Redundant Control Units for Self-Driving Vehicle Safety
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Self-driving vehicles face safety and resource management challenges due to software and hardware errors, requiring complex redundancy strategies to ensure passenger safety and efficient energy use, while balancing computing and memory resources across multiple nodes.
Innovation Solution
A method for operating self-driving vehicles with redundant program codes executed on multiple control units, prioritizing functions by significance and adjusting resource allocation to ensure maximum redundancy and energy efficiency, with a fail-safe system to manage hazardous situations and optimize target achievement levels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If redundant software applications are executed on multiple computing nodes to ensure safety, then reliability is improved, but device complexity increases
Solution Approach 1:
The patent divides the vehicle's control system into multiple independent computing nodes (first computing node, second computing node, third computing node), each capable of executing safety-relevant software applications independently. This segmentation allows redundancy without creating a single point of failure, resolving the contradiction by distributing complexity across separate units while maintaining overall system reliability.
Solution Approach 2:
The patent dynamically changes the operational parameters of computing nodes by selectively activating or deactivating them based on real-time system state. When a malfunction is detected, the system changes the operational mode from single-node execution to multi-node redundant execution, adjusting the degree of redundancy dynamically rather than maintaining fixed high redundancy at all times, thus managing complexity while ensuring safety.
2Use of energy by moving object
If computing nodes are deactivated to reduce power consumption, then energy efficiency is improved, but reliability deteriorates
Solution Approach 1:
The patent implements dynamic control of computing node activation based on real-time assessment of system state and safety requirements. Computing nodes are activated or deactivated dynamically rather than statically, allowing the system to optimize power consumption while maintaining adequate redundancy when safety-critical functions are running. This dynamic approach resolves the contradiction by adapting the system's operational state to current needs.
Solution Approach 2:
The system continuously monitors the operational state of computing nodes and software applications, using this feedback to make informed decisions about node activation. When a malfunction is detected or safety requirements change, the feedback mechanism triggers appropriate responses (activating redundant nodes or deactivating non-critical nodes), ensuring that power consumption is optimized without compromising safety-relevant functions.
3Reliability
If all software applications are executed on all computing nodes for maximum redundancy, then reliability is improved, but use of energy increases
Solution Approach 1:
The patent applies different levels of redundancy to different software applications based on their safety-criticality. Safety-relevant applications are executed on multiple computing nodes with high redundancy, while non-safety-critical applications may run on fewer nodes or be selectively deactivated. This local differentiation of quality (redundancy level) allows the system to maintain adequate safety redundancy while reducing overall energy consumption compared to uniform maximum redundancy across all applications.
Data Source
AI summary
A self-driving motor vehicle including numerous control units and numerous program codes for controlling the functions of the autonomous driving and other functions of the self-driving vehicle. Numerous program codes used for an autonomous driving mode are applied redundantly to at least two different control units. The self-driving motor vehicle may then be operated in an at least a partially autonomous driving mode. In this mode, the functions directly needed for satisfying a passenger's desire are determined, and weighted with regard to their importance in fulfilling the passenger's desires. At least one function of a lower order is then shut off, if the available resources in functioning control units and/or the power level in the self-driving motor vehicle are insufficient to execute program code for executing this function of the lower order.