GB/T 43254-2023 English PDF (GBT43254-2023)

Delivery: 3 seconds. Download true-PDF + Invoice.
Get QUOTATION in 1-minute: Click GB/T 43254-2023
Historical versions: GB/T 43254-2023
Preview True-PDF (Reload/Scroll if blank)

GB/T 43254-2023: Functional safety requirements and testing methods for drive motor system of electric vehicles
GB/T 43254-2023
GB
NATIONAL STANDARD OF THE
PEOPLE’S REPUBLIC OF CHINA
ICS 43.040
CCS T 35
Functional safety requirements and testing methods for
drive motor system of electric vehicles
ISSUED ON: NOVEMBER 27, 2023
IMPLEMENTED ON: JUNE 01, 2024
Issued by: State Administration for Market Regulation;
Standardization Administration of PRC.
Table of Contents
Foreword ... 3
1 Scope ... 5
2 Normative references ... 5
3 Terms and definitions ... 5
4 General requirements ... 6
5 Definition of related items ... 6
5.1 General requirements ... 6
5.2 Functional concept ... 6
5.3 Operating conditions and environmental constraints ... 7
6 Hazard analysis and risk assessment ... 7
6.1 General... 7
6.2 Safety objectives ... 7
7 Functional safety requirements ... 8
7.1 Prevent the motor from being unable to output driving torque ... 8
7.2 Prevent the motor from unexpectedly outputting excessive driving torque ... 10
7.3 Prevent the motor torque output direction from being reversed ... 12
7.4 Prevent the motor from unexpectedly outputting driving torque ... 14
7.5 Prevent the motor from being unable to output braking torque ... 15
7.6 Prevent the unexpected output braking torque of the motor from being too large ... 17
7.7 Prevent the motor from unexpectedly outputting braking torque ... 19
8 Functional safety verification and validation ... 21
8.1 General requirements ... 21
8.2 Functional safety verification ... 21
8.3 Functional safety confirmation ... 31
Appendix A (Informative) Example of hazard analysis and risk assessment (HARA)
involving drive motor systems ... 40
A.1 Definition of related items ... 40
A.2 Hazard identification of related items at the vehicle level ... 42
A.3 Scenario analysis ... 43
A.4 Derivation of ASIL levels ... 43
A.5 Safety objectives and safety status ... 73
Appendix B (Informative) Example of how to determine fault tolerance time interval
(FTTI) ... 74
B.1 Definition of fault tolerance time interval ... 74
B.2 Example of definition of fault of unexpected motor output drive torque FTTI ... 75
References ... 77
Functional safety requirements and testing methods for
drive motor system of electric vehicles
1 Scope
This document specifies the functional safety requirements and test methods for drive
motor systems for electric vehicles (hereinafter referred to as "drive motor systems").
This document is applicable to drive motor systems for electric vehicles. Other types of
drive motor systems shall be implemented with reference to this document.
2 Normative references
The contents of the following documents constitute essential provisions of this
document through normative references in the text. Among them, for dated referenced
documents, only the version corresponding to that date applies to this document; for
undated referenced documents, the latest version (including all amendments) applies to
this document.
GB 18384-2020 Electric vehicles safety requirements
GB/T 18488 (all parts) Drive motor system for electric vehicles
GB/T 34590.1 ~ 34590.12-2022 Road vehicles - Functional safety
3 Terms and definitions
The terms and definitions as defined in GB/T 34590.1-2022, as well as the following
terms and definitions, apply to this document.
3.1
Drive motor system
It is a system, which is installed on electric vehicles to provide driving force for
vehicle driving and realize the mutual conversion between mechanical energy and
electrical energy.
Note: It includes drive motor, drive motor controller, and auxiliary devices necessary for
their work. The auxiliary device includes a transmission device integrated with the drive
motor.
7.3.4 Entry and exit of safe state
When it is confirmed that a fault related to the reverse direction of the drive motor's
torque output occurs, the drive motor system enters a safe state by issuing a fault
warning and terminating the torque output. If the fault related to the reverse direction
of the drive motor's torque output is exited or shall not be exited.
Note: Fault exit or elimination conditions are determined by the vehicle manufacturer and the
drive motor system supplier, through negotiation.
7.3.5 Alarm and degrade concepts
When a fault related to the reverse direction of the drive motor's torque output occurs,
the drive motor system shall feedback fault flag information.
7.4 Prevent the motor from unexpectedly outputting driving torque
7.4.1 General requirements
The vehicle controller unit (VCU) or other controllers (depending on the vehicle
electronic architecture) shall ensure the correctness and completeness of signals, such
as working mode requests and torque commands, as sent to the drive motor controller
unit (MCU).
The drive motor system shall detect the correctness and completeness of these signals.
When an abnormality is detected, the drive motor system shall perform reasonable fault
handling to avoid violating safety objectives.
When the unintended output driving torque of the drive motor system is higher than the
safety threshold, the drive motor system shall enter the safe state. When the relevant
fault exit or elimination conditions are not met, the drive motor system shall not exit
the safe state.
Note: The safety threshold of unexpected output drive torque is determined by the vehicle
manufacturer and the drive motor system supplier through negotiation.
Fault detection, response, processing shall be completed within the FTTI time.
7.4.2 Operating mode
The drive motor system shall be in a non-driving working state and the vehicle shall be
in a stationary state.
7.4.3 Fault tolerance time interval (FTTI)
The fault tolerance time interval for unexpected output drive torque, as shown in Figure
4, shall be given based on analysis, testing, etc.
7.6.4 Entry and exit of the safe state
When it is confirmed that a fault related to unexpected output braking torque is too
large, the drive motor system shall enter a safe state by issuing a fault warning and
terminating torque output. It shall not exit safety state, when the conditions to exit or
eliminate the faults related to unexpected output braking torque being too large are not
met.
Note: Fault exit or elimination conditions are determined by the vehicle manufacturer and the
drive motor system supplier, through negotiation.
7.6.5 Alerting and degrade concepts
When an unexpected fault related to excessive output braking torque occurs, on the
premise of ensuring that it can enter a safe state, the braking torque can be derated first.
The drive motor system shall feedback fault flag information.
7.7 Prevent the motor from unexpectedly outputting braking torque
7.7.1 General requirements
The vehicle controller unit (VCU) or other controllers (depending on the vehicle
electronic architecture) shall ensure the correctness and completeness of signals, such
as working mode requests and torque commands, as sent to the drive motor controller
unit (MCU).
The drive motor system shall detect the correctness and completeness of these signals.
When an abnormality is detected, the drive motor system shall perform reasonable fault
handling to avoid violating safety objectives.
When the braking torque unexpectedly output by the drive motor system is higher than
the safety threshold, the drive motor system shall enter the safe state. When the relevant
fault exit or elimination conditions are not met, the drive motor syst...