Decision System Fail-Silent Fallback for Safe Autonomous Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing control systems for fully autonomous technical systems, such as machines or vehicles, face challenges in ensuring safe operation even when the Decision System (DS) fails silently, as they lack mechanisms to reliably transition the system to a safe state in such scenarios.
Innovation Solution
The system employs a fail-silent Decision System (DS) that selects setpoints for intelligent actuators with two independent input channels, where if the DS fails, the Fallback System's setpoints are used to ensure the system reaches a safe state by having the intelligent actuator switch to the FBS setpoints if no message is received from the DS, and continue using these until the system is reinitialized.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the Decision System (DS) is used to select setpoints for normal operation, then system productivity and control precision are improved, but system reliability deteriorates when the DS fails silently
Solution Approach 1:
The Fallback System (FBS) is pre-configured with alternative setpoint generation capability and the intelligent actuator is pre-configured with dual input channels. When the DS fails, the FBS can immediately take over without requiring system reconfiguration or manual intervention, thus maintaining reliability while preserving productivity
Solution Approach 2:
The intelligent actuator serves as an intermediary component with dual input channels - one from the DS and another from the FBS. This intermediary structure allows seamless switching between normal and fallback modes, resolving the contradiction by enabling both high-productivity normal operation and reliable failover capability
2Device complexity
If a fail-silent Decision System is implemented, then system complexity is reduced, but the ability to detect and respond to failures deteriorates
Solution Approach 1:
The intelligent actuator implements feedback by monitoring the presence and validity of setpoint messages from both the DS and FBS. When no message is received from the DS within the expected time window, the actuator detects the failure condition and automatically switches to FBS setpoints, thus maintaining failure detection capability without increasing overall system complexity
3Reliability
If the Fallback System continuously provides alternative setpoints, then system safety is improved, but loss of information increases due to redundant data transmission
Solution Approach 1:
The FBS provides alternative setpoints continuously, but the intelligent actuator selectively processes only the necessary information - comparing message presence and switching when needed. This partial action approach maintains system safety through continuous monitoring while avoiding unnecessary data transmission and processing of redundant setpoint information
Data Source
Figure 1
Figure 2
AI summary
The invention lies in the field of computer technology and relates to a subsystem, the Decision System, of a distributed fault-tolerant computer architecture for the fully autonomous control of a technical system. A possible architecture of such a distributed fault-tolerant control system was published by H. Kopetz in the Springer Lecture Notes on Computer Science (LNCS) Vol. 13660, Chapter 4, pp. 61-84, entitled "An Architecture for Safe Driving Automation" in December 2022 [Kop22]. This safe control system consists of four subsystems, each of which is an independent hardware/software system and each of the four subsystems forms a fault containment unit. The four independent subsystems of the described architecture are a Primary Control System, a Monitoring System (MS), a Fallback System, and a Decision System. Assuming that the Decision System always functions without errors, the architecture described by H.The control system described by Kopetz brings the technical system into a safe state if any (Byzantine) fault occurs in one of the other three subsystems. The present invention extends this architecture so that the system is also brought into a safe state if a fail-silent fault occurs in the Decision System.