Patent Description:
<CIT> discloses systems and methods to facilitate accurate and rapid simulation of software by periodically saving simulation states and design stimuli for use as a replay model. Divergences from the stored information may be detected during subsequent re-executions, which can in turn be run using the saved stimuli and states.

"<NPL> ET AL) discloses a testing model and a software tool to support structural testing in the context of autonomous vehicle field testing that has been improved to support the generation of new input data from logs collected during field testing using strategies of combination and mutation.

One aspect of the disclosure provides a method of testing software for operating a vehicle in an autonomous driving mode. The method includes running a first simulation using log data collected by a vehicle operating in an autonomous driving mode, wherein the simulation is run using the software to control a first simulated vehicle; comparing one or more characteristics of the simulated vehicle with one or more characteristics of the vehicle from the log data in order to determine a divergence point; using the divergence point to determine a handover time for a second simulation, the handover time corresponding to a time in the second simulation at which the software is allowed to take control of a second simulated vehicle of the second simulation; running a second simulation using the log data, wherein the second simulation is run using the handover time and the software to control a second simulated vehicle; and determining whether the software is able to complete the second simulation without a particular type of event occurring.

In one example, the particular type of event is a collision, and the method further comprises, when the collision is determined to have occurred, flagging the second simulation for further review. In another example, determining the divergence point includes comparing a planned trajectory of the first simulated vehicle with a planned trajectory of the vehicle from the log data. In this example, determining the divergence point includes determining when one or more of a location, speed or change in speed of the planned trajectory of the first simulated vehicle and the planned trajectory of the vehicle from the log data diverge more than some threshold amount over some period of time. In another example, determining the divergence point includes determining when a location of the first simulated vehicle and a location of the vehicle from the log data diverge more than a threshold amount. In another example, determining the divergence point includes determining when a location of the first simulated vehicle and a location of the vehicle from the log data diverge more than a threshold amount in a lateral direction relative to a direction of traffic in a lane in which the simulated vehicle is traveling in the first simulation. In another example, determining the divergence point includes determining when a location of the first simulated vehicle and a location of the vehicle from the log data diverge more than a threshold amount in a longitudinal direction relative to a direction of traffic in a lane in which the simulated vehicle is traveling in the first simulation. In this example, determining the divergence point includes determining when the location of the first simulated vehicle and the location of the vehicle from the log data diverge more than a threshold amount in a lateral direction relative to the direction of traffic in the lane. In another example, the method also includes, at the divergence point in the first simulation, starting a timer that expires during the first simulation and flagging the first simulation for review when the particular type of event occurs before the timer expires. In this example, the method also includes not flagging the first simulation for review if the particular type of event only occurs during the first simulation after the timer expires. In addition or alternatively, the particular type of event is a collision between the first simulated vehicle and an object in the first simulation. In addition or alternatively, the particular type of event includes the simulated vehicle exhibiting a particular type of maneuvering behavior.

Another aspect of the disclosure provides a method of testing software for operating a vehicle in an autonomous driving mode. The method includes running a simulation using log data collected by a vehicle operating in an autonomous driving mode, wherein the simulation is run using the software to control a simulated vehicle; comparing one or more characteristics of the simulated vehicle with one or more characteristics of the vehicle from the log data in order to determine a divergence point; at the divergence point in the simulation, starting a timer that expires during the simulation; and determining whether the software is able to continue through the simulation without a particular event occurring prior to the timer expiring.

In one example, the particular event is a collision between the simulated vehicle and an object in the simulation. In another example, the method also includes flagging the simulation for review if a particular event occurs before the timer expires. In another example, the method also includes not flagging the simulation for review if the particular event only occurs during the simulation after the timer expires. In another example, the particular event is a collision between the simulated vehicle and an object in the simulation. In another example, the particular event includes the simulated vehicle exhibiting a particular type of maneuvering behavior. In another example, determining the divergence point includes determining when a location of the simulated vehicle and a location of the vehicle from the log data diverge more than a threshold amount. In another example, determining the divergence point includes determining when a location of the simulated vehicle and a location of the vehicle from the log data diverge more than a threshold amount in at least one of a lateral direction or a longitudinal direction relative to a direction of traffic in a lane in which the simulated vehicle is traveling in the simulation.

The technology relates to evaluating collisions in log-based simulations using software for vehicles operating autonomously. The log-based simulations correspond to simulations which are run using log data collected by a vehicle operating in an autonomous mode over some brief period of time such as <NUM> minute or more or less. The log data may include information from the vehicle's various systems including perception, routing, planning, positioning, etc. At the same time, the actual vehicle is replaced with a virtual autonomous vehicle or a simulated vehicle which can make decisions using software for controlling the vehicle autonomously. By doing so, the software can be rigorously tested. For instance, the simulations may be used to determine whether a particular type of event has occurred, such as a particular type of behavior or collision. As an example, these events may be used for various purposes, such as determining whether the software can "pass" a given simulation without a collision without requiring a vehicle to physically drive "real" miles or having to "manufacture" situations in the real world.

