What pins in Radar ECU and Camera ECU should be detected for OC, STG, and STB faults and why?

[jani12]

A typical Electronic Control Unit(ECU) performs Open Circuit(OC), Short to Ground(STG), and Short to Battery(STB) Diagnostics on selected internal and external pins in the ECU.

For example, consider a external output pin. There is a wire connected from this pin to somewhere else. If this wire is cut, software will detect OC fault. Or if the output impedance reaches OC threshold, software will detect OC fault.

For some Automotive Advanced Drive Assist System(ADAS) ECU, one Original Equipment Manufacturer(OEM) requires supplier to implement software and hardware to detect OC, STG, and STB faults on all external Digital Outputs and PWM Outputs. They also require supplier to detect these faults on all internal Serial Peripheral Interface(SPI) busses. What might be the reason for selecting these pins for fault detection? Why not some other pins? Maybe fault detection is required on these pins to meet some safety standard?

Consider a Level 2 Autonomous Camera ECU and Radar ECU that support features such as Lane Departure Warning(LDW), Adaptive Cruise Control(ACC), Automatic Emergency Braking(AEB), etc.

What internal and external pins in Camera and Radar ECU should be detected for OC, STG, and STB faults and why?

 

[Nigel Goodwin]

I suggest you do your own homework!.

 

[jani12]

This isn't homework. I'm not in school. In previous projects, I implemented pin fault requirements but didn't know why some fault detection is required on some pins but not on others.

 

[Nigel Goodwin]

Your original posts reads EXACTLY like a homework question.

 

[jani12]

This isn't homework. I'm not in school.

 

[rjenkinsgb]

No idea on those specific devices; I've never been involved with them.

Generically, any control system that relates to "safety of life" grade systems, with a risk of serious injury or death if something fails, must be a "twin circuit" or "twin channel" type setup - two independent methods at every point, so no failure can go undetected, with cross checking between the two parts and at every initialisation.

If one part fails with no error information, the other half must be able to detect that and prevent any risk, usually by causing a safe stop and shutdown. There are variations of techniques depending on the exact system, but that's the concept.


This is a typical risk matrix - if failure of the control equipment puts the risk in the red, a two channel style system is probably required by law. For yellow, it's preferable but may or may not be a legal requirement - it depends on the application and country etc.

 

[jani12]

Camera ECU Pinout

• Camera has no external input pins
• Within camera is Low Voltage Differential Signaling(LVDS) interface. It's from imager to SOC. The pins are as follows:
  • LVDS+
  • LVDS-

Radar ECU Pinout

• Radar has no external input pins