On-Demand Triple Modular Redundancy for Automotive Applications

The vast majority of the automation of driving functions within automotive vehicles is currently not exceeding the sole assistance of a driver. Assistance means, that in the event of a malfunction, the human driver has to take over the driving task manually again. While for most of the existing driver assistant systems this fail over has to take place immediately, even recently launched highly automated driving systems, such as the drive pilot of Mercedes-Benz in 2018, still require the human driver to take over within a couple of seconds in the event of a fault. Therefore, the human driver is used as fall-back for a system up to Level 3 according to the SAE J3016 standard, which is not possible for vehicles where there is no driver anymore. Accordingly, Autonomous Vehicles (AVs) as described in Level4 and Level5 in the standard need both, high reliability by minimizing the amount of faults and high availability by still being operational, even in the event of a fault. The same requirement is relevant in the avionic industry, and it is solved with a high amount of redundancy of the safety critical systems. While this works for big airplanes, automobiles are restricted regarding geometric limitation, power consumption limitation and cost limitation. This work contains an early indication of the realization of a fail-operational E/E-Architecture with a minimal amount of redundant components. This is possible by the usage of a modern service-oriented Architecture (SOA) in combination with modern ECUs.