Dual Controller Fallback for Vehicle Actuator Deviation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Complex controllers used in piloted driving systems for motor vehicles are difficult to fully test, posing challenges in ensuring safety and reliability due to the possibility of software errors, which can lead to unaccounted deviations in actuator output variables.
Innovation Solution
A dual-controller system is implemented, where a simpler second controller is activated when deviations occur, ensuring quick reaction to errors and providing a fallback to prevent software errors in the complex first controller, with the second controller having fewer input variables and designed for emergency operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a complex controller is used for piloted driving, then comfort and safety aspects are improved, but the controller becomes difficult or impossible to fully test
Solution Approach 1:
The control system is segmented into multiple independent controllers (first controller, second controller, third controller) with different levels of complexity. The complex first controller handles normal operations while simpler second and third controllers serve as testable backups, resolving the contradiction by dividing the monolithic complex controller into separable functional units.
Solution Approach 2:
The system changes the complexity parameter of controllers dynamically by switching between different controllers based on operational needs. The first controller operates with high complexity for comfort, while the second and third controllers use reduced complexity parameters to enable full testing and validation.
2Ease of operation
If a complex controller with many input variables is used, then comfort aspects are improved, but testing becomes impossible
Solution Approach 1:
The controller functionality is segmented into multiple units with different numbers of input variables. The first controller accepts many input variables for comfort, while the second and third controllers accept fewer input variables specifically selected to enable complete and systematic testing of all possible input combinations.
Solution Approach 2:
The second and third controllers implement partial functionality with fewer input variables than the first controller. This partial action is sufficient for testing purposes and for handling critical safety situations, while accepting that full comfort functionality is only available in the first controller.
3Reliability
If software errors in the controller occur, then safety is compromised, but adding monitoring increases system complexity
Solution Approach 1:
The system implements beforehand cushioning by pre-configuring backup controllers (second and third controllers) that are ready to immediately take over if software errors are detected in the first controller. This proactive approach cushions against safety compromises without requiring complex real-time error correction mechanisms.
Solution Approach 2:
The system creates simplified copies (second and third controllers) of the first controller's functionality. These copies serve as redundant backup systems that can detect and respond to software errors in the primary controller, providing safety through replication rather than through complex monitoring and correction logic.
Data Source
Figure 1
AI summary
The invention relates to a device (1) for the piloted driving of a motor vehicle, comprising at least one master control unit (2), a first controller (5), a second controller (6), at least one actuator, a unit for detecting at least one actual actuator output variable of the actuator and a monitoring unit (7), wherein the master control unit (2) is designed in such a manner that it determines and transmits to the first controller (5) and to the monitoring unit (7) a target actuator output variable, wherein the first controller (5) is designed in such a manner that it determines a control signal for the actuator on the basis of the target actuator output variable and at least one further variable, wherein the monitoring unit (7) and/or the master control unit (2) are designed in such a manner that, in the event of a predetermined deviation of the actual actuator output variable from the target actuator output variable, the first controller (5) is deactivated and the second controller (6) is activated, wherein the second controller has at least one input variable fewer than the first controller. The invention further relates to an associated method.