Patent Description:
Trucks are an essential part of modern commerce. These trucks transport materials and finished goods across the continent within their large interior spaces. Such goods are loaded and unloaded at various facilities that can include manufacturers, ports, distributors, retailers, and end users. Large over-the road (OTR) trucks typically consist of a tractor or cab unit and a separate detachable trailer that is interconnected removably to the cab via a hitching system that consists of a so-called fifth wheel and a kingpin. More particularly, the trailer contains a kingpin along its bottom front and the cab contains a fifth wheel, consisting a pad and a receiving slot for the kingpin. When connected, the kingpin rides in the slot of the fifth wheel in a manner that allows axial pivoting of the trailer with respect to the cab as it traverses curves on the road. The cab provides power (through (e.g.) a generator, pneumatic pressure source, etc.) used to operate both itself and the attached trailer.

A wide range of solutions have been proposed over the years to automate one or more processes of a truck, thereby reducing or eliminating the input labor needed by a driver. In one application, trucks that are used to shunt trailers around a yard between storage/parking locations and loading/unloading docks. Such vehicles are generally termed "yard trucks" and can be powered by fossil fuels or electricity in various configurations. Various novel autonomous vehicle implementations and function associated with autonomous vehicle yard trucks (herein termed "AV yard trucks"), are described in commonly assigned <CIT>, and related applications thereto, the teachings of which are useful background information. <CIT> discloses a method of controlling the braking of a tractor-trailer. <CIT> discloses a pneumatic brake system that causes brakes to operate by supplying air to a brake mechanism.

Autonomous, typically unmanned, trucks (AV yard and/or OTR) require computer control over the pneumatic brake system to control speed under nominal conditions and to stop the truck under abnormal or emergency situations. Without this control capability, the autonomous vehicle would not be safely operable. Dual mode autonomous vehicles (vehicles which can be operated manually by an onboard operator or autonomously without an occupant), furthermore, require that the computer control be disengaged during manual operation to minimize the chance of accidental activation of the braking system. This failover capability between automated and human operation may pose challenges in continuous control and operation of a vehicle, as priority must be given to the human operator, while not compromising the future operation of automated systems.

In accordance with a first aspect of the invention, there is provided a system for allowing failover between an autonomously controlled braking system and a human controlled braking system in a truck having pneumatic brake lines comprising: a cab-mounted brake actuator arranged to be handled by the human operator and arranged to selectively deliver pressurized air to truck brakes and a trailer brake air supply; a controller that performs autonomous braking operations in response to control inputs and that senses when a human operator is handling the actuator; and a plurality of valves, interconnected in a pressure circuit between a pressurized air source on the truck, the actuator, the truck brakes and the trailer brake air supply, responsive to the controller, and arranged to override selective delivery of pressurized air to the truck brakes and the trailer brake air supply in response to the autonomous braking operations in favor of selective delivery of pressurized air via the actuator. The pressure circuit includes a tank monitor adapted to determine whether tank pressure falls below a predetermined threshold, and wherein, in response thereto, the valves apply at least one of the service brakes and the parking brakes and direct the controller to ignore predetermined sensors and switches within the pressure circuit.

The actuator may, for example, be one of a brake foot pedal assembly and a parking brake handle assembly.

Preferably, the controller is arranged to apply emergency stop braking settings to the valves in response to predetermined conditions.

Preferably, the controller includes a vehicle CAN bus that communicates with other vehicle systems.

Preferably, the valves are adapted to selectively deliver pressurized air to each of service brakes and parking brakes.

Preferably, the pressure circuit includes a plurality of pressure sensing monitor switches, poppet valves that selectively release pressurized air to an external environment and shuttle valves that override pressure flow from each of a plurality of inputs.

Optionally, the controller inputs and outputs signals using at least two substantially redundant physical and communication protocol channels.

In a second aspect of the invention, there is provided a method for allowing failover between an autonomously controlled braking system and a human controlled braking system in a truck having pneumatic brake lines comprising the steps of: providing a cab-mounted brake actuator that is handled by the human operator, and thereby selectively delivering pressurized air to truck brakes and a trailer brake air supply; performing autonomous braking operations in response to control inputs, including, sensing when a human operator handles the actuator; and providing a pressure circuit with a plurality of valves, interconnected between a pressurized air source on the truck, the actuator, the truck brakes and the trailer brake air supply, responsive to the autonomous braking operations, and overriding selective delivery of pressurized air to the truck brakes and the trailer brake air supply in response to the autonomous braking operations in favor of selective delivery of pressurized air via the actuator.

Preferably, the actuator is at least one of a brake foot pedal assembly and a parking brake handle assembly.

Preferably, the method further comprises performing emergency stop braking settings to the valves in response to predetermined conditions.

Preferably the control inputs are transmitted over a vehicle CAN bus that communicates with other vehicle systems.

Preferably, the method further comprises selectively controlling the valves and thereby delivering pressurized air to each of service brakes and parking brakes.

Preferably, the method further comprises overriding pressure flow from each of a plurality of inputs with a plurality of pressure sensing monitor switches, poppet valves that selectively release pressurized air to an external environment.

Preferably, the method further comprises inputting and outputting signals using at least two substantially redundant physical and communication protocol channels.

The method further comprises operating a tank monitor adapted to determine whether tank pressure falls below a predetermined threshold, and in response thereto, operating the valves to apply at least one of the service brakes and the parking brakes ignoring predetermined sensors and switches within the pressure circuit.

This invention overcomes disadvantages of the prior art by providing an Electronic Brake Controller (EBC) system that addresses the challenges of allowing for failover operation in which a human driver must intervene with autonomous operation, whereby the autonomous braking system is disengaged to ensure safe operation, and avoid accidental deployment of brakes in contravention to the human driver's commands. In an exemplary implementation, the system and method operates to accept braking commands over a communications bus from a control computer and/or via discrete digital inputs from a safety-rated PLC. The system and method also enables control of pneumatic valves to apply pressure to the (e.g.) OEM pneumatic brakes based on those commands. It also allows computer control to be disengaged when configured for manual operation, and monitors control of the pneumatic brakes, computer control lockouts, and internal logic components. The system and method further allows for application of full (emergency stop) braking efforts when anomalies occur and/or power is lost to the system, ensure vehicle safety.

