Fault-Tolerant Control System Using Redundant Data Flow Paths
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current control systems for autonomous vehicles, particularly at Level 4 and Level 5 automation, face challenges in achieving the required fault-tolerant integrity levels (ASIL D) due to high probabilities of hardware and software design errors, with complex software systems being difficult to validate thoroughly to meet the stringent safety standards.
Innovation Solution
The method involves a redundant data flow architecture where multiple independent data flow paths process sensor data concurrently to determine safe and emergency trajectories, with simple software decision-making authority selecting trajectories from complex software versions running on fault-tolerant hardware, ensuring immediate detection of latent failures and masking hardware errors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If complex software is used for autonomous control, then the functionality and automation level are improved, but the probability of design errors and validation difficulty increase
Solution Approach 1:
The patent divides the complex control software into multiple independent data flow paths (DFPs), each responsible for specific control functions. This segmentation allows individual paths to be validated separately and reduces the overall complexity verification burden while maintaining high-level autonomous control capabilities.
Solution Approach 2:
Different data flow paths are assigned different complexity levels and validation requirements based on their specific functions. Critical safety-related paths undergo rigorous ASIL D validation, while less critical paths have appropriate validation levels, optimizing the balance between automation capability and validation effort.
2Reliability
If multiple redundant data flow paths are implemented, then the fault-tolerant reliability is improved, but the system complexity and computational load increase
Solution Approach 1:
The system implements redundancy by segmenting control functions into multiple independent data flow paths rather than duplicating the entire system. Each path processes specific sensor inputs and generates control outputs independently, providing fault tolerance while avoiding the complexity of full system duplication.
Solution Approach 2:
Multiple data flow paths share common infrastructure including sensor interfaces, communication protocols, and actuator control mechanisms. This multi-functionality approach allows the same hardware resources to serve multiple redundant logical paths, reducing overall system complexity while maintaining reliability.
3Reliability
If extensive validation and testing are performed, then the design error probability is reduced, but the development time and cost increase
Solution Approach 1:
Validation efforts are segmented and focused on critical data flow paths that have the greatest impact on safety. By identifying and prioritizing validation for specific paths rather than uniformly validating all paths, the system achieves required reliability levels with reduced overall validation time and resource requirements.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method for controlling a controlled object embedded in a changing environment, wherein the controlled object and its environment are periodically observed by sensors, and in each frame at least three independent data flow paths (DFPs) are executed based on the data acquired by observing the controlled object and its environment. A first DFP uses complex software to determine a model of the controlled object and its environment from the data acquired by observing the controlled object and its environment, and performs trajectory planning to generate one or more possible trajectories that correspond to a given task under the given environmental conditions. A second DFP uses complex software to determine the following from the data acquired by observing the controlled object and its environment:Preferably diverse, complex software creates a model of the controlled object and its environment and defines a safe space-time domain (SRZD) within which all safe trajectories must lie. A third DFP uses data acquired through observation of the controlled object and its environment to determine a model of the controlled object and its environment, and calculates an emergency trajectory based on this model. During normal operation, a decision instance verifies whether the emergency trajectory lies within the safe space-time domain (SRZD).