Asymmetric Vehicle Controller Architecture for Fail-Operational Safety
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current fail-operational architectures for vehicle systems controllers in automated driving systems, such as duplex controllers and triple modular redundancy systems, result in increased complexity, weight, and cost inefficiencies, while still ensuring the vehicle remains operational for a predetermined time to allow human intervention upon fault detection.
Innovation Solution
An asymmetric system architecture with a primary and secondary controller, where the primary controller self-detects faults and becomes fail-silent, generating an alert signal to switch to secondary instructions, and vice versa, allowing the vehicle to continue operating pre-identified functions until human intervention or a predetermined time lapses, reducing the need for redundant hardware and software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If symmetric fail-operational architectures (duplex controllers or triple modular redundancy) are used, then the vehicle remains operational for a predetermined time upon fault detection, but system complexity, weight, and cost increase
Solution Approach 1:
The patent applies asymmetry by using a primary controller with full software applications and a secondary controller with only a subset of software applications. This asymmetric configuration reduces the computational burden and resource requirements of the secondary controller while maintaining fail-operational capability, directly resolving the contradiction between reliability and device complexity
Solution Approach 2:
The patent extracts only the essential subset of software applications needed for safe vehicle operation from the complete set and places them in the secondary controller. This extraction allows the secondary controller to be simpler and lighter while still providing adequate fail-operational functionality, addressing both complexity and resource efficiency concerns
2Reliability
If redundant hardware and software are implemented for fail-operational architecture, then the vehicle continues to operate upon fault detection, but weight and cost inefficiencies increase
Solution Approach 1:
The patent extracts only the critical subset of software applications required for safe operation from the complete software set and stores them in the secondary controller. This selective extraction reduces the memory and processing requirements of the secondary controller, thereby reducing overall system weight while maintaining the ability to continue operation upon primary controller failure
Solution Approach 2:
The patent changes the parameter of software application completeness by implementing an asymmetric configuration where the secondary controller contains only a subset of applications rather than a complete copy. This parameter change reduces the resource footprint and weight of the fail-operational system while preserving essential safety functionality
3Reliability
If identical hardware and software are used in duplex controllers, then fail-operational functionality is achieved, but system resources such as CPU and memory are over-designed
Solution Approach 1:
The patent implements asymmetry by configuring the primary controller with the complete set of software applications and the secondary controller with only a subset. This asymmetric resource distribution allows the secondary controller to use fewer CPU and memory resources while still providing adequate fail-operational functionality, resolving the contradiction between reliability and resource efficiency
Solution Approach 2:
The patent applies partial action by implementing only the essential subset of software applications in the secondary controller rather than a complete copy. This partial implementation is sufficient for maintaining safe vehicle operation during fail-operational mode while significantly reducing the computational and memory resources required compared to identical controller configurations
Data Source
AI summary
A vehicle system controller having an asymmetric system architecture and a method of operating the vehicle system controller is provided. The vehicle system controller includes a primary controller and a secondary controller in communications with the vehicle systems. Each of the controllers include a memory unit containing software application and a processor for executing the software to generate commands for the vehicle systems. The memory unit of the secondary controller contains only a subset of the total software applications contained in the memory unit of the primary controller. The subset of software applications is only for the operation of pre-identified features of the vehicle systems. The vehicle systems are configured to default to commands from the primary controller, but switches to the commands from the secondary controller for a predetermined length of time if the primary controller becomes fail-silent.