In an illustrative embodiment a system and method for allowing failover between an autonomously controlled braking system and a human controlled braking system in a truck having pneumatic brake lines is provided. A cab-mounted brake actuator is arranged to be handled by the human operator, and is arranged to selectively deliver pressurized air to truck brakes and a trailer brake air supply. A controller performs autonomous braking operations in response to control inputs, and senses when a human operator is handling the actuator. A plurality of valves are provided in a pressure circuit, interconnected between a pressurized air source on the truck, the actuator, the truck brakes and the trailer brake air supply, are responsive to the controller, and are arranged to override selective delivery of pressurized air to the truck brakes of the truck and the trailer brake air supply in response to the autonomous braking operations in favor of selective delivery of pressurized air via the actuator. Illustratively, the actuator is at least one of a brake foot pedal assembly and a parking brake handle assembly. The controller can be arranged to apply emergency stop braking settings to the valves in response to predetermined conditions. The controller includes a vehicle CAN bus that communicates with other vehicle systems. The valves can be adapted to selectively deliver pressurized air to each of service brakes and parking brakes, and/or the valves include a plurality of pressure sensing monitor switches, poppet valves that selectively release pressurized air to an external environment and shuttle valves that override pressure flow from each of a plurality of inputs. The pressure circuit can also include a tank monitor, which is adapted to determine whether tank pressure falls below a predetermined threshold, and in response thereto, the valves apply at least one of the service brakes and the parking brakes and direct the controller to ignore predetermined sensors and switches within the pressure circuit. The controller inputs and outputs signals using at least two substantially redundant physical and communication protocol channels.

The description below refers to the accompanying drawings, of which:.

Reference is made to <FIG>, which shows a typical autonomous vehicle truck (e.g. an electrically powered AV yard truck) <NUM>. The truck <NUM> includes a cab <NUM> that is adapted for human control in addition to autonomous operation, and thus, includes a windshield <NUM> and access door <NUM>, as well as a seat <NUM>, steering wheel <NUM>, gear shift <NUM>, dashboard instrumentation/gauges <NUM>, and floor pedals for accelerator and braking <NUM> (<FIG>). The truck includes steerable front wheels <NUM> and (typically) drive rear wheels <NUM>. A fifth wheel trailer hitch <NUM> is provided on the rear of the chassis <NUM>, and can be conventional in design (with appropriate automated control). Other features of the truck, such as the pneumatic connections (e.g. glad hands) and/or power connections <NUM> can be adapted for autonomous/unattended operation when hitching and unhitching the trailer. A vision system camera assembly <NUM> is also provided and can be adapted to assist in autonomous guidance. Likewise, other systems (e.g. rear cameras, LIDAR and other range sensors) can be provided to assist autonomous operation (not shown). These systems are managed by one or more hardware and software controllers instantiated on the truck <NUM>, and/or within a remote server system, linked to the truck by (e.g. wireless) a network link <NUM>. The above <CIT>, entitled SYSTEMS AND METHODS FOR AUTOMATED OPERATION AND HANDLING OF AUTONOMOUS TRUCKS AND TRAILERS HAULED THEREBY, describes a wide variety of systems and processes that are desirable to allow for the monitoring and operation of autonomous functionality within the depicted truck <NUM> of <FIG>. These systems can include an on-board vehicle control unit (VCU) <NUM> that manages overall operation of the vehicle, including autonomous operations, based upon applicable hardware and/or software processes.

One of the control units located (in this example) on the truck <NUM> is an Electronic Brake Controller (EBC) <NUM>. In general, unmanned autonomous vehicles must be stoppable, even if the system experiences component failures or even power loss. Therefore, the EBC operates to provide redundant and failover/failsafe mechanisms to apply full pneumatic braking power the vehicle wheels <NUM>, <NUM>, and via the pneumatic connections <NUM> (or other interfaces) to an attached/hitched trailer (not shown).

As shown in <FIG>, The EBC <NUM> is interconnected via an electrical connection to appropriate actuators and pressure sensors within a central service brake and parking brake control valve assembly <NUM>, which includes various fluid-pressure-actuated pneumatic and/or hydraulic elements. The valve assembly <NUM> is, likewise, interconnected by appropriate pressure conduits/lines to various operational elements within the overall truck braking system. One connection is to the human operator foot pedal brake treadle valve <NUM>. A second connection passes through the chassis to the front wheel brake cylinders (on each side) <NUM> and rear wheel brake cylinders <NUM>. Various known load-balancing, anti-lock and other control circuitry can also be provided and are omitted for clarity. A third connection is to the manual parking brake valve <NUM>, which interfaces with a human-operated parking brake control handle. The EBC also interfaces electronically with a safety control interlock circuit <NUM> located at an appropriate position on the vehicle.

By way of background, OEM pneumatic brakes are applied by a human operator in two ways. First, parking or emergency brakes are applied by reducing air pressure from one side of the brake chamber to less than 60psi. This is accomplished by releasing a plunger valve (<NUM>) inside the vehicle cab. Alternatively, if tank pressure drops below 60psi, the parking brakes are applied as a default. Additionally, service brakes are applied by supplying air pressure to the other side of the brake chamber. This is accomplished by depressing the brake treadle valve (<NUM>) to supply air from the tank to the brake chamber. The amount of braking power applied is proportional to the pressure supplied from the treadle valve. Full braking power is applied when the full tank pressure is supplied (typically, at least approximately 100psi). The EBC <NUM>, according to an exemplary embodiment, achieves redundancy by utilizing both of these application methods. Electro-pneumatic valves are used to supply tank pressure to the service brake circuit and apply full service brakes. Electro-pneumatic valves are also used evacuate air from the parking brake circuit, which also applies full braking effort. The electro-pneumatic valves are arranged such that when deenergized, full braking efforts are applied. This approach provides failsafe operation. In summary, regardless of why power is lost to the valves (e.g. vehicle power loss, wire breakage, intentional removal, etc.), the brakes will be applied. During nominal operation, the tank pressure supplied to the service brakes is regulated by a proportional electro-pneumatic valve similar to how the pedal-operated treadle valve operates.

