Autonomous Machine Safety Decomposition with Asymmetric Redundancy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional automated driving systems (ADSs) face challenges in designing a behavior planning system that meets the stringent safety integrity level (ASIL D) requirements, as they must avoid single points of failure and ensure compliance with ASIL D for all hardware and software components involved in safety goals.
Innovation Solution
The proposed safety decomposition architecture employs asymmetric redundancy within the behavior or motion planning system of autonomous or semi-autonomous machines. This involves using two or more individual safety assessments of lower ASIL levels (e.g., ASIL B(D)) to achieve a higher safety integrity level (e.g., ASIL D). Specifically, the system decomposes ASIL D requirements into ASIL B(D) for the behavior planning component and ASIL B(D) for the collision avoidance component, allowing for independent and redundant prevention of safety goal violations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional systems employ system level redundancy to remove single point of failure, then reliability is improved, but device complexity increases and computational cost increases
Solution Approach 1:
The patent segments the safety-critical behavior planning function into two independent processing pipelines: a first pipeline handling primary planning tasks and a second pipeline handling safety monitoring tasks. Each pipeline operates with its own processor and software stack, allowing them to function independently. This segmentation enables the system to achieve ASIL D reliability through functional independence while managing complexity by clearly defining separate responsibilities for each pipeline.
Solution Approach 2:
The patent introduces an intermediary safety monitoring component that acts as a mediator between the primary behavior planning system and the safety evaluation process. This intermediary component receives outputs from the first processing pipeline, performs independent safety assessments, and can override or modify decisions to ensure safety goals are met. This mediator approach allows ASIL D compliance without requiring complete redundancy of the entire system.
2Reliability
If conventional systems use two or more individual rule-based approaches compliant with ASIL D, then reliability is improved, but productivity decreases due to increased latency
Solution Approach 1:
The patent applies local quality by assigning different safety integrity levels to different components of the system. The first processing pipeline (primary behavior planning) operates at ASIL B(D), while the second processing pipeline (safety monitoring) also operates at ASIL B(D). This localized assignment of safety levels allows each component to be optimized for its specific function without the entire system requiring uniform ASIL D compliance, thereby reducing overall computational burden and latency.
Solution Approach 2:
The patent implements partial action by having the second processing pipeline perform selective safety monitoring rather than complete redundant planning. The safety monitoring pipeline focuses specifically on evaluating whether safety goals are violated, rather than performing full behavior planning. This partial action approach maintains reliability by independently verifying safety-critical decisions while reducing computational overhead compared to running two complete planning systems.
3Adaptability or versatility
If asymmetric redundancy is used with diverse ADS planner concepts, then adaptability is improved, but device complexity increases
Solution Approach 1:
The patent implements asymmetry through asymmetric redundancy where the first and second processing pipelines have different functional roles and can use different planner concepts. The first pipeline may use a model predictive controller (MPC) for primary behavior planning, while the second pipeline uses a collision avoidance algorithm for safety monitoring. This asymmetric design allows each pipeline to be optimized for its specific function with appropriate algorithms, improving adaptability while managing complexity through clear functional differentiation.
Data Source
AI summary
In various examples, a safety decomposition architecture for autonomous machine applications is presented that uses two or more individual safety assessments to satisfy a higher safety integrity level (e.g., ASIL D). For example, a behavior planner may be used as a primary planning component, and a collision avoidance feature may be used as a diverse safety monitoring component—such that both may redundantly and independently prevent violation of safety goals. In addition, robustness of the system may be improved as single point and systematic failures may be avoided due to the requirement that two independent failures—e.g., of the behavior planner component and the collision avoidance component—occur simultaneously to cause a violation of the safety goals.