Fault-Tolerant Autonomous Vehicle Control via Independent Data Paths
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current autonomous vehicle control systems lack sufficient fault tolerance to ensure safe operation in the event of hardware or software errors, particularly at higher automation levels like ASIL D, where the probability of dangerous errors must be less than 10^-8 per hour, which is challenging due to the complexity of software and hardware design.
Innovation Solution
The method employs multiple independent data flow paths using diverse sensors and software versions to determine safe trajectories and space-time domains, with a deciding instance in simple software verifying the safety of trajectories and selecting appropriate ones for actuators, and switching to an emergency trajectory if necessary, utilizing hardware redundancy to mask errors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple independent data flow paths with diverse sensors and software versions are used to determine safe trajectories, then reliability is improved, but device complexity increases
Solution Approach 1:
The control system is divided into multiple independent data flow paths (DFP1, DFP2, DFP3), each processing sensor data through separate software versions to determine trajectories. This segmentation allows fault isolation where errors in one path do not affect others, directly improving reliability while managing complexity through modular architecture.
Solution Approach 2:
The system pre-establishes multiple diverse software versions and independent data processing paths before operation. This preliminary preparation ensures that when faults occur, pre-validated alternative paths are immediately available, improving fault tolerance without adding operational complexity.
Solution Approach 3:
The system varies software versions and processing parameters across different data flow paths to create diversity. By changing software parameters and processing approaches, the system achieves fault tolerance through diversity while maintaining manageable complexity through standardized interfaces.
2Reliability
If a deciding instance verifies trajectory safety through multiple independent data flow paths, then the probability of dangerous errors is reduced, but the execution time increases
Solution Approach 1:
The deciding instance performs partial verification by checking if trajectories from multiple data flow paths converge on safe outcomes. Rather than exhaustive verification of all possible errors, the system performs sufficient checking to ensure safety with acceptable time constraints, balancing reliability and execution time.
Solution Approach 2:
When trajectories from independent data flow paths converge and indicate safety, the deciding instance quickly accepts the solution without prolonged verification. This allows the system to rush through the verification process when confidence is high, reducing execution time while maintaining reliability.
Data Source
AI summary
A method for operating a controlled object that is embedded in a changing environment. The controlled object and its environment are periodically observed using sensors. Independent data flow paths (“DFP”) are executed based on the data recorded through the observation of the controlled object and its environment. A first DFP determines a model of the controlled object and the environment of the controlled object and carries out a trajectory planning in order to create possible trajectories that, under the given environmental conditions, correspond to a specified task assignment. A second DFP determines a model of the controlled object and of the environment of the controlled object and determines a safe space-time domain (“SRZD”) in which all safe trajectories must be located. The results of the first and the second DFP are transmitted to a deciding instance to verify whether at least one of the trajectories is safe.