Redundant Driving Function Control with Selective Lockstep Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional lockstep controllers are slower and less available due to time synchronization and inability to identify which processing unit is erroneous upon mismatch, leading to unnecessary shutdowns and reduced system performance in cloud environments.
Innovation Solution
Implementing a lockstep controller with continuous end-to-end protection and independent comparison of input and output data, using a clocked redundant control unit to monitor and diagnose errors, and selectively handling erroneous data for graceful degradation, while utilizing a voter to optimize runtime and availability by comparing three sources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If lockstep comparison is implemented for functional safety, then reliability is improved, but speed deteriorates due to time synchronization requirements
Solution Approach 1:
The patent segments the comparison process into two independent phases: first comparing control fields (security-relevant data) and then comparing result data. This segmentation allows the system to maintain strict lockstep synchronization for security-critical control fields while enabling faster, less synchronized processing for result data, thereby resolving the contradiction between reliability and speed.
Solution Approach 2:
The patent applies partial lockstep comparison by only synchronizing and comparing control fields with strict timing requirements, while result data can be processed with more flexibility. This partial application of lockstep principles maintains functional safety for critical operations while improving overall processing speed by not requiring synchronization for all data types.
2Reliability
If lockstep comparison is implemented for functional safety, then reliability is improved, but device complexity worsens due to additional comparison infrastructure
Solution Approach 1:
The patent segments the comparison infrastructure into specialized components: one dedicated to control field comparison and another for result data comparison. This segmentation reduces overall complexity by allowing each component to be optimized independently and by enabling parallel operation, thus maintaining reliability while managing device complexity.
Solution Approach 2:
The patent performs preliminary comparison of control fields before processing result data. This preliminary action ensures that security-relevant parameters are validated first, allowing the system to maintain high reliability while simplifying the overall comparison infrastructure by establishing a clear hierarchical processing order.
3Reliability
If lockstep comparison is implemented for functional safety, then reliability is improved, but loss of time worsens due to synchronization overhead
Solution Approach 1:
The patent segments the time-critical path by separating control field processing from result data processing. Control fields undergo strict synchronized comparison with minimal time loss, while result data can be processed with greater time flexibility. This segmentation reduces overall time loss while maintaining the reliability benefits of lockstep comparison for critical security parameters.
Solution Approach 2:
The patent applies lockstep synchronization partially, only to control fields that require strict timing and security guarantees. Result data processing operates with relaxed timing constraints, thereby reducing synchronization overhead and time loss while preserving functional safety for the most critical operations.
4Reliability
If lockstep comparison is implemented for functional safety, then reliability is improved, but productivity worsens due to reduced system availability
Solution Approach 1:
The patent segments the system into critical security functions (control fields) and non-critical functions (result data). By applying strict lockstep comparison only to control fields, the system maintains high reliability for safety-critical operations while preserving system availability for overall productivity, as result data processing can continue with greater flexibility even if control field comparison encounters issues.
Solution Approach 2:
The patent applies lockstep principles partially to only the extent necessary for functional safety (control fields), allowing the majority of system operations (result data processing) to proceed with higher availability. This partial application resolves the contradiction by maintaining reliability where absolutely necessary while maximizing productivity elsewhere in the system.
Data Source
AI summary
A method for controlling a driving function. In the method, input data relevant for the driving function are conveyed to a cluster, output data are respectively generated by redundant processing of the input data on at least a first processing unit and a second processing unit in the cluster, the respective output data are supplemented by control fields by each processing unit, the output data of the processing units are conveyed to a comparison and a result of the comparison is ascertained, and depending on the result, the output data are utilized on a case-by-case basis together with the respective control fields for the driving function if the output data and control fields bear the comparison, or are marked as erroneous if the output data or control fields deviate.