Con­ti­nen­tal adds fall­back path for safe stop of au­tonomous ve­hi­cles

Auto components India - - COVER STORY - ACI Bureau

Con­ti­nen­tal is adding a fur­ther safety level to highly au­to­mated driv­ing in the form of a spe­cific elec­tron­ics ar­chi­tec­ture. In ad­di­tion to a cen­tral con­trol unit for au­to­mated driv­ing – the As­sisted & Au­to­mated Driv­ing Con­trol Unit – the tech­nol­ogy com­pany uses a Safety Do­main Con­trol Unit (SDCU) as a fall­back path to stop the ve­hi­cle safely, even in the event of a func­tional fail­ure in the pri­mary au­to­ma­tion path.

Con­ti­nen­tal is us­ing the prin­ci­ple of re­dun­dancy and di­verse de­sign that has proven it­self in the avi­a­tion sec­tor. There are one or more fall­back paths for ev­ery cen­tral sys­tem and they are in­de­pen­dent of each other. Since the SDCU also acts as the airbag con­trol unit, its pri­or­ity avail­abil­ity – in­clud­ing en­ergy re­serve and a crash­proof in­stal­la­tion lo­ca­tion in the ve­hi­cle – is guar­an­teed. With the ad­di­tional fall­back path of the SDCU, Con­ti­nen­tal en­sures that the ve­hi­cle can still be brought to a safe stop if the main au­to­ma­tion func­tion­al­ity fails. Con­ven­tional safety-rel­e­vant sys­tems cur­rently in use have been de­signed with fail-safe in mind. This means that if the sys­tem mal­func­tions, safety is main­tained by iden­ti­fy­ing the fault and putting the faulty sys­tem out of op­er­a­tion. This ap­proach is pos­si­ble be­cause the driver is still at hand as a fail­safe to brake and steer man­u­ally, for ex­am­ple, if re­quired.

“It is pre­cisely this fall­back path that may not be avail­able in highly au­to­mated ve­hi­cles, since the driver is al­lowed to fo­cus on other things and can­not be re­quested, in a frac­tion of a se­cond, to take con­trol of the ve­hi­cle im­me­di­ately af­ter a pos­si­ble fail­ure,” Maged Khalil, Head of Ad­vanced Sys­tems Ar­chi­tec­ture De­sign at Sys­tems and Tech­nol­ogy in the Chas­sis and Safety Divi­sion, said. Ev­ery highly au­to­mated ve­hi­cle must there­fore be able to stop au­to­mat­i­cally. Level 4 ve­hi­cles such as the Cruis­ing Chauf­feur from Con­ti­nen­tal are pre­pared for this. If, de­spite be­ing re­quested, the driver does not take ac­tion, the car per­forms a min­i­mum risk ma­neu­ver. This means that the ve­hi­cle au­to­mat­i­cally drives to the break­down lane and stops there. If there is no break­down lane or if it is blocked, it stops in the lane with the haz­ard lights on or it drives on, slow­ing down gen­tly un­til it finds a suit­able place, where it can stop safely.

If the driver is not avail­able to take con­trol of the ve­hi­cle, the sys­tem must switch over from a “fail-safe” to a “fail-oper­a­tional” mode by main­tain­ing func­tion­al­ity with a high de­gree of re­li­a­bil­ity in ev­ery case. “With the fall­back path of a se­cond in­de­pen­dent con­trol unit, which is also able to stop the car, a highly au­to­mated ve­hi­cle has a safety net, if a fault oc­curs, this means the ve­hi­cle can still come to a safe stop even with­out any driver in­ter­ven­tion. This el­e­ment of trust is key to the ac­cep­tance of au­to­mated driv­ing,” Khalil said.

Safe stop

The ve­hi­cle must come to a safe stop if it de­tects an un­safe state in the sys­tem and the driv­ing func­tion can­not be main­tained ei­ther by the pri­mary au­to­ma­tion path or by the driver. “The pri­mary au­to­ma­tion path must also be able to switch off with­out im­pair­ing safety. Only by means of gen­uine re­dun­dancy can all pos­si­ble fail­ure sce­nar­ios be cov­ered,” Bardo Peters, Head of In­no­va­tion Man­age­ment

Oc­cu­pant Safety and In­er­tial Sen­sors in the Pas­sive Safety and Sen­sorics Busi­ness Unit, said. SDCU is com­pletely in­de­pen­dent of the cen­tral con­trol unit such as the As­sisted and Au­to­mated Driv­ing Con­trol Unit, and fea­tures an au­to­ma­tion so­lu­tion that has been de­signed for the job of the min­i­mum risk ma­neu­ver.

Both the cen­tral con­trol unit and the SDCU mon­i­tor each other con­tin­u­ously with re­gard to avail­abil­ity and func­tion­al­ity. If just one path is no longer ca­pa­ble of con­trol­ling the ve­hi­cle or per­form the min­i­mum risk ma­neu­ver safely,

the other path ini­ti­ates the safe stop in an emer­gency.

“This per­ma­nent mon­i­tor­ing de­tects if a path is no longer avail­able. For this rea­son, the other path would then per­form the min­i­mum risk ma­neu­ver in such sit­u­a­tions,” Lutz Kühnke, Head of Seg­ment Oc­cu­pant Safety and In­er­tial Sen­sors in the Pas­sive Safety and Sen­sorics Busi­ness Unit, said. The fall­back path in­ter­venes in ac­cor­dance with a finely grad­u­ated degra­da­tion con­cept, de­pend­ing on the sever­ity of the prob­lem

de­tected. For self-mon­i­tor­ing as well as mu­tual mon­i­tor­ing of the paths, Con­ti­nen­tal uses in­no­va­tive soft­ware func­tions such as ef­fec­tive fault man­age­ment and in­tel­li­gent mon­i­tor­ing of the sig­nal con­sis­ten­cies.

Newspapers in English

Newspapers from India

© PressReader. All rights reserved.