AUTARCHICAL POWER DOMAINS FOR EXECUTING MINIMAL RISK CONDITIONS

A system includes a power supply and a plurality of buses coupled to the power supply. A bus selector is coupled to an output of each of the plurality of buses. A power storage unit that is separate from the power supply is coupled to an output of the power supply via the bus selector. A power controller is coupled to an output of the bus selector and to an output of the power storage unit. The power controller selects a power output as the output of the power supply or the output of the power storage unit.

FIELD OF THE INVENTION

The field of the invention is vehicle systems, or, more specifically an architecture for providing redundant power to one or more systems of an autonomous vehicle.

SUMMARY

A system includes a power supply and a plurality of buses coupled to the power supply. A bus selector is coupled to an output of each of the plurality of buses. A power storage unit that is separate from the power supply is coupled to an output of the power supply via the bus selector. A power controller is coupled to an output of the bus selector and to an output of the power storage unit. The power controller selects a power output as the output of the power supply or the output of the power storage unit.

In some embodiments, the power output of the power controller is coupled to a first power domain and to a second power domain. At least one of the first power domain or the second power domain receive power from the power output of the power controller. In some embodiments, the system is included in an autonomous vehicle, with the first power domain and the second power domain including one or more microprocessors that control one or more autonomous vehicle control systems of the autonomous vehicle. The first power domain includes at least one microprocessor, and the second power domain similarly includes at least one microprocessor.

In some embodiments, an autonomous vehicle includes a first power domain that includes one or more first microprocessors. The one or more first microprocessors control a collection of systems that control movement of the autonomous vehicle. The autonomous vehicle also includes a second power domain including one or more second microprocessors, with the second microprocessor also controlling the systems that control movement of the autonomous vehicle. A domain controller is coupled to the first power domain and to the second power domain. The domain controller determines hat that the first power domain or the second power domain is capable of providing instructions for the autonomous vehicle to complete a minimal risk condition using the collection of systems. In response to determining the first power domain is not capable of providing instructions for the autonomous vehicle to complete a minimal risk condition using the collection of systems, the domain controller routes power form the first power domain to the second power domain.

DETAILED DESCRIPTION

Autonomous vehicle model training using low-discrepancy sequences may be implemented in an autonomous vehicle. Accordingly,FIG.1shows multiple views of an autonomous vehicle100configured for autonomous vehicle model training using low-discrepancy sequences according to embodiments of the present disclosure. Right side view101ashows a right side of the autonomous vehicle100. Shown in the right-side view101aare right-facing cameras102aand103a, configured to capture image data, video data, and/or audio data of the environment external to the autonomous vehicle100from the perspective of the right side of the car. Cameras102aand103aare depicted in an exemplary placement location on the autonomous vehicle. In some embodiments, cameras may also be placed in additional or different locations on the autonomous vehicle100. For example, in some embodiments, cameras102band103bor cameras102cand103cmay be used instead of or in addition to cameras102aand103a.

Front view101bshows a front side of the autonomous vehicle100. Shown in the front view101bare cameras104and106, configured to capture image data, video data, and/or audio data of the environment external to the autonomous vehicle100from the perspective of the front of the car. Rear view101cshows a rear side of the autonomous vehicle100. Shown in the rear view101care cameras108and110, configured to capture image data, video data, and/or audio data of the environment external to the autonomous vehicle100from the perspective of the rear of the car. Top view101dshows a rear side of the autonomous vehicle100. Shown in the top view101dare cameras102a-110. Although the top view101dshows cameras102aand103aas right-facing cameras for the autonomous vehicle100, in some embodiments, other placement locations for right-facing cameras may also be used, such as those of cameras102band103bor cameras102band103bas described above. Also shown are left-facing cameras112and114, configured to capture image data, video data, and/or audio data of the environment external to the autonomous vehicle100from the perspective of the left side of the car. In some embodiments, other placement locations for left-facing cameras may also be used, such as those similar to cameras102band103bor cameras102band103bat corresponding locations on the left side of the car.

As shown, the autonomous vehicle100may include pairs of cameras each facing the same direction relative to the autonomous vehicle100(e.g., a pair of forward-facing cameras104and106, a pair of rear-facing cameras108and110, a pair of right-facing cameras102aand103a, a pair of left-facing cameras112and114). In some embodiments, each of these cameras may be installed or deployed in a stereoscopic configuration such that each pair of cameras may be used for stereoscopic vision using image data from each camera in the camera pair. In other words, each camera in a given pair may face the same direction and have a substantially overlapping field of view such that their respective image data may be used for stereoscopic vision as will be described below.

Further shown in the top view101dis an automation computing system116. The automation computing system116comprises one or more computing devices configured to control one or more autonomous operations (e.g., autonomous driving operations) of the autonomous vehicle100. For example, the automation computing system116may be configured to process sensor data (e.g., data from the cameras102a-114and potentially other sensors), operational data (e.g., a speed, acceleration, gear, orientation, turning direction), and other data to determine an operational state and/or operational history of the autonomous vehicle. The automation computing system116may then determine one or more control operations or driving decisions for the autonomous vehicle100(e.g., a change in speed or acceleration, a change in brake application, a change in gear, a change in turning or orientation). The automation computing system116may also store captured sensor data for later use, transmission, and the like. Operational data of the autonomous vehicle may also be stored in association with corresponding sensor data, thereby indicating the operational data of the autonomous vehicle100at the time the sensor data was captured.

Also shown in the top view101dis a radar sensor118. The radar sensor118uses radio waves to detect objects in the environment relative to the autonomous vehicle100. The radar sensor118may also detect or track various attributes of such objects, including distance, velocity, angle of movement and the like. The measurements of the radar sensor118may be provided as sensor data (e.g., radar data) to the automation computing system116.

The radar data from the radar sensor118may be used in a variety of ways to facilitate autonomous driving functionality. As an example, the radar sensor118may be used in isolation or in conjunction with other sensors, such as camera sensors, to track persistence of various objects. As described herein, persistence includes determining that a particular object identified at a particular instance (e.g., in camera sensor data, in radar sensor118data, or both) is the same object in subsequent instances. The radar sensor118may also facilitate detecting the size, shape, type, or speed of particular objects. These detected attributes may be correlated with or used to verify estimations of these attributes from camera sensors. As a further example, the radar sensor118may facilitate detecting voids in the environment where no object is present.

The radar sensor118provides several advantages over camera sensors in detecting the environment relative to the autonomous vehicle100. For example, the radar sensor118provides for greater accuracy at longer distances. The radar sensor118may also provide for more accurate estimations of velocity or movement of objects. Moreover, as the radar sensor118does not operate in the optical spectrum, performance degradation of the radar sensor118in inclement weather is lesser than with camera sensors. Radar sensors118also provide some level of vertical resolution in some embodiments, with a tradeoff between distance and vertical resolution.

In some embodiments, the autonomous vehicle100may also include an additional radar sensor120. For example, where the radar sensor118is positioned at a front bumper of the autonomous vehicle100, the autonomous vehicle100may also include the additional radar sensor120positioned at the rear bumper. Such an additional radar sensor allows for multispectral (e.g., both visual and radar) coverage of the environment at the rear of the car. This provides advantages over ultrasonic sensors at the rear bumper which generally have a limited distance relative to radar.

Although the autonomous vehicle100ofFIG.1is shown as car, it is understood that autonomous vehicles100configured for autonomous vehicle model training using low-discrepancy sequences may also include other vehicles, including motorcycles, planes, helicopters, unmanned aerial vehicles (UAVs, e.g., drones), or other vehicles. Moreover, it is understood that additional cameras or other external sensors may also be included in the autonomous vehicle100.

Autonomous vehicle model training using low-discrepancy sequences in accordance with the present disclosure is generally implemented with computers, that is, with automated computing machinery. For further explanation, therefore,FIG.2sets forth a block diagram of automated computing machinery comprising an exemplary automation computing system116configured for autonomous vehicle model training using low-discrepancy sequences according to specific embodiments. The automation computing system116ofFIG.2includes at least one computer Central Processing Unit (CPU) package204as well as random access memory206(‘RAM’) which is connected through a high-speed memory bus208and bus adapter210to CPU packages204via a front side bus211and to other components of the automation computing system116.

A CPU package204may comprise a plurality of processing units. For example, each CPU package204may comprise a logical or physical grouping of a plurality of processing units. Each processing unit may be allocated a particular process for execution. Moreover, each CPU package204may comprise one or more redundant processing units. A redundant processing unit is a processing unit not allocated a particular process for execution unless a failure occurs in another processing unit. For example, when a given processing unit allocated a particular process fails, a redundant processing unit may be selected and allocated the given process. A process may be allocated to a plurality of processing units within the same CPU package204or different CPU packages204. For example, a given process may be allocated to a primary processing unit in a CPU package204. The results or output of the given process may be output from the primary processing unit to a receiving process or service. The given process may also be executed in parallel on a secondary processing unit. The secondary processing unit may be included within the same CPU package204or a different CPU package204. The secondary processing unit may not provide its output or results of the process until the primary processing unit fails. The receiving process or service will then receive data from the secondary processing unit. A redundant processing unit may then be selected and allocated the given process to ensure that two or more processing units are allocated the given process for redundancy and increased reliability.

The CPU packages204are communicatively coupled to one or more sensors212. The sensors212are configured to capture sensor data describing the operational and environmental conditions of an autonomous vehicle. For example, the sensors212may include cameras (e.g., the cameras102a-114ofFIG.1), accelerometers, Global Positioning System (GPS) radios, LiDAR sensors, radar sensors such as radar sensors118,120ofFIG.1, or other sensors. As described herein, cameras may include solid state cameras with a solid-state shutter capable of measuring photons or a time of flight of photons. For example, a camera may be configured to capture or measure photons captured via the shutter for encoding as images and/or video data. As another example, a camera may emit photons and measure the time of flight of the emitted photons. Cameras may also include event cameras configured to measure changes in light and/or motion of light.

Although the sensors212are shown as being external to the automation computing system116, it is understood that one or more of the sensors212may reside as a component of the automation computing system116(e.g., on the same board, within the same housing or chassis). The sensors212may be communicatively coupled with the CPU packages204via a switched fabric213. The switched fabric213comprises a communications topology through which the CPU packages204and sensors212are coupled via a plurality of switching mechanisms (e.g., latches, switches, crossbar switches, field programmable gate arrays (FPGAs)). For example, the switched fabric213may implement a mesh connection connecting the CPU packages204and sensors212as endpoints, with the switching mechanisms serving as intermediary nodes of the mesh connection. The CPU packages204and sensors212may be in communication via a plurality of switched fabrics213. For example, each of the switched fabrics213may include the CPU packages204and sensors212, or a subset of the CPU packages204and sensors212, as endpoints. Each switched fabric213may also comprise a respective plurality of switching components. The switching components of a given switched fabric213may be independent (e.g., not connected) of the switching components of other switched fabrics213such that only switched fabric213endpoints (e.g., the CPU packages204and sensors212) are overlapping across the switched fabrics213. This provides redundancy such that, should a connection between a CPU package204and sensor212fail in one switched fabric213, the CPU package204and sensor212may remain connected via another switched fabric213. Moreover, in the event of a failure in a CPU package204, a processor of a CPU package204, or a sensor, a communications path excluding the failed component and including a functional redundant component may be established. In some embodiments, other data links or communications pathways may be used instead of or in conjunction with switched fabrics213, including cable connections between two endpoints, wireless communications links, or other data links.

The CPU packages204and sensors212are configured to receive power from one or more power supplies215. The power supplies215may comprise an extension of a power system of the autonomous vehicle100or an independent power source (e.g., a battery, a capacitor). The power supplies215may supply power to the CPU packages204and sensors212by another switched fabric214. The switched fabric214provides redundant power pathways such that, in the event of a failure in a power connection, a new power connection pathway may be established to the CPU packages204and sensors212. In some embodiments, other power couplings may be used instead of or in conjunction with the switched fabric214, such as a direct power cable coupling of a power supply215to another component.

Stored in RAM206is an autonomy engine250. As will be described in further detail below, the autonomy engine250may enable autonomous driving functionality for the autonomous vehicle100. Accordingly, in some embodiments, the autonomy engine250may perform various data processing or data analytics operations to enable autonomous driving functionality, including the processing of sensor data, generation of driving decisions, and the like.

The automation computing system116ofFIG.2includes disk drive adapter230coupled through expansion bus232and bus adapter210to CPU package(s)204and other components of the automation computing system116. Disk drive adapter230connects non-volatile data storage to the automation computing system116in the form of data storage218. Disk drive adapters230useful in computers configured for autonomous vehicle model training using low-discrepancy sequences according to various embodiments include Integrated Drive Electronics (‘IDE’) adapters, Small Computer System Interface (‘SCSI’) adapters, and others. Non-volatile computer memory also may be implemented for as an optical disk drive, electrically erasable programmable read-only memory (so-called ‘EEPROM’ or ‘Flash’ memory), RAM drives, and so on.

The exemplary automation computing system116ofFIG.2includes a communications adapter238for data communications with other computers and for data communications with a data communications network. Such data communications may be carried out serially through RS-238 connections, through external buses such as a Universal Serial Bus (‘USB’), through data communications networks such as IP data communications networks, and in other ways. Communications adapters implement the hardware level of data communications through which one computer sends data communications to another computer, directly or through a data communications network. Examples of communications adapters useful in computers configured for autonomous vehicle model training using low-discrepancy sequences according to specific embodiments include modems for wired dial-up communications, Ethernet (IEEE 802.3) adapters for wired data communications, 802.11 adapters for wireless data communications, as well as mobile adapters (e.g., cellular communications adapters) for mobile data communications. For example, the automation computing system116may communicate with one or more remotely disposed execution environments227via the communications adapter238.

The exemplary automation computing system ofFIG.2also includes one or more Artificial Intelligence (AI) accelerators240. The AI accelerator240provides hardware-based assistance and acceleration of AI-related functions, including machine learning, computer vision, etc. Accordingly, functionality of the autonomy engine250or other operations of the automation computing system116may be performed at least in part by the AI accelerators240.

The exemplary automation computing system ofFIG.2also includes one or more graphics processing units (GPUs)242. The GPUs242are configured to provide additional processing and memory resources for processing image and/or video data, including encoding, decoding, etc. Accordingly, functionality of the autonomy engine250or other operations of the automation computing system116may be performed at least in part by the GPUs242.