A significant aspect of the system and method is its ability to operate in dual modes. It provides computer control for autonomous operation while concurrently enabling manual control when properly configured. Electro-pneumatic valves within the valve assembly <NUM> are adapted to isolate airflow when operating under manual control. The isolation prevents air pressure from being supplied on the service circuit and evacuated from the parking circuit. If a failure occurs, however, control reverts to the EBC <NUM>, and full brakes are applied by de-energizing all valves.

Another significant feature of the system and method herein is its ability to permit manual application of service brakes at all times, even when the system is nominally under computer control. This ensures that a human user can exercise override under any circumstance. Shuttle valves are used to implement a max function between the pedal treadle valve <NUM> and the electro-pneumatic proportional valve, which typically resides in the valve assembly <NUM>. Whichever valve is applying the most pressure, and therefore braking effort, is honored by the valve assembly <NUM> and EBC. This enables the system to be safely used in conjunction with a safety driver when operating autonomously because the safety driver can ultimately apply brakes at any time.

When operating under computer control, the Brake Controller ECU (EBC <NUM>) can accept inputs from both a communications bus (e.g. controller area network (CAN), serial, Ethernet, etc.) and discrete inputs. The communications bus is used under nominal operations to apply and release parking brakes and proportionally apply service brakes. The discrete input signals are provided as a redundant path to apply full braking efforts (for example, during an emergency stop), and to request or inhibit computer control.

The operation of all electro-pneumatic valves is monitored using pressure activated switches and transducers by the Brake Controller ECU (EBC <NUM>). If a valve does not operate as expected, that failure will be detected by the monitoring switch or transducer. The ECU logic will then de-energize all valves to apply full brakes.

Reference is made to <FIG>, which is a simplified block diagram showing an arrangement <NUM> of inputs and outputs transmitted between modules of the EBC <NUM>. It is noted that throughout the description there is shown two redundant channels of control and communication A and B. Thus, it can be assumed that any description of one channel applies similarly to the second channel herein and such channels A and B are also referred to collectively. The brake controller logic <NUM> is responsible for enabling computer control of pneumatic brake systems via a J1939 CAN bus <NUM>. It provides proportional control of the service brake proportional valve <NUM>, similar to how a standard treadle valve works, and on/off control of the parking brakes. It controls brake mechanisms for both the tractor and an attached trailer (via pneumatic line (e.g. glad hand connections).

It is contemplated that the brake controller <NUM> can support an ISO <NUM> PLd safety case. To mitigate hazards, ISO <NUM> requires that specific safety functions are defined. Those safety functions must include all inputs, logic, outputs, and power that are involved in any potentially hazardous operation. The safety functions defined for the Brake Controller are (a) Emergency Stop Braking and (b) Unintended Control Detection.

The Emergency Stop Braking safety function applies full braking efforts using both service brakes and parking brakes under specific internal conditions and external inputs. The Unintended Control Detection safety function determines if the EBC <NUM> does not hand over brake controls to the operator when commanded and causes Emergency Stop Braking.

The brake controller <NUM> also interconnects to the parking brake on/off valve <NUM>, trailer supply on/off valve <NUM>, and any feedback pressure switches via the bus architecture. The arrangement <NUM> also includes a safety interlock module circuit <NUM> according to the system and method. As described further below, this module <NUM> outputs to the brake controller <NUM> "Computer Control Request" signals <NUM> that manage whether autonomous control is enabled. The module <NUM> also outputs "Emergency (E)-Stop Release" signals <NUM> that cause an emergency stop event to occur. The module <NUM> also outputs "Computer Inhibit OK" signals <NUM> that determine when manual control is enabled. Also, the module <NUM> outputs "Brake OK" signals <NUM> that determine when normal manual or autonomous brake function can occur.

In operation, the brake controller <NUM> applies full braking effort upon power loss, regardless of prior operating mode. In alternate embodiments, it is contemplated that the power loss behavior can vary based on operating mode. The brake controller <NUM> (based on feedback from (e.g.) switches <NUM>) performs all self-checking functions associated with braking. That includes verifying that the brake pressures respond appropriately during an e-stop event and ensuring that brake pressures do not change to release brakes if there is a failure in the e-stop chain within the module. That latching behavior can be maintained across power cycles. Notably, the brake controller overrides the in-cab parking brake plunger (treadle valve <NUM>) functions when operating under computer control.

In operation, the brake controller <NUM> reads the discrete input signals <NUM>, <NUM>, <NUM> and <NUM> from the safety interlock module <NUM> to determine its intended operating mode. Based on operating mode, it can accept brake commands via the J1939 CAN bus <NUM>. It also performs various self-checking functions and indicate any critical failures to the safety interlock module.

The above signals <NUM>, <NUM>, <NUM> and <NUM> of the interlock module <NUM> are expressed as a set of interrelated logical states in the diagram <NUM> of <FIG>. These states relate to a particular mode of operation.

The brake controller module <NUM> can operate in one of three modes: Manual Control <NUM>, Computer Control <NUM>, and Emergency Stop <NUM>. These modes are selected based on inputs to the logic block <NUM> by the safety interlock module <NUM>.

In Manual Control mode <NUM>, the brake controller module <NUM> releases all control of the service brakes, parking brakes, and trailer supply to ensure that the operator has complete control of the system without interference. This is monitored by the Unintended Control Detection safety function described above.

