Autonomous Vehicle Control Architecture for Fail-Silent Fault Tolerance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing devices for autonomously driving motor vehicles lack fault-tolerance, failing to ensure safe operation in the event of individual system failures.
Innovation Solution
A device with a master-slave configuration of sub-systems, including fail-silent first and third sub-systems and slave sub-systems, ensures continuous safe operation by generating control commands for actuators even in the presence of faults, utilizing redundant systems and independent power supplies to maintain vehicle safety.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full redundancy with two systems working in parallel is implemented, then fault-tolerance is improved, but device complexity increases
Solution Approach 1:
The control device is divided into four functional sub-systems (first master, first slave, second master, second slave) that are interconnected in a ring structure. Each sub-system performs specific functions (trajectory calculation, control command generation, actuator control) rather than duplicating entire systems. This segmentation allows fault-tolerance through distribution while reducing overall complexity compared to full redundancy.
Solution Approach 2:
The patent introduces a ring topology dimension to the system architecture, connecting sub-systems in a closed loop where each sub-system has multiple communication paths to others. This topological dimension provides alternative signal routes during faults, achieving fault-tolerance without requiring complete duplicate systems, thus reducing complexity while maintaining reliability.
2Reliability
If multiple sub-systems with master-slave configuration are used, then fault-tolerance is improved, but communication complexity increases
Solution Approach 1:
Multiple master-slave pairs are merged into a unified ring structure where sub-systems serve dual roles as both masters and slaves depending on communication direction. The first master communicates with first slave, second master communicates with second slave, while simultaneously first master communicates with second master and first slave communicates with second slave in the ring. This merging reduces communication overhead compared to independent master-slave pairs.
Solution Approach 2:
Each sub-system is designed with universal communication capabilities, functioning as both master and slave depending on the communication context. The sub-systems can initiate communications, respond to requests, and maintain ring topology connections, reducing the need for dedicated communication hardware and protocols for each role, thus simplifying the overall communication structure.
3Reliability
If fail-silent design is implemented, then safety is improved, but system functionality is reduced during faults
Solution Approach 1:
The ring topology is pre-configured with multiple communication paths before faults occur. When a fault is detected in one sub-system, the ring structure automatically provides alternative routes for control commands and status information to flow through other sub-systems. This preliminary structural preparation ensures safety through fail-silent operation while maintaining functionality through pre-established redundancy paths.
Solution Approach 2:
The system dynamically reconfigures communication paths when faults are detected. Healthy sub-systems can change roles and adjust their master-slave relationships in real-time based on the operational status of other sub-systems. This dynamic adaptation allows the system to maintain safety through fail-silent design while preserving productivity by continuously optimizing the operational configuration of remaining healthy components.
Data Source
AI summary
Technologies and techniques for generating and transmitting control commands for an autonomously driving motor vehicle. A device receives at least surroundings data and vehicle status data, calculates a trajectory on the basis of said data, calculates the control commands required for the implementation of the trajectory and transmits them to at least one actuator. The device includes four sub-systems, wherein a first and a third sub-system operate as master and a second and a fourth sub-system operate as slave. Each of the first/second sub-system receives at least surroundings data and vehicle status data and the third/fourth sub-system transmit at least the control commands to at least one actuator. At least the first/third sub-system are designed to be fail-silent; if individual faults occur in a sub-system, at least one control command is to be generated and transmitted in order to bring the motor vehicle into a safe state.