FIG.3shows a block diagram of an exemplary autonomy engine250for autonomous vehicle model training using low-discrepancy sequences according to some embodiments of the present disclosure. The autonomy engine250facilitates autonomous driving operations of the autonomous vehicle100. In some embodiments, the autonomy engine250includes a perception engine300. The perception engine300facilitates the capture and processing of sensor data from various sensors212in order to determine an environmental state relative to the autonomous vehicle100. The environmental state may describe, for example, indications of objects in the environment, identification or classification of those objects, velocity and motion direction of those objects, indications and placement of particular road features including lane markers, intersections, turns, and other environmental features.

In some embodiments, the perception engine300includes a motion module302. The motion module302uses visual information (e.g., image data from cameras) to detect objects in the environment relative to the autonomous vehicle100and calculate various motion attributes of those objects, including distance, velocity, and motion direction. In some embodiments, the motion module302may be implemented using one or more neural networks. In some embodiments, the motion module302may use a stereoscopic neural network that processes stereoscopic image data from a pair of cameras in a stereoscopic configuration in order to detect objects and calculate their various motion attributes. In some embodiments, the motion module302may use a monoscopic neural network that processes non-stereoscopic image data from individual cameras to detect objects and calculate their various motion attributes. In other words, objects may be detected, and their motion attributes calculated, without the need for image data from another camera (e.g., another camera in a stereoscopic configuration).

In some embodiments, the autonomous vehicle100may include complementary or fallback camera modalities usable by the motion module302. This increases the robustness of a perception system of the autonomous vehicle100by allowing alternate modalities to perceive environmental conditions. As an example, there may be a left and a right camera in a stereoscopic configuration, with each camera pointed in approximately the same direction that allows the autonomous vehicle100to perceive objects in that direction. Different camera modes of the two cameras may allow the cameras to operate stereoscopically, monoscopically using the left camera, monoscopically using the right camera, or a combination of any of these. The autonomous vehicle100may use images from the cameras for a variety of purposes, such as to determine existence of objects in the environment, determine distance to objects from the autonomous vehicle, or determine velocities of objects from the autonomous vehicle. Depending on the camera modality, the autonomous vehicle100may use different techniques to determine environmental conditions. For example, while using a single camera, the autonomous vehicle100may use techniques such as object (or blob) expansion, bounding box expansion, known size position or comparison techniques, defocusing, or other techniques to determine distance or velocity of objects in the environment. When using two cameras, the autonomous vehicle100may use techniques such as stereoscopy to determine distance or velocity of objects in the environment.

In some embodiments, the motion module302may operate in a stereoscopic and monoscopic modality concurrently. Thus, for a given pair of stereoscopic cameras, the stereoscopic neural network may be used to process image data from the pair of stereoscopic cameras while the monoscopic neural network may be used to process image data from one or both cameras individually. In some embodiments, the output of each neural network may be used to reinforce or otherwise affect the output of the other. For example, a downstream component may use the output of the monoscopic neural network to verify or validate the output of the stereoscopic neural network. As another example, the similarity between output of the stereoscopic neural network and monoscopic neural network may be used to increase confidence scores or other values associated with their respective outputs. In some embodiments, as will be described in more detail below, the stereoscopic and monoscopic neural networks may be executed concurrently such that, should an error occur that prevents the use of stereoscopic imagery (e.g., a camera failure), a monoscopic neural network is already executing and has sufficient image data history so as to be useful in detecting objects and calculating their respective motion attributes.

A radar module304processes data from one or more radar sensors118,120to facilitate determining the environmental state relative to the autonomous vehicle100. In some embodiments, a radar data cube may be generated that defines a three-dimensional space, with each portion in the three-dimensional space either having an object occupying it or being empty. Changes in radar data cubes over time may be used to detect objects and calculate their respective motion attributes as described above. In some embodiments, the radar module304may be used to calculate an ambient velocity of the scene relative to the autonomous vehicle100. The ambient velocity is a collective or aggregate velocity of multiple objects in the environment, such as the autonomous vehicle100and other vehicles occupying the road. Accordingly, the ambient velocity may include an ambient velocity for particular lanes or the entire road as detectable by the radar sensors118,120.

The scene module306determines possible actions or maneuvers performable by the autonomous vehicle100based on the environment relative to the autonomous vehicle. The scene module306may detect the environment relative to the autonomous vehicle100using image data from cameras, radar data, and/or other sensor data. For example, the scene module306may detect road features such as lane markers, changes in the road such as curvature, splits or convergence, intersections, and the like as identified in image data from cameras of the autonomous vehicle100. Such road features may constrain maneuvers performable by the autonomous vehicle100(e.g., due to constraints within a particular lane), or present possible maneuvers (e.g., a possible turn at an intersection). As another example, objects identified by the motion module302as well as their respective motion attributes may be provided as input to the scene module306. Such identified objects may affect or constrain possible actions or maneuvers due to risk of collision or other factors.

In some embodiments, one or more trained neural networks may be used by the scene module306to determine possible actions or maneuvers of the autonomous vehicle100. For example, the possible actions or maneuvers may be determined based on a predicted environmental state (e.g., a predicted state of the road). Accordingly, in some embodiments, a neural network may be trained based on various lane and/or intersection configurations in order to predict the state of the road and determine possible actions or maneuvers. In some embodiments, the neural network may be trained using a corpus of data defining all combinations of road and intersections as limited by rules or laws for road construction. This improves the safety and performance of the autonomous vehicle100by ensuring that the neural network is trained on any possible road condition or configuration that the autonomous vehicle100may encounter. The scene module306allows for determination of possible actions for an autonomous vehicle100without requiring high-definition maps of the road traversed by the autonomous vehicle100.

Although described as different modules, in some embodiments, each module of the perception engine300may affect the functionality of the other. For example, output of one module may be provided as input to another module, or output of one module may be correlated with output of another module for verification, confidence estimation, and the like. In some embodiments, the neural networks described above may be implemented as separate neural networks or combined into a same network. For example, one or more neural networks of the radar module304may be combined with one or more neural networks of the motion module302to perform their respective calculations. Various combinations or configurations of such neural networks are contemplated within the scope of the present disclosure.

The driving engine310determines and executes maneuvers (e.g., driving decisions) for the autonomous vehicle100. As described herein, a maneuver describes an action or combination of actions to be performed by the autonomous vehicle100, particularly with respect to movement of the autonomous vehicle. A maneuver may also be referred to as a driving decision, with such terms being used interchangeably herein. In some embodiments, the driving engine310includes a maneuvers module312. The maneuvers module312determines, based on various inputs, a particular maneuver to be executed. For example, the maneuvers module312may receive from the scene module306an indication of possible maneuvers that may be performed. The maneuvers module312may then select a particular maneuver for execution.

In some embodiments, selecting a particular maneuver for execution may be based on costs associated with possible paths. For example, in some embodiments, selecting a particular maneuver may include optimizing one or more cost functions (e.g., by optimizing path costs). In some embodiments, path costs may be determined using one or more lattices with each lattice focusing on a different aspect of the drive (e.g., safety, comfort, efficiency). Maneuvers may then be selected for a path optimized for one or more of the lattices.

In some embodiments, the driving engine310includes a controls module314. A controls module314generates control signals to actuate various components in order to perform maneuvers. For example, control signals may be provided via a vehicle interface222to autonomous vehicle control systems223to actuate acceleration, braking, steering, and the like in order to perform a maneuver. In some embodiments, the maneuvers module312may provide a particular maneuver to the controls module314. The controls module314then determines and outputs the particular control signals required to perform the maneuver. As an example, assume that the maneuvers module312outputs a maneuver of a lane change to a lane to the left of the autonomous vehicle100. The controls module314may then output a control signal to a steering system to angle the autonomous vehicle100some amount to the left. As another example, assume that the maneuvers module312outputs a maneuver to perform a right turn at an intersection. The controls module314may then output a control signal to the steering system to turn the car to the right and also output a control signal to the braking system to decelerate the autonomous vehicle100during the turn.

In some embodiments, the driving engine310may include a navigation module316. The navigation module316may determine a route for the autonomous vehicle100to travel. The route may be based on a currently selected destination or based on other criteria. The route may be provided, for example, as input to a maneuvers module312such that maneuvers may be selected for traveling along the determined route. For example, the determined route may affect one or more cost functions associated with selecting a particular maneuver.

The safety engine320implements one or more features to ensure a safe driving experience when in an autonomous driving mode. In some embodiments, the safety engine320includes a redundancy module322. The redundancy module322may detect errors associated with particular components of the autonomous vehicle100. The redundancy module322may also perform remedial actions for these errors using redundant components for an erroneous component. For example, in some embodiments, the redundancy module322may establish or remove data or power pathways between components using switch fabrics as described above. Thus, the redundancy module322may establish data or power pathways to a redundant component when a corresponding component fails. This ensures that the autonomous vehicle100may maintain autonomous driving functionality in the event of component failure. In some embodiments, the redundancy module322may control different camera modalities as described above. For example, in response to detecting an error associated with a first camera in a stereoscopic configuration with a second camera, the redundancy module322may indicate (e.g., to the motion module302) to operate in a monoscopic modality using the second camera. This allows the autonomous vehicle100to maintain autonomous driving functionality in the event of a camera failure, improving overall performance and safety.

In some embodiments, the safety engine320includes a safe stop module324. The safe stop module324may cause the autonomous vehicle100to execute a safe stop maneuver. A safe stop maneuver is a sequence or combination of one or more maneuvers that will bring the autonomous vehicle100to a safe stop. Criteria for what is considered a safe stop may vary according to particular environmental considerations, including a type of road being traversed, traffic conditions, weather conditions, and the like. For example, a safe stop on a busy highway may include directing the vehicle to stop on the shoulder of the highway. As another example, a safe stop in a no or low traffic environment may include bringing the vehicle to an initial stop on the road before a human driver takes control.

The particular maneuvers required to execute the safe stop may be determined by the maneuvers module312. For example, in addition to determining maneuvers to execute a particular driving path, the maneuvers module312may also concurrently determine maneuvers required to execute a safe stop maneuver. Thus, the maneuvers module312may continually update a stored sequence of maneuvers to reflect the most recently determined safe stop maneuver. In response to some condition or error state, such as critical component failure or another error that may affect safe autonomous driving, the safe stop module324may signal the maneuvers module312to execute the most recently determined safe stop maneuver. The maneuvers module312may then send to the controls module314, the various maneuvers to perform the safe stop maneuver.

In some embodiments, the safety engine320includes an operational design domain (ODD)326. The ODD326defines various operating conditions in which the autonomous vehicle100may operate autonomously. The ODD326may include, for example, particular environmental restrictions, geographical restrictions, time-of-day restrictions, and the like. The restrictions of the ODD326may correspond to different legal requirements, regulatory requirements, engineering considerations, and the like. The ODD326ensures that the autonomous vehicle100only operates autonomously within the bounds defined by the ODD326, improving safety and ensuring conformity with relevant legal and regulatory restrictions. Enforcement of the ODD may include through automatic means.

The autonomy engine250also includes a human machine interface (HMI)330. The HMI330presents various content to the driver or other occupants of the autonomous vehicle100and monitors the driver for various inputs that may affect driving or other systems of the autonomous vehicle100. In some embodiments, the HMI330includes a visualization module332. The visualization module332generates and presents for display a representation of the environment relative to the autonomous vehicle100as perceived by the autonomous vehicle100(e.g., based on data from various sensors). For example, the visualization module332may present a representation of detected road lanes, objects, or other relevant driving information so that an occupant can understand why the autonomous vehicle100is performing a particular task or maneuver. The visualization module332may also present for display various information relating to the state of the vehicle, such as cabin temperature, whether lights or windshield wipers are on, and the like. In some embodiments, an interior of the autonomous vehicle100may include a display or monitor to which the HMI330may provide the information or environmental representation described above.

In some embodiments, the HMI330includes a driver monitoring module334. The driver monitoring module334monitors behaviors or actions of a driver using sensors inside and/or outside of the autonomous vehicle100. Such sensors may include cameras, infrared sensors, pressure sensors, and the like. In other words, the driver monitoring module334generates sensor data capturing the driver. The driver monitoring module334may thus monitor behaviors or actions of a driver both inside of the vehicle and outside of the vehicle. In some embodiments, the driver monitoring module334may also monitor behavior or actions of other occupants of the autonomous vehicle100. The driver monitoring module334may detect behaviors or actions including gestures, voice commands, posture, gaze, and the like.

In some embodiments, the HMI330also includes an intent module336. The intent module336derives an intent of the driver using sensor data from the driver monitoring module334. For example, one or more trained modules or neural networks may derive a particular intent based on sensor data from the driver monitoring module334. The intent of the driver is an action the driver wishes performed by the autonomous vehicle100. For example, assume that the driver monitoring module334detects a driver outside of the vehicle approaching the trunk. The intent module336may determine that the trunk should be opened or unlocked. As another example, assume that the driver monitoring module334detects a particular gesture performed by the driver during an autonomous driving mode. The intent module336may determine that the gesture indicates that the speed of the vehicle should be increased. Accordingly, in some embodiments, the intent module336may generate, based on a determined intent, one or more control signals to actuate one or more components or systems of the autonomous vehicle100.

In some embodiments, the autonomy engine250includes an operating system340. The operating system340may include, for example, UNIX™, Linux™, Microsoft Windows™ Android™, and others, as well as derivatives thereof. In some embodiments, the operating system340includes a formally verified operating system340. Formal verification uses mathematical proof techniques to establish properties or functionality of the operating system340. For example, formal verification may cover all lines of code or decisions, a range of all possible inputs, or other factors in operating system340execution. The use of a formally verified operating system340verifies that the operating system340will function correctly during operation of the autonomous vehicle100, thereby establishing the safety and reliability of the operating system340during autonomous driving.

The various components of the autonomy engine250may be embodied or encoded according to a variety of approaches. For example, the various components and/or subcomponents of the autonomy engine250(e.g., the various engines and modules) may be implemented using one or more containers, one or more virtual machines, or by other approaches. Moreover, though the autonomy engine250is described with respect to various different engines, modules, and the like, in some embodiments portions of their respective functionality may be implemented by a same or shared module, application, service, and the like.

