A physically isolated minimal certainty safety execution device for intelligent driving and a control method thereof

Abstract

This invention discloses a physically isolated minimal deterministic safety actuator and its control method for intelligent driving, belonging to the field of functional safety technology for intelligent driving. The device adopts a hardware architecture physically independent of the main decision-making unit, possessing independent power supply and timing. Its runtime working set is no larger than 10KB, and it has no operating system or dynamic memory. Deterministic control is achieved through hardware-fixed logic, with a worst-case response time of no more than 50ms. The device is equipped with independent sensing paths and hardwired execution interfaces, enabling direct actuator driving without relying on the vehicle bus. Cross-domain health monitoring enables multi-node status monitoring and computing power management. This invention can provide a safety fallback in the event of a system-wide failure, resisting common-cause failures, meeting ASIL D functional safety level, and features low cost, small size, easy integration, and suitability for mass production. It solves the problems of insufficient independence and poor real-time performance of traditional safety islands.

Description

Technical Field

[0001] This invention belongs to the field of intelligent driving and vehicle functional safety technology, specifically relating to a physically isolated minimal deterministic safety execution device and its control method for intelligent driving. The device is independent of the main computing system, has highly limited resources and is deterministic, and is used to independently execute the minimum risk strategy when all decision units fail or the decision exceeds the safety boundary in a gradient redundancy system, thus providing a safety fallback for the system.

[0002] Terminology Definition 1. Physical isolation: refers to the use of physically independent semiconductor chips from the main decision-making unit, fixed redundant decision-making unit, and configurable redundant decision-making unit, without sharing silicon wafers, power rails, or clock trees, and communication is achieved through isolation devices such as optocouplers, cutting off the common cause failure propagation path (complies with the isolation labeling specifications recommended by ISO 26262). 2. Minimal deterministic logic operation requirements: refers to the extreme resource constraints on storage units to achieve hardware-fixed deterministic logic operation. The core requirement is that the total space occupied by the runtime working set of code and data is ≤10KB, which can be expanded to 16KB. 3. Runtime working set: refers to the total storage space occupied by code, data, and stack actually residing in the on-chip memory during device runtime, excluding external non-volatile memory mapping areas and dynamically loaded content. 4. Deterministic logic: refers to a logical architecture that has no dynamic memory allocation, no recursive calls, no neural networks or machine learning models, all state transition paths can be exhaustively verified, and the worst-case response time can be formally mathematically proven. 5. Hardwired interface: refers to a physical interface that does not rely on automotive communication protocols such as CAN / LIN / Ethernet, and directly outputs PWM signals (frequency 1kHz~20kHz, duty cycle 0%~100%) or digital level signals (high level 3.3V~12V, low level 0V~0.8V) that meet automotive-grade requirements to the redundant control terminal of the actuator, which can directly drive actuators such as brake solenoid valves and steering motors. 6. Cross-domain health monitoring unit: refers to a hardware module that synchronously monitors the operating status of the main decision-making unit, fixed redundant decision-making unit, and configurable redundant decision-making unit in the gradient redundancy system through a physical isolation channel, as well as the computing resource occupancy status of offline computing tasks in the vehicle non-driving state. It is dedicated to computing resource monitoring and isolation. 7. Formal verification: This refers to exhaustively verifying all state transition paths of the hardware-based rule engine using tools such as SAT / SMT solvers (e.g., CBMC v5.8.0 or equivalent formal verification tools, configuration parameters: --unwind 10 --depth 200) to ensure 100% state coverage, no deadlocks, and no unreachable states. 8. Simplified environmental feature data: refers to the compressed vehicle environmental perception data that is independent of the main perception system. It includes core information such as obstacle distance, vehicle speed, and lateral offset. The data format is structured data of ≤50 bytes / frame. Background Technology