In Computer Control mode <NUM>, the brake controller module <NUM> applies braking efforts based on J1939 CAN bus messages. Controlled braking efforts include actuation of valves for service brake pressure <NUM>, parking brake application <NUM>, and trailer air supply <NUM>, according to commands received on the J1939 CAN bus. If the trailer air is supplied, simply controlling the vehicle/truck service brake pressure and parking brake application serves to control trailer service brakes and trailer parking brakes as these circuits are tied together in a known configuration. In alternate implementations it is contemplated that independent trailer service brake control can be provided. Note that in Computer Control mode <NUM>, the operator's foot pedal can still apply service brakes, but the in-cab plungers for parking brake and trailer air supply are not operational. This behavior could potentially produce a new hazard if the service brake pedal does not operate correctly for the operator because the operator will not be able to activate the parking brakes. In that case, the operator can still activate the HV disconnect to power-off the truck and apply parking brakes.

In Emergency Stop mode <NUM>, the brake controller module <NUM> will apply full braking efforts using both the service and parking brakes/valves <NUM>, <NUM>. This is accomplished by the Emergency Stop Braking safety function described above.

With more particular reference to the state diagram <NUM> of <FIG>, the operating mode is selected based on discrete inputs and J1939 CAN commands. The following is a more-detailed description of the various modes <NUM>, <NUM> and <NUM>.

Manual Control Mode <NUM> is entered when all of the following conditions <NUM> are met; namely (a) both of the Computer Control Request lines/signals <NUM> are electrically disconnected (no current), and (b) J1939 CAN commands are not being received at a rate of at least <NUM> for more than <NUM>. The mode transition depends upon J1939 CAN commands because in alternate implementations, it can be desirable to remove the Computer Control Request lines and fully apply the J1939 standard paradigm of providing control when messages are present and releasing control when messages are absent.

When the brake controller module transitions into Manual Control Mode <NUM>, the service brakes are released, and the parking brakes and trailer supply are no longer being controlled. The parking brakes and trailer supply revert the state commanded by the in-cab plungers. Note that this can result in immediate application of the parking brakes and/or trailer brakes. This can be mitigated by permitting the overall vehicle control unit (VCU) and/or Safety Interlock Module not request computer control until the in-cab plungers are in an appropriate state. Then, the Computer Inhibit OK signals <NUM> are asserted to indicate that the module is no longer under computer control.

The Computer Control Mode <NUM> is entered when either of the following conditions <NUM> are met; namely (a) either Computer Control Request signal <NUM> is active or (b) J1939 CAN commands are being received at a rate of at least <NUM>. Upon entering Computer Control Mode <NUM>, the Computer Inhibit OK signals <NUM> are de-asserted to indicate the mode change. The brake controller module <NUM> then applies service brakes, parking brakes, and trailer supply air as directed by the J1939 CAN commands.

The Emergency Stop Mode <NUM> is entered under any of the following conditions <NUM>; namely (a) power loss, (b) either of the E-Stop Release lines/signals <NUM> is disconnected/de-asserted, (c) a critical internal module error is detected). The critical errors that trigger the Emergency Stop mode <NUM> are, at a minimum, one or more of the following; (a) a disagreement between the A and B inputs of the E-Stop Release signal (<NUM>), (b) a disagreement between the A and B inputs of the Computer Control Request inputs (<NUM>) and/or J1939 commands, and/or (c) a feedback indicating failure to apply any braking mechanism. When one of these critical errors is encountered, the brake controller module <NUM> disconnects/de-asserts the redundant Brake OK signals <NUM>. Otherwise, those signals <NUM> remain connected to indicate nominal operations. If the brake controller module <NUM> is in the Emergency Stop mode <NUM> due to a critical error, it will not exit the Emergency Stop mode until the system has been power cycled and the error cleared. If an error is not cleared, the vehicle/truck can still be recovered by manually caging the brakes. This action serves to release the brakes regardless of air pressure, and thus, additional steps are employed to ensure that the truck is not operated while brakes are caged. As shown, once the module is in the Emergency Stop mode <NUM>, the service brakes and parking brakes are fully applied.

In alternate implementation it is contemplated that differing default brake behavior can occur during power loss and critical internal error based on operating mode. In such alternate implementations power loss and/or critical internal errors may be arranged to trigger an Emergency Stop only if the module is configured to do so. The below-listed Table <NUM> defines various operational and safety requirements that are met by the brake controller module <NUM>, interlock module <NUM> and related modes.

The Service Brake Control function enables proportional control of the OEM vehicle brakes over a J1939 CAN communications channel. This is accomplished using a proportional pneumatic valve that regulates pressure to the service brakes, similar to the behavior of the treadle valve <NUM>. The air pressure from the proportional valve <NUM> and the brake treadle valve <NUM> is routed through a shuttle valve (e.g. residing in the assembly <NUM>). The result is that the maximum brake pressure applied between the two sources is applied to the brake cylinders <NUM>, <NUM> via the shuttle valve. Details of how the service brake behaves in each operating mode are provided in Table <NUM> directly below.

The Parking Brake Control function enables engage/disengage control of the OEM parking brakes over a J1939 CAN communications channel. This is accomplished using (e.g.) poppet valves within the assembly <NUM> that either supply or evacuate air pressure to the parking brake supply line, similar to the behavior of the hand-operated in-cab plunger valve(s) <NUM>. To apply parking brakes, the poppet valves evacuate pressure from the parking brake supply lines. To release parking brakes, the poppet valves supply tank/reservoir pressure to the parking brake supply lines. Note that if the reservoir pressure is not high enough to release the parking brakes, the Parking Brake Control function cannot fully release the brakes. The control valves are installed such that the in-cab plunger valve does not affect operation of this function when in the Computer Control mode <NUM>. This alleviates the need for an operator to enter the truck/vehicle and manually release the parking brakes every time autonomous operation is desired, or the reservoir pressure is depleted. Details of how the parking brake behaves in each operating mode are provided in Table <NUM> directly below.