However, when running simulations using logged data, changing the behavior of the autonomous vehicle, such as by testing a different software version than that used to log the log data, can cause unintended consequences. For instance, after only a few seconds of a minute long simulation, the simulated vehicle may diverge in its behavior so much that the purpose of the simulation, to test reaction of the software to a specific situation, is lost because the situation is no longer achievable. This may occur because the agents (or other road users defined in the log data) in the simulation may interfere with the simulated vehicle, for instance, colliding with the simulated vehicle because those agents are behaving as they were observed doing so in the log data. Typically, if the simulation results in a particular type of event, such as a particular type of behavior of the simulated vehicle and/or the simulated vehicle colliding with an agent or other object of the log data, then the simulation may be flagged for review by an operator.

In order to make better use of the log data for simulations, the simulations may be "adjusted" based on how much the behavior of a simulated vehicle diverges from the behavior of the actual vehicle that was used to log the log data. For instance, the "handover time" or the point in which the software is given control of the simulated vehicle may be adjusted. For instance, simulations may be run identically as to how an actual vehicle drove in the log data up until some point of interest or sometime after that point of interest. This point of interest may be a divergence point between a simulated vehicle in a simulation and the actual vehicle that captured the log data.

In one example, the divergence point may be determined by comparing the planned trajectory of the simulated vehicle with the planned trajectory of the actual vehicle identified in the log data. Each planned trajectory may correspond to a combined speed and geometry of a future path or individual geometry and speed profile components. When one or more of a location, speed or change in speed of the planned trajectories diverge more than some threshold amount over some period of time, this may be considered a divergence point.

However, because of the timing requirement for comparing planned trajectories, at least some divergences may not be identified as points of interest. As such, the locations of the simulated vehicle in the simulation and the actual vehicle that captured the log data may be compared. The first point in time in the simulation at which the locations sufficiently diverge may be identified as a divergence point.

This divergence point may then be to determine the handover time for a new simulation using the same log data. This handover time may be the divergence point or the divergence point plus some period of time. In other words, the new simulation forces the simulated vehicle to wait until at least the divergence point before changing its position, speed, orientation, heading, etc. from the log data. If the new simulation results in a particular type of event, such as such as a particular type of behavior of the simulated vehicle and/or the simulated vehicle colliding with an agent or other object of the log data, then the new simulation may be flagged for review by an operator. This process may be repeated until there are no additional points of divergence between the simulated vehicles and the actual vehicle that captured the log data for the simulation.

In addition or alternatively, once the divergence point is identified in a simulation, a timer may be started. After the timer expires, certain events may be ignored. For instance, if simulations are being analyzed to determine when the software is likely to cause the vehicle to behave or maneuver in a particular way or collide with another agent or object, and such events occur after the timer expires, these events may be ignored or not flagged. Thus, such simulations, which would otherwise have been flagged for review by an operator would not be.

The features described herein provide for a safe, effective, and realistic way of testing software for autonomous vehicles. For instance, the software can be tested in hundreds of thousands of scenarios without endangering the life and property of actual persons. At the same time, by making the handover time for a new simulation a divergence point corresponding to a divergence point of a prior simulation, this prevents the simulated vehicle from inadvertently making the simulation less useful. In addition, this approach effectively provides for more realistic responses of the software being tested as well as more valuable and useful simulations out of a fixed amount of log data. In addition, using a timer to determine whether to flag a simulation for review may reduce the time and other resources required to review simulations that are not actually true "fails". In addition, those simulations that are flagged may be more critically important to determining how to revise or update the software being tested. Without such testing, the risks of injury to persons or property using un-tested software may be too great.

As shown in <FIG>, a vehicle <NUM> in accordance with one aspect of the disclosure includes various components. While certain aspects of the disclosure are particularly useful in connection with specific types of vehicles, the vehicle may be any type of vehicle including, but not limited to, cars, trucks, motorcycles, buses, recreational vehicles, etc. The vehicle may have one or more computing devices, such as computing devices <NUM> containing one or more processors <NUM>, memory <NUM> and other components typically present in general purpose computing devices.

In that regard, the terms "software," "instructions" and "programs" may be used interchangeably herein.

The one or more processors <NUM> may be any conventional processors, such as commercially available CPUs. Alternatively, the one or more processors may be a dedicated device such as an ASIC or other hardware-based processor. Although <FIG> functionally illustrates the processor, memory, and other elements of computing devices <NUM> as being within the same block, it will be understood by those of ordinary skill in the art that the processor, computing device, or memory may actually include multiple processors, computing devices, or memories that may or may not be stored within the same physical housing. For example, memory may be a hard drive or other storage media located in a housing different from that of computing devices <NUM>. Accordingly, references to a processor or computing device will be understood to include references to a collection of processors or computing devices or memories that may or may not operate in parallel.