In some embodiments, one or more components or functions of the autonomy engine250may be verified using simulation or other computerized methods. For example, a simulated vehicle in a simulated road environment may be operated using an instance of the autonomy engine250. Thus, maneuvers or driving decisions by the simulated vehicle may be controlled by the autonomy engine250. Verification may include determining whether the simulated vehicle operates as expected, satisfies certain conditions (e.g., stays within defined lane parameters, executes maneuvers within prescribed bounds), or other actions. In some embodiments, the autonomy engine250may undergo verification using a variety of different scenarios where the simulated vehicle begins operation in some defined simulated environmental state. The defined simulated environmental state may include parameters such as particular road conditions or road features, placement of the simulated vehicle on the road, a speed and direction of the simulated vehicle, placement of other vehicles on the road, speeds of such vehicles, and the like. In some embodiments, the autonomy engine250may be verified by encoding these parameters as a multidimensional space and generating a distribution of different simulation scenarios that evenly cover the multidimensional space. This improves the safety of the autonomous vehicle100by verifying the autonomy engine250across a full and evenly distributed space of possible driving scenarios.

FIG.4is an example system400for redundantly supplying power to one or more microprocessors of an autonomous vehicle100. The system400includes a plurality of buses405a,405b(also referred to individually and collectively using reference number405). Each bus405is coupled to the power supply215and to a bus selector410. Further, each bus405of the plurality of buses405is independent of other buses405of the plurality of buses405. WhileFIG.4shows an embodiment with two buses405a,405b, in other embodiments, different numbers of buses405are included in the system400. For example, various embodiments include three buses405, four buses405, five buses405, or any other number of buses405.

The bus selector410selects one of the plurality of buses405as an output of the bus selector410. The bus selector410is one or more integrated circuits or other logic circuits that selects one of the buses405a,405bas an output based on characteristics of voltage or current detected along bus405aand bus405b. For example, the bus selector410selects bus405aas output in response to the bus selector410detecting a higher voltage on bus405athan on bus405b. Similarly, the bus selector410selects bus405bas output in response to the bus selector410detecting a higher voltage on bus405bthan on bus405a. In various embodiments, the bus selector410selects whichever bus405coupled to the bus selector410having a highest voltage as the output of the bus selector410.

The output of the bus selector410is coupled to a power controller415, which is also coupled to a power storage unit425. In some embodiments, the output of the bus selector410is coupled to the power storage unit425. The power controller415is a microcontroller, processor, logical circuit, field-programmable gate array (FPGA), or other structure configured to select a power output as one of the outputs of the bus selector410or the power storage unit425. However, in some embodiments, such as the embodiment shown inFIG.4, the output of the bus selector410is coupled to a charging system420, with the charging system420coupled to the power storage unit425. In some embodiments, the power controller415is coupled to the charging system420, with the charging system420coupled to the power storage unit425. However, in other embodiments, the power controller415is directly coupled to the power storage unit425, and the output of the bus selector410is coupled to the charging system420.

The power controller415selects the power output based on the output of the bus selector410. The power output of the power controller415is coupled to at least one of a first power domain435aor a second power domain435b, with the first power domain435aincluding a first set of microprocessors430aand the second power domain435bincluding a second set of microprocessors430b. WhileFIG.4shows an example including two power domains, in other embodiments, additional power domains are coupled to the power controller415to increase redundancy. The power output selected by the power controller415is directed to at least one of the first power domain435aor the second power domain435b. In various embodiments, the power output is directed to a single power domain435, with other power domains435not receiving power. In other embodiments, power is provided to a power domain435athrough the power output, with a portion of the power output sufficient for one or more microprocessors in the power domain435bto operate in a standby mode directed to the power domain435b

In various embodiments, the power controller415selects the power output based on a voltage of the output of the bus selector410. For example, the power controller415selects the power output as the output of the bus selector410in response to determining the voltage of the output of the bus selector410is at least a threshold voltage. In the preceding example, the power controller415selects the power output as an output of the power storage unit425in response to determining the voltage of the output of the bus selector410is less than the threshold voltage. For example, the threshold voltage is a voltage sufficient to operate at least one of the first power domain435aor the second power domain435b. In some embodiments, the threshold voltage is specified as a voltage sufficient to operate the first set of microprocessors430aor the second set of microprocessors430bfor at least a threshold amount of time. The threshold voltage is stored in a memory of the power controller415in various embodiments, allowing different systems400to specify different threshold voltages for selecting the power output of the power controller415.

In various embodiments, the threshold voltage stored by the power storage unit425is sufficient to power the first power domain435aor the second power domain435bfor a threshold amount of time for the autonomous vehicle100to complete a minimal risk condition. As used herein, a “minimal risk condition” specifies one or more actions for the autonomous vehicle100to complete while an autonomous mode to allow a driver to resume manual control of the autonomous vehicle100or for the autonomous vehicle100to safely come to a stop while in the autonomous mode. In some embodiments, the minimal risk condition specifies the autonomous vehicle100moving to an emergency lane or otherwise out of a lane including moving traffic and stopped. In other embodiments, the minimal risk condition specifies the autonomous vehicle100travels an off ramp and comes to a stop. As another example, a minimal risk condition specifies the autonomous vehicle100enters a lane for traffic moving at a slower speed. In another example, a minimal risk condition specifies the autonomous vehicle100perform autonomous control operations for a threshold amount of time to allow a driver to resume manual control of the autonomous vehicle100. For another example, the minimal risk condition specifies the autonomous vehicle100come to a stop in a lane where the autonomous vehicle100Is currently travelling. In other embodiments, the minimal risk condition specifies multiple actions for the autonomous vehicle to complete100. For example, a minimal risk condition specifies the autonomous vehicle100complete a maneuver in progress, move to a different lane than a current lane, identify a location out of a flow of traffic (e.g., on a side of a road), come to a stop in the identified location, park, and turn on hazard lights. In different embodiments, different combinations of actions or actions are specified as the minimal risk condition; for example, different autonomous vehicles100store information identifying different vehicle-specific minimal risk conditions. Both the first power domain435aand the second power domain435bare capable of providing instructions for completing the minimal risk condition.

The charging system420provides power from the output of the bus selector410to the power storage unit425. This causes the output of the bus selector410to charge the power storage unit425, allowing the power storage unit425to store power from the power supply215received via the output of the bus selector410. In some embodiments, the charging system420obtains charging information from the power storage unit425and adjusts charging of the power storage unit425accordingly. For example, the charging system420obtains a current voltage from the power storage unit425and determines whether a current voltage of the power storage unit425is less than a threshold voltage.

The power storage unit425is a device configured to store power. Examples of the power storage unit425include a battery or a capacitor. In various embodiments, the power storage unit425is configured to store a minimum voltage for operating at least one of the first set of microprocessors430aor the second set of microprocessors430b. For example, the power storage unit425is configured to store a voltage capable of operating at least one of the first set of microprocessors430aor the second set of microprocessors430bfor at least a threshold amount of time. The power storage unit425receives power from the output of the bus selector410, so the power storage unit425accumulates power received from output of the bus selector410. This allows the power storage unit425to act as an alternative power source that is charged while at least one of the buses405is supplying power as the output of the bus selector410and is used when the output of the bus selector410satisfies one or more criteria (e.g., when the output of the bus selector410has less than a threshold voltage). In different embodiments, the power storage unit425has different power storage capacities or charges at different rates. WhileFIG.4shows a single power storage unit425for purposes of illustration, in other embodiments, the system400includes multiple power storage units425coupled to the output of the bus selector410and to the power controller415.

In the embodiment shown inFIG.4, the power output of the power controller is coupled to a control bus440that comprises connections between the power controller415and each of at least a collection of autonomous vehicle control systems223to route power from the power storage unit425to at least the collection of autonomous vehicle control systems223. Inclusion of the control bus440simplifies routing of power from the power storage unit425to different autonomous vehicle control systems223. In some embodiments, the threshold amount of power stored by the power storage unit425is sufficient to operate the collection of autonomous vehicle control systems223and one of the first set of microprocessors430aor the second set of microprocessors430bfor a sufficient amount of time for the autonomous vehicle100to complete a minimum risk condition. The collection of autonomous vehicle control systems223includes one or more autonomous vehicle control systems223capable of completing a minimal risk condition and capable of modifying movement of the autonomous vehicle100. For example, the collection of autonomous vehicle control systems223includes a braking system and a steering system. One or more lighting systems may be included in the collection of autonomous vehicle control systems223in various implementations. The collection of autonomous vehicle control systems223excludes one or more autonomous vehicle control systems, such as an entertainment system or a heating and air conditioning control system, in various embodiments.

A domain controller445is coupled to the first power domain435aand to the second power domain435b. The domain controller445includes switching logic that redirects power from the power output of the power controller415to the first power domain435aor to the second power domain435bbased on one or more conditions. For example, the domain controller445routes power that the first power domain435areceives from the power output of the power controller415to the second power domain435bin response to one or more microprocessors in the first power domain435aproviding less than a threshold amount of functionality. In various embodiments, the domain controller445monitors the first power domain435aand the second power domain435band determines whether the first power domain435aor the second power domain435bis capable of providing instructions for the autonomous vehicle to complete a minimal risk condition using at least the collection of the autonomous vehicle control systems223that control movement of the autonomous vehicle100while the autonomous vehicle100is in an autonomous mode based on instructions provided by the first set of microprocessors430aor by the second set of microprocessors430b. In response to determining the first power domain435ais not capable of providing instructions to at least the collection of autonomous vehicle control systems223to complete the minimal risk condition, the domain controller445routes power from the first power domain435ato the second power domain435b. Similarly, in response to determining the second power domain435bis not capable of providing instructions to at least the collection of autonomous vehicle control systems223to complete the minimal risk condition, the domain controller445routes power from the second power domain435bto the first power domain435a. The domain controller445allows the power output of the power controller415to be routed to a power domain435capable of completing a minimal risk condition, providing redundancy for the autonomous vehicle completing a minimal risk condition while in an autonomous mode. This allows the domain controller445to direct the power output to a power domain435capable of executing functionality for completing a minimal risk condition, providing additional safety for a driver of the autonomous vehicle100.

FIG.5shows an example redundant power fabric for autonomous vehicle model training using low-discrepancy sequences. The redundant power fabric provides redundant pathways for power transfer between the power supplies215, the sensors212, and the CPU packages204. In this example, the power supplies215are coupled to the sensors212and CPU packages via two switched fabrics214aand214b. The topology shown inFIG.5provides redundant pathways between the power supplies215, the sensors212, and the CPU packages204such that power can be rerouted through any of multiple pathways in the event of a failure in an active connection pathway. The switched fabrics214aand214bmay provide power to the sensors212using various connections, including Mobile Industry Processor Interface (MIPI), Inter-Integrated Circuit (I2C), Universal Serial Bus (USB), or another connection. The switched fabrics214aand214bmay also provide power to the CPU packages204using various connections, including Peripheral Component Interconnect Express (PCIe), USB, or other connections. Although only two switched fabrics214aand214bare shown connecting the power supplies215to the sensors212and CPU packages204, the approach shown byFIG.5can be modified to include three, four, five, or more switched fabrics214. This example redundant power fabric improves the safety and reliability of the autonomous vehicle100by allowing for dynamic switching of power pathways to ensure that each component may receive the required power for operation should a power connection be damaged or otherwise negatively impacted.

FIG.6is an example redundant data fabric for autonomous vehicle model training using low-discrepancy sequences. The redundant data fabric provides redundant data connection pathways between sensors212and CPU packages204. In this example view, three CPU packages204a,204b, and204care connected to three sensors212a,212b, and212cvia three switched fabrics213a,213b, and213c. Each CPU package204a,204b, and204cis connected to a subset of the switched fabrics213a,213b, and213c. For example, CPU package204ais connected to switched fabrics213aand213c, CPU package204bis connected to switched fabrics213aand213b, and CPU package204cis connected to switched fabrics213band213c. Each switched fabric213a.213b, and213cis connected to a subset of the sensors212a,212b, and212c. For example, switched fabric213ais connected to sensors212aand212b, switched fabric213bis connected to sensor212band212c, and switched fabric213cis connected to sensors212aand212c. Under this topology, each CPU package204a,204b, and204chas an available connection path to any sensor212a,212b, and212c. It is understood that the topology ofFIG.6is exemplary, and that CPU packages, switched fabrics, sensors, or connections between components may be added or removed while maintaining redundancy. This example redundant data fabric improves the safety and reliability of the autonomous vehicle100by allowing for the use of redundant sensors and processors that may be dynamically linked via the redundant data fabric in response to an error or other condition.

For further explanation,FIG.7shows a block diagram of a system700for redundantly supplying power to one or more microprocessors730A and one or more microprocessors730B. In various embodiments, the system700is included in an autonomous vehicle100, as further described above in conjunction withFIG.1. For example, the microprocessors730A,730B are CPU packages204further described above in conjunction withFIG.2. However, in other embodiments, the system700is included in another device or another system to provide redundant power to one or more microprocessors730A,730B.

The power supply215supplies voltage and current to components of the system700. In various embodiments, the power supply215is a battery, a capacitor, or another charge source, or any of a combination of these. However, other power sources comprise the power supply215in various embodiments. In embodiments where the power supply215is included in an autonomous vehicle100, such as the autonomous vehicle further described above in conjunction withFIGS.1-5, the power supply215is an alternator driven by an internal combustion engine of the autonomous vehicle100or another device driven by the engine of the autonomous vehicle100. In other embodiments, the power supply215is a power supply of the autonomous vehicle100, such as a battery of the autonomous vehicle100. For example, the power supply215is an ignition battery of the autonomous vehicle100. As another example, the power supply215is an electric vehicle battery (or traction battery) of an electric autonomous vehicle100or of a hybrid autonomous vehicle100. In some embodiments, the power supply215is an extension of a power system of an autonomous vehicle100. However, in other embodiments, the power supply215is independent form the power supply215of the electric vehicle.

For purposes of illustration,FIG.7shows a single power supply215. However, in other embodiments, the system700includes multiple power supplies215. In embodiments where the system700is included in an autonomous vehicle100, one power supply215is an extension of the power system of the autonomous vehicle100, while a different power supply215is independent from the power system of the autonomous vehicle100. In some embodiments, different power supplies215have different types. For example, a first power supply215is a battery, while a second power supply215is a capacitor or any of the other power sources as described elsewhere. As another example, a first power supply215is driven by an engine of the autonomous vehicle100, while a second power supply215is a battery (or a capacitor) that is independent of the engine of the autonomous vehicle100.

