Vehicle Controller Architecture With Independent Safety Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current drive-by-wire systems for vehicles require rigorous software testing to ensure proper execution, but existing controller designs lack efficient methods for validating and simplifying the software, particularly in ensuring safety and error detection.
Innovation Solution
A controller with separate main and safety processing modules, where the safety processing module uses a lockstep system with multiple processors for parallel operations, compares actual and expected command output values, and activates a safety shutdown switch if deviations exceed a defined tolerance, thereby disabling actuators to maintain a safe state.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single integrated processing module is used, then device complexity is reduced, but reliability and error detection capability deteriorate
Solution Approach 1:
The controller is divided into two independent processing modules: a main processing module for normal control operations and a safety processing module for monitoring and validation. This segmentation allows each module to specialize in its function, improving reliability while keeping individual module complexity manageable.
Solution Approach 2:
The safety processing module acts as an intermediary between the main processing module and the actuator. It receives commands from the main module, validates them against safety criteria, and only permits execution if they meet safety requirements. This intermediary layer provides error detection without requiring complete redesign of the control architecture.
2Reliability
If rigorous software testing is performed, then reliability is improved, but loss of time and productivity deteriorate
Solution Approach 1:
The safety processing module is designed with pre-programmed safety criteria and validation rules that are established during development. This preliminary configuration allows the system to perform continuous validation during operation without requiring extensive ad-hoc testing, as the safety checks are already embedded in the module's logic.
Solution Approach 2:
The safety processing module autonomously monitors its own operations and those of the main processing module, performing self-validation without external intervention. This self-service capability reduces the need for external testing and validation activities, saving time while maintaining reliability.
3Reliability
If separate safety processing module is added, then reliability and error detection are improved, but device complexity increases
Solution Approach 1:
The safety processing module is integrated into the same controller housing and shares common resources such as power supply, communication interfaces, and actuator connections with the main processing module. This merging approach allows the safety function to be added without proportionally increasing overall device complexity, as many components are shared between the two modules.
Data Source
Figure 1
Figure 2
AI summary
A driving system for a vehicle includes one or more sensors, a controller, an actuator, and a safety shut down switch. The controller includes a main processing circuit, a main processing module, an actuator drive, a safety processing circuit, a safety processing module, and a safety shutdown switch. The safety processing module is independent of the main processing module, and the safety processing module is configured to perform one or more safety functions.