Computing devices <NUM> may all of the components normally used in connection with a computing device such as the processor and memory described above as well as a user input <NUM> (e.g., a mouse, keyboard, touch screen and/or microphone) and various electronic displays (e.g., a monitor having a screen or any other electrical device that is operable to display information). In this example, the vehicle includes an internal electronic display <NUM> as well as one or more speakers <NUM> to provide information or audio visual experiences. In this regard, internal electronic display <NUM> may be located within a cabin of vehicle <NUM> and may be used by computing devices <NUM> to provide information to passengers within the vehicle <NUM>.

Computing devices <NUM> may also include one or more wireless network connections <NUM> to facilitate communication with other computing devices, such as the client computing devices and server computing devices described in detail below. The wireless network connections may include short range communication protocols such as Bluetooth, Bluetooth low energy (LE), cellular connections, as well as various configurations and protocols including the Internet, World Wide Web, intranets, virtual private networks, wide area networks, local networks, private networks using communication protocols proprietary to one or more companies, Ethernet, WiFi and HTTP, and various combinations of the foregoing.

In one example, computing devices <NUM> may be control computing devices of an autonomous driving computing system or incorporated into vehicle <NUM>. The autonomous driving computing system may capable of communicating with various components of the vehicle in order to control the movement of vehicle <NUM> according to the autonomous control software of memory <NUM> as discussed further below. For example, returning to <FIG>, computing devices <NUM> may be in communication with various systems of vehicle <NUM>, such as deceleration system <NUM>, acceleration system <NUM>, steering system <NUM>, signaling system <NUM>, routing system <NUM>, positioning system <NUM>, perception system <NUM>, and power system <NUM> (i.e. the vehicle's engine or motor) in order to control the movement, speed, etc. of vehicle <NUM> in accordance with the instructions <NUM> of memory <NUM>. Again, although these systems are shown as external to computing devices <NUM>, in actuality, these systems may also be incorporated into computing devices <NUM>, again as an autonomous driving computing system for controlling vehicle <NUM>.

As an example, computing devices <NUM> may interact with one or more actuators of the deceleration system <NUM> and/or acceleration system <NUM>, such as brakes, accelerator pedal, and/or the engine or motor of the vehicle, in order to control the speed of the vehicle. Similarly, one or more actuators of the steering system <NUM>, such as a steering wheel, steering shaft, and/or pinion and rack in a rack and pinion system, may be used by computing devices <NUM> in order to control the direction of vehicle <NUM>. For example, if vehicle <NUM> is configured for use on a road, such as a car or truck, the steering system may include one or more actuators to control the angle of wheels to turn the vehicle. Signaling system <NUM> may be used by computing devices <NUM> in order to signal the vehicle's intent to other drivers or vehicles, for example, by lighting turn signals or brake lights when needed.

Routing system <NUM> may be used by computing devices <NUM> in order to determine and follow a route to a location. In this regard, the routing system <NUM> and/or data <NUM> may store detailed map information, e.g., highly detailed maps identifying the shape and elevation of roadways, lane lines, intersections, crosswalks, speed limits, traffic signals, buildings, signs, real time traffic information, vegetation, or other such objects and information.

<FIG> is an example of map information <NUM> for a section of roadway including intersections <NUM> and <NUM>. In this example, the map information <NUM> includes information identifying the shape, location, and other characteristics of lane lines <NUM>, <NUM>, <NUM>, traffic signal lights <NUM>, <NUM>, crosswalk <NUM>, sidewalks <NUM>, stop signs <NUM>, <NUM>, and yield sign <NUM>. Although the map information is depicted herein as an image-based map, the map information need not be entirely image based (for example, raster). For example, the map information may include one or more roadgraphs or graph networks of information such as roads, lanes, intersections, and the connections between these features. Each feature may be stored as graph data and may be associated with information such as a geographic location and whether or not it is linked to other related features, for example, a stop sign may be linked to a road and an intersection, etc. In some examples, the associated data may include grid-based indices of a roadgraph to allow for efficient lookup of certain roadgraph features.

Positioning system <NUM> may be used by computing devices <NUM> in order to determine the vehicle's relative or absolute position on a map or on the earth. For example, the position system <NUM> may include a GPS receiver to determine the device's latitude, longitude and/or altitude position. Other location systems such as laser-based localization systems, inertial-aided GPS, or camera-based localization may also be used to identify the location of the vehicle. The location of the vehicle may include an absolute geographical location, such as latitude, longitude, and altitude as well as relative location information, such as location relative to other cars immediately around it which can often be determined with less noise that absolute geographical location.

The positioning system <NUM> may also include other devices in communication with computing devices <NUM>, such as an accelerometer, gyroscope or another direction/speed detection device to determine the direction and speed of the vehicle or changes thereto. By way of example only, an acceleration device may determine its pitch, yaw or roll (or changes thereto) relative to the direction of gravity or a plane perpendicular thereto. The device may also track increases or decreases in speed and the direction of such changes. The device's provision of location and orientation data as set forth herein may be provided automatically to the computing devices <NUM>, other computing devices and combinations of the foregoing.

