Simplex Controller Switching for Provable Autonomous Driving Safety
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing control systems for autonomous driving lack a design method that logically proves safety, particularly in simplex architectures incorporating autonomous driving safety rules.
Innovation Solution
A control system is designed using a simplex architecture with an advanced controller and a baseline controller, where a decision module switches between them based on predefined safety rules, and safety is logically proven through Hoare logic and differential Floyd-Hoare Logic (dFHL) to ensure safety conditions are met.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a simplex architecture is used for autonomous driving control, then the system structure is simplified and ease of operation is improved, but the ability to logically prove safety is insufficient
Solution Approach 1:
The control system is segmented into two distinct controllers: an advanced controller that implements complex control algorithms for high performance, and a baseline controller that ensures basic safety requirements. This segmentation allows each controller to be independently verified and proves safety through the baseline controller's simpler, verifiable logic while maintaining operational simplicity at the system level.
2Reliability
If switching between controllers is implemented, then safety can be maintained through fallback mechanisms, but device complexity increases
Solution Approach 1:
A switching mechanism acts as an intermediary between the advanced and baseline controllers. This mediator monitors system state and automatically switches between controllers based on predefined safety conditions, providing a systematic way to maintain safety guarantees without requiring complex manual intervention or overly complicated controller integration.
3Productivity
If advanced control algorithms are used, then productivity and performance are improved, but the difficulty of detecting and measuring safety conditions increases
Solution Approach 1:
Different parts of the control system have different quality requirements: the advanced controller focuses on performance optimization with complex algorithms, while the baseline controller focuses on safety verification with simpler, more verifiable logic. This local differentiation allows high productivity from the advanced controller while maintaining easier safety detection through the baseline controller's straightforward safety checks.
Data Source
AI summary
A control system includes a processor; and a memory storing program instructions that cause the processor to control an operation of an object and output state information indicating a state of the controlled object; perform first control that operates the controlled object according to a first safety rule; perform second control that operates the controlled object according to a second safety rule; and perform the first control in response to determining that the state information satisfies a first switching condition defined based on the first safety rule and the second safety rule, and perform the second control in response to determining that the state information does not satisfy the first switching condition.