Longitudinal Control Safety Using Mixed-ASIL Acceleration Fallback
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing vehicle control systems with Automated Driving Systems (ADS) features face challenges in ensuring functional safety due to components that do not meet the required Automotive Safety Integrity Level (ASIL), necessitating the identification and mitigation of incorrect control decisions to ensure safe vehicle acceleration.
Innovation Solution
A control system with components of varying ASILs, including a first set with lower ASIL, detects acceleration deviations and switches to a second set with higher ASIL to determine a safe acceleration state, comprising maximum deceleration, reduced deceleration, and reduced acceleration, ensuring compliance with the required ASIL.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a control system uses components with lower ASIL to reduce system complexity and cost, then device complexity and manufacturing cost decrease, but functional safety and reliability deteriorate because the components cannot ensure the required ASIL level
Solution Approach 1:
The control system is segmented into multiple independent control components, each with different ASIL ratings. The system divides the control functionality among these components, allowing lower-ASIL components to handle less critical functions while higher-ASIL components ensure safety-critical operations. This segmentation enables the system to achieve required safety levels without requiring all components to meet the highest ASIL standard.
Solution Approach 2:
An intermediary control component is introduced that monitors and coordinates the outputs of lower-ASIL components. This intermediary acts as a mediator that ensures the overall system output meets the required ASIL level by validating and potentially overriding decisions from lower-ASIL components, thus maintaining functional safety while allowing cost-effective component selection.
2Ease of manufacture
If the system uses components with varying ASIL levels to improve ease of manufacture and reduce cost, then ease of manufacture improves, but the difficulty of detecting and measuring control decision correctness increases
Solution Approach 1:
The system implements feedback mechanisms where higher-ASIL components monitor the outputs of lower-ASIL components and provide corrective feedback when deviations are detected. This feedback loop enables automatic detection of incorrect control decisions without requiring complex external testing, as the system self-validates through its hierarchical architecture.
Solution Approach 2:
The control system performs preliminary validation of control decisions by having higher-ASIL components pre-approve or pre-validate the outputs of lower-ASIL components before they are executed. This preliminary action prevents incorrect decisions from reaching the vehicle control actuators, making it easier to ensure correctness without adding complex post-hoc detection mechanisms.
3Reliability
If the system implements mitigation strategies by introducing additional control components with higher ASIL, then functional safety improves, but device complexity increases
Solution Approach 1:
The higher-ASIL control components are designed with multi-functionality, serving both as primary controllers for their specific functions and as backup/monitoring components for lower-ASIL components. This universal design reduces the need for dedicated redundant components, thereby limiting the increase in system complexity while maintaining improved functional safety through the mitigation strategy.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present disclosure relates to performing an ADS feature. An acceleration of the vehicle is controlled based on automotive sensor data and a planned acceleration using a control system. The control system comprises a first set of control components (221) having a first ASIL and a second set of control components (211, 212, 223) having a second ASIL, the first ASIL being lower than the second ASIL. An acceleration deviation caused by the first set of control components is detected based on the automotive sensor data. Finally, if the acceleration deviation is detected, a safe acceleration state is determined using the second set of control components, wherein the safe acceleration state is selected from a set of safe acceleration states based on the automotive sensor data, the set comprising at least a maximum deceleration, a reduced deceleration and a reduced acceleration.