The perception system <NUM> also includes one or more components for detecting objects external to the vehicle such as other vehicles, obstacles in the roadway, traffic signals, signs, trees, etc. For example, the perception system <NUM> may include lasers, sonar, radar, cameras and/or any other detection devices that record data which may be processed by computing device <NUM>. In the case where the vehicle is a passenger vehicle such as a minivan, the minivan may include a laser or other sensors mounted on the roof or other convenient location. For instance, <FIG> is an example external view of vehicle <NUM>. In this example, roof-top housing <NUM> and dome housing <NUM> may include a lidar sensor as well as various cameras and radar units. In addition, housing <NUM> located at the front end of vehicle <NUM> and housings <NUM>, <NUM> on the driver's and passenger's sides of the vehicle may each store a lidar sensor. For example, housing <NUM> is located in front of driver door <NUM>. Vehicle <NUM> also includes housings <NUM>, <NUM> for radar units and/or cameras also located on the roof of vehicle <NUM>. Additional radar units and cameras (not shown) may be located at the front and rear ends of vehicle <NUM> and/or on other positions along the roof or roof-top housing <NUM>.

The computing devices <NUM> may control the direction and speed of the vehicle by controlling various components. By way of example, computing devices <NUM> may navigate the vehicle to a destination location completely autonomously using data from the detailed map information and routing system <NUM>. Computing devices <NUM> may use the positioning system <NUM> to determine the vehicle's location and perception system <NUM> to detect and respond to objects when needed to reach the location safely. In order to do so, computing devices <NUM> may cause the vehicle to accelerate (e.g., by increasing fuel or other energy provided to the engine by acceleration system <NUM>), decelerate (e.g., by decreasing the fuel supplied to the engine, changing gears, and/or by applying brakes by deceleration system <NUM>), change direction (e.g., by turning the front or rear wheels of vehicle <NUM> by steering system <NUM>), and signal such changes (e.g., by lighting turn signals of signaling system <NUM>). Thus, the acceleration system <NUM> and deceleration system <NUM> may be a part of a drivetrain that includes various components between an engine of the vehicle and the wheels of the vehicle. Again, by controlling these systems, computing devices <NUM> may also control the drivetrain of the vehicle in order to maneuver the vehicle autonomously.

Computing device <NUM> of vehicle <NUM> may also receive or transfer information to and from other computing devices, such as those computing devices that are a part of the transportation service as well as other computing devices. <FIG> and <FIG> are pictorial and functional diagrams, respectively, of an example system <NUM> that includes a plurality of computing devices <NUM>, <NUM>, <NUM>, <NUM> and a storage system <NUM> connected via a network <NUM>. System <NUM> also includes vehicle <NUM>, and vehicles 100A, 100B which may be configured the same as or similarly to vehicle <NUM>. Although only a few vehicles and computing devices are depicted for simplicity, a typical system may include significantly more.

In one example, one or more computing devices <NUM> may include one or more server computing devices having a plurality of computing devices, e.g., a load balanced server farm, that exchange information with different nodes of a network for the purpose of receiving, processing and transmitting the data to and from other computing devices. For instance, one or more computing devices <NUM> may include one or more server computing devices that are capable of communicating with computing device <NUM> of vehicle <NUM> or a similar computing device of vehicle 100A as well as computing devices <NUM>, <NUM>, <NUM> via the network <NUM>. For example, vehicles <NUM>, 100A, may be a part of a fleet of vehicles that can be dispatched by server computing devices to various locations. In this regard, the server computing devices <NUM> may function as a validation computing system which can be used to validate autonomous control software which vehicles such as vehicle <NUM> and vehicle 100A may use to operate in an autonomous driving mode. In addition, server computing devices <NUM> may use network <NUM> to transmit and present information to a user, such as user <NUM>, <NUM>, <NUM> on a display, such as displays <NUM>, <NUM>, <NUM> of computing devices <NUM>, <NUM>, <NUM>. In this regard, computing devices <NUM>, <NUM>, <NUM> may be considered client computing devices.

As shown in <FIG>, each client computing device <NUM>, <NUM>, <NUM> may be a personal computing device intended for use by a user <NUM>, <NUM>, <NUM>, and have all of the components normally used in connection with a personal computing device including a one or more processors (e.g., a central processing unit (CPU)), memory (e.g., RAM and internal hard drives) storing data and instructions, a display such as displays <NUM>, <NUM>, <NUM> (e.g., a monitor having a screen, a touch-screen, a projector, a television, or other device that is operable to display information), and user input devices <NUM>, <NUM>, <NUM> (e.g., a mouse, keyboard, touchscreen or microphone). The client computing devices may also include a camera for recording video streams, speakers, a network interface device, and all of the components used for connecting these elements to one another.

