Autonomous Driving Controller Takeover After Main ECU Failure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional autonomous driving systems lack a response strategy when the main controller fails, leading to the cessation of autonomous driving operations.
Innovation Solution
A vehicle control apparatus and method that includes a first safety controller, a second main controller, and a third subcontroller, where the third controller can take over autonomous driving functions if the second controller fails, and the first controller performs a failure response strategy based on commands from the third controller, including transitioning control authority to the driver or executing a minimum risk maneuver.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single main controller is used for autonomous driving control, then the device complexity is reduced, but the reliability deteriorates when the controller fails
Solution Approach 1:
The autonomous driving control system is segmented into multiple independent controllers: a first controller for safety control functions and a second controller for main autonomous driving determination and control. This segmentation allows the system to maintain critical safety functions even if the main controller fails, thereby improving reliability without requiring a completely redundant complex architecture.
Solution Approach 2:
Different controllers are assigned different functional qualities: the first controller handles safety-critical functions with high reliability requirements, while the second controller handles main autonomous driving control. This local differentiation of quality allows each controller to be optimized for its specific function, improving overall system reliability while managing complexity through functional specialization.
2Reliability
If redundant controllers are added to handle main controller failure, then the reliability is improved, but the device complexity increases
Solution Approach 1:
The system performs preliminary configuration by pre-establishing the first controller as a safety backup and defining failure detection mechanisms and response protocols in advance. When the main controller fails, the pre-configured safety controller can immediately take over critical functions without requiring complex real-time decision-making, thus improving reliability while managing complexity through advance preparation.
Solution Approach 2:
The first controller acts as an intermediary between the second controller and the vehicle's safety-critical systems. It monitors the health of the main controller and intervenes only when necessary to maintain safety, providing a simple mediation mechanism that improves reliability without adding significant complexity to the overall system architecture.
3Reliability
If the third controller takes over autonomous driving functions upon second controller failure, then the reliability is improved, but the ease of operation deteriorates due to control subject changes
Solution Approach 1:
The controller failure detection and takeover mechanism operates autonomously without requiring driver intervention. The first controller automatically detects failures of the second controller and takes over safety-critical functions, while the system automatically manages the transition of control authority. This self-service approach maintains continuous operation and reliability while preserving ease of operation by eliminating the need for manual control subject changes.
Data Source
AI summary
A vehicle control apparatus and a method thereof include a first controller configured to perform control for safety of a vehicle; a second controller configured to mainly perform determination and control of autonomous driving of the vehicle; and a third controller configured to subordinately perform the determination and the control of the autonomous driving of the vehicle, wherein the third controller is configured to determine whether the second controller fails, when the second controller fails, to change a control subject for performing an autonomous driving function from the second controller to the third controller, and to transmit control subject change information to the first controller.