The Trailer Brake Supply Control function enables or disables the air supply to a trailer based on J1939 CAN communications commands. This is accomplished using poppet valves within the assembly <NUM> that either supply air pressure to, or evacuate air pressure from, the trailer emergency supply line, similar to the behavior of the hand-operated in-cab plunger valve <NUM>. If the poppet valves supply air to the emergency supply line, then the trailer parking brakes are released, and the trailer service brakes are controlled from the Service Brake Control function, described above. If the poppet valves evacuate the emergency supply line, then the trailer parking brakes are applied, and the service brake pressure is no longer routed to the trailer brake. The poppet valves are installed such that the in-cab plunger valve <NUM> does not affect operation of this function when in the Computer Control mode <NUM>. This, again, alleviates the need for an operator to access the cab, and manually supply trailer air if/when the reservoir pressure is depleted. Details of how the parking brake behaves in each operating mode are provided in Table <NUM> directly below.

The Emergency Stop Braking safety function is responsible for executing the Emergency Stop Mode <NUM>. The safety function brings the vehicle to a complete stop by applying full brake efforts under certain exceptional circumstances regardless of operating mode. The Emergency Stop Braking safety function is implemented in accordance with the arrangement <NUM> shown in <FIG>. The redundant logic chain, A and B, <NUM> and <NUM> are responsible for taking separate discrete actions to apply full braking efforts. The A chain <NUM> applies full service brakes (<NUM>), while the B chain <NUM> applies parking brakes <NUM>. Respective, feedback, in the form of a Brake OK A <NUM> and Brake OK B signal <NUM> monitors for system failure. If either chain <NUM>, <NUM> fails, the other will still stop the truck. Furthermore, if one chain (A or B) fails, the brakes are not released.

The Emergency Stop Braking safety function logic <NUM> chains each receive a single-ended release signal to transition to the Emergency Stop mode. When the release signal is removed, the brake controller module transitions to the Emergency Stop mode. This constitutes a triggering mechanism for the function.

Each safety function chain (A or B) is responsible for outputting independent signals to apply full braking efforts. Additionally, each chain outputs a Brake OK status signal to indicate that the chain is operating nominally. The A chain output applies full service brakes by setting the proportional control valve to maximum pressure. The B chain output applies parking brakes by evacuating the parking brake supply lines. Either chain can bring the vehicle to a complete stop without (free of) the other chain. As the overall system speed/velocity is increased, simply applying full braking efforts may not be the safest execution path. Thus, it is contemplated that more intelligent braking controls can be implemented in alternate embodiments. Some features that can be included are (a) ramped application of service brakes, (b) exclusively applying parking brakes if service brake ramping is not operating correctly or the vehicle is below a threshold speed, and/or (c) implementing anti-lock brake system (ABS) functionality in a manner that can be known to those of skill.

Both the A chain logic block <NUM> and B chain logic block <NUM> perform error checking via feedback (blocks <NUM> and <NUM> in <FIG>). If an error is detected in one chain, then that chain of the safety function enters an error state. In the error state, full braking efforts are applied, and the associated Brake OK signals are removed. Each chain monitors the other for error status. If one chain detects that the other is in error, the detecting chain also removes its output signals to apply full braking efforts.

Each logic chain <NUM>, <NUM> A and B performs short-circuit checking on the input E-Stop Release signals. Shorts are checked against ground, power, and between signals. The function will enter the error state when a short circuit is detected. Additionally, the logic blocks compare their respective E-Stop Release signal states against each other via a logic cross-check function <NUM>. If there is a discrepancy in those states for more than <NUM>, the safety function enters the error state.

Each logic chain <NUM>, <NUM> (A and B) performs short-circuit detection on the output signals. Shorts are checked against ground, power, and between output signals using techniques clear to those of skill. If a short is detected, the offending chain will enter the error state.

Each logic chain (A and B) monitors the effects of its output on brake application. Chain A monitors service brake pressure to verify that the brakes are fully applied. Chain B monitors parking brake pressure to ensure that the parking brakes are applied. If either chain detects that its output is not having the desired effect, it will enter the error state.

Reference is made to <FIG>, which shows and arrangement <NUM> for the Unintended Control Detection safety function, which is responsible for ensuring that the brake actuation is inactive in the Manual Control mode <NUM>. The safety function releases brake application and locks out service brake control when configured in the Manual Control mode <NUM>. If control is not handed back to the operator, then the safety function triggers an internal error, which results in Emergency Stop Braking.

The redundant logic chains <NUM> and <NUM> are responsible for taking separate discrete actions to prevent/block computer control (<NUM>, <NUM>) of the brake function. The A chain <NUM> releases the service brakes and parking brakes <NUM>. The B chain <NUM> prevents/blocks further brake actuation <NUM>. If either chain (A or B) fails, then the other chain will not release its brake control. If one chain fails, that chain will enter an error state, and Emergency Stop Braking is triggered. This status is then reflected in the Computer Inhibit OK outputs.

The Unintended Control Detection safety function logic chains <NUM>, <NUM> (A and B) each receive a single-ended request signal to request Computer Control mode <NUM>. These signals are asserted/active-high, so that when the signals are removed, the brake controller module <NUM> can transition to the Manual Control mode <NUM>. Additionally, each logic chain <NUM>, <NUM> monitors incoming J1939 CAN commands. If brake commands are not being received at <NUM> for more than <NUM>, and the request signals are removed, then the brake control module <NUM> will transition to the Manual Control mode <NUM>.

