VWAY

Newsroom
Technical Resources


STPAExample of applying STPA analysis(Automotive) - EPS System

Technical Resources

1. EPS(Electric Power Steering)?

The EPS system is a system that enables the driver to quickly steer the car. The EPS system is an electromechanical device that rotates a tire by increasing the mechanical force provided by the driver to the steering wheel. The screen below provides a detailed description of the EPS system and a block diagram.


VisualPro System Information screen for the project 'EPS (Electric Power Steering)' — company VWAY, department Engineering, person in charge S. Kim, analysis period 2022-06-01 to 2022-06-30, with a description of the EPS system and an attached EPS block diagram showing the steering wheel column with torque and angle sensors, shaft and pinion, rack and housing, motor, electronic control unit (ECU), powertrain and other vehicle modules

Picture 1. EPS System Information



2. STPA Analysis

2.1 Identify Losses and Hazards

Losses and hazards that can be defined in the EPS system are as follows:


VisualPro Losses screen for the EPS analysis — L-01 vehicle occupants are injured during operation (A1.1 two or more vehicles collide, A1.2 vehicle collides with a moving body, A1.3 vehicle collides with a non-moving body), L-02 vehicle is damaged (economic loss), L-03 loss of customer preference and brand loyalty

Picture 2. Identify Losses


VisualPro System-Level Hazards screen for the EPS analysis — H-01 occupants experience harmful conditions during vehicle operation, H-02 vehicle does not maintain minimum separation from other moving bodies, H-03 from static bodies, H-04 vehicle is difficult to operate, H-05 vehicle equipment is operated beyond limits, with the loss relationship panel

Picture 3. Identify Hazards


STPA hazard table for the EPS system — H1 occupants experience harmful conditions during vehicle operation, H2 vehicle does not maintain minimum separation from other moving bodies, H3 from static bodies, H4 vehicle is difficult to operate (all leading to accidents A1, A2, A3), H5 vehicle equipment operated beyond limits with excessive wear and tear (A2, A3)

Table 1. Losses and Hazards Relationship



2.2 Control Structure Modeling

Once you have identified the loss and hazards above, you will now conduct modeling to show the relationship between the entities of the control structure of the EPS system. The control structure modeling relationship of the entities associated with the EPS system is as follows:


STPA control structure for the Electric Power Steering system — driver, Steering Control Module (SCM), steering gear, rotor and wheels, and other vehicle modules, with control actions start commands, assistance level, torque angle and torque force, and feedback information system status, feedback force, wheel speed, torque, force and road feedback

Picture 4. EPS System's Control Structure Model



2.3 UCA(Unsafe Control Action)

Once you have completed the control structure modeling for the EPS system, you can now derive the UCAs that may occur in the corresponding Control Action. The UCA that can be derived from the Control Action, where the SCM sends the Assistance level to the Steering Gear, is as follows:


VisualPro UCA screen for the EPS assistance level control action from the SCM to the steering gear — UCA-18 assistance not provided during a steering maneuver, UCA-19 to UCA-23 assistance provided unsafely (too high at high speed, too low at low speed, over-assist, opposite direction, uncomfortable), UCA-24 and UCA-25 timing errors, UCA-26 and UCA-27 interrupted or continued past a safe angle

Picture 5. Assistance Level UCA


STPA unsafe control action table for 'SCM provides assistance command to the motor' — UCA1 assistance not provided during a steering maneuver; UCA2 high assistance at high speeds, UCA5 low assistance at low speeds, UCA8 too much turning force (over assist), UCA9 assistance in the opposite direction, UCA10 assistance that discomforts the driver; UCA3 assistance too late, UCA6 intermittent assistance; UCA4 assistance interrupted, UCA7 continued after a safe angle, UCA16 continued above an internal temperature limit, UCA17 continued when available voltage is below the limit — each mapped to hazards H1 to H5

Table 2. Assistance Level UCA



2.4 Identify Loss Scenario

And You should identify potential loss scenarios through UCA. Below is UCA18 – Assistance is not provided when driver executes a steering maneuver‘s loss scenarios that identified.


VisualPro Loss Scenario screen for the EPS system with the STPA control loop diagram (SCM, actuator, steering gear and sensor), listing loss scenarios LS-01 to LS-05 with their STPA Handbook (2018) guide words — unsafe controller behaviour, power failure, control action sent but not followed, inadequate process model and feedback issues

Picture 6. Identifying UCA18's Loss Scenarios



2.5 Derive Countermeasures and Requirements

After indentifying the loss scenario, some countermeasures or requirements were written for the solution. Depending on the loss scenario, various countermeasures and requirements may be required. You can also support the evidence for the solution by attaching the data.


VisualPro Loss Scenario and Countermeasure screens for the EPS system — loss scenarios LS-01 to LS-13 (SCM incorrectly believes assistance is not needed, SCM electronic or circuit failure, insufficient current to the motor, engine stall unrelated to EPS, steering lock condition, ABS module error, transmission calculation errors, internal overheating and false readings, uneven acceleration on slippery surfaces, intermittent signals) each mapped to countermeasures CM-01 to CM-08, with the countermeasure table showing owner, end date and solved/unsolved status

Picture 7. Writing Countermeasures & Requirements



3. Conclusion

When developing complex systems, such as automotive EPS systems, this study shows how STPA can be applied early in development to derive hazards from a new perspective and how the results can be utilized. In addition, FMEA and STPA are applied to the system respectively, and the application results and utility of each risk analysis method are also specified. FMEA techniques widely used in the automotive industry have limitations in identifying unsafe interrelationships, human error or user impact on the system. In this study, the STPA method was able to identify a wider range of accident causes than the FMEA analysis method, and the results of approximately 40 more causes compared to the FMEA technique can be found in the table below. In addition, the results of this study detail the requirements to be reflected in the design and the process of deriving detailed levels of requirements by repeating the control structure rather than performing STPA only once.


Comparison table of cause types identified by STPA and FMEA for the EPS system — engineering design 47 vs 28, component failure 18 vs 22, lack of correspondence 14 vs 15, interaction 32 vs 13, physical degradation 10 vs 5, totalling 121 for STPA and 83 for FMEA

Table 3. STPA & FMEA Comparison


Rodrigo Sotomayor Martinez, "STPA of Electric Power Steering for Automotive Applications", 2015.6

Engineers beside a car hologram, one holding a tablet — closing image of the EPS system STPA example

Back to list