Safety-Critical Computer System With Envelope Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Safety-critical computer systems, such as those in autonomous vehicles, face challenges in recognizing and mitigating dangerous faults, particularly due to the high complexity and untestable nature of optimization algorithms, which can lead to unsafe outcomes.
Innovation Solution
A distributed computer system where sensor data is processed in parallel by node computers using optimization algorithms, with a self-checking fault containment unit (SCFCU) verifying whether the optimized results fall within a safely calculated envelope, ensuring that only safe results are relayed to the actuator controller, and switching to a simple result if the optimized result is outside the envelope.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Manufacturing precision
If optimization algorithms are used to calculate the best possible solution, then the quality of the result is improved, but the complexity and untestability of the algorithm increases, making formal verification impossible
Solution Approach 1:
The system segments the computational task into two distinct parts: an optimization algorithm that calculates the best possible solution, and a separate envelope calculation that defines safety boundaries. This segmentation allows each component to be independently verified and validated, with the envelope serving as a formal verification mechanism for the optimization results.
Solution Approach 2:
The envelope calculation acts as an intermediary between the optimization algorithm and the final control decision. Instead of directly trusting the optimization algorithm's output, the system introduces an envelope verification layer that checks whether the optimized result falls within pre-calculated safe operating boundaries, thus enabling formal verification of complex optimization results.
2Reliability
If redundant identical components are arranged in parallel to detect hardware faults, then fault detection capability is improved, but the technical level of effort more than doubles
Solution Approach 1:
Instead of duplicating the entire complex optimization system, the patent applies redundancy only to the envelope calculation component. The envelope calculator computes safe operating boundaries using simplified, formally verifiable methods, while the main optimization algorithm remains single-instance but benefits from the verified safety envelope. This localized application of redundancy reduces the overall complexity increase.
Solution Approach 2:
The system changes the parameters of the redundant component from full optimization algorithm duplication to simplified envelope boundary calculation. By transforming the redundancy requirement into a parameter-based safety verification approach rather than full system duplication, the technical effort increase is significantly reduced while maintaining fault detection capability.
3Reliability
If the SCFCU checks every optimized result against a formally verified simple result, then safety is improved, but the computational time and processing delay increases
Solution Approach 1:
Instead of performing complete formal verification of every optimized result, the system applies partial verification by checking only whether the result falls within the pre-calculated envelope boundaries. This partial checking approach provides sufficient safety assurance without the full computational overhead of complete formal verification, thus reducing processing delay.
Solution Approach 2:
The envelope boundaries are calculated and verified in advance before the optimization algorithm runs. This preliminary action allows the runtime check to be a simple boundary comparison rather than a complex verification process, significantly reducing the computational time required for each safety check while maintaining safety assurance.
Data Source
AI summary
The invention relates to a computer system for carrying out safety-critical applications, said computer system comprising a plurality of node computers and a communications system. Sensor data are supplied in parallel to one or more node computers, the node computers calculating an optimized result, preferably using an optimization algorithm, in order to solve a given problem, and transmitting said optimized result, preferably for checking the safety, to a node computer which is designed as an SCFCU, said SCFCU being directly connected to the actuator controller, and the SCFCU furthermore calculating from the sensor data a simple result, which preferably meets all safety requirements, and an envelope of the simple result, and the SCFCU checking whether the resulting values, particularly those relevant to safety, of the optimized result lie within the envelope of the simple result, and, if this is the case, directly forwarding the optimized result to the actuator controller, and, if this is not the case, forwarding the simple result calculated by the SCFCU directly to the actuator control.