Reliability-based safeguarding of automated traffic systems by means of "fail-operational" capable on-board architectures

Fully automated and autonomous vehicles place new demands on reliability, availability and safety. Eliminating the driver as a fallback path in the event of technical breakdowns or failures, forces a self-driving vehicle to operate safely even in the event of a fault, in order to reach a riskminimum state. Similarly, minor disturbances, such as software crashes or failures, must be compensated for safety terms in real time. These requirements are realized through redundancybased, fail-operational on-board architectures. In the event of an error, a fault-tolerant subsystem can be switched on or off in order to obtain a (possibly degraded) operability. In aviation, such system designs have been standardized and steadily developed for the use of complex, software-based flight control systems. The article gives an overview of the technical requirements of the aviation and automotive industries, as well as the presentation of aviation methods and principles and their transfer to the automotive development. This includes methods for fault detection, fault tolerance, strategies for continued operation, live repair, degradation and the safe shutdown of the system into a state of minimal risk. This procedure has not been implemented in the current automotive development because the responsibility for driving the vehicle lies always with the driver. A quantitative assessment of reliability, availability and safety – considering the above system properties – can be performed using multi-stage simulation models, which are also presented in this paper. The goal is the statistical validation of an economic system design while complying with the safety requirements as established by common standards and rules in the automotive sector (for example ISO 26262, SOTIF via ISO / PAS 21448, etc.).     «

Fully automated and autonomous vehicles place new demands on reliability, availability and safety. Eliminating the driver as a fallback path in the event of technical breakdowns or failures, forces a self-driving vehicle to operate safely even in the event of a fault, in order to reach a riskminimum state. Similarly, minor disturbances, such as software crashes or failures, must be compensated for safety terms in real time. These requirements are realized through redundancybased, fail-operation...     »