Taxonomy to Unify Fault Tolerance Regimes for Automotive Systems: Defining Fail-Operational, Fail-Degraded, and Fail-Safe

Abstract

This paper presents a taxonomy that allows to define the fault tolerance regimes fail-operational, fail-degraded, and failsafe in the context of automotive systems. Fault tolerance regimes such as these are widely used in recent publications related to automated driving, yet without definitions, which largely holds true for automotive safety standards, too. Moreover, we show that fault tolerance regimes defined in scientific publications related to the automotive domain are partially ambiguous as well as taxonomically unrelated. The presented taxonomy is based on terminology stemming from ISO 26262 as well as from systems engineering and uses four criteria to distinguish fault tolerance regimes. In addition to fail-operational, fail-degraded, and fail-safe, the core terminology consists of operational and fail-unsafe. These terms are supported by definitions of available performance, nominal performance, and a novel definition of the safe state. For verification, we show by means of two examples from the automotive domain that the taxonomy can be applied to hierarchical systems of different complexity. Finally, we relate the definitions to the recently published technical report ISO/TR 4804, which also presents definitions of fault tolerance regimes.

Characterization of Transient Communication Outages Into States to Enable Autonomous Fault Tolerance in Vehicle Platooning

“…We can prevent too frequent state switching by increasing the (fair, poor) thresholds. For instance, the platooning vehicles exhibit better string stability and LV tracking for the thresholds (2,6), (3,5), (3,6), (4,5), and (4,6); see the speed profiles in Figure 7. The corresponding distance profiles show that the inter-vehicle gaps are between 5-10 m for all except the last two vehicles.…”

“…To better understand how the RTM governs switching between the states in Figure 2, let us take a closer look at the distance profiles of vehicle 6 (d 6 ) with thresholds (2, 3) and (4,6) in Figure 7 The state machine in Figure 2 dictates that a vehicle should adopt the PLATOON & GA state when c2l is fair and c2f is good. To this end, vehicle 6 upgrades its performance by adopting the PLATOON & GA state, and d 6 becomes 6.25 m at around 73 s, continuing until 78 s. Then communication with the LV becomes poor again, and vehicle 6 increases its gap to degrade its performance in order to prioritize safety over fuel efficiency by adopting the CACC state.…”

“…Any safety-critical system should be fault-tolerant, e.g., include fail-operational and/or fail-safe states, to mitigate the effects of failures [2]. Fail-operational in this context implies that a platoon should provide certain critical functionalities and remain at least as safe as it was before the temporary communication outage occurred, i.e., a nominal performance in terms of safety should always be ensured [4]. In order to facilitate the failoperational state, the platooning vehicles should gracefully degrade their performance in terms of, e.g., fuel efficiency, during runtime in a way that is proportionally related to the level of transient communication errors [5].…”

Elastic Gateway Functional Safety Architecture and Deployment: A Case Study

“…The new requirement for Autonomous Driving / Advanced Driver-Assistance Systems (AD/ADAS)) is that the vehicle must be fault-tolerant, i.e. it must continue operation even in the presence of failure [20], [21]. Thus, the NGIVN shall also migrate from being fail-safe to being fail-operational.…”

An Extendable Maneuver Management Framework with Fault-Tolerant Mechanism for Vehicle Platoon Control System in Highway Scenario

“…The V2V failure and the radar failure is the hazardous event in the platoon system. [27] distinguished between different fault-tolerant mechanism. It's a fail-degraded system if it can provide its specified functionality with below nominal performance.…”