[0003] Advanced intelligent driving safety systems with gradient redundancy must meet the highest functional safety level of ISO 26262 ASIL-D. Their core challenge is providing a safety safety net in the event of a complete failure, while also considering the need for low-cost mass production. Currently, the safety monitoring functions of most intelligent driving systems are integrated into the main chip, sharing power, clock, operating system, and software stack with the main decision-making unit. When the main chip crashes, experiences power supply anomalies, software deadlocks, or random hardware failures, safety monitoring also fails, making it impossible to provide a safety net. Existing technologies also include general-purpose microkernels with formal verification (such as seL4). Although they achieve formal verification of functional correctness and can be applied to the automotive field, they are essentially general-purpose operating system kernels. They rely on MMU memory management units and multi-core hardware architectures, and have general computing functions such as process isolation and communication scheduling. Their code size and resource consumption are much greater than 10KB, making it impossible to directly drive the actuator with bare-metal hardwired connections. In contrast, this invention is a hardware execution device specifically designed for safety assurance in intelligent driving. It has no operating system kernel, no dynamic memory allocation, and no general computing functions. It only implements the execution of the minimum risk strategy through ≤10KB of hardware-fixed deterministic logic. It belongs to a different technical field and has a different application positioning than general-purpose microkernels. The technical solutions and invention purposes of the two are fundamentally different.

[0004] Some existing technologies propose the concept of a "safety island" (such as the TI Jacinto 7 and ST SPC5 series, with the closest prior art patent being CN202310867890.2). This patent discloses a monitoring device based on a chip-embedded security core, which achieves main system fault monitoring through a security core in a shared power domain. However, it suffers from insufficient physical independence, large resource consumption (code space exceeding 256KB), and reliance on the main chip's actuator control, and still cannot meet the dual requirements of a gradient redundancy security system in terms of both fallback and cost. The core shortcomings of the existing technology are as follows: 1. Insufficient physical independence: The security island shares the same chip with the main computing domain, which poses a risk of common cause failure (such as short circuit in the chip substrate or clock tree abnormality). It cannot cope with the global failure scenario of the gradient redundancy system, and the probability of security monitoring failure under common cause failure reaches 100%. 2. Excessive resource consumption: The code space often requires 256KB~2MB, relies on RTOS or AUTOSAR operating system, has high hardware cost, cannot use ultra-low cost MCU, and conflicts with the cost gradient design concept of gradient redundancy system. 3. Insufficient determinism: It contains non-deterministic logic such as dynamic memory allocation and recursive calls. The worst-case response time is 100-500ms, which is difficult to prove formally and cannot meet the real-time requirements of ASIL-D level. 4. Strong execution dependency: The safety island sends control requests to the main chip via the bus. When the main chip fails, it cannot independently control the vehicle actuators, thus losing its backup function. 5. Poor system adaptability: It does not consider the collaborative monitoring requirements with fixed and configurable redundant units in a gradient redundancy system, lacks cross-domain health monitoring capabilities, and cannot be matched with the system's hierarchical takeover logic.

[0005] The fixed redundant decision unit is a hot standby unit with the same architecture as the main decision unit, and its computing power is 50%-80% of that of the main decision unit. The configurable redundant decision unit is an independent, non-cooperative external automotive-grade hardware that supports hot-swappable connections and can independently implement L2-level autonomous driving fallback functions. Specific technical details of both can be found in the related patent applications filed on the same day. Existing watchdog chips (such as the TI TPS3823) can only perform simple power monitoring and reset, lacking independent perception input and execution control capabilities, and cannot replace the safety fallback function of this invention. Addressing the shortcomings of existing technologies, this invention achieves a balance between ASIL D-level functional safety and extremely low mass production costs through a core design that meets the operational requirements of minimal deterministic logic, complete physical isolation, hardware-embedded deterministic logic, and direct hard-wired execution. It can still achieve 100% safe takeover even under common-cause failure, perfectly adapting to the safety fallback requirements of the intelligent driving gradient redundancy safety system. This is a technical solution not disclosed in existing technologies. Therefore, there is an urgent need for a truly independent, minimalist, deterministic, directly controllable actuator that also considers low cost. Summary of the Invention

[0006] I. This invention provides a physically isolated minimal deterministic safety execution device and its control method for intelligent driving, which solves the technical problems of insufficient physical independence of existing safety islands, large resource consumption, poor determinism, strong execution dependence, poor system adaptability and high cost. It achieves deep collaboration with gradient redundancy system, independently completes safety takeover when the system fails in the whole domain, and at the same time takes into account ASIL-D level safety requirements and the need for extremely low mass production cost.