Each safety function chain <NUM>, <NUM> (A and B) is responsible for outputting independent signals to prevent computer-controlled braking efforts. Additionally, each chain <NUM>, <NUM> respectively outputs the Computer Inhibit OK status signal <NUM>, <NUM> to indicate that the chain is operating in the Manual Control mode. When in the Manual Control mode <NUM>, the A chain <NUM> output releases the service brakes (<NUM>) by setting the proportional control valve to zero pressure and returning parking brake control to the in-cab plunger valve. The B chain <NUM> output locks out service brake control (<NUM>) using (e.g.) poppet valves within the assembly <NUM>. Since parking brake control is returned to the in-cab plunger <NUM>, further actuation is not possible by computer control. If both chains <NUM>, <NUM> (A and B) are not operating properly, the control is not returned to the driver, and the module enters the Emergency Stop mode <NUM>.

Both the A chain logic block <NUM> and B chain logic block <NUM> perform error checking via a cross check <NUM>. If an error is detected in one chain, then that chain of the safety function enters an error state. In the error state, Emergency Stop Braking is performed, and the Computer Inhibit OK signal <NUM> or <NUM> is removed/de-asserted. Each chain monitors the other chain for error status. If one chain detects that the other is in error, the detecting chain does not return control to the operator, ensuring that brakes cannot be released.

Each logic chain <NUM>, <NUM> (A and B) performs short circuit checking on the input Computer Control Request signals. Shorts are checked against ground, power, and between request signals using known techniques. The function does not enter the error state when a short circuit is detected. Additionally, the logic blocks compare their respective Computer Control Request signal states against each other. If there is a discrepancy in those states for more than <NUM>, then the safety function enters the error state.

Each logic chain <NUM>, <NUM> (A and B) performs short circuit detection on the output signals. Shorts are checked against ground, power, and between output signals. If a short is detected, the offending chain will enter the error state.

Each logic chain (A and B) monitors the effects of its output on returning brake control to the operator. Chain A <NUM> monitors the computer-controlled brake pressures to verify that the brakes are released. Chain B <NUM> monitors pressure in the lock-out circuit sections. If either chain detects that its output is not having the desired effect, then it enters the error state.

The brake controller module <NUM> is commanded under the Computer Control mode <NUM> using the J1939 CAN bus. Brake commands are expected to be received at a rate of at least <NUM> in accordance with the communication protocol specified hereby. Module status is reported at approximately the same rate.

In a basic implementation, the brake controller module can accept the following types of commands; namely (a) Requested Service Brake Pressure or Percentage, (b) Requested Parking Brake State, and (c) Requested Trailer Supply State. In an alternate implementation, accepted brake controller module commands can also include (d) a Requested Acceleration command. This command causes the brake controller module <NUM> to perform Service Brake Control to achieve the requested acceleration. Note that this behavior should account for the effects of regenerative braking in an electric vehicle.

Status messages for the J1939 implementation can include the following information, at a minimum; namely (a) Computer Controlled Service Brake Pressure, (b) Brake Pedal Controlled Service Brake Pressure, (c) Parking Brake Status, (d) Trailer Supply Status, (e) Internal Error Status, and (f) Operational Mode.

The brake controller module design consists of three primary sections, the Safety Interlock Module interface, the Service Brake Circuit, and the Parking Brake Circuit. These sections are implemented using a COTS SIL2 rated ECU and pneumatic components (valves, switches, and transducers). The brake controller EBC <NUM> determines the proper operating mode based on the Safety Interlock Module interface. Based on the operating mode, the EBC uses electrical signals to control the state of various pneumatic valves in the Service Brake Circuit and Parking Brake Circuit. It also monitors pneumatic pressure switches and transducers to verify proper operation of those valves. Those valves and feedback signals are used to implement both computer control via a J1939 CAN interface and the Emergency Stop and Unintended Computer Control Safety Functions.

As described above, the brake controller EBC <NUM> operates in one of three modes or states, Emergency Stop <NUM>, Computer Control <NUM>, or Manual Control <NUM>. The operational state is determined by the Safety Interlock Module interface signals and the presence of J1939 CAN commands, as shown in the above-described <FIG>. Depending on the operational state <NUM>, <NUM>, <NUM>, the Brake Controller EBC thereby set the Safety Interlock Module <NUM> status signals appropriately.

As also described above, the input signals (E-Stop Release <NUM> and Computer Control Request <NUM>) from the Safety Interlock Module <NUM> each consist of two discrete digital lines A and B. Reference is made to the signal diagram of <FIG>, which shows both the E-Stop Release timing diagram <NUM> and the Computer Control Requested timing diagram <NUM> for the "ON" state of each. Each timing diagram shows the A and B chains passed <NUM>-degrees with respect to the other. When a signal is off, both lines are set to 0V. When a signal is on, the two digital lines take on complementary voltage values of either 0V or 24V. As shown, the waveforms toggle at a frequency of <NUM>, or every <NUM>. The "OFF" State is the opposite of that depicted for each signal <NUM>, <NUM>.

When the E-Stop Release signal <NUM> is "ON," the Brake Controller EBC <NUM> releases the E-Stop braking valves within the assembly <NUM>. When the Computer Control Request signal is "ON," the Brake Controller EBC <NUM> honors brake commands arriving on the J1939 CAN bus.

The brake controller EBC <NUM> monitors the input signals for certain error conditions. The E-Stop Request and Computer Control Request digital pairs are generally monitored for short circuits, both with respect to a 24V specified peak, and with respect to each other. The following conditions will be monitored to determine if an error has occurred; namely (a) A and B signals are both at 24V for more than <NUM> (thereby indicates possible short between A and B), (b) A or B signal remains at 24V for more than <NUM> (thereby indicates short to 24V), and (c) only one of A or B signals is oscillating (thereby indicates open circuit or short to 0V).

If an error is detected on the E-Stop Release input signal <NUM>, then the brake controller EBC <NUM> transitions to the Emergency Stop mode <NUM>. If an error is detected on the Computer Control Request input signal, then the brake controller EBC remains in the Computer Control mode <NUM>, but applies full brakes and does not honor J1939 CAN commands.

If J1939 CAN commands are being received at a rate of at least <NUM>, but the Computer Control Request signal is not "ON," then the brake controller EBC <NUM> transitions to the Computer Control mode <NUM>, and applies full brakes. All detected errors are reported via the J1939 CAN interface.