Although the client computing devices <NUM>, <NUM>, and <NUM> may each comprise a full-sized personal computing device, they may alternatively comprise mobile computing devices capable of wirelessly exchanging data with a server over a network such as the Internet. By way of example only, client computing device <NUM> may be a mobile phone or a device such as a wireless-enabled PDA, a tablet PC, a wearable computing device or system, or a netbook that is capable of obtaining information via the Internet or other networks. In another example, client computing device <NUM> may be a wearable computing system, shown as a wristwatch as shown in <FIG>. As an example the user may input information using a small keyboard, a keypad, microphone, using visual signals with a camera, or a touch screen.

In some examples, client computing device <NUM> may be an operations workstation used by an administrator or operator to review scenario outcomes, handover times, and validation information as discussed further below. Although only a single operations workstation <NUM> is shown in <FIG> and <FIG>, any number of such work stations may be included in a typical system. Moreover, although operations work station is depicted as a desktop computer, operations works stations may include various types of personal computing devices such as laptops, netbooks, tablet computers, etc..

As with memory <NUM>, storage system <NUM> can be of any type of computerized storage capable of storing information accessible by the server computing devices <NUM>, such as a hard-drive, memory card, ROM, RAM, DVD, CD-ROM, write-capable, and read-only memories. In addition, storage system <NUM> may include a distributed storage system where data is stored on a plurality of different storage devices which may be physically located at the same or different geographic locations. Storage system <NUM> may be connected to the computing devices via the network <NUM> as shown in <FIG> and <FIG>, and/or may be directly connected to or incorporated into any of the computing devices <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, etc..

Storage system <NUM> may store various types of information as described in more detail below. This information may be retrieved or otherwise accessed by a server computing device, such as one or more server computing devices <NUM>, in order to perform some or all of the features described herein. For instance, storage system <NUM> may store log data. This log data may include, for instance, sensor data generated by a perception system, such as perception system <NUM> of vehicle <NUM>. As an example, the sensor data may include raw sensor data as well as data identifying defining characteristics of perceived objects such as shape, location, orientation, speed, etc. of objects such as vehicles, pedestrians, bicyclists, vegetation, curbs, lane lines, sidewalks, crosswalks, buildings, etc. The log data may also include "event" data identifying different types of events such as collisions with other objects, planned trajectories describing a planned geometry and/or speed for a potential path of the vehicle <NUM>, actual locations of the vehicles at different times, actual orientations/headings of the vehicle at different times, actual speeds, accelerations and decelerations of the vehicle at different times, classifications of and responses to perceived objects, behavior predictions of perceived objects, status of various systems (such as acceleration, deceleration, perception, steering, signaling, routing, power, etc.) of the vehicle at different times including logged errors, inputs to and outputs of the various systems of the vehicle at different times, etc. As such, these events and the sensor data may be used to "recreate" the vehicle's environment, including perceived objects, and behavior of a vehicle in a simulation.

In addition, the storage system <NUM> may also store autonomous control software which is to be used by vehicles, such as vehicle <NUM>, to operate a vehicle in an autonomous driving mode. This autonomous control software stored in the storage system <NUM> may be a version which has not yet been validated. Once validated, the autonomous control software may be sent, for instance, to memory <NUM> of vehicle <NUM> in order to be used by computing devices <NUM> to control vehicle <NUM> in an autonomous driving mode.

In order to test and/or validate the autonomous control software which will be stored in memory <NUM> for use by the computing devices <NUM> of vehicle <NUM>, the server computing devices <NUM> may run various simulations. These simulations are log based simulations that are generated from the information stored in the aforementioned log data of storage system <NUM>. In this regard, the server computing devices <NUM> may access the storage system <NUM> in order to retrieve the log data and run a simulation. For instance, a portion of the log data corresponding to a minute in real time of an autonomous vehicle that generated the log data may be retrieved from the storage system. This portion of log data may be "hand" selected by human operators and/or computing devices based on the types of events recorded in the logs or more randomly, for instance, by selecting <NUM>% or more or less of all autonomous driving logs.

The retrieved portion of log data is used to run an initial simulation. When running the autonomous control software through the portion of log data, the details (sensor data and events) of the log data may be used to generate a simulation. In other words, the sensor data of the portion of log data may simply be "played" as input to the perception system <NUM> of a simulated vehicle controlled by the autonomous control software. In this regard, the autonomous control software "experiences" or processes the log data as if the autonomous control software was actually being run on vehicle <NUM>. In other words, the simulation may include data defining characteristics of objects such as shape, location, orientation, speed, etc. of objects such as vehicles, pedestrians, bicyclists, vegetation, curbs, lane lines, sidewalks, crosswalks, buildings, etc. defined by the sensor data of the log data. Further, the simulation may include characteristics for a virtual vehicle, corresponding to vehicle <NUM>, including the virtual vehicle's shape, location, orientation, speed, etc. defined by the events of the log data.