[0007] II. Technical Solution The physically isolated minimal deterministic safety execution device of the present invention is a core backup component of the intelligent driving gradient redundancy safety system. It is completely physically isolated from the main decision-making unit, fixed redundant decision-making unit, and configurable redundant decision-making unit in the system. The five basic core features of claim 1 can independently achieve the core inventive objective of the present invention: "physical isolation + minimal determinism + hard-wired safe execution". The cross-domain health monitoring unit is an adaptive extension feature of the system and does not affect the achievement of the core objective.

[0008] The device must simultaneously possess the following five core technological features to create a synergistic effect: 1. Physically separated hardware carrier: It uses a physically independent semiconductor chip from the main decision-making unit, has an independent power domain and an independent clock source, and has no shared silicon wafers, power rails, or clock trees. Communication is achieved through optocoupler isolation, which completely cuts off the common cause failure propagation path and complies with the ISO 26262 isolation labeling specification. 2. Storage unit that meets the requirements of minimal deterministic logic operation: The total space occupied by the runtime working set of code and data meets the requirements of minimal deterministic logic operation, with a core size of ≤10KB (expandable to 16KB). The 10KB is the code and data actually residing in the on-chip memory during runtime, without including any mapped area of ​​external non-volatile memory or dynamic loading mechanism; and this unit does not include the operating system kernel, file system, or dynamic memory allocator, ensuring logical determinism from the bottom layer, while laying the hardware foundation for low-cost implementation; 3. Hardware-based fixed rule engine: Implemented as a finite state machine (number of states ≤ 32) or a lookup table (number of rules ≤ 128). All state transition paths can be exhaustively verified by the SAT / SMT solver (CBMC v5.8.0 or a formal verification tool with equivalent functionality). The worst-case response time is ≤ 50ms and can be formally mathematically proven. There are no neural networks or machine learning models, ensuring real-time performance and verifiability. 4. Heterogeneous sensing input interface: at least one signal input independent of the main sensing system, receiving simplified environmental feature data (≤50 bytes / frame, including obstacle distance, vehicle speed, and lateral offset), without relying on the computing power and algorithms of the main sensing system, ensuring sensing independence; 5. Hard-wired output interface: It does not rely on automotive communication protocols such as CAN / LIN / Ethernet, and directly outputs PWM signals (frequency 1kHz~20kHz, duty cycle 0%~100%) or digital level signals (high level 3.3V~12V, low level 0V~0.8V) that meet automotive-grade requirements to the redundant control terminals of the brake, steering or parking actuators. It can still independently control the actuators when the main system fails.

[0009] Key Extended Features: A cross-domain health monitoring unit receives heartbeat signals from the main decision-making unit, fixed redundant decision-making unit, and configurable redundant decision-making unit through a physically isolated channel. Takeover is triggered when the heartbeat loss exceeds a preset threshold (100ms~500ms). This unit has a non-driving state computing power monitoring function. By detecting the resource utilization rate of offline computing task modules (70%~90%, preferably 80%), when the utilization rate exceeds the standard and persists for 3 to 8 seconds (preferably 5 seconds), a resource isolation command is output to avoid computing power conflicts affecting the device's real-time response capability. This function is independent of the main decision-making unit and does not rely on upper-layer operating system scheduling.

[0010] The control method of the present invention is based on the above-mentioned device, and the core steps are: initialization standby → three-node heartbeat + real-time monitoring of computing power → continuous collection of sensing data → resource isolation when computing power occupancy exceeds the standard → failure / trigger signal detection → ≤50ms rapid takeover → hard-wired execution of minimum risk strategy → vehicle safety status maintenance → fault alarm. The entire process does not depend on the software state of any decision unit and is executed completely independently.

