Dual-Controller Path Verification for Automated Driving Safety
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing automated driving systems lack robust mechanisms to address latent faults and ambiguities in path planning decisions, leading to potential safety risks and inefficiencies.
Innovation Solution
A dual-controller system is employed, where a primary controller makes driving decisions and a secondary safety controller verifies these decisions against safety conditions, ensuring compliance with permissible paths and preempting unsafe operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single controller is used for automated driving decisions, then device complexity is reduced, but safety and reliability are compromised due to latent faults and ambiguities in path planning
Solution Approach 1:
The automated driving control system is segmented into two distinct controllers: a primary controller that generates path plans and a secondary safety controller that verifies safety conditions. This segmentation allows each controller to have specialized functions, with the primary controller focusing on path planning efficiency and the secondary controller focusing on safety verification, thereby improving overall system reliability without excessively increasing complexity.
Solution Approach 2:
The secondary safety controller acts as an intermediary between the primary controller and the vehicle systems. It receives path plans from the primary controller, independently evaluates safety conditions using sensor data, and either approves or preempts the path plan. This intermediary role provides an additional safety layer that catches latent faults and ambiguities that the primary controller might miss.
2Reliability
If redundant functionality is provided in both controllers, then safety is improved through redundancy, but device complexity and cost increase significantly
Solution Approach 1:
Instead of providing full redundant functionality in both controllers, the patent applies local quality by giving each controller different specialized functions. The primary controller is optimized for path planning with access to sensor data and mapping information, while the secondary controller is specialized for safety verification with focus on evaluating safety conditions and preempting unsafe paths. This asymmetric configuration reduces overall complexity while maintaining safety through functional diversity.
3Object-affected harmful factors
If the second controller preempts unsafe path plans, then safety is enhanced by preventing harmful actions, but productivity and efficiency are reduced due to additional verification steps
Solution Approach 1:
The secondary safety controller performs preliminary safety verification of path plans before they are executed by the vehicle systems. By evaluating safety conditions in advance and preempting only when necessary, the system prevents unsafe driving scenarios while allowing efficient path execution when safety conditions are met, thus minimizing the impact on driving efficiency.
Solution Approach 2:
When the secondary controller determines that safety conditions are satisfied, it quickly approves the path plan without further delay, allowing the primary controller's path plan to be executed promptly. The preemptive safety check only interrupts the flow when actual safety violations are detected, enabling the system to skip unnecessary verification delays while maintaining safety oversight.
Data Source
AI summary
Systems and methods for a safety control framework for automated driving systems in which a second controller—with different/diverse hardware and/or software than the first controller—verifies whether a path plan generated by the first controller meets certain safety conditions and preempts the first controller from controlling automated driving of the host vehicle in response to determining that the path plan does not satisfy the safety conditions. In some implementations, the second controller is configured to preempt the first controller by operating the vehicle under automated control using a safety path plan generated by the second controller.