Fault-Tolerant Controller Designation for Vehicle Actuation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Fail-operational vehicle systems with dual duplex controllers are unable to maintain functionality when both controllers fail due to common software defects, leading to a loss of operational control.
Innovation Solution
Implementing a fault-tolerant controller strategy where one controller identifies and resets the other to a safe operating mode, allowing continued system functionality and minimizing risks from both hardware and software failures, by designating a primary and secondary controller and enabling seamless transition between them.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Duration of action of stationary object
If a controller fails and the secondary controller activates, then system continuity is improved, but both controllers may become silent due to common software defects
Solution Approach 1:
The system changes operational parameters by switching from full-function mode to safe mode when a failure is detected. The secondary controller operates in safe mode with minimal operating system support and deterministic behavior, changing the operational parameters to reduce complexity and eliminate the risk of both controllers becoming silent due to common software defects.
Solution Approach 2:
The system prepares cushioning measures in advance by having a secondary controller ready in safe mode with deterministic behavior. This prior preparation ensures that when a failure occurs, the system can transition to a pre-configured safe state that is isolated from elements of normal mode operation, preventing total system failure.
2Productivity
If normal mode operation favors performance over deterministic behavior, then system performance is improved, but deterministic behavior is lost during failures
Solution Approach 1:
The system dynamically adjusts its operational characteristics based on failure state. During normal operation, the primary controller provides high-performance operations. Upon failure detection, the system transitions to safe mode with deterministic behavior, creating a dynamic adaptation that maintains performance when possible and ensures stability when needed.
Data Source
AI summary
A fault tolerant controller system includes a first controller and a second controller. One of the first and second controllers designated as a primary controller for generating control signals intended to control actuation devices on a vehicle under non-fault operating conditions, and the other of the first and second controllers designated as a secondary controller generating control signals intended to control actuation devices on the vehicle. The actuation devices are responsive only to the designated primary controller. An error is detected in the primary controller and a message is transmitted from the faulty controller to the non-faulty controller identifying the error. The non-faulty controller is subsequently designated as the primary controller. The control signals including an identifier that identifies the non-faulty controller as the designated primary controller. In response to detecting the error, the faulty controller is reset to operate in a safe operating mode as the secondary controller.