[0011] The correlation between technical features and low-cost effect: By constraining resources to "meet the requirements of minimal deterministic logic operation with ≤10KB memory units", this invention can use automotive-grade MCUs with extremely low unit prices, combined with SMT standard process and integrated design of domain controller (occupying an area of ​​<2cm²), without the need for additional hardware expansion modules. The above core technical features directly and inevitably bring about a significant reduction in hardware mass production costs, and this cost is the mass production cost of bulk purchase of automotive-grade chips, which is not affected by the purchase price of a single set.

[0012] Beneficial effects The device and method of the present invention are deeply adapted to the intelligent driving gradient redundancy safety system, and have the following significant beneficial effects: 1. Completely physically independent, with no risk of common cause failure: All decision-making units in the gradient redundancy system use physically independent semiconductor chips, with no shared hardware resources. The device can still work normally when the main chip is completely burned out. The probability of safe takeover under common cause failure is 100%, achieving a reliable safety backup. 2. Minimal resource design and extremely low mass production cost: The runtime working set core is ≤10KB (expandable to 16KB), based on automotive-grade low-cost MCU / FPGA. Through minimal design and integrated design, the hardware mass production cost is significantly reduced, which is much lower than the traditional safety island hardware cost. The cost gradient design of the system adapts to meet the cost requirements of mass production models. 3. High determinism, meeting ASIL-D requirements: The hardware-fixed rule engine has no non-deterministic logic, the worst-case response time is ≤50ms and can be formally verified by CBMC v5.8.0 or equivalent formal verification tools, with 100% state coverage. The response time is significantly improved compared to traditional safety islands, greatly reducing the cost of functional safety certification. 4. Direct execution and extremely fast takeover response: The hard-wired interface directly controls the actuator without the need for communication protocol relay. The design has been verified that the main domain controller can take over in 32ms after power failure. It can achieve safe braking and stopping within the vehicle speed range of 50km / h~120km / h, meeting the real-time requirements of high-level intelligent driving. 5. Deep system adaptation and strong collaboration: The cross-domain health monitoring unit synchronously monitors the status of the three nodes, and the takeover priority matches the hierarchical takeover logic of the system. The non-driving state computing power monitoring function (70%~90% occupancy threshold, 3 seconds~8 seconds duration, preferably 80% / 5 seconds) avoids computing power conflicts within the system and ensures the real-time response capability of the device. After 1000 actual tests, the computing power isolation response speed is the fastest (≤10ms) when the threshold is set to 80% and the duration is 5 seconds, and the impact on non-critical computing tasks is minimal. This is the optimal parameter combination. 6. Excellent mass production performance and stable throughout the entire lifecycle: It adopts SMT process integration, supports graded mass production, and features OTP memory + hardware fuse locking design to prevent any online modifications, ensuring consistent behavior throughout the entire lifecycle. After integration, it occupies less than 2cm² of the domain controller PCB area, requiring no additional installation space.

[0013] This invention is a core safety fallback solution for the intelligent driving gradient redundancy safety system. It forms a hierarchical architecture that complements the intelligent driving safety-related technologies in the same system, jointly supporting the implementation of intelligent driving functional safety. Attached Figure Description

[0014] Figure 1 This is a connection block diagram of the device of the present invention and the intelligent driving gradient redundancy safety system. The isolation symbols recommended by ISO 26262 are marked to show the physical isolation boundaries between the device and the main decision-making unit, the fixed redundant decision-making unit, and the configurable redundant decision-making unit. The hardware architecture of independent power domain and independent clock source is clearly shown. The device receives the three-node heartbeat signal through the physical isolation channel, receives simplified environmental feature data (≤50 bytes / frame) through the heterogeneous sensing input interface, directly connects to the redundant control link of the brake / steering / parking actuator through the hard-wired output interface, and the trigger signal connection relationship between the device and the decision arbitration module, reflecting the hardware layout of the three-level collaborative safety architecture. Figure 2The present invention provides a finite state machine logic flowchart for the internal hardware-based rule engine of the device, disclosing the six core states of the finite state machine (S1 initialization state, S2 standby state, S3 monitoring state, S4 takeover state, S5 minimum risk strategy execution state, and S6 fault alarm state), clarifying the transition conditions of each state, the rule basis for state transition (corresponding to "rules ≤ 128" in claim 1), and the output logic of each state. Figure 3 This is a timing diagram for cross-domain heartbeat monitoring and takeover in this invention. It is marked with time axis scale and ISO 26262 related markings, and clarifies the heartbeat signal acquisition period (1ms), the preset threshold for heartbeat loss (100ms~500ms), and the takeover trigger delay ≤50ms. It shows the synchronous monitoring timing of the heartbeat signals of the three nodes: the main decision unit, the fixed redundant decision unit, and the configurable redundant decision unit, as well as the access timing of the computing power monitoring status signal, and clarifies the time synchronization relationship of each signal and the time constraints for takeover triggering. Detailed Implementation

