Autonomous Vehicle FOTA Failover Using Redundant Network Paths
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firmware updates in autonomous driving vehicles (ADV) often fail due to software incompatibility, hardware failure, or communication issues, posing reliability and safety risks.
Innovation Solution
Implementing a dual boot mechanism and function dependency matrix analysis to mitigate firmware over-the-air (FOTA) failures by using redundant network paths and backup firmware versions, ensuring reliable firmware updates through a computer network with separate power domains and dual redundant communication pathways.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If firmware updates are performed over-the-air in autonomous driving vehicles, then the ability to update components remotely is improved, but the risk of update failure increases
Solution Approach 1:
The system performs preliminary validation of firmware packages before installation, checking compatibility with the target component and vehicle system. This preliminary action prevents incompatible firmware from being installed, thereby maintaining high update success rates while enabling remote updates.
Solution Approach 2:
The system maintains backup firmware versions and implements rollback mechanisms that allow recovery if an update fails. This cushioning approach ensures that even if remote updates encounter issues, the system can revert to previous working states, preserving reliability.
2Reliability
If multiple network paths are implemented for firmware transmission, then the robustness against communication failures is improved, but the system complexity increases
Solution Approach 1:
The network communication path is segmented into multiple independent routes, allowing firmware to be transmitted through different network interfaces (e.g., cellular, Wi-Fi, wired Ethernet). This segmentation provides redundancy without requiring a completely complex rearchitecture of the entire system.
Solution Approach 2:
A gateway device or intermediate server is introduced that manages multiple network paths and routes firmware transmissions appropriately. This intermediary handles the complexity of path selection and failover, keeping the core vehicle system relatively simple while maintaining high communication reliability.
3Reliability
If firmware compatibility validation is performed before installation, then the rate of incompatible updates is reduced, but the update time increases
Solution Approach 1:
Firmware compatibility validation is performed as a preliminary step before actual installation. The system checks firmware metadata, version compatibility, and component matching in advance, so that incompatible firmware is identified before it reaches the installation stage, reducing wasted installation time.
Solution Approach 2:
The compatibility validation process is merged with the firmware reception and preparation phase. Rather than being a separate time-consuming step, validation checks are performed concurrently with firmware download and initial processing, minimizing the perceived update time while ensuring compatibility.
Data Source
AI summary
An autonomous driving vehicle (ADV) includes a computer network that includes at least one wireless gateway. The ADV also includes a plurality of network components coupled to the computer network, the plurality of network components including a target device. The ADV also includes a processor, configured to receive, through the at least one wireless gateway, a firmware to be installed on the target device, and to direct the firmware to the target device through a first network path of the computer network. In response to detecting a failure to update the target device with the firmware, the processor directs the firmware to the target device through a second network path of the computer network.