A plurality of buses705A,705B (also referred to individually or collectively using reference number705) are coupled to the power supply215and to a bus selector710. Each bus705A,705B is coupled to both the power supply215and to the bus selector710. Further, different buses705A,705B are independent of each other. A bus705directs power from the power supply215to the bus selector710, so a bus comprises an electrical connection between the power supply215and the bus selector710. WhileFIG.7shows an embodiment with two buses705A,705B, in other embodiments, different numbers of buses705are included in the system700. For example, various embodiments include three buses705, four buses705, five buses705, or any other number of buses705.

In some embodiments, each bus705includes a protection system, or is coupled to a protection system, configured to prevent high-energy transient pulses from traveling from the power supply215through a bus705to other components of the system700. For example, the protection system includes a switch configured to disconnect the power supply215from the bus705in response to the protection system detecting a voltage on the bus705exceeding a threshold. In another embodiments, the protection system includes a transient voltage suppressor diode. As another example, the protection system including a transient voltage suppressor diode and a switch configured to disconnect the power supply215from the bus705in response to the protection system detecting a voltage on the bus705exceeding a threshold. In other examples, the protection system includes a buck regulator or a buck-boost regulator. A protection system coupled to a bus705also protects components of the system700from reverse voltage or overcurrent. For example, the protection system includes an ideal diode controller or one or more other components to protect from reverse voltage. In embodiments where the power supply215is a direct current (DC) source, the protection system also protects components of the system700from alternating current (AC) superimposed on the output of the DC source. For example, the protection system includes an active rectifier controller to remove a superimposed AC signal from a DC output of the power supply215. A protection system is coupled to the bus705and to the bus selector710, so voltage or current from the power supply215is directed through the bus protection system before reaching the bus selector710.

Further, each bus705is coupled to a filter in some embodiments. When a bus705is coupled to a filter, voltage or current from the power supply215travels through the filter via the bus705, with an output of the filter coupled to the bus selector710. The filter removes or attenuates electromagnetic interference, such as electromagnetic interference from switching currents or from switching voltages included in the system700. In various embodiments, the filter removes electromagnetic interference having frequencies within a particular range of frequencies.

The bus selector710is coupled to each bus705A,705B. The bus selector710is one or more integrated circuits or other logic circuits that selects one of the buses705A,705B as an output. In some embodiments, the bus selector710comprises one or more transistors and logic circuitry configured to select one of bus705A and bus705B as an output based on characteristics of voltage or current detected along bus705A and bus705B. For example, the bus selector710selects bus705A as output in response to the bus selector710detecting a higher voltage on bus705A than on bus705B. Similarly, the bus selector710selects bus705B as output in response to the bus selector710detecting a higher voltage on bus705B than on bus705A. In various embodiments, the bus selector710selects whichever bus705coupled to the bus selector710having a highest voltage as the output of the bus selector710. In some embodiments, the bus selector710associates a priority level with each bus705coupled to the bus selector710and accounts for the priority level of each bus705, as well as a voltage (or a current), of each bus705when selecting a bus705as the output of the bus selector710. For example, the bus selector710selects a bus705having a highest voltage and associated with a highest priority level as the output of the bus selector710. As described herein, the bus selector710provides a single output selected from multiple buses705coupled to the bus selector710.

The output of the bus selector710is coupled to a power controller715, which is also coupled to a power storage unit725. In some embodiments, the output of the bus selector710is coupled to the power storage unit725. However, in other embodiments, such as the embodiment shown inFIG.7, the output of the bus selector710is coupled to a charging system720, with the charging system720coupled to the power storage unit725. In some embodiments, the power controller715is coupled to the charging system720, with the charging system720coupled to the power storage unit725. However, in other embodiments, the power controller715is directly coupled to the power storage unit725, and the output of the bus selector710is coupled to the charging system720. In another embodiment, the power controller715is directly coupled to the power storage unit725and the output of the bus selector710is also directly coupled to the power storage unit725. The power controller715is a microcontroller, processor, logical circuit, field-programmable gate array (FPGA), or other structure configured to select a power output as one of the output of the bus selector710and the power storage unit725.

The power controller715selects the power output based on the output of the bus selector710. In various embodiments, the power controller715selects the power output based on a voltage of the output of the bus selector710. For example, the power controller715selects the power output as the output of the bus selector710in response to determining the voltage of the output of the bus selector710is at least a threshold voltage. In the preceding example, the power controller715selects the power output as an output of the power storage unit725in response to determining the voltage of the output of the bus selector710is less than the threshold voltage. In some embodiments, the threshold voltage is specified based on power consumption by microprocessors730A,730B coupled to the power controller715. For example, the threshold voltage is a voltage sufficient to operate at least one of microprocessor730A or microprocessor730B. In some embodiments, the threshold voltage is specified as a voltage sufficient to operate microprocessor730A or microprocessor730B for at least a threshold amount of time. The threshold voltage is stored in a memory of the power controller715in various embodiments, allowing different systems700to specify different threshold voltages for selecting the power output of the power controller715. Such embodiments allow the power controller715to prevent the power output from falling below the threshold voltage.

The charging system720provides power from the output of the bus selector710to the power storage unit725. This causes the output of the bus selector710to charge the power storage unit725, allowing the power storage unit725to store power from the power supply215received via the output of the selector710. In various embodiments, the charging system720includes buck-boost charging circuitry that charges the power storage unit725. Inclusion of buck-boost charging circuitry allows the charging system720to charge power storage units725having different storage capacities (e.g., power storage units725having different voltages). However, in other embodiments, the charging system720includes different charging circuitry for charging the power storage unit725.

In some embodiments, the charging system720obtains charging information from the power storage unit725and adjusts charging of the power storage unit725accordingly. For example, the charging system720obtains a current voltage from the power storage unit725and determines whether a current voltage of the power storage unit725is less than a threshold voltage. In response to determining the current voltage of the power storage unit725is less than the threshold voltage, the charging system720directs power from the output of the bus selector710to the power storage unit725. In response to determining the current voltage of the power storage unit725equals the threshold voltage, the charging system720stops directing power from the output of the bus selector710to the power storage unit725. In some embodiments, the charging system720periodically compares a voltage of the power storage unit725to the threshold voltage to determine whether to direct power from the output of the bus selector710to the power storage unit725. In other embodiments, the charging system720continuously compares a voltage of the power storage unit725to the threshold voltage to determine whether to direct power from the output of the bus selector710to the power storage unit725. In some embodiments, the threshold voltage stored by the power storage unit725is determined based on the microprocessor730A or by the microprocessor730B coupled to the power controller715. For example, the threshold voltage is a voltage sufficient to operate at least one of the microprocessor730A or the microprocessor730B. As an example, the threshold voltage stored by the power storage unit725is a voltage sufficient to operate at least one of the microprocessor730A or the microprocessor730B for at least a threshold amount of time. This allows the power storage unit725to store adequate voltage to be an alternative power source for operating the microprocessor730A or the microprocessor730B when the output of the bus selector710is insufficient for powering the microprocessor730A or the microprocessor730B.

Further, in some embodiments the charging system720obtains a temperature of the power storage unit725. For example, the charging system720includes a thermocouple that is thermally coupled to the power storage unit725to determine a temperature of the power storage unit725. As another example, the charging system720is coupled to an infrared thermometer that is directed to the power storage unit725to capture the temperature of the power storage unit725. The charging system720compares the temperature of the power storage unit725to a maximum temperature and stops directing power from the output of the bus selector710to the power storage unit725in response to the temperature of the power storage unit725equaling or exceeding the maximum temperature. While the temperature of the power storage unit725is less than the maximum temperature, the charging system720directs power from the output of the bus selector710to the power storage unit725. Accounting for the temperature of the power storage unit725allows the charging system720to prevent the power storage unit725from overheating when being charged by the output of the bus selector710. In some embodiments, the charging system720accounts for both the current voltage stored by the power storage unit725and the temperature of the power storage unit725. For example, the charging system720directs power from the output of the bus selector710to the power storage unit725when both the temperature of the power storage unit725is less than the maximum temperature and the current voltage of the power storage unit725is less than the threshold voltage. In the preceding example, the charging system720stops directing power from the output of the bus selector710when the temperature of the power storage unit725is not less than the maximum temperature or when the current voltage of the power storage unit equals or exceeds the threshold voltage.

In some embodiments, the power controller715, rather than the charging system720, determines whether to direct power from the output of the bus selector710to the power storage unit725. For example, the power controller715is coupled to the power storage unit725and to the output of the power storage unit725. In such configurations, the power controller715obtains a current voltage of the power storage unit725and directs power from the output of the bus selector710in response to the current voltage of the power storage unit725being less than the threshold voltage, as further described above. The power controller715obtains a temperature of the power storage unit725and stops directing power from the output of the bus selector710in response to the temperature of the power storage unit725equaling or exceeding a maximum temperature, as further described above. In some embodiments the power controller715directs or stops directing power from the output of the bus selector710to the power storage unit725, allowing the power controller715to regulate charging of the power storage unit725and to determine whether the power output is from the power storage unit725or is from the output of the bus selector710.

The power storage unit725is a device configured to store power. Examples of the power storage unit725include a battery or a capacitor. In various embodiments, the power storage unit725is configured to store a minimum voltage for operating at least one of the microprocessor730A or the microprocessor730B. For example, the power storage unit725is configured to store a voltage capable of operating at least one of the microprocessor730A or the microprocessor730B for at least a threshold amount of time. The power storage unit725receives power from the output of the bus selector710, so the power storage unit725accumulates power received from output of the bus selector710. This allows the power storage unit725to act as an alternative power source that is charged while at least one of the buses705is supplying power as the output of the bus selector710and is used when the output of the bus selector710satisfies one or more criteria (e.g., when the output of the bus selector710has less than a threshold voltage). In different embodiments, the power storage unit725has different power storage capacities or charges at different rates. WhileFIG.7shows a single power storage unit725for purposes of illustration, in other embodiments, the system700includes multiple power storage units725coupled to the output of the bus selector710and to the power controller715.

In some embodiments, a charge storage device (not shown) is coupled to the power controller715. The charge storage device is coupled to the power controller715when the power controller715switches from selecting the output of the bus selector710from the output of the bus selector710to an output of the power storage unit and vice versa. Charge from the charge storage device is provided as the power output from the power controller715for an amount of time for the power controller715to select the appropriate source of the power output. For example, the charge storage device is a capacitor coupled to the power controller715when the power controller715is selecting the power output. The charge storage device allows the power output to remain uninterrupted to the first power domain735A and to the second power domain735B when the power controller715is switching to a different source of the power output than a current source of the power output.

The power controller715is coupled to a first power domain735A including microprocessor730A and to a second power domain735B including microprocessor730B. WhileFIG.7shows an example including two power domains, in other embodiments, additional power domains are coupled to the power controller715to increase redundancy. For example, the power controller715is coupled to three power domains, to four power domains, or to other numbers of power domains in different embodiments. In some embodiments, a power domain735A,735B includes multiple microprocessors730on a single circuit board, such as a printed circuit board. Different microprocessors730in a power domain735A,735B provide different functionalities in different embodiments. For example, different microprocessors730in a power domain735A,735B provide control signals to different systems, such as different autonomous vehicle control systems223, as further described below in conjunction withFIG.10.

The power output selected by the power controller715is directed to at least one of the first power domain735A or the second power domain735B. In various embodiments, the power output is directed to a single power domain735, with other power domains735not receiving power. In other embodiments, power is provided to a power domain735A through the power output, with a portion of the power output sufficient for one or more microprocessors in the power domain735B to operate in a standby mode directed to the power domain735B In some embodiments, the power output selected by the power controller715is directed to both the first power domain735A and to the second power domain735B. The power output from the power controller715powers one or more microprocessors730in a power domain735A,735B that receives the power output. In various embodiments, the microprocessor730A includes one or more processors configured to execute instructions stored in a memory coupled to the one or more processors. Similarly, the microprocessor730B includes one or more additional processors configured to execute instructions stored in an additional memory coupled to the one or more additional processors. For example, the system700is included in an autonomous vehicle100, and the microprocessor730A included in the first power domain735A is a microprocessor coupled to a braking electronic control unit of the autonomous vehicle100and microprocessor730B in second power domain735B is a second microprocessor coupled to the braking electronic control unit of the autonomous vehicle. In the preceding example, the system700provides autarchical power to the microprocessor and to the second microprocessor from the power supply215or from the power storage unit725. The configuration described above in conjunction withFIG.7allows the power storage unit725to supply power to operate the microprocessor and the second microprocessor when the power supply215is unable to provide sufficient power to the microprocessor and to the second microprocessor. In some embodiments, the instructions stored in the additional memory are a functional duplicate of the instructions stored in the memory, allowing the microprocessor730A and the microprocessor730B to provide common functionality, providing redundancy between the first power domain735A and the second power domain735B.

WhileFIG.7shows an embodiment where the first power domain735A includes a single microprocessor730A, in other embodiments, the first power domain735A includes any number of microprocessors730A. Similarly, in embodiments other than the embodiment shown inFIG.7, the second power domain735B includes any number of microprocessors730B. As further described below in conjunction withFIG.9, in some embodiments where the system700is included in an autonomous vehicle100, the first power domain735A and the second power domain735B each include one or more autonomous vehicle control systems223. In embodiments where the first power domain735A or the second power domain735B include multiple microprocessors730, the threshold voltage stored by the power storage unit725is determined based on a voltage for operating microprocessor730included in a single power domain735. For example, the threshold voltage stored by the power storage unit725is a voltage sufficient to operate the one or more microprocessors730A included in power domain735A or sufficient to operate the one or more microprocessor730B in power domain735B. In another example, the threshold voltage stored by the power storage unit725is a voltage sufficient to operate the one or more microprocessors730in one power domain735A,735B and to allow one or more microprocessors730in a second power domain735B.735B to operate in a standby state. For example, in the standby state, one or more microprocessors730perform a set of computations or perform computations but do not generate output signals. As an example, the threshold voltage is a voltage sufficient for microprocessors730included in the first power domain735A to operate with full functionality and for microprocessors730in the second power domain735B to operate in a standby state. In another example, the threshold voltage is a voltage sufficient for microprocessors730in multiple power domains735to operate with full functionality. In various embodiments, the power storage unit725maintains a voltage sufficient for microprocessors730in at least one power domain735A.735B to provide full functionality, allowing at least one power domain735A.735B to provide full functionality (e.g., to provide output signals for controlling one or more systems).

