## 3 Fail-Operational Architectures
Furthermore, some basic requirements and assumptions are formulated in Table 1:  
The assumed computing platform in this chapter consists of three identified main components: power management, controller and external communication. The computing platform forms a single fault containment unit because the controller and communication components both are dependent on the power management component. It is \begin{table}
\begin{tabular}{c c} \hline \hline
**Nr.** & **Requirement/Assumption** \\ \hline
1 & The system shall host software components, capable of executing safety critical functionality with high reliability and an integrity level of up to ASIL D. \\
2 & The software components shall implement algorithms capable of processing sensor set data for surround detection (RADAR, LIDAR, camera). \\
3 & The system shall perform AI algorithms for sensor fusion, object detection and trajectory planning. \\
4 & The system shall remain operational in case a single failure occurs. \\
5 & The system shall receive sensor data via a communication interface. \\
6 & The system shall send actuator data via a communication interface. \\
7 & The fail-operational concept may allow degraded functionality when executing fallback functions. \\
8 & The system shall execute autonomous driving functions for SAE levels 3+. \\
9 & The ASIL level of a potential fallback system may be lower than the ASIL level of the primary system. If so, the resulting restrictions must be defined. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Requirements and assumptions. mitigated by adding a certain degree of redundancy, which is covered by the three fail-operational architectures. Basic assumptions for further investigations of the different architectures for a prototypical implementation of the computing platform are the following:  
* All fault containment units fail independently;
* All fault containment units fail in the most restrictive manner, i.e., fail-silent;
* All fault containment units can fail in an arbitrary failure mode, as long as all other assumptions are not violated. Based on the defined requirements and assumptions, further investigation is done for each of the three architectures. The first architecture, Simplex architecture, originally evolved from control engineering and utilizes two controllers. The high-performance mission controller performs the main functionality, e.g., executing AI algorithms for sensor fusion, object recognition and trajectory planning, while the less powerful safety controller performs evaluation and forwards it to the external communication interfaces. The data are evaluated by a decision module inside the safety controller and requires some reference, e.g., calculated by simpler versions of the AI algorithms (sensor fusion, object recognition and trajectory planning). Since AI algorithms are mostly non-deterministic, this issue of replica non-determinism must be mitigated and considered at the algorithm level (solving the problem of replica non-determinism was not the scope of our investigations). The redundancy ensures that, if the mission controller fails, the safety controller still provides results and ensures that the system is operational. However, the results then are of lower quality because of the lower computational power of the safety controller--the functionality of the system is degraded. In Figure 2, the power supply and sensor sets (RADAR, LIDAR, camera) are redundant to mitigate a single point of failures. The sensor data are sent to the controllers via diverse communication channels, thus mitigating systematic faults. The most restricting weakness of this architecture is the safety controller being the single point of failure, which potentially can break down the entire system. Even if the safety controller has a very high safety integrity level (e.g., ASIL D), the simplex architecture is not an advisable choice for creating fail-operational computing platforms to enable autonomous driving functions for SAE levels equal to or higher than 3.