Fail-Operational Redundancy: Seamless Primary-to-Secondary Controller Handover under 5ms
Designing steer-by-wire and brake-by-wire architectures that remain fully functional even after an unexpected catastrophic controller fault.
Traditional safety systems are fail-silent: when a fault is detected, the ECU shuts down (e.g., disengaging cruise control). However, for SAE Level 3+ autonomous vehicles without mechanical steering columns or hydraulic brake linkages, fail-silent is unacceptable: the vehicle must remain operational.
Safe ECU implements true fail-operational dual-redundant topology: • Two independent ASIL-D compute channels operate in parallel with isolated power feeds and distinct sensors. • High-speed cross-communication links verify heartbeats and calculation plausibility every 1 millisecond. • In the event of primary channel failure, the secondary channel takes full control of multi-winding electric actuators within 5 milliseconds, maintaining vehicle trajectory without steering loss.