Level 3+ automated driving implies highest safety demands for the entire vehicle automation functionality. For the part of trajectory tracking, functional redundancies among all available actuators provide an opportunity to reduce safety requirements for single actuators. Yet, the exploitation of functional redundancies must be well argued if employed in a safety concept as physical limits can be reached. In this paper, we want to examine from a trajectory tracking perspective whether such a concept can be used. For this, we present a model predictive fault-tolerant trajectory tracking approach for over-actuated vehicles featuring wheel individual all-wheel drive, brakes, and steering. Applying this approach exemplarily demonstrates for a selected reference trajectory that degradations such as missing or undesired wheel torques as well as reduced steering dynamics can be compensated. Degradations at the physical actuator limits lead to significant deviations from the reference trajectory while small constant steering angles are partially critical.

Automated driving systems operated at SAE levels 4 and 5 require a far-reaching fault-tolerant design. To meet this need at the actuator level, we present an integrated vehicle motion control approach that is able to tolerate a wide range of different actuator degradations and failures as well as tire blowouts in vehicles featuring four wheel-individual steering, drive, and brake actuators. The approach, which is based on non-linear model predictive control (MPC), tracks a temporal sequence of reference poses. Fault tolerance is achieved by reconfiguration of the MPC's constraints, weights, and prediction model, which consists of a double-track vehicle and a brush tire model. The evaluation of the approach is based on two reference trajectories. The example of a simple single lane change trajectory in IPG CarMaker demonstrates the basic functionality of the approach. The example of a demanding decelerated single lane change trajectory shows that the approach is subject to limitations when tolerating different degradations and failures. Still, the observed limitations can be explained by the interplay of the specific degradation or failure and the demanding nature of the trajectory. Therefore, the results indicate that the suitability of fault-tolerant vehicle motion control as part of a system-wide safety concept is strongly connected to the range of possible driving scenarios that an automated driving system can encounter.