Command Filter for Automotive Diagnostic Safety
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In safety-relevant systems like automotive control units, script-based programming for diagnostic and software updates poses a risk of inadvertent interventions due to lack of mechanisms to manage flexible control processes, especially in over-the-air (OTA) updates where actions can occur without defined states and monitoring.
Innovation Solution
A system architecture separates the execution of diagnostic command sequences, monitoring, and receiving safety-relevant ECUs, using a secured area with a command filter to selectively relay valid commands based on predefined conditions, ensuring safety integrity levels are met, and employing finite state machines to manage valid commands and prevent unintended interventions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If script-based programming is used for diagnostic commands, then flexibility and adaptability are improved, but reliability and safety are worsened due to risk of inadvertent interventions
Solution Approach 1:
The system is divided into a dynamic area for script execution and a secured area for safety-critical operations. The secured area contains a command filter that segments and validates commands before they reach the ECU, allowing flexible scripting while maintaining safety through structural separation.
Solution Approach 2:
A command filter acts as an intermediary between the script interpreter and the ECU. This mediator validates commands against predefined conditions and safety rules, blocking invalid commands while allowing valid ones to pass through, thus enabling flexible scripting without compromising safety.
2Reliability
If static programming is used for safety-critical systems, then reliability is improved, but adaptability and flexibility are worsened
Solution Approach 1:
The system separates static safety-critical code in the secured area from dynamic script-based commands in the dynamic area. This segmentation allows each part to use the most appropriate programming approach while maintaining overall system safety and flexibility.
Solution Approach 2:
The command filter uses finite state machines that can dynamically adjust their validation rules based on the current system state. This allows the system to maintain strict safety checks while adapting to different operational contexts and diagnostic scenarios.
3Reliability
If command filtering and monitoring are added, then safety is improved, but device complexity increases
Solution Approach 1:
The secured area with the command filter is implemented as a separate, modular component within the ECU. This segmentation isolates the complexity of safety monitoring to a specific module, making the overall system easier to understand and maintain while improving safety.
Solution Approach 2:
The command filter serves multiple functions: it validates commands, monitors system state, enforces safety rules, and manages communication between the dynamic and secured areas. This multi-functionality reduces the need for separate components, thereby limiting the increase in overall system complexity.
Data Source
AI summary
A device for monitoring diagnostic commands to a control unit. The device includes an execution platform, and a security device connected to the execution platform, with a command filter and state machines. The execution platform is configured to generate the diagnostic commands based on predefined scripts. The command filter is configured to select valid commands from among the diagnostic commands, based on conditions following from states of the state machines. The security device is configured to relay the commands to the control unit.