Three-Layer Control Architecture for Certified Autonomous Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Autonomous systems, particularly those in regulated environments like aviation and space exploration, face challenges in balancing autonomy with determinism to meet certification standards, as non-deterministic systems lack certification from entities like FAA and NASA.
Innovation Solution
A control system architecture with three processor layers: a mission processor generating commands, a compliance processor validating against regulations, and a safety processor ensuring human-rated standards, where commands must comply with both to be executed, ensuring deterministic and safe operation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If autonomy is increased to reduce human interaction and labor, then productivity and ease of operation are improved, but determinism deteriorates making certification difficult
Solution Approach 1:
The control system is divided into multiple independent processors: a mission processor that executes non-deterministic autonomous algorithms, a compliance processor that validates commands against regulations, and a safety processor that ensures human-rated standards. This segmentation allows each component to specialize in one aspect, enabling autonomy while maintaining determinism through dedicated validation layers.
Solution Approach 2:
The compliance processor and safety processor act as intermediary layers between the autonomous mission processor and the actuators. These intermediaries translate non-deterministic mission commands into deterministic, regulation-compliant commands, allowing the system to maintain both autonomy and certifiable determinism.
2Reliability
If deterministic control is retained to ensure safety and compliance, then reliability is improved, but autonomy is reduced requiring more human operators
Solution Approach 1:
The system dynamically adjusts the level of autonomy based on compliance validation. The mission processor can operate autonomously when commands comply with regulations, but human oversight is engaged when compliance issues arise. This dynamic approach allows the system to maximize autonomy within safety boundaries.
Solution Approach 2:
The compliance processor performs preliminary validation of mission commands before they are executed by actuators. By checking commands against regulations in advance, the system ensures determinism and safety without requiring continuous human intervention, thus maintaining high autonomy while meeting compliance requirements.
3Reliability
If multiple processor layers are added for compliance and safety validation, then reliability and certification capability are improved, but device complexity increases
Solution Approach 1:
Each processor layer is designed with multi-functionality to reduce overall complexity. The compliance processor handles both regulatory validation and generates compliance reports, while the safety processor manages both safety validation and emergency override functions. This consolidation of multiple functions into unified components reduces the number of separate elements needed.
Solution Approach 2:
The compliance and safety validation layers are nested within the control architecture, with the safety processor encompassing the compliance processor which in turn validates mission processor commands. This nested structure allows hierarchical validation where each layer builds upon the previous one, reducing redundancy and simplifying the overall architecture compared to parallel independent systems.
Data Source
Figure 1~2
Figure 3~4
AI summary
Systems and methods are provided for controlling one or more actuators to perform a mission while complying with predetermined regulations. A system for controlling one or more actuators includes a first processor (12) for transmitting a command to operate at least one of the actuators, a second processor (14) having an input coupled to the first processor, and a third processor (16) having an input coupled to the output of the second processor and an output configured to couple to the actuators. The second processor (14) is configured to transmit a first signal based on the command, and the first signal indicates a compliant command. The third processor (16) is configured to transmit a second signal based on the first signal, and the second signal indicates a safe command. Software partitions executing on a single processor may be substituted for the hardware processors.