[0015] Example 1: Basic MCU Hardware Implementation (Adapted for L2+ to L3 Level Vehicles) It can be implemented using automotive-grade general-purpose low-cost MCUs (such as the Infineon TRAVEO T2G series). The actual running code of the device is 9.6KB, the static data is 0.3KB, and the total is 9.9KB (runtime working set), which meets the core design requirement of ≤10KB and can also be expanded to 16KB. The hardware uses an independent LDO power supply and an internal independent RC clock source. It uses a physically independent semiconductor chip from the main decision-making unit and has no shared power rail or clock tree. The hardware-based fixed rule engine is implemented as a finite state machine, containing 16 states and 64 rules. It was exhaustively verified using the SAT / SMT solver (CBMC v5.8.0, configuration parameters: --unwind 10 --depth 200), achieving 100% state coverage and a worst-case response time of 48.7ms. The heterogeneous sensing input interface receives simplified obstacle distance data (≤50 bytes / frame, including obstacle distance, vehicle speed, and lateral offset) via the CAN bus, independent of the main sensing system; The hard-wired output interface directly drives the brake solenoid valve and hazard lights via GPIO, outputting a PWM signal with a frequency of 5kHz and a duty cycle of 30%, and digital level signals with a high level of 5V and a low level of 0.3V, all of which meet automotive-grade parameter requirements. The cross-domain health monitoring unit receives 100Hz heartbeat signals from the main domain controller, fixed redundant decision unit, and configurable redundant decision unit through optical isolation. It triggers a parking command when there is no heartbeat for 50ms. The non-driving state computing power monitoring function is set with a threshold of 80% and a duration of 5 seconds. Actual testing shows that it can effectively isolate non-critical computing threads, with a computing power isolation response speed of ≤10ms, ensuring the device's real-time response capability. In actual testing, the main domain controller took over the control in 32ms after power failure, and could achieve smooth and safe braking within the vehicle speed range of 50km / h~120km / h. This solution significantly reduces the cost of mass production of hardware through miniaturized storage design, low-cost MCU and SMT integrated design. It can be integrated into the domain controller PCB and occupies an area of ​​<2cm².

[0016] Example 2: Flagship FPGA Hardware Implementation (Adapted for High-End Intelligent Driving Vehicles) Implemented using automotive-grade FPGA (such as Lattice MachXO2 256HC), the core functions are mainly implemented with hardware logic, which can reduce the software operation links and is suitable for safety scenarios with extremely low latency such as AEB. The FPGA occupies approximately 2000 LUTs and uses physically independent semiconductor chips from the main decision-making unit. There is no dynamic resource allocation during operation. The physical isolation design is consistent with Example 1. The hard-wired interface supports simultaneous control of the three actuators: braking, steering, and parking. The output PWM signal frequency is 15kHz with a duty cycle of 60%, and the digital level signal is 12V high and 0.5V low. The cross-domain health monitoring unit achieves microsecond-level heartbeat acquisition and can trigger takeover within 100ms of heartbeat loss, adapting to the high real-time requirements of advanced intelligent driving and serving as an optional backup solution for the gradient redundancy system. The non-driving state computing power monitoring function supports custom thresholds (70%~90%) to adapt to the computing power scheduling needs of different vehicle models; The cost of mass production of the hardware is slightly higher than that of the basic MCU, but still much lower than that of the traditional safety island. Costs can be further reduced through bulk purchasing to meet the safety requirements of high-end models.

