Patent Description:
An autonomous vehicle is a vehicle that is capable of sensing its environment and navigating without human input. In particular, an autonomous vehicle can observe its surrounding environment using a variety of sensors and can attempt to comprehend the environment by performing various processing techniques on data collected by the sensors. Given knowledge of its surrounding environment, the autonomous vehicle can identify an appropriate motion plan through such surrounding environment and command vehicle motion to track such motion plan. <CIT> relates to a method for operating a motor vehicle in an automated driving mode that includes identifying, using two devices, the current position, the objects and open spaces currently present in the vehicle surroundings. The method of <CIT> further comprises respectively identifying, by the two devices, a trajectory for independent vehicle guidance; and in two regulation devices, control signals for actuator devices are respectively identified and control is applied, in accordance with the previously calculated trajectory, to longitudinal-dynamics-influencing actuators and to transverse-dynamics-influencing actuators for vehicle control. <CIT> relates to a method and a device for operating a motor vehicle in an automated driving mode, in which a standard trajectory is ascertained which implements a vehicle control according to the destination setting specified by the driver and the current environment situation, and a safety trajectory is ascertained which implements safe stopping of the vehicle in the event of an emergency as a function of the current vehicle environment situation,.

Aspects and advantages of the present invention will be set forth in part in the following description, or may be learned from the description, or may be learned through practice of the embodiments.

According to a first aspect of the present invention, there is provided a computer-implemented method as set out in independent claim <NUM>. According to a second aspect of the present invention, there is provided an autonomous vehicle control system as set out in independent claim <NUM>. According to a third aspect of the present invention, there is provided an autonomous vehicle as set out in claim <NUM>. Other embodiments are described in the dependent claims.

These and other features, aspects, and advantages of various embodiments will become better understood with reference to the following description and appended claims. The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments of the present invention and, together with the description, serve to explain the related principles.

Detailed discussion of embodiments directed to one of ordinary skill in the art are set forth below, which make reference to the appended figures, in which:.

Reference numerals that are repeated across plural figures are intended to identify the same components or features in various implementations.

Reference now will be made in detail to embodiments, one or more example(s) of which are illustrated in the drawings. Each example is provided by way of explanation of the embodiments, not limitation of the present invention. In fact, it will be apparent to those skilled in the art that various modifications and variations can be made to the embodiments without departing from the scope or spirit of the present invention. Thus, it is intended that aspects of the present invention cover such modifications and variations.

Example aspects of the present invention are directed to controlling an autonomous vehicle with multiple control lanes. An autonomous vehicle can autonomously navigate through a surrounding environment by executing one or more planned trajectories in a motion plan that cause the autonomous vehicle to travel along a vehicle route. An autonomous driving system onboard the autonomous vehicle can generate the motion plan and provide the motion plan to a vehicle control system. The vehicle control system can generate one or more vehicle control signals based on the motion plan to track the one or more planned trajectories, and provide the vehicle control signals to one or more vehicle actuation systems that can control the autonomous vehicle.

The autonomous vehicle can detect a fault with respect to its operation, and in particular an operation of the autonomous driving system, vehicle control system, and/or vehicle actuation system(s). However, in a single-lane control architecture even if the autonomous vehicle can detect a fault, the autonomous vehicle can be unable to effectively handle the fault. For example, if an autonomous vehicle detects a fault associated with a braking control system causing a loss of braking control when the autonomous vehicle is traveling at high speed, then the autonomous vehicle can be unable to effectively slow down. The autonomous vehicle could downshift to slow down, but this may not be the most "effective" solution. Furthermore, if the autonomous vehicle detects a fault associated with a transmission system, then downshifting may not be an available solution. The present invention can enable an autonomous vehicle with a multi-lane control architecture and methods for controlling the same. The multi-lane control architecture can allow for fault-tolerant control of the autonomous vehicle. Fault-tolerant control means that the autonomous vehicle can be tolerant of any single point of failure and is always able to be controlled to a safe state. This means if a fault occurs in a currently active set of localization, perception, planning, control, and actuation systems, then the autonomous vehicle can use a redundant or alternate control system that can control the autonomous vehicle to a safe state. This also means that if a fault occurs in one of the active, redundant, or alternate control systems, then the autonomous vehicle is no longer robust to a single point of failure and the autonomous vehicle can be controlled to a safe state to avoid exposure to any potential single points of failure.

By using two or more control lanes of the multi-lane control architecture, the autonomous vehicle can be controlled to effectively handle a fault associated with one or more operations of the autonomous vehicle, such as the implementation of the motion plan. For example, the multi-lane control architecture can include a first braking control system connected to a first control lane, and a second braking control system connected to a second control lane. If the autonomous vehicle detects a fault associated with a loss of braking control (e.g., a failure of the first control lane or the first braking control system), then the autonomous vehicle can switch to the second control lane to maintain braking control (e.g., via the second control lane and the second braking control system). In this way, in the event of one or more faults associated with one or more operations of the autonomous vehicle (e.g., autonomous navigation, propulsion, steering, braking, etc.), the autonomous vehicle can continue to operate by switching to a different control lane. Additionally, by introducing a level of redundancy with regard to the one or more operations, the multi-lane control architecture can improve the safety and reliability of the autonomous vehicle.

More particularly, an autonomous vehicle can include a vehicle computing system that implements a variety of systems on-board the autonomous vehicle (e.g., located on or within the autonomous vehicle) for autonomous navigation. For instance, the vehicle computing system can include an autonomous driving system (e.g., for planning and executing autonomous navigation), a plurality of vehicle actuation systems (e.g., vehicle-specific systems responsible for powertrain, steering, braking, etc.), and a vehicle control system (e.g., for interfacing between the autonomous driving system and vehicle-specific vehicle actuation systems). In some implementations, the vehicle computing system can include a collision mitigation system (e.g., for detecting and mitigating potential collisions).