In some embodiments, the power controller715activates connections from the power storage unit725to the first power domain735A and to the second power domain735B when the power controller715selects the power storage unit725as the power output. Activating the connections electrically couples the power storage unit725to the first power domain735A and to the second power domain735B. Alternatively, the power controller715routes power from the power storage unit725to the first power domain735A and to the second power domain735B through the power controller715and connections between the power controller715and the first power domain735A and between the power controller715and the second power domain735B.

In various embodiments, the one or more microprocessors730A and the one or more microprocessors730B provide common functionality to provide a measure of redundancy for the functionality. If the one or more microprocessors730A are inoperable, the functionality provided the one or more microprocessors730A is provided by the one or more microprocessors730B. In some embodiments, the first power domain735A and the second power domain735B each include switching logic that redirects power from the power output based on one or more conditions. For example, switching logic in the first power domain735A routes power that the first power domain735A receives from the power output of the power controller715to the second power domain735B in response to one or more microprocessors730A in the first power domain735A providing less than a threshold amount of functionality. For example, in response to at least a threshold number of microprocessors730A in the first power domain735A being inoperative, switching logic routes power from the first power domain735A to the second power domain735B. This allows the one or more microprocessors730B in the second power domain735B to provide the functionality previously provided by the one or more microprocessors in the first power domain735A. In embodiments where a single power domain735A,735B receives the power output from the power controller715, switching logic in the power domain735A,735B allows power received from the power domain735A.735B to be directed to another power domain735A,735B in response to one or more microprocessors730in the power domain735A,735B being unable to provide at least a threshold amount of functionality. This provides redundancy across multiple power domains735to maintain at least the threshold amount of functionality.

In various embodiments, output from a single power domain735A,735B is provided to one or more other systems. For example, instructions are output from a single power domain735A,735B to one or more control systems, while other power domains735do not output instructions to the control systems. This results in a single power domain735A,735B providing output at a particular time, while other power domains735do not provide output at the particular time.

In some embodiments, the power controller715includes the switching logic to direct the power output to power domains735based on functionality provided by microprocessors730included in different power domains735, allowing the power controller715to reroute the power output to different power domains735. For example, in response to the power controller715not receiving a signal from the first power domain735A, the power controller715reroutes the power output from the first power domain735A to the second power domain735B. Such rerouting increases the power routed to the second power domain735B via the power output, allowing one or more microprocessors730B in the second power domain735B to provide increased functionality. In other embodiments, the power controller715reroutes the power output from the first power domain735A to the second power domain735B in response to receiving a signal from the first power domain735A. In various embodiments, both the first power domain735A and the second power domain735B include microprocessors730that are capable of completing a specific set of actions, such as actions comprising a minimal risk condition as further described below in conjunction withFIG.10. In other embodiments, both the first power domain735A and the second power domain735B include microprocessors that are capable of completing the minimal risk condition, as further described below in conjunction withFIG.10. For example, microprocessors730A in the first power domain735A execute different instructions than microprocessors730B in the second power domain735B, but the instructions executed by microprocessors730A or by microprocessors730B provide common functionality (e.g., both microprocessors730A and microprocessors730B execute instructions for completing a minimal risk condition for an autonomous vehicle, while different microprocessors may execute different instructions to complete the minimal risk condition). This allows a power domain735A,735B to which the power output is routed to perform the specific set of actions when receiving power. For example, when a connection to one or more microprocessors730A in the first power domain735A is damaged or loose, the one or more microprocessors730A receive less than a threshold amount of power (e.g., voltage), preventing the first power domain735A from completing the specific set of actions. In response to the one or more microprocessors730A receiving less than the threshold amount of power, the power controller715reroutes the power output from the first power domain735A to the second power domain735B. This increases power to the second power domain735B, allowing the second power domain735B to complete the specific set of actions when the first power domain735A is unable to complete the specific set of actions.

For purposes of illustration,FIGS.8and9are process flow diagrams showing operation of the system700for supplying power to one or more microprocessors730A,730B. As shown inFIG.8, bus705A directs a first power flow805from the power supply215to the bus selector710. Similarly, bus705B directs a second power flow810from the power supply215to the bus selector710. The first power flow805and the second power flow810supplies voltage or current from the power supply215to the bus selector710. Based on one or more characteristics of the first power flow805and the second power flow810, the bus selector710selects one of bus705A or bus705B as an output. For example, the bus selector710selects bus705A as output in response to the bus selector710detecting a higher voltage from the first power flow805via bus705A than on the second power flow810received bus705B. Similarly, the bus selector710selects bus705B as output in response to the bus selector710detecting a higher voltage from the second power flow810via bus705B than from the first power flow805via bus705A. The bus selector710may use different characteristics, or combinations of characteristics, of the first power flow805and of the second power flow810to determine whether to select bus705A or bus705B.

In some embodiments, the bus selector710maintains one or more timing criteria, and accounts for the timing criteria, as well as characteristics of the first power flow805and characteristics of the second power flow810, when selecting between bus705A and bus705B. For example, the bus selector710maintains an amount of time that a bus705has been selected as the output of the bus selector710and a threshold time interval. In response to the amount of time that a bus705has been selected as the output of the bus selector710equaling or exceeding the threshold time interval, the bus selector710changes the output of the bus selector710to an alternative bus705. In some embodiments, the bus selector710changes the output of the bus selector710from a bus705A to an alternative bus705B in response to a voltage difference (or a current difference) between the first power flow805on bus705A and the second power flow810on bus705B not exceeding a threshold amount and in response to the bus output having been bus705A for at least the threshold time interval. Accounting for an amount of time a bus705has been the output of the bus selector710allows the bus selector710to periodically switch between which bus705is the output of the bus selector710.

In the example ofFIG.8, the bus selector710selects bus705A as the output. This selection causes the first power flow805to be output from the bus selector710. The first power flow805is directed from the bus selector710to the power controller715and to the charging system720in the embodiment shown byFIG.8. In other embodiments, the first power flow805is directed from output of the bus selector710output to the power storage unit725and to the power controller715. As further described above in conjunction withFIG.7, power from the first power flow805charges the power storage unit725.

As further described above in conjunction withFIG.7, the power controller715selects a power output based on the output of the bus selector710. In various embodiments, the power controller715selects the power output based on a voltage of the output of the bus selector710. For example, the power controller715selects the power output as the output of the bus selector710in response to determining the voltage of the output of the bus selector710is at least a threshold voltage. In the example shown byFIG.8, the power controller715determines the voltage of the first power flow805, which is the output of the bus selector710, has at least the threshold voltage. InFIG.8, the power output is the first power flow805, which is directed from the power controller715to the first power domain735A and to the second power domain735B.

For purposes of illustration,FIG.9shows bus705A directing the first power flow805from the power supply215to the bus selector710. Similarly, bus705B directs the second power flow810from the power supply215to the bus selector710. The bus selector710in the example ofFIG.9also selects bus705A as the output of the bus selector710. This causes the bus selector710to direct the first power flow805to the power controller715and to the charging system720(or to the power storage unit725).

However, in the example ofFIG.9, the power controller715selects the power output as the power storage unit725. For example, the power controller715determines that the voltage of the first power flow805is less than the threshold voltage, so the power controller715selects the power storage unit725as the power output. Selection of the power storage unit725as the power output causes an alternative power flow905from the power storage unit to be directed to the first power domain735A and to the second power domain735B. As further described above in conjunction withFIG.7, the threshold voltage is based on voltage sufficient to operate one or more microprocessors730A in the first power domain735A and to operate one or more microprocessors730B in the second power domain735B. The power controller715selects the power storage unit725as the power output in response to a voltage of the output of the bus selector (i.e., the first power flow805inFIG.9) being insufficient to operate one or more microprocessors730A in the first power domain735A and to operate one or more microprocessors730B in the second power domain735B.

In the example ofFIG.9, the alternative power flow905is directed from the power storage unit725to the first power domain735A through one or more connections between the power storage unit725and one or more microprocessors730A in the second power domain. Similarly, the alternative power flow905is directed to the second power domain735B through one or more connections between the power storage unit725and one or more microprocessors730B in the second power domain735B. However, in other embodiments, the alternative power flow905is directed from the power storage unit725to the power controller715, with connections between the power controller715and the first power domain735A and the second power domain735B directing the alternative power flow905from the power storage unit725to the first power domain735A and to the second power domain735B.

In various implementations, the system700is included in an autonomous vehicle100, as further described above in conjunction withFIG.1. For example, the system700, further described above in conjunction withFIGS.7-9couples the power supply215to one or more microprocessors730A,730B or to one or more autonomous vehicle control systems223, as further described above in conjunction withFIGS.1and2. For further illustration,FIG.10is a block diagram of an autonomous vehicle100including a system700for redundantly supplying power to one or more microprocessors730A.730B and to one or more autonomous vehicle control systems223. As shown inFIG.10, the system700further described above in conjunction withFIGS.7-9couples a power supply215to one or more microprocessors730A,730B. In further embodiments, the system700includes one or more sensors212of the autonomous vehicle100in a power domain735, so the system700couples the power supply215to one or more sensors212of the autonomous vehicle100in some embodiments. For clarity, components of the autonomous vehicle100further described above in conjunction withFIGS.1and2are not reproduced inFIG.10.

As shown inFIG.10, the system700includes a plurality of buses705A,705B (also referred to individually and collectively using reference number705). Each bus705is coupled to the power supply215and to a bus selector710, as further described above in conjunction withFIG.7. Further, each bus705of the plurality of buses705is independent of other buses705of the plurality of buses705. As further described above in conjunction withFIG.7, the bus selector710selects one of the plurality of buses705as an output of the bus selector710. For example, the bus selector710selects a bus705having a maximum voltage (or a maximum current) as the output of the bus selector710.

The output of the bus selector710is directed to a power controller715and to a charging system720in the embodiment shown inFIG.10. The charging system720charges the power storage unit725using power from the output of the bus selector710, as further described above in conjunction withFIG.10. Power from the power supply215is used to accumulate charge in the power storage unit725. WhileFIG.10depicts an embodiment where the output of the bus selector710is coupled to the charging system720, in other embodiments, the output of the bus selector710is directly coupled to the power storage unit725. In other embodiments, power from the bus selector710is directed from the output of the bus selector710to the power controller715and from the power controller715to the power storage unit725. Additionally, in some embodiments, the charging system720is coupled to the power controller715, while in other embodiments the power controller715is not coupled to the charging system720.

Based on characteristics of the output of the bus selector710, the power controller715selects a power output. The power controller715selects either the output of the bus selector710or the power storage unit725as the power output. In various embodiments, the power controller715selects the power output based on one or more characteristics of the output of the bus selector710. For example, the power controller715compares a voltage of the output of the bus selector710to a threshold voltage. In response to determining the output of the bus selector710has a voltage equaling or exceeding the threshold voltage, the power controller715selects the power output as the output of the bus selector710, as further described above in conjunction withFIGS.7and9. However, in response to determining the output of the bus selector710has a voltage less than the threshold voltage, the power controller715selects the power storage unit725as the power output, as further described above in conjunction withFIGS.7and9. Charging the power storage unit725using power from the power supply215via the bus selector710allows the power storage unit725to function as an alternative power source when the power supply215provides less than a threshold voltage.

In some embodiments, in response to selecting the power storage unit725as the power output, the power controller715transmits an instruction to one or more driver notification systems of the autonomous vehicle100. In response to receiving the instruction, the one or more driver notification systems present one or more notifications to a driver of the autonomous vehicle that the power storage unit725is powering one or more microprocessors730A,730B. For example, a warning light or a warning message is displayed to the driver via a display of the autonomous vehicle100visible to the driver. In another example, a sound system of the autonomous vehicle100plays a warning message or a specific sound to indicate to the driver that the power storage unit725is powering one or more microprocessors730A,730B. In another example, a driver notification system provides haptic feedback to the driver via the steering wheel of the autonomous vehicle100or through a seat of the autonomous vehicle100in response to receiving the instruction from the power controller715. Notifications may be continuously provided to the driver, provided to the driver at periodic intervals, or provided to the driver when the power controller715initially selects the power storage unit725as the power output. Providing one or more notifications to the driver allows the power controller715to notify the driver when a bus705is no longer powering one or more microprocessors730A,730B, indicating to the driver that the one or more microprocessors730A,730B are drawing from a power sourced with reduced capacity relative to the bus705.

The power output selected by the power controller715is routed to a first power domain735A and to a second power domain735B. In the embodiment shown byFIG.10, power domain735A includes a first set of microprocessors730A that are coupled to at least a collection of autonomous vehicle control systems223. Similarly, power domain735B includes a second set of microprocessors730B that are also coupled to at least the collection of autonomous vehicle control systems223. In some embodiments, one or more of the autonomous vehicle control systems223are included in the first power domain735A and in the second power domain735B. In such embodiments, the power output from the power controller715provides power to the autonomous vehicle control systems223included in the first power domain735A and to the autonomous vehicle control systems223included in the second power domain735B.

In various embodiments, the first set of microprocessors730A or the second set of microprocessors730B provide instructions for controlling movement of the autonomous vehicle100when the autonomous vehicle100is an autonomous mode. For example, the first set of microprocessors730A or the second set of microprocessors730B provide instructions to the collection of autonomous vehicle control systems223controlling movement of the autonomous vehicle100when the autonomous vehicle100is in an autonomous mode. In some embodiments, the collection of autonomous vehicle control systems223included in the first power domain735A and in the second power domain735B determine a threshold voltage to be maintained by the power storage unit725. For example, the threshold voltage included in the power storage unit725is a voltage sufficient to operate a set of microprocessors (the first set of microprocessors730A or the second set of microprocessors730B) coupled to at least the collection of autonomous vehicle control systems223for at least a threshold amount of time. In another example where one or more of the collection of autonomous vehicle control systems223are included in the first power domain735A and in the second power domain735B, the threshold voltage included in the power storage unit725is a voltage sufficient to operate at least one set of microprocessors730A,730B and the collection of autonomous vehicle control systems223for at least a threshold amount of time. The threshold amount of time is determined based on a time for the autonomous vehicle100to satisfy a minimal risk condition where the autonomous vehicle comes to a complete stop in some embodiments. In various embodiments, the minimal risk condition includes one or more actions to be performed for the autonomous vehicle100to be out of danger, as further described below.