[0017] Example 3: Mass Production Integration of the Device The device of this invention adopts a 4-layer PCB design and is integrated with the domain controller of the intelligent driving gradient redundancy safety system. It adopts the SMT standard process and does not require special processes. The device is powered by a redundant power supply channel of the domain controller, which is independent of the power supply channel of the main decision unit, ensuring that the device can still work normally when the main power supply fails. All interfaces of the device use automotive-grade connectors, meet ISO 16750-3 vibration requirements, and have an operating temperature of -40℃ to 125℃, making them suitable for extreme automotive environments. After integration, the overall domain controller PCB area occupied is less than 2cm², without increasing the additional installation space. It is fully compatible with existing domain controller designs. The integrated solution significantly reduces assembly and material costs and is one of the key technical means to achieve low-cost mass production.

[0018] Example 4: Formal Verification Implementation The finite state machine of the hardware-fixed rule engine of this invention was fully exhaustively verified using the CBMC v5.8.0 formal verification tool (or an equivalent formal verification tool with configuration parameters: --unwind 10 --depth 200). The verification results showed that the state coverage was 100%, with no deadlocks and no state unreachable. The worst-case execution path takes 187 clock cycles, corresponding to a response time of 48.7ms, which meets the design requirement of ≤50ms. A formal verification certificate is generated, which can serve as the core evidence for ISO 26262 ASIL-D software unit design verification, significantly reducing certification costs. The verification process is reproducible and meets the traceability requirements of automotive-grade functional safety certification.

[0019] Example 5: Fault Injection Test Implementation The device of this invention was subjected to single-event upset (SEU) fault injection test through the JTAG interface, with a total of 10,000 fault injections and a fault coverage rate of >99%, covering core modules such as chip power supply, clock, and logic operation. Test results show that the device can enter a safe state within 50ms under all fault scenarios, with no deadlock, no state unreachability, no actuator malfunction, and a 100% safe takeover probability under common cause failure, meeting the ASIL-D level fault tolerance requirements. Compared to traditional safety islands (with a 100% failure probability under common-cause failure), the fault tolerance capability of this invention is significantly improved.

[0020] Example 6: Implementation of Computational Power Monitoring in Non-Driving State When the vehicle is in a non-driving state, such as charging or parking, the cross-domain health monitoring unit of this device continuously monitors the computing resource utilization rate of the on-board offline computing task module (such as strategy optimization, trajectory inference and other background tasks); When the device detects that the module’s resource utilization rate exceeds 80% for 5 seconds, it immediately outputs a resource isolation command and forcibly cuts off non-critical computing threads through hardware signals to ensure that the device’s computing resources are not encroached upon and that it always maintains sufficient real-time response capability. This computing power monitoring function is completely independent of the main decision-making unit and does not rely on the upper-level operating system for scheduling. Even if the main operating system crashes, it can still work normally. It also supports threshold adjustment (70%~90%) and duration adjustment (3 seconds~8 seconds) to adapt to the computing power configuration requirements of different vehicle models. After 1,000 real-world tests, the optimal combination is 80% threshold + 5 seconds duration. The computing power isolation response speed is ≤10ms, minimizing the impact on non-critical tasks.

[0021] Example 7: Achieving Stability Throughout the Device's Lifecycle The device of this invention uses a one-time programmable (OTP) memory to solidify security strategies and control logic. During the mass production stage, the OTP memory is locked by a hardware fuse to prevent any online modification or programming operations. The device has no external data interface and its internal logic cannot be tampered with by software means, ensuring consistent behavior throughout the device's entire life cycle and eliminating the risk of malicious tampering, thus meeting the full life cycle requirements of vehicle functional safety. Mass production consistency testing shows that the core parameters such as response time and computing power usage of devices in the same batch are less than 5%, meeting the requirements for automotive-grade mass production consistency, and the batch production yield is greater than 99.5%, further reducing the overall cost of mass production.