<FIG> provides an example <NUM> of a simulation for a section of roadway corresponding to the map information <NUM>. In this example, intersections <NUM> and <NUM> correspond to intersections <NUM> and <NUM>, respectively. This regard, the shape, location, and other characteristics of lane lines <NUM>, <NUM>, <NUM>, traffic signal lights <NUM>, <NUM>, crosswalk <NUM>, sidewalks <NUM>, stop signs <NUM>, <NUM>, and yield sign <NUM> corresponds to the shape, location and other characteristics of lane lines <NUM>, <NUM>, <NUM>, traffic signal lights <NUM>, <NUM>, crosswalk <NUM>, sidewalks <NUM>, stop signs <NUM>, <NUM>, and yield sign <NUM>. In example <NUM>, a simulated vehicle <NUM>, corresponding to vehicle <NUM> or vehicle 100A, is approaching an intersection <NUM>. An agent vehicle <NUM>, generated from sensor data and/or event data from the log data for the simulation, is also approaching intersection <NUM>. This simulation may include the agent vehicle <NUM> "behaving badly" because vehicle <NUM> may ignore stop sign <NUM>.

In some instances, the autonomous control software is only provided with information which the perception system <NUM> would be able to detect about the scenario, and not every detail of the scenario. For instance, returning to example <NUM>, the server computing devices <NUM> may run the scenario such that the autonomous control software is given access to the detailed map information <NUM> as well as any information that would be detected by a perception system of the simulated vehicle <NUM>.

The initial simulation is associated with a "handover time. " This handover time corresponds to the time when the autonomous control software is given control of controlling the virtual vehicle within the simulation and allows the simulation to be used to test the autonomous control software. In other words, the autonomous control software is able to use the sensor data in combination with the map information to determine how the virtual vehicle should respond to its environment.

For the "initial" handover time for an initial simulation, a default handover time, such as <NUM> seconds or more or less into the simulation, may be used. Alternatively, the handover time may be automatically selected for each scenario according to the circumstances of that simulation. In some instances, the handover time may further be confirmed or hand tuned by a human operator, for instance using operations workstation <NUM>. In one example, for a given simulation, if the simulated vehicle collides with another object, such as a vehicle, pedestrian, or bicyclist, in the simulation at some point in the simulation, a second point a few seconds before this expected collision, such as <NUM> seconds or more or less before the collision, may be selected as the handover time for future uses of that simulation. This handover time may then be confirmed as reasonable or adjusted by a human operator. Using a simpler validation process for handover time with human review reduces unnecessary complications and calculations and can provide more consistent results over larger datasets. For instance, example <NUM> of <FIG> may represent a simulation at handover time.

During or after the running of the initial simulation, the log data is compared with the results of the simulation in order to determine a divergence point. For instance, a divergence point is determined by comparing one or more characteristics of the simulated vehicle with one or more characteristics of the actual vehicle (in the example above, vehicle <NUM>) from the log data. In one example, the divergence point may be determined by comparing the planned trajectory of the simulated vehicle with the planned trajectory of the actual vehicle identified in the log data. Each planned trajectory may correspond to a combined speed and geometry of a future path or individual geometry and speed profile components. When one or more of a location, speed or change in speed of the planned trajectories diverge more than some threshold amount over some period of time, this may be considered a divergence point.

However, because of the timing requirement for comparing planned trajectories, at least some divergences may not be identified as points of divergence. As such, the locations of the simulated vehicle in the simulation and the real or actual vehicle that captured the log data may be compared. The first point in time in the simulation at which the locations diverge at least a predetermined threshold, such as <NUM> meter or more or less, may be identified as a divergence point.

For instance, <FIG> represents an example comparison <NUM> of log data location for an actual vehicle, identifying locations <NUM>-<NUM> represented by squares and increasing in time from <NUM> to <NUM> as well as locations <NUM>-<NUM> of the simulated vehicle represented by circles and increasing in time from <NUM> to <NUM>. Each of these locations may represent a point in time either in the simulation or the log data. Of course, the simulation may have a simulated clock that corresponds to the clock in the log data in order to allow for the identification of corresponding points in the log data and the simulation. As such, for comparison purposes, location <NUM> and location <NUM> correspond to a first point in time, location <NUM> and <NUM> correspond to a second point in time, and so on. In this example, a divergence point may be determined when the divergence or difference in distance between these locations is greater than or equal to <NUM> meter, or for instance, at locations <NUM> and <NUM>. The time represented by locations <NUM> and <NUM> may thus be a divergence point.

In some instances, rather than drawing a "straight line" to determine the divergence point, the divergence point may be measured both laterally (in a lateral direction) and longitudinally (in a longitudinal direction) relative to a direction of traffic or travel of a lane in which the vehicle is currently traveling. In this example, lateral divergence may be treated differently than longitudinal divergence as it may be less interesting that the simulated vehicle is moving faster or slower than the actual vehicle did as compared to whether the simulated vehicle is moving to the left or right with respect to a lane. An example of thresholds may include meeting one or both of a <NUM> meter or more or less lateral divergence and a <NUM> meter or more or less longitudinal divergence.