In some embodiments, the minimal risk condition specifies the autonomous vehicle100moving to an emergency lane or otherwise out of a lane including moving traffic and stopped. In other embodiments, the minimal risk condition specifies the autonomous vehicle100travels an off ramp and comes to a stop. In other examples, the minimal risk condition specifies the autonomous vehicle100stays in a lane in which the autonomous vehicle100is currently travelling. As another example, a minimal risk condition specifies the autonomous vehicle100enters a lane for traffic moving at a slower speed. In another example, a minimal risk condition specifies the autonomous vehicle100perform autonomous control operations for a threshold amount of time to allow a driver to resume manual control of the autonomous vehicle100. For another example, the minimal risk condition specifies the autonomous vehicle100come to a stop in a lane where the autonomous vehicle100is currently travelling. In other embodiments, the minimal risk condition specifies multiple actions for the autonomous vehicle to complete100. For example, a minimal risk condition specifies the autonomous vehicle100complete a maneuver in progress, move to a different lane than a current lane, identify a location out of a flow of traffic (e.g., on a side of a road), come to a stop in the identified location, park, and turn on hazard lights. In different embodiments, different combinations of actions or actions are specified as the minimal risk condition; for example, different autonomous vehicles100store information identifying different vehicle-specific minimal risk conditions.

In various embodiments, the power storage unit725stores charge (e.g., voltage) sufficient for the microprocessors730A,730B or the collection of autonomous vehicle control systems223to complete a minimal risk condition, such as bringing the autonomous vehicle100to a complete stop. The autonomous vehicle100includes information identifying the minimal risk condition to be executed in various embodiments. In some embodiments, the autonomous vehicle100identifies the collection of autonomous vehicle control systems223for completing the minimal risk conditions. In various embodiments, a collection of autonomous vehicle control systems223for completing a minimal risk condition includes one or more autonomous vehicle control systems223capable of modifying movement of the autonomous vehicle100. For example, the collection of autonomous vehicle control systems223includes a braking system and a steering system, with the braking system and the steering system stored in association with the minimal risk conditions. Different minimal risk conditions may be associated with different collections of autonomous vehicle control systems223.

In some embodiments, the power storage unit725provides power to the microprocessors730A,730B in the first power domain735A or in the second power domain735B that provide control signals to at least the collection of the one or more autonomous vehicle control systems223. The autonomous vehicle control systems223receives power for performing actions affecting movement of the autonomous vehicle100in various embodiments, with the power output from the power controller715used to power microprocessors730A,730B that provide control signals or instructions to the collection of autonomous vehicle control systems223while the autonomous vehicle100is in an autonomous mode. The collection of autonomous vehicle control systems223perform one or more actions based on the control signals or instructions from the first set of microprocessors730A or from the second set of microprocessors730B. For example, a microprocessor730A,730B receiving the power output provides instructions to a braking system that activates brakes of the autonomous vehicle100at a time and with a force specified by a control signal from the microprocessor730A,730B. Similarly, a microprocessor730A,730B receiving the power output provides instructions to a transmission system of the autonomous vehicle100that changes a gear in which the autonomous vehicle100operates based on the received instructions. The power storage unit725provides the power controller715with a source of power capable to power one or more microprocessors730A,730B in at least one power domain735A.735B to provide control signals to one or more autonomous vehicle control systems223so the autonomous vehicle100completes a minimal risk condition. In such embodiments, the power storage unit725maintains a threshold voltage sufficient for microprocessors730A,730B in at least one power domain735A,735B to operate at full functionality for an amount of time for the autonomous vehicle100to compete the minimal risk condition. As further described above, the collection of autonomous vehicle control systems223control movement of the autonomous vehicle100. For example, the collection of autonomous vehicle control systems223control movement of the autonomous vehicle100based on instructions from a set of microprocessors730A,730B when the autonomous vehicle100is in an autonomous mode that allows the autonomous vehicle to handle the dynamic driving task. As another example, the collection of autonomous vehicle control systems223allows the autonomous vehicle100to complete a minimal risk condition by performing one or more movements or alternations in movement of the autonomous vehicle100.

In various embodiments, a threshold amount of power stored in the power storage unit725is based on the minimal risk condition. For example, the power storage unit725stores a threshold amount of power for a power domain735A,735B to provide control signals to the collection of autonomous vehicle control systems223for a threshold amount of time, with the threshold amount of time determined based on an amount of time to complete the minimal risk condition. In another example, the power storage unit725stores a threshold amount of power for a power domain735A,735B to provide control signals to the collection of autonomous vehicle control systems223for performing a set of functions, such as the functions comprising the minimal risk condition. In some embodiments, the threshold amount of power stored in the power storage unit725is based on one or more autonomous vehicle control systems223included in the collection of autonomous vehicle control systems223. For example, the power storage unit725includes a threshold amount of power sufficient to operate one or more microprocessors730in a power domain735A,735B and to operate one or more of the collection of autonomous vehicle control systems223for at least a threshold amount of time or for completion of a set of functions. In some embodiments, the power storage unit725maintains a threshold amount of power for operating one or more microprocessors730in a power domain to provide functionality for completing a minimum risk condition without providing power to one or more of the collection of autonomous vehicle control systems223. In alternative embodiments, the power storage unit725includes a threshold amount of power for operating one or more microprocessors730in a power domain to provide functionality for completing a minimum risk condition and for powering the collection of autonomous vehicle control systems223(or powering a subset of the collection of autonomous vehicle control systems223) to complete the minimal risk condition.

In other embodiments, the power output of the power controller715provides power to both microprocessors730A,730B and to the collection of autonomous vehicle control systems223coupled to the microprocessors730A,730B. In such embodiments, the power storage unit725has a threshold voltage that is sufficient to power microprocessors730A,730B in at least one power domain735A,735B for an amount of time for the autonomous vehicle100to complete a minimal risk condition and to power the collection of autonomous vehicle control systems223coupled to the microprocessors730A.730B in the power domain735. In embodiments where the power storage unit725provides power to at least a collection of autonomous vehicle control systems223when selected by the power controller715, the power controller715is coupled to a control bus1005. The control bus1005comprises connections between the power controller715and each of at least the collection of autonomous vehicle control systems223to route power from the power storage unit725to at least the collection of autonomous vehicle control systems223. Inclusion of the control bus1005simplifies routing of power from the power storage unit725to different autonomous vehicle control systems223.

In some embodiments, the collection of autonomous vehicle control systems223include a collection of systems controlling movement of the autonomous vehicle100in addition to one or more lights of the autonomous vehicle100. For example, the collection of autonomous vehicle control systems223include headlights of the autonomous vehicle100, hazard lights of the autonomous vehicle100, tail lights of the autonomous vehicle100, or other lights of the autonomous vehicle100. This allows at least some of the lights of the autonomous vehicle100remain operational by receiving power from one of the power domains735, increasing safety of the autonomous vehicle100by maintaining operability of at least some of the lights of the autonomous vehicle100.

Various autonomous vehicle control systems223are included in the first power domain735A and in the second power domain735B in different embodiments. For example, an autonomous vehicle control system223is a system configured to change a rate of speed of the autonomous vehicle100; for example, an autonomous vehicle control system223is a throttle control system or an accelerator. As another example, an autonomous vehicle control system223is a braking system configured to change application of one or more brakes of the autonomous vehicle. In some embodiments, the braking system controls brakes coupled to both the front and the rear wheels of the autonomous vehicle100. As another example, an autonomous vehicle control system223is a transmission of the autonomous vehicle100that changes a gear in which the autonomous vehicle100operates. As another example, an autonomous vehicle control system223is a steering system configured to change an orientation of the autonomous vehicle100; for example, the steering system is coupled to one or more wheels of the vehicle and repositions the wheels to change a direction of the autonomous vehicle100. Various combinations of autonomous vehicle control systems223or autonomous vehicle control systems223are included the first power domain735A and in the second power domain735B in various embodiments. Each autonomous vehicle control system223included in a power domain735A,735B is coupled to a microprocessor730A,730B in the power domain735, with a microprocessor730A,730B providing control signals or instructions to the autonomous vehicle control system223.

One or more systems of the autonomous vehicle100are excluded from the collection of autonomous vehicle control systems223coupled to the first power domain735A and to the second power domain735B. For example, the collection of autonomous vehicle control systems223excludes systems of the autonomous vehicle100that do not affect movement or functional safety requirements of the autonomous vehicle100. In some embodiments, the collection of autonomous vehicle control systems223do not include a heating, ventilation, and air conditioning system of the autonomous vehicle100. As another example, the collection of autonomous vehicle control systems223does not include an entertainment system of the autonomous vehicle100. In various embodiments, different combinations of systems controlling movement of the autonomous vehicle100are included in the collection of autonomous vehicle control systems223, allowing different embodiments to include different systems in the collection of autonomous vehicle control systems223.

In various embodiments, the one or more microprocessors730A,730B in the first power domain735A and the one or more microprocessors730A,730B in the second power domain735B provide common functionality to provide a measure of redundancy for the functionality. The one or more microprocessors730A,730B in one of the power domains735is inoperable, the functionality provided the one or more microprocessors730A,730B in the power domain735A.735B is provided by the one or more microprocessors730A,730B in another power domain735. As further described below, in some embodiments, a domain controller1010is coupled to the first power domain735A and to the second power domain735B. The domain controller1010includes switching logic that redirects power from the power output of the power controller715to the first power domain735A or to the second power domain735B based on one or more conditions. For example, the domain controller1010routes power that the first power domain735A receives from the power output of the power controller715to the second power domain735B in response to one or more microprocessors730A.730B in the first power domain735A providing less than a threshold amount of functionality. For example, in response to at least a threshold number of microprocessors730A,730B in the first power domain735A being inoperative, the domain controller1010routes power from the first power domain735A to the second power domain735B. This allows the one or more microprocessors730A,730B in the second power domain735B to provide the functionality previously provided by the one or more microprocessors730A,730B in the first power domain735A. In embodiments where a single power domain735A.735B receives the power output from the power controller715, switching logic in the domain controller1010allows power received from the power domain735A,735B to be directed to another power domain735A,735B in response to one or more microprocessors730in the power domain735A.735B being unable to provide at least a threshold amount of functionality. This provides redundancy across multiple power domains735to maintain at least the threshold amount of functionality for microprocessors730A,730B. In various embodiments, the microprocessors730A,730B in the power domains735provide instructions or control signals to one or more autonomous vehicle control systems223, with the redundancy provided by the system700allowing microprocessors730A,730B in at least one power domain735A,735B to continue receiving power for providing the instructions or the control signals to the corresponding autonomous vehicle control systems223.

The power storage unit725stores an amount of power sufficient to operate least one of the first power domain735A or the second power domain735B so at least the collection of autonomous vehicle control systems223remain operational for an amount of time needed to stop the autonomous vehicle100. This allows the power storage unit725to ensure operation of at least one power domain735A.735B until the autonomous vehicle100stops if the power supply215is unable to provide sufficient power to operate a power domain735. In embodiments where the power controller715also couples the power storage unit725to one or more autonomous vehicle control systems223, the power storage unit725allows the autonomous vehicle control systems223to remain operational when the power supply215provides insufficient power, enabling the autonomous vehicle control systems223to bring the autonomous vehicle to a stop.

In some embodiments, the power controller715monitors power provided to systems of the autonomous vehicle100other than the autonomous vehicle control systems223via the control bus1005. In response to determining less than a threshold amount of power is available to, or is received by, a system of the autonomous vehicle100, the power controller715, the power controller715directs at least a portion of the power output from the power controller715to the one or more systems of the autonomous vehicle100. When the power output selected by the power controller715is the power storage unit725, the one or more systems of the autonomous vehicle100receive power from the power storage unit725via the power output of the power controller715and the control bus1005. This allows the one or more systems of the autonomous vehicle100to receive power when another source of power for the one or more systems of the autonomous vehicle100is unavailable or is insufficient. In various embodiments, the power controller715monitors power available to a collection of systems of the autonomous vehicle100, with each system included in the set performing one or more actions comprising a minimal risk condition for the autonomous vehicle. As other examples, the collection of systems includes a steering system, a transmission, or other systems affecting movement of the autonomous vehicle100. For example, the collection of systems includes a brake controller and a power braking system, so the power controller715directs power from the power storage unit725to the brake controller and to the power braking system via the control bus1005when less than a threshold amount of power is available to the brake controller and to the power braking system. Such a configuration allows the power controller715to provide power from the power storage unit725to systems of the autonomous vehicle100that perform actions comprising a minimal risk condition to safely bring the autonomous vehicle100to a stop. In embodiments where the power output of the power controller715is directed to one or more systems of the autonomous vehicle100, the threshold voltage maintained by the power storage unit725accounts for power consumption requirements of the one or more systems of the autonomous vehicle100. For example, the power storage unit725maintains a threshold voltage that is sufficient for at least one power domain735A.735B to provide instructions or signals for operating one or more autonomous vehicle control systems223or for operating one or more systems controlling movement of the autonomous vehicle100for a threshold amount of time and for the one or more systems to remain functional for at least the threshold amount of time. In various embodiments, the threshold amount of time is an amount of time for completion of a minimal risk condition, as further described above, stored by the autonomous vehicle100.

In the embodiment shown byFIG.10, the system700includes a domain controller1010. The domain controller1010includes the switching logic to direct the power output to power domains735A,735B based on functionality provided by one or more microprocessors730included in different power domains735A.735B, allowing the domain controller1010to reroute the power output to different power domains735A,735B. For example, in response to the domain controller1010not receiving a signal from one or more microprocessors730A (e.g., from at least a threshold number of microprocessors730A) in the first power domain735A, the domain controller1010reroutes the power output from the first power domain735A to the second power domain735B. Such rerouting increases the power routed to the second power domain735B via the power output, allowing one or more microprocessors730B in the second power domain735B to provide signals or instructions to control one or more autonomous vehicle control systems223or other systems controlling movement of the autonomous vehicle100. In other embodiments, the domain controller1010reroutes the power output from the first power domain735A to the second power domain735B in response to receiving a signal from the first power domain735A.

