Actuator Control Architecture Using ASIL-D Disable Supervision
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing vehicle steering systems face challenges in achieving the highest safety integrity level (ASIL-D) while minimizing costs and complexity by assigning all components the same high rating, which is costly and inefficient.
Innovation Solution
Implementing ASIL decomposition in a domain controller architecture where a domain controller with an ASIL-D rating monitors and selectively disables lower-rated ECUs, ensuring the system attains ASIL-D by independently controlling actuators through separate hardwired connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all components are assigned the highest ASIL-D rating, then system safety integrity is improved, but cost and complexity increase
Solution Approach 1:
The system segments components into different ASIL rating groups: the domain controller and actuator controller are rated ASIL-D, while the actuator itself is rated at a lower level (QM or ASIL-A/B/C). This segmentation allows the overall system to achieve ASIL-D integrity without requiring every individual component to carry the full ASIL-D burden, thereby reducing complexity and cost while maintaining safety.
Solution Approach 2:
Different components are assigned different quality levels appropriate to their specific safety-criticality. The domain controller and actuator controller receive the highest ASIL-D rating due to their critical control functions, while the actuator receives a lower rating. This local differentiation optimizes the balance between safety and complexity by applying high standards only where absolutely necessary.
2Reliability
If all components are assigned the highest ASIL-D rating, then system safety integrity is improved, but cost increases
Solution Approach 1:
The system segments components into different ASIL rating groups: the domain controller and actuator controller are rated ASIL-D, while the actuator itself is rated at a lower level (QM or ASIL-A/B/C). This segmentation allows the overall system to achieve ASIL-D integrity without requiring every individual component to carry the full ASIL-D burden, thereby reducing complexity and cost while maintaining safety.
3Reliability
If a domain controller with ASIL-D rating monitors and disables lower-rated ECUs, then system safety integrity is maintained, but device complexity increases
Solution Approach 1:
The domain controller serves as an intermediary between the higher-level control system and the lower-rated actuator controller. It monitors the actuator controller's outputs and can disable it when anomalies are detected, thereby bridging the safety gap created by using mixed-rating components. This intermediary approach maintains overall ASIL-D integrity while allowing the use of lower-cost, lower-rated components in non-critical positions.
Data Source
AI summary
A method for controlling an actuator in a domain controller architecture in a vehicle includes receiving, at a domain controller, data related to operation of the actuator. The data includes information indicative of outputs of an actuator controller configured to control the actuator. The domain controller is configured to operate in accordance with a first safety integrity level among a plurality of safety integrity levels. The actuator controller is configured to operate in accordance with a second safety integrity level below the first safety integrity level. The method includes selectively supplying, from the domain controller based on the received data, a disable signal to a hardware component of the actuator controller to disable control of the actuator by the actuator controller. The disable signal is generated in accordance with the first safety integrity level and the hardware component is configured to operate in accordance with the first safety integrity level.