The Service Brake Control Circuit portion <NUM> of the brake controller module is shown in more detail in <FIG>. It provides two pneumatic pathways <NUM> and <NUM> for applying service brakes <NUM> and <NUM>. These pathways include a proportional pathway <NUM> that mimics the brake treadle valve <NUM> and an on/off pathway <NUM> that simply applies full braking effort. Both of these pathways are connected to the service brakes <NUM>, <NUM> via respective shuttle valves <NUM> and <NUM>, along with the OEM brake pedal <NUM>, as shown. The source which supplies the highest pressure to the circuit will be passed through the shuttle valves to the brakes. This enables the operator to always apply service brakes.

The Service E-Stop valve <NUM> is a <NUM>/<NUM> poppet that is controlled by the SERV_ESTOP signal, issued by the output block <NUM> of the EBC brake controller's service brake subsystem/module <NUM>. When the output signal is 0V or disconnected, the valve passes air directly from the pressurized air tank <NUM> to the service brakes <NUM>, <NUM>, applying full brakes. When the output signal is 12V, the valve <NUM> changes state and evacuates air between the valve and the shuttle valve <NUM>, <NUM>. If no other source is applying air, then the service brakes <NUM>, <NUM> are released.

The Service E-Stop Monitor pressure switch <NUM> provides a 12V signal, SRV_ESTP_MON to the associated input block <NUM> of the brake controller EBC (<NUM>) input <NUM> to indicate whether the Service E-Stop valve <NUM> is applying brakes or not. When the valve applies full brakes, the pressure switch <NUM> closes and return the 12V signal to the input.

Service brake proportional control is provided via a combination <NUM>/<NUM> poppet valve <NUM> and proportional control valve <NUM>. The <NUM>/<NUM> poppet valve <NUM>, also labeled Service Brake Enable, is used to enable or disable proportional brake control via the valve <NUM>, also labeled Proportional Valve. The Service Brake Enable valve <NUM> is controlled by the SERV_EN_CC output signal. When the output signal is 0V or disconnected, the valve evacuates air between its output and the Proportional Valve, ensuring that the Proportional Valve cannot apply brakes. When the output signal is 24V, the valve supplies tank pressure to the Proportional Valve <NUM>. The Proportional Valve <NUM> is then controlled from the SERV_PROP <NUM>-10V signal issued from the EBC output block <NUM>, which is set by J1939 CAN commands. The Proportional Valve <NUM> regulates air pressure to the brakes via the shuttle valves <NUM>, <NUM>, etc..

The Service Release Monitor pressure switch <NUM> provides a 12V signal to the SRV_REL_MON input (<NUM>) to indicate whether the proportional pathway has released the brakes <NUM>, <NUM>. When the proportional control path <NUM> releases the brakes, this switch will close and return 12V to the input. Additionally, the CC Service Pressure transducer <NUM> provides an analog signal to indicate the actual pressure being applied by the proportional control path. That signal is read at the SRV_CC_PRES input (<NUM>).

The Pedal Service Pressure transducer also provides an analog signal to indicate the pressure being applied by the brake pedal treadle valve <NUM>. That signal is read at the SRV_PED_PRES input (<NUM>) via an in-line transducer <NUM>.

Under nominal computer control operations, the Brake Controller EBC <NUM> releases the Service E-Stop valve <NUM> by setting the SRV_ESTOP output to 12V. It will then enable proportional control by setting the SRV_EN_CC output to 24V. Finally, it will set the SRV_PROP output signal based on the J1939 CAN commands to control actual braking pressure (EDOG-BRK-<NUM>).

When operating under manual control, the SRV_PROP output signal should be set to <NUM> and the SRV_EN_CC signal should be turned off. This will inhibit computer control via the proportional pathway.

Reference is made to <FIG>, collectively showing a parking and trailer supply control arrangement <NUM> and associated pressure circuit (which routes and switches pressurized gas/air through various pipes, tubes and/or hoses of appropriate size and pressure-rating), employing the parking brake circuit subsystem/module <NUM> of the overall brake controller EBC. This subsystem/module <NUM> and associated arrangement <NUM> enables computer control of the vehicle/truck parking brakes <NUM> and trailer air supply (e.g. glad hand) <NUM>. When operating under computer control, the respective in-cab, manually actuated, plungers <NUM> and <NUM> for parking brakes and trailer air supply are locked out to prevent misapplication. When control is returned to the operator, those plungers <NUM>, <NUM> become operational again. Note that this could lead to unexpected behavior. For example, if an operator applies the parking brake and relinquishes control to the autonomy system, the autonomy system could release the parking brake. If the operator subsequently takes manual control without releasing the parking brake plunger, the parking brakes will be applied upon operator intervention.

The Auto/Manual Selection valves <NUM> and <NUM> are <NUM>/<NUM> poppets which select between computer control and plunger control for the parking brakes <NUM>. When the PARK_LOCKOUT signal issued from the brake controller EBS output <NUM> is set to 0V, or disconnected, these poppet valves <NUM>, <NUM> select computer control by routing air from the Tractor Parking Brake valve <NUM> and the Trailer Brake Supply valve <NUM>. When the output is set to 12V, the poppet valves route air from the in-cab plungers, thereby giving the operator control of the parking and trailer brakes <NUM>, <NUM>.

When the Auto/Manual Selection valves <NUM>, <NUM> are configured for computer control, the Tractor Parking Brake <NUM>/<NUM> poppet valve <NUM> is used to apply and release the tractor parking brakes <NUM>. When the TRAC_PARK_REL signal is set to 0V or disconnected by the output block <NUM>, the valve evacuates air from its output to the Auto/Manual Selection valve. If that valve is configured for computer control, air is also evacuated from the parking brakes, thereby applying brakes. If the output is set to 12V, air is supplied to the parking brakes to release them. Air is also supplied to the Trailer Brake Supply valve <NUM>.