In order to make better use of the log data for simulations, the simulations may be "adjusted" based on how much the behavior of a simulated vehicle diverges from the behavior of the actual vehicle that was used to log the log data. For instance, the handover time or the point in which the software is given control of the simulated vehicle may be adjusted. In other words, simulations may be run identically as to how an actual vehicle drove in the log data up until some divergence point between a simulated vehicle in a simulation and the actual vehicle that captured the log data.

The retrieved portion of log data is used to run a new or second simulation. The second simulation is run using the software to control a second simulated vehicle. The divergence point from the first or prior simulation is used to determine a handover time for the second simulation to allow the software to take control of the second simulated vehicle. In other words, the new simulation forces the simulated vehicle to wait until at least the divergence point before changing its position, speed, orientation, heading, etc. from the log data. In one example, the divergence point may be used as the handover time for the second simulation. Alternatively, a period of time, such as <NUM> seconds or more or less, may be added to the divergence point to determine the handover time. The duration of the period of time may be adjustable. For instance, a smaller number would provide more detailed information, though at the expense of greater computational resource requirements (i.e. more simulations would require more resources).

As another alternative, a minimum difference may be used. For instance, the handover time for a new simulation may be determined from the maximum of the divergent point and some minimum period of time from the handover time in the prior simulation. This minimum period of time may be, for instance <NUM> seconds or more or less, and may also be adjusted as discussed above. By using a minimum period of time, the computing devices may avoid creating an excessive number of simulations in some part of the log data that is just very susceptible to divergence.

For instance, <FIG> may represent an example <NUM> of a simulation corresponding to the simulation of example <NUM>. Again, in example <NUM>, a simulated vehicle <NUM>, corresponding to vehicle <NUM> or vehicle 100A, is approaching an intersection <NUM>. However, in this example, the handover time may be determined from the divergence point of example <NUM>, or for instance, locations <NUM> and <NUM> of example <NUM>. Again, the time of locations <NUM> and <NUM> may be used as the handover time for the second simulation or some fixed period of time may be added to the times of locations <NUM> and <NUM> to determine the handover time. Again, example <NUM> of <FIG> may represent a second simulation at the handover time for the second simulation.

The server computing devices <NUM> may monitor and/or analyze the results of the second simulation in order to determine whether a particular type of event has occurred during the second simulation. In other words, the server computing devices are able to determine whether the software is able to complete the second simulation without the particular type of event occurring. For instance, the server computing devices may determine whether the simulated vehicle exhibits a particular type of maneuvering behavior, such as swerving, harsh braking, and/or colliding with another object of the log data. If the particular type of event does or has occurred, then the new simulation may be flagged for review by an operator.

At the same time, a new or second divergence point may be determined for this second simulation as discussed above. A third simulation may be run. The second divergence point may be used to determine a handover time for the third simulation as discussed above. Again, the server computing devices <NUM> may monitor and/or analyze the results of the third simulation in order to determine whether a particular type of event has occurred during the third simulation. At the same time, a third divergence point may be determined for this third simulation as discussed above. A fourth simulation may be run. The third divergence point may be used to determine a handover time for the fourth simulation as discussed above, and so on.

This process may be repeated until there are no additional points of divergence between the simulated vehicles and the actual vehicle that captured the log data over the course of the simulation and/or until the handover time would go beyond the duration of the original simulation. For instance, turning to example <NUM> of <FIG>, timelines of first, second, and third simulations <NUM>, <NUM>, <NUM> are represented. If a divergence point for a first simulation <NUM> occurs at t = <NUM>, a second simulation <NUM> may be started with a handover time <NUM> five seconds after the divergence point, for instance, at t = <NUM>. If that second simulation has a divergence point at t = <NUM>, then a third simulation <NUM>'s handover time may be set to t = <NUM> (using the example of the handover time being determined from the maximum of the divergent point and some minimum period of time from the handover time in the prior simulation). Once there is no divergence point during the duration of the original simulation (i.e. if there was a divergence point, it would occur after the duration of the original simulation), the process may be terminated.

In addition, to make later simulations "cheaper" in terms of computational resource costs, when triggering a new simulation, the new simulation may reuse the output of the perception system for the virtual vehicle. This is possible because what the simulated vehicle's perception system will "detect" in the simulation does not necessarily change when the position, location, orientation of the simulated vehicle changes with respect to the actual vehicle that captured the log data.