[0022] Industrial applicability The physical isolation minimal deterministic safety execution device and its control method of the present invention are fully adapted to the technical requirements, mass production requirements and cost requirements of the intelligent driving gradient redundancy safety system. It is based on mature automotive-grade low-cost MCU / FPGA chips and standardized SMT process. Through minimal storage design and integrated domain controller, the hardware mass production cost is significantly reduced, and no additional installation space and power supply design are required. The device meets the highest functional safety level of ISO 26262 ASIL-D, with comprehensive verification methods such as formal verification and fault injection testing. The functional safety certification cost is low, and all verification processes are reproducible, meeting automotive-grade certification requirements. Supports tiered mass production; the basic model is compatible with ordinary L2+ to L3 level vehicles, while the flagship model is compatible with high-end intelligent driving vehicles, which is highly compatible with the cost gradient design of the gradient redundancy system. The device's cross-domain health monitoring, computing power isolation, and hard-wired execution functions, in deep collaboration with the fixed redundant decision-making units and configurable redundant decision-making units in the gradient redundancy system, can jointly form a three-level collaborative security architecture of "main decision-making - redundancy backup - security fallback". The takeover priority matches the hierarchical takeover logic of the system, and can be directly applied to the mass production and deployment of L2+ to L3 level intelligent driving vehicles. Compared to traditional safety islands, this invention significantly reduces hardware costs, improves response time, and increases the probability of safe takeover from 0 to 100% under common-cause failure. It addresses the core pain points of existing technologies, achieving a balance between ASIL D-level functional safety and extremely low mass production costs. It provides a mass-producible and cost-effective safety fallback solution for the gradient redundancy safety system of intelligent driving, possessing strong industrial applicability and market promotion value.

Claims

1. A physically isolated minimal deterministic safety actuator for intelligent driving, characterized in that, The device is applied to a multi-redundant system for the decision-making layer of intelligent driving. It is physically isolated from the main decision-making unit, fixed redundant decision-making unit and configurable redundant decision-making unit in the system, and has the following features: physically separated hardware carrier, using physically independent semiconductor chips from the main decision-making unit, having independent power domain and independent clock source, and no shared silicon wafer, power rail or clock tree. The runtime working set has a total code and data space occupied by a deterministic logic storage unit that meets the requirements of minimal deterministic logic operation. The minimum deterministic logic operation requirement is that the total space occupied does not exceed 10KB (the 10KB is the code and data actually resident in the on-chip memory during runtime, without external non-volatile memory mapping area and dynamic loading mechanism), and the unit does not contain operating system kernel, file system, or dynamic memory allocator. A hardware-based, formally verifiable rule engine with ≤32 states and ≤128 rules, with a worst-case response time of ≤50ms; at least one heterogeneous sensing input interface independent of the main sensing system to receive simplified environmental feature data; and a hard-wired output interface that directly controls the braking, steering, or parking actuators, without relying on automotive communication protocols such as CAN / LIN / Ethernet, directly outputting automotive-grade PWM signals (frequency 1kHz~20kHz, duty cycle 0%~100%) or digital level signals (high level 3.3V~12V, low level 0V~0.8V).

2. The apparatus according to claim 1, characterized in that, It also includes a cross-domain health monitoring unit, which receives heartbeat signals from the main decision-making unit, the fixed redundant decision-making unit, and the configurable redundant decision-making unit through a physical isolation channel. When the heartbeat is lost for more than a preset threshold (100ms~500ms), it triggers takeover and has a non-driving state computing power monitoring function. When the device receives a trigger signal from the decision arbitration module, or when it detects that all decision units have failed, it independently executes the minimum risk strategy and takes over the software state with a decision delay of ≤50ms and which does not depend on any decision unit.

3. The apparatus according to claim 1, characterized in that, The hardware-based fixed rule engine is implemented as a finite state machine or lookup table, without neural networks or machine learning models. All state transition paths can be exhaustively verified by the SAT / SMT solver, and the monitoring cycle is ≤10ms.

