Self-Driving Car Control with Safety Certificate Interlocks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional machine learning techniques for vehicle control in self-driving cars are not reliable in complex interactions and fail to certify the safety of selected vehicle control actions, such as speed, acceleration, and steering angles, which is critical for ensuring safe vehicle interactions.
Innovation Solution
A certified control system that includes a main controller analyzing safety situations, generating safety certificates for proposed vehicle control actions, and an interlock controller verifying these certificates using predefined safety arguments to ensure safe vehicle control actions are taken, with a low-level controller executing the verified actions or intervening with safety mitigations if necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If conventional machine learning techniques are used for vehicle control, then the system can handle complex interactions and select appropriate control actions, but the safety of selected vehicle control actions cannot be certified
Solution Approach 1:
The control system is segmented into two independent components: a main controller that uses machine learning to determine proposed vehicle control actions, and an interlock controller that verifies safety certificates. This segmentation allows the main controller to maintain adaptability while the interlock controller ensures reliability through independent verification of safety claims.
Solution Approach 2:
A safety certificate acts as an intermediary between the main controller and interlock controller. The main controller generates this certificate to attest to the safety of its proposed actions, enabling the interlock controller to verify safety without directly trusting the main controller's decisions, thus bridging adaptability and reliability.
2Reliability
If a certified control system with interlock controller is implemented, then safety certification is achieved, but the system complexity increases
Solution Approach 1:
The safety verification function is extracted from the main controller and placed in a separate interlock controller. This extraction reduces the complexity burden on the main controller while maintaining safety certification capabilities, as the interlock controller handles only verification tasks independently.
Solution Approach 2:
The main controller performs preliminary safety analysis and generates a safety certificate before submitting control actions to the interlock controller. This preliminary action reduces the interlock controller's workload to verification only, thereby managing system complexity while achieving safety certification.
3Reliability
If the interlock controller verifies all safety claims, then high assurance of safety is provided, but the response time may be delayed
Solution Approach 1:
The interlock controller performs partial verification by checking safety certificates against predefined safety arguments rather than re-evaluating all control parameters. This partial verification approach maintains high safety assurance while reducing verification time and improving response speed.
Solution Approach 2:
The main controller performs preliminary safety analysis and generates certificates in advance, so the interlock controller only needs to verify pre-computed safety claims. This preliminary action reduces the verification burden and accelerates the overall control response time while maintaining high safety assurance.
Data Source
AI summary
A method for certified control of a self-driving ego vehicle is described. The method includes analyzing a safety situation of the self-driving ego vehicle to determine a proposed vehicle control action using a main controller of the self-driving ego vehicle. The method also includes presenting, by the main controller, the proposed vehicle control action to an interlock controller, including a certificate of the proposed vehicle control action. The method further includes checking a safety certification evidence from the certificate by the interlock controller using a predefined safety argument to verify the safety certification evidence of the certificate. The method also includes directing, by a low-level controller, the self-driving ego vehicle to perform a certified vehicle control action.