ASIL Segmented Control System for Autonomous Vehicles
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current control systems for autonomous motor vehicles face challenges in achieving high functional safety while being cost-efficient, due to the complexity and high redundancy requirements associated with high Automotive Safety Integrity Levels (ASILs).
Innovation Solution
A control system comprising an environmental sensor system, a first control unit with a lower ASIL for normal operation, and a control monitoring unit with a higher ASIL for checking and overriding control commands, ensuring emergency control commands are prioritized for actuator control, along with a second control unit for monitoring and fault detection to enhance reliability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a control system with high ASIL is implemented to ensure functional safety, then safety and reliability are improved, but device complexity and implementation cost increase
Solution Approach 1:
The control system is segmented into multiple control units with different ASIL ratings. The first control unit operates with lower ASIL for normal driving functions, while a second control unit with higher ASIL provides safety monitoring and emergency control. This segmentation allows the system to achieve high overall safety without requiring all components to be implemented with maximum complexity and cost.
2Reliability
If redundancy requirements for high ASIL are implemented, then functional safety is improved, but implementation cost increases
Solution Approach 1:
Different levels of redundancy and safety measures are applied locally to different control units based on their specific safety requirements. The first control unit implements standard safety measures appropriate for its ASIL level, while the second control unit implements enhanced redundancy specifically for safety-critical functions. This local quality approach avoids uniformly applying high-cost redundancy throughout the entire system.
Solution Approach 2:
The second control unit acts as an intermediary safety layer that monitors the first control unit and provides emergency control commands when safety violations are detected. This intermediary structure enables the system to achieve high safety standards through targeted monitoring and intervention rather than requiring all components to be implemented with maximum redundancy from the outset.
Data Source
AI summary
A control system for the autonomous control of a motor vehicle comprises an environmental sensor system, which is arranged and configured to acquire environmental data for the autonomous control of a motor vehicle. The control system further comprises at least one actuator controller, which is configured to control at least one actuator of the motor vehicle. A first control unit is configured to determine control commands for the at least one actuator controller with the environmental data and to transmit these to the actuator controller. The control system further comprises a control monitoring unit, which is configured to check a functionality of the first control unit with the environmental data and with the control commands transmitted to the actuator controller, wherein the control monitoring unit is further configured to determine emergency control commands for the at least one actuator controller with the environmental data, depending on the checking of the first control unit, and to transmit these emergency control commands to the actuator controller. In this case the at least one actuator controller is further configured to execute the emergency control commands of the control monitoring unit prioritised over the control commands of the first control unit.