Telematics Controller Isolation for Certified and Agile Functions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge in motor vehicle telematic control units is to separate safety-related and certification-related components from agile components to allow for modifications and updates without affecting the certification of critical functions, which is currently hindered by high complexity and costs associated with existing separation methods.
Innovation Solution
A controller with a main control unit and secondary control units, equipped with a switching device that can deactivate secondary control units upon predefined events, ensuring that only the main control unit executes critical functions, thereby preventing interference from agile components and allowing for independent modification of agile components without recertification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If critical components and agile components are separated into different control devices, then the risk of recertification is reduced, but the device complexity and costs increase
Solution Approach 1:
The control device is segmented into a main control unit for critical functions and secondary control units for agile functions, all within a single device. This internal segmentation allows functional separation without physical device separation, maintaining certification stability while avoiding increased system complexity
Solution Approach 2:
A switching device acts as an intermediary between the main control unit and secondary control units. This mediator enables dynamic deactivation of secondary units when critical functions need to execute, preventing interference while maintaining system integration and avoiding the need for multiple separate control devices
2Adaptability or versatility
If agile components are modified or updated at a later stage, then system adaptability is improved, but the certification of critical components must be repeated
Solution Approach 1:
Agile components are extracted into separate secondary control units that can be independently modified. The switching device enables these secondary units to be deactivated when critical functions require guaranteed performance, allowing agile component updates without affecting critical component certification
Solution Approach 2:
The system dynamically switches between different operational modes: normally, secondary control units operate alongside the main control unit; when critical functions are executed, the switching device deactivates secondary units to eliminate potential interference. This dynamic behavior enables both adaptability and certification stability
3Ease of manufacture
If virtualization solutions are used to separate critical and agile components, then hardware costs are reduced, but the risk of recertification cannot be reliably reduced
Solution Approach 1:
The switching device serves as a physical intermediary that provides deterministic isolation between critical and agile components. Unlike virtualization which provides software-based isolation, this hardware-level switching mechanism reliably prevents interference from agile components during critical function execution, enabling recertification risk reduction while maintaining cost efficiency
4Adaptability or versatility
If external application processors are used for critical components, then functional separation is achieved, but software modifications may still disturb critical functions
Solution Approach 1:
The switching device acts as a protective intermediary between the main control unit and secondary control units. When critical functions are executed, the switching device deactivates secondary units, providing deterministic isolation that prevents software modifications in secondary units from disturbing critical functions, even though all units remain in the same control device
Data Source
AI summary
A controller for a vehicle includes a main control unit, at least one first secondary control unit, and a switching device. The main control unit is configured to execute processes of critical or safety-related applications. The at least one first secondary control unit is configured execute agile applications. The switching device is configured to deactivate the at least one secondary control unit. The main control unit is also configured, in the event of the occurrence of a predefined safety-related event, to deactivate the at least one secondary control unit by means of the switching device.