Dual-Controller Autonomous Driving for Single-Point Failure Tolerance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing autonomous driving systems with a single Electric Control Unit (ECU) architecture cannot achieve the required Automotive Safety Integration Level (ASIL) D-level functional safety and reliability, particularly in highly autonomous driving scenarios where failures in controllers or actuation mechanisms can lead to system instability.
Innovation Solution
A dual-controller architecture is implemented, where a main controller and a backup controller work together with corresponding steering and braking controllers, enabling the system to switch to backup control instructions and instructions when abnormalities or communication interruptions occur, ensuring continuous operation and ASIL D-level safety.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single ECU architecture is used in autonomous driving systems, then the device complexity is reduced, but the reliability cannot achieve ASIL D-level functional safety requirements
Solution Approach 1:
The control system is segmented into multiple independent controllers (main controller and backup controller) rather than using a single ECU. Each controller can independently execute control instructions, and the system divides the control functions across multiple units to achieve redundancy and meet ASIL D-level safety requirements.
Solution Approach 2:
The system implements beforehand cushioning by pre-configuring backup controllers that stand ready to take over if the main controller fails. This prior preparation of redundant control units ensures that safety is maintained even when abnormalities occur, cushioning against potential failures before they impact system reliability.
2Reliability
If backup controllers are added to the autonomous driving system, then the reliability achieves ASIL D-level safety, but the device complexity increases
Solution Approach 1:
The backup controllers are designed with multi-functionality, serving both as standby units for safety redundancy and as active controllers when needed. This universal design allows the same hardware architecture to fulfill multiple roles, reducing the need for entirely separate systems and thereby limiting the increase in device complexity.
Solution Approach 2:
The system uses copying by creating identical backup controller units that replicate the main controller's functionality. Instead of designing complex unique backup systems, the solution copies the proven main controller architecture, ensuring reliability through redundancy while keeping the complexity manageable through standardized designs.
3Reliability
If the system switches to backup control instructions when abnormalities occur, then the reliability is maintained, but the response time and system complexity increase
Solution Approach 1:
The system performs preliminary action by pre-configuring and pre-testing backup controllers before failures occur. The backup units are ready with pre-loaded control instructions and can immediately take over without requiring complex real-time decision-making or instruction transmission delays, thus minimizing switching response time.
Solution Approach 2:
The system implements feedback mechanisms that continuously monitor the main controller's status and automatically trigger the switch to backup controllers when abnormalities are detected. This closed-loop feedback ensures rapid response to failures, maintaining reliability while minimizing the time loss associated with detection and switching operations.
Data Source
AI summary
An autonomous driving control system comprises a main controller, a backup controller, main execution apparatuses and backup execution apparatuses. The backup controller is configured to decompose, when receiving a main control instruction from the main controller, the main control instruction to obtain backup control instructions corresponding to the backup execution apparatuses respectively, and send the backup control instructions to the backup execution apparatuses correspondingly; and the control system is configured to control, when detecting that an abnormality occurs in any one device of the main execution apparatuses, the backup execution apparatus corresponding to the device in which the abnormality has occurred to execute a corresponding backup control instruction. The system can solve the problem that an autonomous driving control system cannot operate normally when any controller or actuation mechanism fails at a single point.