In various embodiments, the domain controller1010monitors the first power domain735A and the second power domain735B and determines whether the first power domain735A or the second power domain735B is capable of providing instructions for the autonomous vehicle to complete the minimal risk condition, as further described above, using at least a collection of the autonomous vehicle control systems223that control movement of the autonomous vehicle100while the autonomous vehicle100is in an autonomous mode based on instructions provided by the first set of microprocessors730A or by the second set of microprocessors730B. In response to determining the first power domain735A is not capable of providing instructions to at least the collection of autonomous vehicle control systems223to complete the minimal risk condition, the domain controller1010routes power from the first power domain735A to the second power domain735B. Similarly, in response to determining the second power domain735B is not capable of providing instructions to at least the collection of autonomous vehicle control systems223to complete the minimal risk condition, the domain controller1010routes power from the second power domain735B to the first power domain735A. In various embodiments, the domain controller1010determines a power domain735A,735B is not capable of providing instructions for completing the minimal risk condition in response to determining the power domain735A,735B receives less than a threshold voltage from the power controller715. For example, the domain controller1010determines the power domain735A,735B is not capable of providing instructions for completing the minimal risk condition in response to determining the power domain735A,735B receives zero volts. As another example, the domain controller1010determines the power domain735A,735B is not capable of providing instructions for completing the minimal risk condition in response to determining a threshold number of microprocessors730in the power domain735A,735B receive less than the threshold voltage or receive zero volts. This allows the domain controller1010to determine a power domain735A,735B is not capable of providing instructions for completing the minimal risk condition when one or more microprocessors730in the power domain735A,735B are disconnected from the power output of the power controller715or have a degraded connection to the power output of the power controller715.

In various embodiments, output from a single power domain735A.735B is provided the collection of autonomous vehicle control systems223. For example, instructions are output from a single power domain735A,735B to the collection of autonomous vehicle control systems223, while other power domains735A,735B do not output instructions to the collection of autonomous vehicle control systems223. This results the collection of autonomous vehicle control systems223receiving instructions from a single power domain735A,735B at a particular time, with other power domains735A,735B not providing instructions to the collection of autonomous vehicle control systems223at the particular time.

In various embodiments, when routing power from a power domain735A,735B to an alternative power domain735A,735B, the domain controller1010also transfers instructions for completing the minimal risk condition from the power domain735A,735B to the alternative power domain735A,735B. Such transfer of instructions from the power domain735A,735B to the alternative power domain735A,735B allows the alternative power domain735A,735B to begin executing the minimal risk condition form a point when the power domain735A,735B was executing the minimal risk condition. This reduces an amount of time for the alternative power domain735A,735B to begin providing instructions to the one or more autonomous vehicle control systems223when the domain controller1010transfers power form the power domain735A,735B to the alternative power domain735. In other embodiments, microprocessors730A,730B in the alternative power domain735A,735B operate in a standby mode where they receive power and generate instructions based on inputs, but do not communicate the instructions from to the collection of autonomous vehicle control systems223. When the domain controller1010routes power to the alternative power domain735A,735B, the microprocessors730A.730B of the alternative power domain735A,735B provide instructions to the autonomous vehicle control systems223in place of microprocessors730A,730B in the power domain735A,735B.

In some embodiments, the first power domain735A includes a first steering control microprocessor, and the second power domain735B includes a second steering control microprocessor. The first steering control microprocessor provides instructions to a steering control unit. Similarly, the second steering control microprocessor may provide instructions to the steering control unit. Based on an instruction from the first steering control microprocessor or from the second steering control microprocessor, the steering control unit performs a dynamic driving task without input from a driver of the autonomous vehicle100. A dynamic driving task affects a direction or velocity of movement of the autonomous vehicle100. For example, a dynamic driving task changes a direction of movement of the autonomous vehicle100. As another example, the dynamic driving task maintains a current direction of movement of the autonomous vehicle100. In various embodiments, the steering control unit receives instructions from the first steering control microprocessor via a steering instruction output of the first power domain735A or from the second steering control microprocessor via a steering instruction output of the second power domain735B, resulting in the steering control unit receiving instructions from a single steering control microprocessor.

The first power domain735A has a domain selector input coupled to the domain controller1010. Similarly, the second power domain735B has a domain selector input coupled to the domain controller1010. The domain selector input of a power domain735A,735B receives a signal or an instruction from the domain controller1010that specifies whether the power domain735A,735B provides instructions to an autonomous vehicle control system223. For example, in response to receiving a first value via the domain selector input, a power domain735A,735B provides instructions to an autonomous vehicle control system223, while in response to receiving a second value via the domain selector input, the power domain735A.735B does not provide instructions to the autonomous vehicle control system223. In an example, the first steering control microprocessor provides instructions to the steering control unit through a steering control output of the first power domain735A in response to the first power domain735A receiving a first value from the domain controller1010through the domain selector input, while the second power domain735B receives a second value from the domain controller1010through the domain selector input and does not provide steering instructions to the steering control unit through the steering instruction output of the second power domain735B. This causes the domain controller1010to select one of the first power domain735A or the second power domain735B to transmit instructions to the steering control unit. As further described above, in various embodiments, the domain controller1010governs power transmission to the first power domain735A and to the second power domain735B. This allows the domain controller1010to route the power output from the power controller715to the first power domain735A or to the second power domain735B.

In some embodiments, the first power domain735A and the second power domain735B include additional microprocessors730A,730B, with outputs of a power domain735A,735B providing instructions from one or more additional microprocessors730A,730B to a corresponding autonomous vehicle control system223through an output. For example, the first power domain735A includes a first velocity control microprocessor, and the second power domain735B includes a second velocity control microprocessor. A braking control unit is coupled to a braking instruction output of the first power domain735A. Similarly, the braking control unit is coupled to a braking instruction output of the second power domain735B. The braking control unit modifies a velocity of the autonomous vehicle100without input from the driver in response to a braking instruction from a braking output of the first power domain735A or a braking instruction from a braking output of the second power domain735B. This allows a power domain735A.735B selected by the domain controller1010to provide instructions to the braking control unit to alter a velocity with which the autonomous vehicle100moves. Other microprocessors providing instructions to other autonomous vehicle control systems223are included in the first power domain735A and in the second power domain735B in other embodiments, allowing for various autonomous vehicle control systems223to receive instructions from corresponding outputs of a power domain735A.735B when the power domain735A,735B receives a domain selector input from the domain controller1010indicating that the power domain735A,735B has been selected to provide instructions to one or more autonomous vehicle control systems223.

In some embodiments, the domain controller1010is also coupled to the driver notification system. In response to the domain controller1010determining a power domain735A,735B is not capable of providing instructions for the autonomous vehicle to complete a minimal risk condition using the collection of autonomous vehicle control systems223, the driver notification system receives an instruction from the domain controller1010. The driver notification system presents one or more notifications to the driver of the autonomous vehicle in response to receiving the instruction. Examples notifications presented to the driver include: displaying a warning light to the driver, displaying a message to the driver through a display, playing a specific sound to the driver through one or more speaker, and playing a message to the driver through one or more speakers. Other types of notifications may be presented to the driver by the driver notification system in various embodiments. Notifications may be continuously provided to the driver, provided to the driver at periodic intervals, or provided to the driver when the domain controller1010determines a power domain735A.735B is not capable of providing instructions to complete a minimal risk condition. This allows the driver to be alerted when a power domain735A,735B is not capable of providing instructions for the autonomous vehicle to complete a minimal risk condition.

In the embodiment shown byFIG.10, one or more sensors212are coupled to the first power domain735A and to the second power domain735B. As further described above in conjunction withFIG.2, the sensors are configured to capture sensor data describing the operational and environmental conditions of the autonomous vehicle100. For example, the sensors212may include cameras (e.g., the cameras102-114ofFIG.1), accelerometers, Global Positioning System (GPS) radios, Lidar sensors, or other sensors. In various embodiments, coupling the sensors212to multiple power domains735allows the sensors212to receive power regardless of which power domain735A.735B receives the power output from the power controller715. For example, coupling the sensors212to both the first power domain735A and to the second power domain735B prevents power to the sensors212from being interrupted when power is routed from the first power domain735A to the second power domain735B or vice versa. As the microprocessors730A,730B in a power domain735A,735B receive data from the sensors212that is used to generate instructions or control signals for the collection of autonomous vehicle control systems223, preventing interruptions to power to the sensors212when routing power to a different power domain735. In other embodiments, the one or more sensors212receive power from an alternative source than the power domains735.

For further illustration,FIG.11shows a flowchart of a method for redundantly supplying power to one or more computing devices according to some embodiments of the present disclosure. The method ofFIG.11may be performed, for example, by the system700further described above in conjunction withFIGS.7-9in various embodiments.

The method shown inFIG.11includes selecting1105a bus705from a power supply215. In various embodiments, a plurality of buses705are coupled to a power supply215and to a bus selector710. Each bus705is independent of the other buses705, with each bus705directing power from the power supply215. The bus selector710selects1105a bus705, with the selected bus705output from the bus selector710. In various embodiments, the bus selector710selects1105a single bus705from a plurality of buses705coupled to the power supply215in various embodiments. As further described above in conjunction withFIG.7, the bus selector710uses characteristics of power transmitted by different buses705to select1005a bus705. For example, the bus selector710selects1105a bus705carrying a maximum voltage. As another example, the bus selector710selects a bus705having a maximum current. However, in other embodiments, the bus selector710may use any suitable characteristics or combination of characteristics of power carried by different buses705coupled to the power supply215to select1005a bus705.

The method ofFIG.11selects1110a power output as one of the selected bus705and a power storage unit725. In some embodiments, a power controller715is coupled to the selected bus705and to the power storage unit725. Based on characteristics of power carried by the selected bus705, the power controller715selects the selected bus705of the power storage unit725as the power output. For example, an output of the bus selector710is coupled to the power controller715to couple the power controller715to the selected bus705. Similarly, the power storage unit725is coupled to the power controller715. In various embodiments, the power controller715selects1110between the selected bus705and the power storage unit725based on a voltage of the selected bus705. In response to determining the voltage of the selected bus705is less than a threshold voltage, the power controller715selects1110the power storage unit725as the power output. However, in response to determining the voltage of the selected bus705equals or exceeds the threshold voltage, the power controller715selects1110the selected bus705as the power output. As further described above in conjunction withFIGS.7-9, the threshold voltage is a voltage sufficient to operate one or more computing devices, or systems, that receive the power output selected1110by the power controller715. In some embodiments, the threshold voltage is specified as a voltage sufficient to operate one or more computing devices for at least a threshold amount of time. As an example, the computing devices are included in an autonomous vehicle100, and the threshold voltage is a voltage sufficient to operate the one or more computing devices for a length of time to have the autonomous vehicle100reach a complete stop. The threshold voltage is stored in a memory of the power controller715in various embodiments. Further, in other embodiments, the power controller715selects the power output based on other suitable characteristics of power routed along the selected bus705, such as whether a current carried by the selected bus705equals or exceeds a threshold current.

Additionally, the power storage unit725is charged from power carried by the selected bus705, allowing the power supply215to provide the power stored in the power storage unit725. Such a configuration allows the power supply215to provide charge to the power storage unit725, which accumulates power to act as an alternative power source if the power supply215is unable to provide at least a threshold amount of power (e.g., voltage). In some embodiments, the power controller715is configured to direct power from the selected bus705to the power storage unit725in response to the power controller715determining that less than a threshold voltage is stored in the power storage unit725. As further described above, the threshold voltage stored in the power storage unit725is a voltage sufficient to operate at least one computing device coupled to an output of the power controller715. For example, the threshold voltage stored in the power storage unit725is a voltage sufficient to operate at least one computing device coupled to an output of the power controller715for at least a threshold amount of time. In embodiments where multiple computing devices, or other systems (e.g., autonomous vehicle control systems223) are included in a power domain that is coupled to an output of the power controller715, the threshold voltage stored in the power storage unit725is a voltage sufficient to operate the power domain for at least a threshold amount of time.

In alternative embodiments, a charging system720couples the selected bus705to the power storage unit725. The charging system720directs power from the selected bus705to the power storage unit725in response to the charging system720determining less than the threshold voltage is stored in the power storage unit725. As further described above in conjunction withFIG.7, in various embodiments, the power controller715or the charging system720accounts for other characteristics of the power storage unit725(e.g., a temperature of the power storage unit725) when determining when to direct power from the selected bus705to the power storage unit725.

The method shown byFIG.11couples1115the power output to a first power domain735A and to a second power domain735B. WhileFIG.11describes coupling1115the power output to the first power domain735A and to the second power domain735B, in other embodiments the power output is coupled1115to a different number of power domains735. As the power output is selected1110based on a threshold voltage, the power output provides at least the threshold voltage to the first power domain735A and to the second power domain735B, allowing the method to prevent the voltage supplied to the first power domain735A and to the second power domain735B from falling below the threshold voltage for at least a threshold duration.

For further illustration,FIG.12shows a flowchart of a method for redirecting power from a power domain735A,735B to an alternative power domain735. The method ofFIG.12may be performed, for example, by the domain controller1010further described above in conjunction withFIG.10in various embodiments. In other embodiments, different components, such as the power controller715or logic included in a power domain735A,735B performs the method described in conjunction withFIG.12.

As further described above in conjunction withFIGS.7-11, a system700provides1205power to a first power domain735A of an autonomous vehicle100. As further described above in conjunction withFIGS.7-10, a power controller715provides a power output to the first power domain735A. The power controller715selects the power output as a power storage unit725or an output of a bus selector710, as further described above in conjunction withFIGS.7-10. The first power domain735A includes one or more microprocessors730A,730B, with the one or more microprocessors730A.730B coupled to one or more systems controlling movement of the autonomous vehicle100. For example, the one or more systems are a collection of autonomous vehicle control systems223, as further described above in conjunction withFIG.10. Example systems controlling movement of the autonomous vehicle include: a braking system that activates brakes of the autonomous vehicle100at a time and with a force specified by a control signal from the microprocessor730A,730B, a transmission system of the autonomous vehicle100that changes a gear in which the autonomous vehicle100operates based on the received instructions, a steering system of the autonomous vehicle100that changes a direction of movement or an orientation of the autonomous vehicle100in based on the received instructions, Other systems may be included in the one or more systems in some embodiments. For example, one or more lighting systems are coupled to the first power domain735A.

In some embodiments, when power is provided1205to the first power domain735A, power is not provided to a second power domain735B. In alternative embodiments, when power is provided1205to the first power domain735A, power sufficient for one or more second microprocessors730B in the second power domain735B to operate in a standby mode is also provided to the second power domain735B.