4. The apparatus according to claim 2, characterized in that, The failure detection of the cross-domain health monitoring unit includes at least one of the following: heartbeat timeout, decision output exceeding the preset safety envelope, and decision output being inconsistent with the majority results for more than 3 voting cycles.

5. The apparatus according to claim 2, characterized in that, The non-driving state computing power monitoring function is as follows: detect the resource occupancy rate of the offline computing task module. When the occupancy rate exceeds the preset safety threshold (70%~90%, preferably 80%) and continues for a preset duration (3 seconds~8 seconds, preferably 5 seconds), output a resource isolation command to forcibly cut off non-critical computing threads. The computing power monitoring function is independent of the main decision-making unit and does not rely on the scheduling of the upper-level operating system.

6. The apparatus according to claim 1, characterized in that, The device is based on automotive-grade low-cost MCU / FPGA and can be integrated into the intelligent driving domain controller PCB, occupying an area of ​​<2cm². It is mass-produced using SMT standard process. The ≤10KB runtime working set is the core design, and its total space can be expanded to 16KB according to the actual application scenario.

7. The apparatus according to claim 1, characterized in that, The device employs a one-time programmable (OTP) memory-based security strategy. During mass production, it is locked by a hardware fuse to prevent online modification and ensure consistent behavior throughout its entire lifecycle.

8. A physically isolated minimal deterministic safe execution control method for intelligent driving, characterized in that, Applied to the apparatus according to any one of claims 1-7, comprising the following steps: (1) The device is powered on and initialized. The hardware-based rule engine enters standby mode, and the cross-domain health monitoring unit starts three-node heartbeat monitoring and non-driving state computing power monitoring. (2) The heterogeneous sensing input interface continuously receives simplified environmental feature data (≤50 bytes / frame, including obstacle distance, vehicle speed, and lateral offset), while the hardwired output interface remains in standby mode. (3) When the cross-domain health monitoring unit is not driving, it detects the resource occupancy rate of the offline computing task module in real time. When the occupancy rate exceeds 70%~90% (preferably 80%) and lasts for 3 to 8 seconds (preferably 5 seconds), it outputs a resource isolation command to forcibly cut off non-critical computing threads. (4) When the cross-domain health monitoring unit detects that the heartbeat loss exceeds the threshold, or receives a trigger signal from the decision arbitration module, or detects that all decision units have failed, it triggers a takeover command. (5) The hardware-based fixed rule engine switches to the takeover state within ≤50ms and sends the minimum risk strategy control signal to the executor through the hard-wired output interface; (6) During the execution of the minimum risk strategy, continuously collect perception data to adjust control commands until the vehicle enters a safe state; (7) After the vehicle enters a safe state, the engine enters a fault alarm state and keeps the actuator in a safe lock.

9. The method according to claim 8, characterized in that, The minimum risk strategy includes at least one of vehicle deceleration, pulling over to the side of the road, and turning on hazard lights. It can achieve safe braking to a stop within a vehicle speed range of 50km / h to 120km / h. The design verifies that the main domain controller takes over 32ms after power failure.

10. A domain controller for intelligent driving, characterized in that, The system includes the physically isolated minimal deterministic safety execution device as described in any one of claims 1-7, and further includes a main decision-making unit, a fixed redundant decision-making unit, a configurable redundant decision-making unit, and a decision arbitration module. The domain controller is configured with a hierarchical takeover scheduling module for automatically triggering a three-level coordinated response based on the fault level: backup of the fixed redundant decision-making unit, anti-common-cause failure of the configurable redundant decision-making unit, and safety backup of the physically isolated minimal deterministic safety execution device, with a scheduling delay ≤100ms. The physically isolated minimal deterministic safety execution device establishes heartbeat communication with the fixed redundant decision-making unit and the configurable redundant decision-making unit through a physically isolated channel, establishes a trigger signal connection with the decision arbitration module, and adopts the control method described in any one of claims 8-9. Each module is hardware-independent and logically coordinated, constituting a complete intelligent driving gradient redundancy safety system.

Images