Fail-Safe EE Architecture for Automated Driving

#This application claims priority under 35 U.S.C. §119 to application no. DE 10 2014 220 781.9, filed on Oct. 14, 2014 in Germany, the disclosure of which is incorporated herein by reference in its entirety.

#The disclosure concerns a system with two computer units and a method for performing a driving function.

#In the prior art it is known to implement safety-relevant systems such that they change into a safe state in the event of a fault. The safe state is not functional as a rule and is characterized for example by a system that is not energized or that is de-energized. Furthermore, systems are known in which redundancy is maintained in relation to the computing power in case of a failure.

#Exemplary embodiments of the disclosure are presented in the drawings an are explained in more detail in the description below.

#In the drawings:

#FIG. 1 shows a schematic representation of a first embodiment of the system.

#FIG. 1 shows a basic idea of the proposed system. A first computer unit 1 is connected to at least one sensor 3. In addition, the first computer unit 1 is connected to at least one actuator 4. The actuator 4 can be in the form of a single actuator or in the form of a plurality of actuators or in the form of an actuator system. Furthermore, a second computer unit 2 is provided, which is also connected to the at least one sensor 3 and the at least one actuator 4. The sensor can be in the form of one sensor or in the form of a plurality of sensors or in the form of a sensor system. In addition, the first and/or second computer units comprise a data memory 15, 16. Furthermore, the second computer unit 2 is connected by means of an interface 5 to the first computer unit 1. The first computer unit 1 detects the signals of the sensor 3 and according to at least one control method stored in the first data memory 15 determines therefrom a control signal with which the first computer unit 1 activates the actuator 4. In a first operating state, in which the first computer unit 1 is considered to be correctly operational, only the first computer unit 1 can activate the actuator 4. The second computer unit 2 is indeed both connected to the sensor 3 and also to the actuator 4, but cannot activate the actuator 4 in the first operating state. In this case the computer units 1 and 2 are advantageously structurally separate controllers with their own mechanical boundaries having suitable sealing properties.

#The first computer unit 1 fulfills for example the following conditions: it comprises a good fault detection means for its own faults. As a result it should be guaranteed that if the first computer unit 1 sends a control signal to the actuator 4 the control signal is also reliable and safe. If the first computer unit cannot supply a safe control signal, then it should not supply a control signal. A classic implementation of said fail-silence function means that the first computer unit does not output a control signal to the actuator 4 in the event of a malfunction. Depending on the selected embodiment, the fail-silence function can also be implemented by a suitable separate fault signal that is transmitted to the actuator 4. With said embodiment, when a fault signal of the first computer unit is input the actuator 4 detects that the control signals of the first computer unit may no longer be carried out. In addition, the first computer unit should have a high availability, i.e. faults and function failures should only occur very seldom.

#If a malfunction occurs, i.e. a fault or a functional failure of the first computer unit 1, then the second computer unit 2 takes over the function of the first computer unit 1. For this the second computer unit 2 should fulfill the following requirements for example: the second computer unit 2 should be formed independently of the first computer unit 1, i.e. as a physically unique component. In addition, it would be advantageous if the second computer unit 2 is installed in a dedicated housing and preferably structurally separately and for example at a different location. Furthermore, the second computer unit 2 should be designed to be able to rapidly and seamlessly take over the function of the first computer unit 1 in the event of a fault of the first computer unit 1.