The domain controller1010determines1210whether one or more first microprocessors730A in the first power domain735A are able to provide instructions for the autonomous vehicle100to complete a minimal risk condition. As further described above in conjunction withFIG.10, the minimal risk condition includes one or more actions to be performed for the autonomous vehicle100to be out of danger, as further described below. In some embodiments, the minimal risk condition specifies the autonomous vehicle100moving to an emergency lane or otherwise out of a lane including moving traffic and stopped. In other embodiments, the minimal risk condition specifies the autonomous vehicle100travels an off ramp and comes to a stop. As another example, a minimal risk condition specifies the autonomous vehicle100enters a lane for traffic moving at a slower speed. In another example, a minimal risk condition specifies the autonomous vehicle100perform autonomous control operations for a threshold amount of time to allow a driver to resume manual control of the autonomous vehicle100. For another example, the minimal risk condition specifies the autonomous vehicle100come to a stop in a lane where the autonomous vehicle100is currently travelling. In other embodiments, the minimal risk condition specifies multiple actions for the autonomous vehicle to complete100. For example, a minimal risk condition specifies the autonomous vehicle100complete a maneuver in progress, move to a different lane than a current lane, identify a location out of a flow of traffic (e.g., on a side of a road), come to a stop in the identified location, park, and turn on hazard lights. In different embodiments, different combinations of actions or actions are specified as the minimal risk condition; for example, different autonomous vehicles100store information identifying different vehicle-specific minimal risk conditions.

In response to determining1210one or more microprocessors730A,730B in the first power domain735A are able to provide instructions for the autonomous vehicle100to complete the minimal risk condition, power remains provided1205to the first power domain735A. The first power domain735A continues to be provided1205with power while the first power domain735A is able to provide instructions for the autonomous vehicle100to complete the minimal risk condition.

However, in response to determining1210one or more first microprocessors730A in the first power domain735A are unable to provide instructions for the autonomous vehicle100to complete the minimal risk condition, power is routed1215from the first power domain735A to the second power domain735B. The second power domain735B includes one or more second microprocessors730B that are also coupled to the one or more systems controlling movement of the autonomous vehicle100. As further described above in conjunction withFIGS.7and10, the second microprocessors730B and the first microprocessors730A are capable of generating instructions or control signals for the one or more systems controlling movement of the autonomous vehicle100to complete the minimal risk condition. This allows the first power domain735A and the second power domain735B to provide redundancy for completing the minimum risk condition. When a power domain735A,735B is unable to provide instructions for completing the minimum risk condition, power is rerouted1215from the power domain735A,735B to an alternative power domain735A,735B that is capable of completing the minimum risk condition, increasing safety for a driver of the autonomous vehicle100.

In some embodiments, the one or more first microprocessors730A in the first power domain735A are unable to provide instructions for the autonomous vehicle100to complete the minimal risk condition if the first power domain735A receives less than a threshold voltage. As another example, the one or more first microprocessors730A in the first power domain735A are unable to provide instructions for the autonomous vehicle100to complete the minimal risk condition if at least a threshold number of the one or more first microprocessors730A receive less than a threshold voltage. For example, the one or more first microprocessors730A in the first power domain735A are unable to provide instructions for the autonomous vehicle100to complete the minimal risk condition if at least a threshold number of the one or more first microprocessors730A receive zero volts. In another example, the one or more first microprocessors730A in the first power domain735A are unable to provide instructions for the autonomous vehicle100to complete the minimal risk condition in response to at least a threshold number of the one or more first microprocessors730A being unable to generate an output signal.

In some embodiments, in response to determining1210the one or more first microprocessors730A in the first power domain735A are unable to provide instructions for the autonomous vehicle100to complete the minimal risk condition, one or more notifications are presented to a driver of the autonomous vehicle100. For example, a driver notification system receives an instruction or a signal in response to a determination that the one or more first microprocessors730A in the first power domain735A are unable to provide instruction for the autonomous vehicle100to complete the minimal risk condition. The driver notification system presents one or more notifications to the driver of the autonomous vehicle in response to receiving the instruction or the signal. Example notifications presented to the driver include: displaying a warning light to the driver, displaying a message to the driver through a display, playing a specific sound to the driver through one or more speaker, and playing a message to the driver through one or more speakers. Other types of notifications may be presented to the driver by the driver notification system in various embodiments. Notifications may be continuously provided to the driver, provided to the driver at periodic intervals, or provided to the driver when the domain controller1010determines a power domain735A.735B is not capable of providing instructions to complete a minimal risk condition. This allows the driver to be alerted when a power domain735A.735B is not capable of providing instructions for the autonomous vehicle to complete a minimal risk condition.

In some embodiments, the system described above in conjunction withFIGS.7-12is included in an autonomous vehicle, with the microprocessors in the first power domain and in the second power domain providing control signals or instructions for autonomous vehicle control systems. The system described herein allows microprocessors in at least one power domain to remain operational via the power storage unit when a power supply of the autonomous vehicle is unable to power the microprocessors. When the microprocessors provide control signals or instructions to the autonomous vehicle control systems, the power storage unit maintains voltage sufficient for the autonomous vehicle control systems to complete a minimal risk condition for the autonomous vehicle. As further described above in conjunction withFIG.10, the minimal risk condition specifies one or more actions for the autonomous vehicle control systems to complete to safely bring the autonomous vehicle to a stop. Instructions specifying the actions for completing the minimal risk condition are stored in the autonomous vehicle in various embodiments. Further, microprocessors in different power domains provide redundant functionality, so if microprocessors in one power domain are inoperable, power is directed to another power domain whose microprocessors provide the functionality of the inoperable microprocessors. Additionally, the power storage unit maintains sufficient power to operate one or more systems of the autonomous vehicle that perform the actions specified by the autonomous vehicle, allowing the systems that perform the actions for the minimal risk condition to remain operational for completing the minimal risk condition. This autarchical power architecture for multiple power domains increases safety for passengers in the autonomous vehicle by allowing the power storage unit to function as an alternative power supply for one or more control systems of the autonomous vehicle to complete a minimal risk condition, such as those further described above in conjunction withFIG.10, for the autonomous vehicle to navigate to a complete stop when the power supply is inoperative or is insufficiently operating. As further described above in conjunction withFIG.10, the power storage unit provides power for operating one or more microprocessors in a power domain for a sufficient amount of time to provide instructions to one or more control systems to complete a minimal risk condition or provides power for operating the one or more microprocessors in the power domain and for operating one or more control systems used to complete the minimal risk condition for a sufficient amount of time to complete the minimal risk condition. Further, the system described herein affords increased time for a driver of an autonomous vehicle to transition to manually driving the autonomous vehicle when power supply to the autonomous driving systems is interrupted, while other systems of the autonomous vehicle remain sufficiently powered.

In view of the explanations set forth above, a system including multiple buses coupled to a power supply as well as a power storage unit provides multiple levels of redundancy in providing power to microprocessors. As further described above in conjunction withFIGS.7-11, the power storage unit accumulates power from the power supply. The accumulated power allows the power storage unit to act as an alternative power supply for one or more microprocessors when the power supply is unable to provide at least a threshold amount of power (e.g., voltage) to the one or more microprocessors. This system allows the first power domain and the second power domain to retain power autarchy from the power supply, enabling microprocessors in at least one of the first power domain and in the second power domain to continue to receive power when the power supply is unable to provide sufficient power. Further, having multiple buses coupled to the power supply allows selection of a bus providing a maximum amount of power from the power supply to the microprocessors. The power storage unit maintains at least a threshold voltage, with the threshold voltage sufficient to operate the microprocessors in at least one power domain for at least a threshold amount of time. This allows the microprocessors in at least one power domain to remain operational for at least the threshold amount of time in scenarios where the power supply is inactive or providing insufficient power to the microprocessors.

For further explanation,FIG.13sets forth a diagram of an execution environment227in accordance with some embodiments of the present disclosure. The execution environment227depicted inFIG.13may be embodied in a variety of different ways. The execution environment227may be provided, for example, by one or more physical or virtual machine components consisting of bare-metal applications, operating systems such as Android, Linux, Real-time Operating systems (RTOS), Automotive RTOS, such as AutoSAR, and others, including combinations thereof. The execution environment227may also be provided by cloud computing providers such as Amazon AWS™, Microsoft Azure™, Google Cloud™, and others, including combinations thereof. Alternatively, the execution environment227may be embodied as a collection of devices (e.g., servers, storage devices, networking devices) and software resources that are included in a computer or distributed computer or private data center. The execution environment227may be constructed in a variety of other ways and may even include resources within one or more autonomous vehicles or resources that communicate with one or more autonomous vehicles.

The execution environment227depicted inFIG.13may include storage resources1308, which may be embodied in many forms. For example, the storage resources1308may include flash memory, hard disk drives, nano-RAM, 3D crosspoint non-volatile memory, MRAM, non-volatile phase-change memory (PCM), storage class memory (SCM), or many others, including combinations of the storage technologies described above. Other forms of computer memories and storage devices may be utilized as part of the execution environment227, including DRAM, SRAM, EEPROM, universal memory, and many others. The storage resources1308may also be embodied, in embodiments where the execution environment227includes resources offered by a cloud provider, as cloud storage resources such as Amazon Elastic Block Storage (EBS) block storage, Amazon S3 object storage, Amazon Elastic File System (EFS) file storage, Azure Blob Storage, and many others. The example execution environment227depicted inFIG.13may implement a variety of storage architectures, such as block storage where data is stored in blocks, and each block essentially acts as an individual hard drive, object storage where data is managed as objects, or file storage in which data is stored in a hierarchical structure. Such data may be saved in files and folders and presented to both the system storing it and the system retrieving it in the same format.

The execution environment227depicted inFIG.13also includes communications resources1310that may be useful in facilitating data communications between components within the execution environment227, as well as data communications between the execution environment227and computing devices that are outside of the execution environment227. Such communications resources may be embodied, for example, as one or more routers, network switches, communications adapters, and many others, including combinations of such devices. The communications resources1310may be configured to utilize a variety of different protocols and data communication fabrics to facilitate data communications. For example, the communications resources1310may utilize Internet Protocol (‘IP’) based technologies, fibre channel (FC) technologies, FC over ethernet (FCOE) technologies, InfiniBand (IB) technologies, NVM Express (NVMe) technologies and NVMe over fabrics (NVMeoF) technologies, and many others. The communications resources1310may also be embodied, in embodiments where the execution environment227includes resources offered by a cloud provider, as networking tools and resources that enable secure connections to the cloud as well as tools and resources (e.g., network interfaces, routing tables, gateways) to configure networking resources in a virtual private cloud. Such communications resources may be useful in facilitating data communications between components within the execution environment227, as well as data communications between the execution environment227and computing devices that are outside of the execution environment227(e.g., computing devices that are included within an autonomous vehicle100).

The execution environment227depicted inFIG.13also includes processing resources1312that may be useful in useful in executing computer program instructions and performing other computational tasks within the execution environment227. The processing resources1312may include one or more application-specific integrated circuits (ASICs) that are customized for some particular purpose, one or more central processing units (CPUs), one or more digital signal processors (DSPs), one or more field-programmable gate arrays (FPGAs), one or more systems on a chip (SoCs), or other form of processing resources1312. The processing resources1312may also be embodied, in embodiments where the execution environment227includes resources offered by a cloud provider, as cloud computing resources such as one or more Amazon Elastic Compute Cloud (EC2) instances, event-driven compute resources such as AWS Lambdas, Azure Virtual Machines, or many others.

The execution environment227depicted inFIG.13also includes software resources1313that, when executed by processing resources1312within the execution environment227, may perform various tasks. The software resources1313may include, for example, one or more modules of computer program instructions that when executed by processing resources1312within the execution environment227are useful in training neural networks configured to determine control autonomous vehicle control operations. For example, a training module1314may train a neural network using training data including sensor212data and control operations recorded or captured contemporaneous to the training data. In other words, the neural network may be trained to encode a relationship between an environment relative to an autonomous vehicle100as indicated in sensor212data and the corresponding control operations effected by a user or operation of the autonomous vehicle. The training module1314may provide a corpus of training data, or a selected subset of training data, to train the neural network. For example, the training module1314may select particular subsets of training data associated with particular driving conditions, environment states, etc. to train the neural network.

The software resources1313may include, for example, one or more modules of computer program instructions that when executed by processing resources1312within the execution environment227are useful in deploying software resources or other data to autonomous vehicles100via a network1318. For example, a deployment module1316may provide software updates, neural network updates, or other data to autonomous vehicles100to facilitate autonomous vehicle control operations.

The software resources1313may include, for example, one or more modules of computer program instructions that when executed by processing resources1312within the execution environment227are useful in collecting data from autonomous vehicles100via a network1318. For example, a data collection module1320may receive, from autonomous vehicles100, collected sensor212, associated control operations, software performance logs, or other data. Such data may facilitate training of neural networks via the training module1314or stored using storage resources1308.

Exemplary embodiments of the present disclosure are described largely in the context of a fully functional computer system for an autonomous vehicle100. The present disclosure also may be embodied in a computer program product disposed upon computer readable storage media for use with any suitable data processing system. Such computer readable storage media may be any storage medium for machine-readable information, including magnetic media, optical media, or other suitable media. Examples of such media include magnetic disks in hard drives or diskettes, compact disks for optical drives, magnetic tape, and others. Any computer system having suitable programming means will be capable of executing the steps of the method of the disclosure as embodied in a computer program product. Although some of the exemplary embodiments described in this specification are oriented to software installed and executing on computer hardware, nevertheless, alternative embodiments implemented as firmware or as hardware are well within the scope of the present disclosure.

It will be understood that any of the functionality or approaches set forth herein may be facilitated at least in part by artificial intelligence applications, including machine learning applications, big data analytics applications, deep learning, and other techniques. Applications of such techniques may include: machine and vehicular object detection, identification and avoidance; visual recognition, classification and tagging; algorithmic financial trading strategy performance management; simultaneous localization and mapping; predictive maintenance of high-value machinery; prevention against cyber security threats, expertise automation; image recognition and classification; question answering; robotics; text analytics (extraction, classification) and text generation and translation; and many others.

It will be understood from the foregoing description that modifications and changes may be made in various embodiments of the present disclosure without departing from its true spirit. The descriptions in this specification are for purposes of illustration only and are not to be construed in a limiting sense. The scope of the present disclosure is limited only by the language of the following claims.