Fault-Containment Units for Safe Autonomous Restart
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Cyber-Physical Systems, such as autonomous robots or vehicles, transient errors can lead to serious consequences due to hardware or software failures, and intrusions, necessitating a method to safely restore normal operation after errors occur.
Innovation Solution
A distributed real-time computer system architecture with Fault-Containment Units, including a Fault-Tolerant Decision Subsystem, Normal Processing Subsystem, Monitor Subsystem, and Critical Event Handling Subsystem, which independently evaluate sensor data, review setpoints, and trigger restarts to ensure safe operation by isolating and correcting errors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If complex software components with millions of commands are used for autonomous operation, then the system's functionality and intelligence are improved, but the risk of software defects and design errors increases
Solution Approach 1:
The system is divided into multiple independent subsystems (Normal Processing Subsystem, Monitor Subsystem, Critical Event Handling Subsystem) that operate independently. Each subsystem processes sensor data and generates control commands separately, preventing a single point of failure. The Monitor Subsystem specifically watches for errors in the Normal Processing Subsystem, creating a segmented architecture that isolates potential defects.
Solution Approach 2:
The Monitor Subsystem acts as an intermediary between the Normal Processing Subsystem and the Critical Event Handling Subsystem. It monitors the operation of the Normal Processing Subsystem and triggers the Critical Event Handling Subsystem when errors are detected, serving as a mediator that enables safe error handling without requiring direct interaction between the potentially faulty subsystem and the safety-critical subsystem.
2Reliability
If the system stops operation to ensure safety after errors, then catastrophic failures are prevented, but productivity and operational continuity are reduced
Solution Approach 1:
The system dynamically adjusts its operational state based on error detection. The Monitor Subsystem continuously monitors the Normal Processing Subsystem and can trigger different responses depending on the error type. For transient errors, the system can resume operation after correction, while for permanent errors, it transitions to safe state. This dynamic response optimizes both safety and productivity by avoiding unnecessary shutdowns.
Solution Approach 2:
The system is designed to discard transient errors through correction mechanisms and recover normal operation. The Monitor Subsystem detects errors and triggers the Critical Event Handling Subsystem to correct transient errors, allowing the Normal Processing Subsystem to resume operation. This discard-and-recover approach maintains productivity while ensuring safety by only permanently stopping for critical errors.
3Reliability
If multiple independent subsystems are implemented for error monitoring and correction, then system reliability is improved, but device complexity increases
Solution Approach 1:
The Monitor Subsystem performs multiple functions: it monitors the Normal Processing Subsystem for errors, validates sensor data, and triggers the Critical Event Handling Subsystem when needed. This multi-functional design reduces overall system complexity by consolidating monitoring and validation tasks into a single subsystem rather than requiring separate dedicated components for each function.
Solution Approach 2:
The Monitor Subsystem is designed to detect errors before they can cause catastrophic failures. By continuously monitoring the Normal Processing Subsystem and validating its operations in advance, the system can trigger corrective actions proactively. This preliminary error detection and validation reduces the complexity of emergency response mechanisms needed after failures occur.
Data Source
AI summary
The invention is part of the field of computer technology. It describes the architecture of a secure automation system and a method for safe autonomous operation of a technical apparatus, in particular a motor vehicle. The architecture disclosed herein solves the problem that any Byzantine error in one of the complex subsystems of a distributed real-time computer system, regardless of whether the error was triggered by a random hardware failure, a design error in the software or an intrusion, must be recognized and controlled in such a way that no security-relevant incident occurs. The architecture includes four largely independent subsystems which are arranged hierarchically and each form an isolated Fault-Containment Unit (FCU). At the top of the hierarchy is a secure subsystem, which executes simple software on fault-tolerant hardware. The other three subsystems are insecure because they contain complex software executed on non-fault-tolerant hardware.