Redundant MPC Cross-Channel Analysis for Feasible Vehicle Trajectories
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing autonomous driving systems lack comprehensive safety diagnosis and testing capabilities, particularly in handling physically impossible motion plans due to unfavorable road conditions, low braking capacity, or high vehicle mass, which constrains their ability to meet safety performance requirements.
Innovation Solution
Implementing a cross-channel safety analysis system using redundant Model Predictive Controllers (MPCs) to perform cross-channel safety analysis by comparing predicted trajectory data from multiple vehicle control subsystems, detecting hazardous motion plans, and generating safety reactions to prevent unsafe vehicle actuation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional redundant channel architectures are used to provide fail-operational behavior, then system reliability is improved through failover capability, but the ability to perform feasibility analysis of motion planning and vehicle control subsystems deteriorates
Solution Approach 1:
The patent makes the redundant channel serve dual functions: it maintains its traditional failover capability while simultaneously enabling feasibility analysis of the nominal channel's motion plans. The redundant vehicle controller processes both safety-critical failover operations and diagnostic feasibility assessments, eliminating the need for separate analysis infrastructure.
Solution Approach 2:
The redundant channel performs self-diagnosis and feasibility analysis by independently evaluating the nominal channel's motion plans against vehicle dynamics models and constraints. This self-service approach allows the system to monitor its own safety and operational feasibility without external intervention.
2Reliability
If heterogeneous redundant channels are implemented with multiple ECUs for cross-validation, then system safety is improved through redundancy, but device complexity increases
Solution Approach 1:
The patent merges the functions of multiple ECUs into a more integrated architecture where the redundant vehicle controller handles both failover operations and feasibility analysis. This consolidation reduces the number of discrete control units while maintaining cross-validation capabilities through the interaction between the nominal and redundant controllers.
3Productivity
If healthy fault-free channels are used to generate motion plans, then system operation is maintained, but the risk of generating physically impossible motion plans increases due to unfavorable road conditions, low braking capacity, or high vehicle mass
Solution Approach 1:
The redundant vehicle controller performs preliminary feasibility analysis on motion plans generated by the nominal channel before they are executed. By evaluating whether the motion plans are physically realizable given current vehicle conditions (braking capacity, mass, road conditions), the system prevents impossible commands from reaching the actuators, thereby avoiding unsafe operations.
Solution Approach 2:
The system implements a feedback loop where the redundant controller continuously monitors the feasibility of nominal channel outputs and provides safety reactions when physically impossible motion plans are detected. This feedback mechanism ensures that unsafe commands are identified and corrected before affecting vehicle operation.
Data Source
Figure 1
Figure 2
Figure 3~5
AI summary
A motion plan safety analysis is performed by processing vehicle sensor signals to generate a motion plan which includes a reference trajectory value, by processing the reference trajectory value at a first MPC to generate a first current setpoint and a first plurality of future setpoints, by processing the first plurality of future setpoints at a second MPC to generate a second plurality of future setpoints, by processing the second plurality of future setpoints at the first MPC to generate a first plurality of predicted trajectory states, by processing the first plurality of future setpoints at the second MPC to generate a second plurality of predicted trajectory states, by evaluating the predicted trajectory states to generate a predetermined safety reaction for the vehicle, and by choosing between the first and second current setpoints based on the safety reaction to provide a safest setpoint to a vehicle actuator in the vehicle.