Automated Driving Fallback Control with Redundant Brake and Steering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing automated driving control systems frequently experience breakdowns due to complex architecture, leading to frequent fallback to degradation levels that result in immediate stops, and lack robustness in handling double failures or systematic failures.
Innovation Solution
The equipment arrangement includes at least two brake systems, two steering systems, an engine controller, two primary automated drive controllers, and a third controller designed exclusively for guiding the vehicle to a standstill. This arrangement ensures that automated driving operation is only initiated and maintained when multiple critical systems are functional, and automatically transitions to a safe stop if any critical failure occurs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If simple redundancy with two automated drive controllers is used, then basic failure coverage is achieved, but systematic failures and double failures cannot be handled robustly
Solution Approach 1:
The control system is segmented into three distinct automated drive controllers (ADC1, ADC2, ADC3), where ADC3 is specifically dedicated to handling failure scenarios. This segmentation allows each controller to have specialized functions, improving robustness against systematic failures while maintaining manageable complexity through clear division of responsibilities.
Solution Approach 2:
The system implements beforehand cushioning by pre-configuring multiple redundant controllers and establishing degradation levels with predetermined fallback procedures. When failures occur, the system can smoothly transition to alternative controllers without emergency stops, cushioning the impact of failures on system availability.
2Reliability
If frequent fallback to degradation levels is implemented, then safety is maintained, but automated driving availability decreases due to immediate stops
Solution Approach 1:
The system cushions the impact of failures by pre-configuring multiple degradation levels and alternative controllers. Instead of immediate stops, the system can transition to ADC3 or other degradation levels, maintaining safety while preserving automated driving availability during failure scenarios.
Solution Approach 2:
The system implements dynamic fallback strategies where the degradation level and active controller are adjusted based on the specific failure scenario. This dynamic adaptation allows the system to maintain automated driving operation at reduced levels rather than complete stops, balancing safety and availability.
3Reliability
If multiple redundant systems are added, then system availability increases, but device complexity increases
Solution Approach 1:
The redundant systems are segmented into specialized controllers with distinct functions. ADC1 and ADC2 handle primary automated driving operations, while ADC3 specifically manages failure scenarios. This segmentation increases availability through redundancy while controlling complexity through clear functional separation.
Solution Approach 2:
The automated drive controllers are designed with multi-functionality, where each controller can operate independently and assume different roles based on system state. This universality allows the redundant controllers to be integrated into a unified control architecture, increasing availability without proportionally increasing operational complexity.
Data Source
AI summary
A device for controlling an automated driving operation of a vehicle may have at least two brake systems, at least two steering systems, an engine controller, a first automated drive controller, a second automated drive controller, a surroundings sensor assembly, and inertial sensors. A third automated drive controller at least controls the vehicle into a standstill. The device is configured such that the automated driving operation is initiated and/or maintained only when the brake systems, steering systems, and at least two of the automated drive controllers are functional and such that the automated driving operation is interrupted if only one of the automated drive controllers is functional and/or if one of the brake systems and/or steering systems is not functional and/or if the engine controller is not functional, in which case the still functional automated drive controller assumes control of the vehicle and guides the vehicle into a standstill.