Safety ECU Hardware Interlock for Autonomous Vehicle Fault Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Autonomous or semi-autonomous vehicles face challenges in reliably detecting and isolating faults in motion control actuator ECUs during prototype testing, as these ECUs may not be functionally and regulatorily certified, leading to uncertainty in software-based fault detection and response.
Innovation Solution
A safety assurance ECU is interconnected with the CAN bus to monitor vehicle driving behavior and perform hardware-based actions, such as disabling communication from motion control actuator ECUs, using logic signals to trip hardware contacts and prevent faulty commands from being sent, thereby ensuring vehicle safety and flexibility during testing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If software-based fault detection methods are used in motion control actuator ECUs, then the system can operate during prototype testing, but the reliability of fault detection is insufficient due to lack of functional certification
Solution Approach 1:
The system separates fault detection into two independent layers: software-based monitoring for adaptability during prototyping, and hardware-based monitoring for reliability and safety certification. Each layer operates independently with its own ECUs and communication paths, allowing the vehicle to meet functional safety requirements while maintaining prototyping flexibility.
Solution Approach 2:
A dedicated hardware monitoring ECU is introduced as an intermediary component that independently verifies control signals from motion control actuator ECUs before they reach the vehicle bus. This hardware intermediary provides certified reliability without replacing the software-based control system, enabling both prototyping flexibility and safety certification.
2Loss of time
If hardware-based fault isolation actions are implemented, then response time to faults is reduced, but the system complexity increases
Solution Approach 1:
The hardware monitoring ECU continuously monitors control signals in real-time and maintains pre-configured isolation capabilities ready to activate immediately upon detecting faults. This preliminary preparation enables instantaneous fault response without requiring complex real-time decision algorithms, reducing response time while keeping the system relatively simple.
Solution Approach 2:
The hardware monitoring ECU autonomously detects faults and executes isolation actions without requiring external intervention or complex coordination with other system components. This self-service capability reduces response time and simplifies the overall system architecture by eliminating the need for complex fault management software or multiple ECUs working in concert.
Data Source
AI summary
A method includes determining vehicle driving parameters associated with a driving behavior of a vehicle while in an autonomous driving mode. A plurality of electronic control units (ECUs) is interconnected to a vehicle bus for communicating instructions from electromechanical contacts to actuators to control the driving behavior. The computing unit may receive a control signal from one of the ECUs. The computing unit lacks knowledge of whether the control signal a valid. The method further includes analyzing vehicle driving parameters associated with the driving behavior to determine whether the vehicle driving parameters satisfy a driving behavior criteria. Subsequent to determining that the vehicle driving parameters fails to satisfy the driving behavior criteria, the method includes generating a signal that causes the electromechanical contacts to disconnect from the vehicle bus and disable communication of instructions between the ECUs and the vehicle bus.