Controller

A controller comprising:

• a control backup data extraction unit that extracts a state value and a control plan value calculated by a first control program, the control plan value indicating a travel path of a vehicle for a predetermined duration;
• a control backup data storage unit that stores, in a time series backup, the state value, the control plan value, and an input value, wherein the time series backup is accessible by a second control program as a backup;
• a control program fast start unit that initializes the second control program by inputting the state value and the input value to the second control program in an order of the time series backup responsive to detecting a failure of the first control program;
• a proxy output unit that, responsive to detecting the failure, retrieves the control plan value from the time series backup and outputs the control plan value in the order of the time series backup until the second control program has been initialized, such that the vehicle is navigated along the travel path according to the control plan value in the time series backup until the second control program has been initialized, wherein control values generated by the second control program are used to navigate the vehicle after the second control program has been initialized;
• and
• a reconfiguration verification unit that executes a fail safe program in parallel with the second control program, the fail safe program receiving the control plan value in the time series backup and an input value calculated by the first control program and generating a signal for gradually decelerating the vehicle based on the control plan value and the input value, wherein the reconfiguration verification uses the signal generated by the fail safe program in response to failure of the second control program.