Independent safety monitoring of an automated driving system
AssigneeIntel Corporation
InventorsUmberto Santoni, Riccardo Mariani, John Weast
Life of this patent
Estimating the term…
Abstract
An automated driving system includes a security companion subsystem to access data generated at a compute subsystem of the automated driving system, which indicates a determination by the compute subsystem associated with an automated driving task. The security companion subsystem determines whether the determination is safe based on the data. The security companion subsystem is configured to realize a higher safety integrity level than the compute subsystem.
Claims20
An apparatus comprising:
- a security companion subsystem of an automated driving system of a vehicle, the security companion subsystem comprising:
- a first processor device;
- first memory;
- one or more interfaces to couple the security companion subsystem to a compute subsystem of the automated driving system;
- a safety monitor, executed by the first processor device, to:
- access data generated at the compute subsystem, wherein the data indicates a determination by the compute subsystem associated with an automated driving task to be performed by the automated driving system, wherein the determination is made by an automated driving application executed by a different, second processor device on the compute subsystem;
- and
- determine whether the determination is safe based on the data,
- wherein the security companion subsystem is configured to realize a higher safety integrity level than the compute subsystem.
At least one non-transitory, machine readable storage medium with instructions stored thereon, wherein the instructions are executable by a machine to cause the machine to:
- access event data at a safety companion subsystem of an automated driving system, wherein the event data is generated at a compute subsystem of the automated driving system, and the event data indicates a determination by the compute subsystem associated with an automated driving task;
- access, at the safety companion subsystem, first hardware monitoring data captured at the compute subsystem to indicate attributes of hardware of the compute subsystem;
- access second hardware monitoring data captured at the safety companion subsystem to indicate attributes of hardware of the safety companion subsystem, wherein the hardware of the safety companion subsystem is distinct from the hardware of the compute subsystem;
- determine, at the safety companion subsystem, malfunctions capable of affecting safety of automated driving tasks of the automated driving system based on one or more of the event data, first hardware monitoring data, or second hardware monitoring data;
- and
- trigger an action to control a malfunction determined by the safety companion subsystem.
A system comprising:
- a compute subsystem comprising:
- a first microcontroller;
- first memory;
- an automation engine executable by the first microcontroller to:
- receive sensor data;
- and
- determine an automated task to be performed by a machine based on the sensor data;
- and
- a safety companion subsystem comprising:
- a second microcontroller;
- second memory;
- a safety monitor executable by the second microcontroller to:
- access event data to identify attributes of the compute subsystem associated with determination of the automated task;
- determine a malfunction of the compute subsystem based on the event data;
- and
- cause an action to be performed to control safety of the machine based on the determined malfunction,
- wherein the security companion subsystem implements a higher safety integrity level than the compute subsystem.
Dependencies are inferred from the claim text.