<FIG> includes an example flow diagram <NUM> of some of the examples for testing software for operating a vehicle in an autonomous driving mode, which may be performed by one or more processors such as processors of computing devices <NUM>. For instance, at block <NUM> a first simulation is run using log data collected by a vehicle operating in an autonomous driving mode. The simulation is run using the software to control a first simulated vehicle. At block <NUM>, one or more characteristics of the simulated vehicle are compared with one or more characteristics of the vehicle from the log data in order to determine a divergence point. At block <NUM>, the divergence point used to determine a handover time for the second simulation. The handover time corresponds to a time in the second simulation at which the software is allowed to take control of the second simulated vehicle. At block <NUM>, a second simulation is run using the log data. The second simulation is run using the software to control a second simulated vehicle (or rather the simulated vehicle of the second simulation) and using the divergence point as a handover time to allow the software to take control of the second simulated vehicle. At block <NUM>, whether the software is able to complete the second simulation without a particular type of event occurring is determined.

In addition or alternatively, once the divergence point is identified in a simulation, a timer may be started. For instance, this timer may be <NUM> seconds of time in the simulation (which may run faster than real time) or more or less. After the timer expires, certain events may be ignored. For instance, if simulations are being analyzed to determine when the software is likely to cause the vehicle to behave or maneuver in a particular way (such as swerving or changing lanes, etc.) or collide or nearly collide with another agent or object, and such events occur after the timer expires, these events more likely to be caused by the other agents in the simulation rather than the software. The timer may help to determine how likely an event is to be caused by software versus another agent in the simulation. In other words, such events that occur before the timer has expired are more likely to be caused by the software than other agents in the simulation. Similarly, such events that occur after the timer has expired may be more likely to be caused by other agents in the simulation than the software. As such, these events that occur after the timer has expired may be ignored, or not flagged, or flagged, but with lower priority to avoid unnecessary review of simulations with collisions caused by agents rather than the software. <FIG> includes an example flow diagram <NUM> of some of the examples for testing software for controlling a vehicle in an autonomous driving mode, which may be performed by one or more processors such as processors of computing devices <NUM>. For instance, at block <NUM>, a simulation is run using log data collected by a vehicle operating in an autonomous driving mode. The simulation is run using the software to control a first simulated vehicle. At block <NUM>, one or more characteristics of the simulated vehicle are compared with one or more characteristics of the vehicle from the log data in order to determine a divergence point. At block <NUM>, a timer that expires during the simulation is started at the divergence point in the simulation. At block <NUM>, whether the software is able to continue through the simulation without the particular event occurring prior to the timer expiring is determined.

<FIG> includes an example flow diagram <NUM> of some of the examples for testing software for controlling a vehicle in an autonomous driving mode, which may be performed by one or more processors such as processors of computing devices <NUM>. For instance, at block <NUM>, a first simulation is run using log data collected by a vehicle operating in an autonomous driving mode. The first simulation is run using the software to control a first simulated vehicle. At block <NUM>, during the running of the first simulation, one or more characteristics of the first simulated vehicle are compared with one or more characteristics of the vehicle from the log data in order to determine a divergence point. At block <NUM>, a timer that expires during the simulation is started at the divergence point. At block <NUM>, whether the software is able to continue through the first simulation without the particular event occurring prior to the timer expiring is determined. At block <NUM>, the divergence point is used to determine a handover time for a second simulation. The handover time corresponds to a time in the second simulation at which the software is allowed to take control of the second simulated vehicle. At block <NUM>, a second simulation is run using the log data. The second simulation is run using the software to control a second simulated vehicle and using the divergence point as a handover time to allow the software to take control of the second simulated vehicle. At block <NUM>, whether the software is able to complete the second simulation without a particular type of event occurring is determined. Again this process may be continued in a loop as described above.

Again, the features described herein provide for a safe, effective, and realistic way of testing software for autonomous vehicles. For instance, the software can be tested in hundreds of thousands of scenarios without endangering the life and property of actual persons. At the same time, by making the handover time for a new simulation a divergence point corresponding to a divergence point of a prior simulation, this prevents the simulated vehicle from inadvertently making the simulation less useful. In addition, this approach effectively provides for more realistic responses of the software being tested as well as more valuable and useful simulations out of a fixed amount of log data. In addition, using a timer to determine whether to flag a simulation for review may reduce the time and other resources required to review simulations that are not actually true "fails". In addition, those simulations that are flagged may be more critically important to determining how to revise or update the software being tested. Without such testing, the risks of injury to persons or property using un-tested software may be too great.

Claim 1:
A method of testing software for operating a vehicle in an autonomous driving mode, the method comprising:
running (<NUM>) a first simulation using log data collected by a vehicle (<NUM>) operating in an autonomous driving mode, wherein the first simulation is run using the software to control a first simulated vehicle;
comparing (<NUM>) one or more characteristics of the first simulated vehicle (<NUM>, <NUM>) with one or more characteristics of the vehicle from the log data in order to determine a divergence point;
using (<NUM>) the divergence point to determine a handover time for a second simulation, the handover time corresponding to a time in the second simulation at which the software is allowed to take control of a second simulated vehicle of the second simulation;
running (<NUM>) the second simulation using the log data, wherein the second simulation is run using the handover time and the software to control the second simulated vehicle; and
determining (<NUM>) whether the software is able to complete the second simulation without a particular type of event occurring in the second simulation.