Automotive Control Unit Failover Using Backup Software Clusters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional automotive systems face challenges in managing software redundancy for safety-critical units without increasing complexity or hardware, as software components are often interdependent and require extensive build times, limiting the ability to maintain functionality in case of faults within control units.
Innovation Solution
Implementing a method where a primary software cluster on one control unit controls a unit, and a backup software cluster on another unit takes over in case of failure, allowing the system to transition the faulty unit into a fail-silent state and ensuring continuous functionality without additional hardware, using the AR Flex concept of AUTOSAR Classic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple side-by-side hardware components are installed to create redundancy, then reliability is improved, but device complexity increases
Solution Approach 1:
The patent creates a software copy (backup software cluster) of the control functionality that can be executed on the same or different control units. This software-based copying approach provides redundancy without requiring additional hardware components, thus maintaining reliability while avoiding the complexity increase that would result from duplicating physical hardware.
Solution Approach 2:
The backup software cluster is designed to be universally applicable across different control unit architectures (AUTOSAR Classic and AUTOSAR Adaptive). This multi-functionality allows the same backup mechanism to serve multiple purposes and different system configurations, providing redundancy without requiring architecture-specific hardware duplications.
2Reliability
If the entire software is created as a complete and closed element, then reliability is improved, but manufacturing precision worsens due to long build times
Solution Approach 1:
The software is segmented into separate software clusters (primary and backup) that can be independently developed, tested, and maintained. This segmentation allows parallel development of different software components, reducing overall build time while maintaining the completeness and reliability of the overall software system through structured integration of the clusters.
Solution Approach 2:
The backup software cluster is prepared and configured in advance as part of the system setup, but remains dormant until needed. This preliminary action allows the backup software to be fully built and validated beforehand without extending the active development timeline, as it can be developed independently and activated only when the primary software fails.
3Ease of operation
If software clusters are divided into separate components, then ease of operation is improved, but device complexity increases
Solution Approach 1:
An intermediary mechanism (the fail-silent state and activation logic) manages the interaction between the primary and backup software clusters. This intermediary layer handles the complexity of coordination, switching, and state management, allowing the individual software clusters to remain simple and independent while the system as a whole achieves sophisticated failover capabilities through the mediating control logic.
Data Source
AI summary
The disclosure relates to a computer-implemented method and a control device for controlling a unit of an automotive system. An electrical/electronic architecture of the automotive system includes a first control unit, a second control unit, and the unit to be controlled. The method includes detecting that the control of the unit by a primary software cluster is faulty and/or defective. The method also includes activating the second control unit by the first control unit, whereby the second control unit is transferred to a fail-silent state and does not send any more potentially erroneous data. Additionally, the method includes controlling the unit by a backup software cluster of the first control unit, thereby maintaining the functionality of the unit.