The Trailer Brake Supply <NUM>/<NUM> poppet valve <NUM> is used to supply or remove air from the trailer lines, similar to the in-cab plunger <NUM>. When the TRAL_PARK_REL signal at the output block <NUM> is set to 0V, or disconnected, the valve <NUM> evacuates air from the trailer supply lines and applies the trailer brakes <NUM>-if a trailer is connected. When the output is set to 12V, the valve routes air from the Tractor Parking Brake valve <NUM> to the trailer supply lines, which will release the trailer brakes <NUM>, if a trailer is connected. Note that if the Trailer Brake Supply valve <NUM> is supplying air to the trailer brakes, and the Tractor Parking Brake valve <NUM> is turned off to apply parking brakes <NUM>, the trailer brakes will be applied as well since the Tractor Parking Brake valve supplies air for the trailer.

The CC Tractor Parking Monitor pressure switch <NUM> provides a 12V signal to the CCTRC_PK_MON in the input block <NUM> of the brake Controller EBC <NUM> input when the Tractor Parking Brake valve <NUM> is turned off, and applies the brakes <NUM>. Similarly, the CC Trailer Supply Monitor pressure switch <NUM> provides a 12V signal to the CCTRL_PK_MON input (<NUM>) when the Trailer Brake Supply valve <NUM> turns off, and applies trailer brakes. Note that there is some ambiguity in this case, however, since this pressure switch <NUM> is also be triggered simply by turning off the Tractor Parking Brake valve <NUM>.

The Plunger Tractor Parking Monitor pressure switch <NUM> provides a 12V signal to the PLTRC_PK_MON input (<NUM>) when the in-cab parking brake plunger <NUM> is pulled out to apply parking brakes <NUM>. Similarly, the Plunger Trailer Supply Monitor pressure switch <NUM> provides a 12V signal to the PLTRL_PK_MON input when the in-v cab trailer supply plunger is pulled out to apply trailer brakes.

Additionally, the Tractor Parking Monitor and Trailer Supply (Parking) Monitor pressure switches, <NUM> and <NUM>, respectively, monitor the overall parking brake and trailer supply status. If the parking brakes <NUM> are applied, 12V is supplied to the TRC_PK_MON input (<NUM>). If the trailer air supply <NUM> is removed (thereby applying trailer brakes), 12V will be supplied to the TRL_PK_MON input (<NUM>).

Under nominal computer control, the brake controller EBC <NUM> sets the PARK_LOCKOUT output (<NUM>) to 0V to lockout the in-cab plungers <NUM>, <NUM>, and to enable computer control. If the EBC receives a J1939 command to release the parking brakes <NUM>, it will set the TRAC_PARK_REL output (<NUM>) to 12V. To apply parking brakes <NUM>, it will set the same output to 0V. If the EBC <NUM> receives a J1939 command to connect the trailer air supply <NUM>, then it will set the TRAL_PARK_REL output to 12V. This action directs the service brake pressure and parking brake pressure to the trailer. To disconnect trailer air, it will set the same signal to 0V.

When operating under manual control, the EBC <NUM> sets the PARK_LOCKOUT output (<NUM>) to 12V to enable control via the in-cab plungers <NUM>, <NUM>, and inhibit computer control.

Note that the circuit further includes a tank monitor pressure switch <NUM> that monitors pressure of the vehicle supply tank <NUM>, and transmits a signal TANK_MON to the input block <NUM> of the EBC <NUM>. If tank pressure falls below a predetermined threshold, the brakes are applied, and signals issued by other monitor switches can be considered invalid. This provides a safety feature in the event of loss of pressure to the system.

It should be clear that the above-described system and method provides a robust and effective control arrangement for providing failsafe operation to an autonomous truck and associated trailer in the presence of required human intervention. The system and method ensures that the operating environment remains free of contradictory commands between the human and computer operators and affords deference to the human operator's commands and judgment. The system and method can be integrated with existing vehicle pneumatic, communications and electrical systems, and allows existing and future safety requirements in association with autonomous vehicles to be addressed.

The foregoing has been a detailed description of illustrative embodiments. Various modifications and additions can be made without departing from the scope of this invention as defined in the appended claims.

Claim 1:
A system for allowing failover between an autonomously controlled braking system and a human controlled braking system in a truck (<NUM>) having pneumatic brake lines comprising:
a cab-mounted brake actuator (<NUM>, <NUM>, <NUM>, <NUM>) arranged to be handled by the human operator and arranged to selectively deliver pressurized air to truck brakes (<NUM>, <NUM>, <NUM>) and a trailer brake air supply (<NUM>, <NUM>);
a controller (<NUM>, <NUM>) that performs autonomous braking operations in response to control inputs and that senses when a human operator is handling the actuator (<NUM>, <NUM>, <NUM>, <NUM>); and
a plurality of valves (<NUM>), interconnected in a pressure circuit between a pressurized air source (<NUM>) on the truck (<NUM>), the actuator (<NUM>, <NUM>, <NUM>, <NUM>), the truck brakes (<NUM>, <NUM>, <NUM>) and the trailer brake air supply (<NUM>, <NUM>), responsive to the controller (<NUM>, <NUM>), and arranged to override selective delivery of pressurized air to the truck brakes (<NUM>, <NUM>, <NUM>) and the trailer brake air supply (<NUM>, <NUM>) in response to the autonomous braking operations in favor of selective delivery of pressurized air via the actuator (<NUM>, <NUM>, <NUM>, <NUM>),
characterized in that
the pressure circuit includes a tank monitor (<NUM>) adapted to determine whether tank pressure falls below a predetermined threshold, and wherein, in response thereto, the valves (<NUM>) apply at least one of the service brakes (<NUM>, <NUM>) and the parking brakes (<NUM>) and direct the controller (<NUM>, <NUM>) to ignore predetermined sensors and switches within the pressure circuit.