment ends.

8.2.1.5 Test passing criteria

The test passing criteria shall meet the following conditions at the same time.

8.2.2.1 Test purpose

The drive motor system shall detect the output torque status. When the motor's unexpected output of excessive driving torque exceeds the safety threshold, the drive motor system shall enter a safe state. It shall not exit the safe state, when the conditions to exit or eliminate the fault related to unexpected output of excessive driving torque are not met.

The drive motor system shall detect the output torque status. When the output drive torque is lower than the safety threshold, the drive motor system shall enter a safe state.

8.2.2.2 Test objects

The test object is the drive motor system.

8.2.7 Prevent the motor from unexpectedly outputting braking torque

8.2.7.1 Test purpose

8.3 Functional safety confirmation

8.3.1 Prevent the motor from being unable to output driving torque

8.3.2 Prevent the motor from unexpectedly outputting excessive driving torque

8.3.3 Prevent the motor torque output direction from being reversed

8.3.4 Prevent the motor from unexpectedly outputting driving torque

8.3.5 Prevent the motor from being unable to output braking torque

8.3.6 Prevent the unexpected output braking torque of the motor from being too large

8.3.7 Prevent the motor from unexpectedly outputting braking torque

8.3.2.4 Confirmation end conditions

Confirmation ends when any of the following conditions are met. […]