Methods and systems for compensating for common failures in fail operational systems

A method comprising:

• providing instructions, by a primary controller, to perform functions associated with control of operation of a vehicle including vehicle propulsion, braking and steering;
• providing a secondary controller configured in a redundant configuration as the primary controller, wherein the primary controller and the secondary controller are configured to operate based on execution of a first set of logic and perform cross-checks of each other and to reset based on a detected fault at one of the primary controller and the secondary controller;
• transferring control of operation of the vehicle between the primary controller and the secondary controller based on the detected fault at one of the primary controller and the secondary controller;
• outputting a common fault signal based on detection of a common fault of the primary controller and the secondary controller;
• based on the common fault signal, transferring control of operation of the vehicle by the primary controller to a safety controller that is configured to operate based on execution of a second set of logic independent of operation of the primary controller and the secondary controller;
• and performing functions associated with control of operation of the vehicle at the safety controller including vehicle braking.

A non-transitory computer readable medium having stored therein instructions, that when executed by a computing device, cause the computing device to perform functions comprising:

• receiving outputs of a primary controller and a secondary controller, wherein the primary controller is configured to perform functions associated with control of operation of a vehicle including vehicle propulsion, braking and steering, and the secondary controller is configured in a redundant configuration as the primary controller, wherein the primary controller and the secondary controller are configured to operate based on execution of a first set of logic and perform cross-checks of each other;
• providing instructions to transfer control of operation of the vehicle between the primary controller and the secondary controller based on receiving a given output indicative of a detected fault at one of the primary controller and the secondary controller;
• providing instructions to transfer control of operation of the vehicle from the primary controller to a safety controller based on detection of a common fault of the primary controller and the secondary controller, wherein the safety controller is configured to operate based on execution of a second set of logic independent of operation of the primary controller and the secondary controller;
• and performing functions associated with control of operation of the vehicle at the safety controller including vehicle braking.