The autonomous driving system of the autonomous vehicle can include one or more autonomy system(s) for planning and executing autonomous navigation. For instance, an autonomous driving system can include, among other systems, a localization system, a perception system, a prediction system, and a motion planning system that cooperate to perceive a surrounding environment of an autonomous vehicle and determine a motion plan for controlling a motion of the autonomous vehicle. The motion plan can include one or more trajectories (e.g., trajectory information) that cause the autonomous vehicle to travel from a starting location of a vehicle route to an ending location of the vehicle route when executed. In some implementations, the trajectory information can include requirements on speed, time of arrival, or other components of the vehicle's dynamic state associated with the vehicle route. In some implementations, the motion plan can include one or more primary trajectories that each correspond to a segment of the vehicle route and cause the autonomous vehicle to travel from the starting location to the ending location of the vehicle route when executed in sequence. Each of the one or more primary trajectories can cause the autonomous vehicle to travel from a starting location of the primary trajectory (e.g., starting location of the corresponding vehicle route segment) to an ending location of the primary trajectory (e.g., ending location of the corresponding vehicle route segment) when executed. In some implementations, the motion plan can include a safe-stop trajectory associated with each primary trajectory that cause the autonomous vehicle to travel from a starting location of the primary trajectory to a safe-stop location (e.g., nearest location where the autonomous vehicle can safely come to a stop) when executed. The autonomous driving system can continuously update the motion plan and provide the updated motion plan to the vehicle control system. For example, the autonomous driving system can update the motion plan based on the surrounding environment of the autonomous vehicle (e.g., one or more objects in the surrounding environment) and a dynamic state of the autonomous vehicle within the environment.

The vehicle control system of the autonomous vehicle can receive data representing a motion plan from the autonomous driving system and implement the motion plan via a multi-lane control architecture. For instance, the vehicle control system can receive the data representing the motion plan via a plurality of control lanes. Each of the control lanes can be configured to independently implement the motion plan by generating one or more vehicle control signals to track a trajectory in the motion plan. The vehicle control system can control one or more control lanes from the plurality of control lanes to provide the vehicle control signal(s) to one or more vehicle actuation systems associated with the control lane to control the autonomous vehicle in accordance with the motion plan. The vehicle control system can silence one or more remaining control lanes from the plurality of control lanes by controlling the remaining control lane(s) to assume a "fail silent" mode that prevents the remaining control lane(s) from providing the vehicle control signal(s) to one or more vehicle actuation systems associated with the control lane. In this way, the vehicle control system can preclude multiple control lanes from attempting to simultaneously control a single operation of the autonomous vehicle (e.g., propulsion, steering, braking, etc.).

In some implementations, each control lane of vehicle control system can be connected to a set of vehicle actuation systems to control the autonomous vehicle independently of each other. For example, a first control lane can be associated with a first set of vehicle actuation systems (e.g., systems responsible for powertrain, steering, braking, etc.) and a second control lane can be associated with a second set of vehicle actuation systems (e.g., systems responsible for powertrain, steering, braking, etc.). The vehicle control system can control the first control lane to implement the motion plan and provide vehicle control signal(s) to the first set of vehicle actuation systems to control the vehicle. If the vehicle control system detects a fault associated with implementing the motion plan via the first control lane, then the vehicle control system can silence the first control lane and control the second control lane to implement the motion plan.

In some implementations, each control lane of the vehicle control system can be connected to a different set of vehicle actuation systems to control the autonomous vehicle. For example, a first control lane can be associated with a first set of vehicle actuation systems that includes a powertrain control system, and a second control lane can be associated with a second set of vehicle actuation systems that does not include a powertrain control system. In the invention, the vehicle control system determines that the first control lane has a greater capability of controlling the autonomous vehicle (because the first control lane can, for example, control a propulsion of the autonomous vehicle and the second control lane cannot) and the vehicle control system controls the first control lane to implement the motion plan. If the vehicle control system detects a fault associated with implementing the motion plan via the first control lane, then the vehicle control system silences the first control lane and controls the second control lane to implement the motion plan. The vehicle control system determines that the second control lane has a reduced capability of controlling the autonomous vehicle (e.g., because the second set of vehicle actuation systems does not include a powertrain control system) and adjusts the motion plan of the autonomous vehicle accordingly. For example, the vehicle control system can request the autonomous driving system to provide a new motion plan for safely stopping the autonomous vehicle (e.g., assisted safe-stop action) and implement the new motion plan. Alternatively, the vehicle control system can retrieve a locally stored safe-stop trajectory that was previously received, and track the local safe-stop trajectory.

The vehicle actuation systems of the autonomous vehicle can include one or more systems for controlling the autonomous vehicle. For instance, the vehicle actuation systems can include a powertrain control system, steering control system, braking control system, etc., to control a motion of the autonomous vehicle. The vehicle actuation systems can also include various other systems to control different operations of the autonomous vehicle, such as, for example, a climate control system, stereo control system, seat control system, internal/external indicator control system, etc. The vehicle actuation systems can receive one or more vehicle control signals from a control lane of the vehicle control system, and control the autonomous vehicle in accordance with the vehicle control signals. For example, the powertrain control system can control a propulsion of the autonomous vehicle, the steering control system can control a steering of the autonomous vehicle, the braking control system can control a braking of the autonomous vehicle, etc. In some implementations, the vehicle actuation systems can generate one or more actuator commands (e.g., at least one lateral vehicle actuator command and at least one longitudinal vehicle actuator command) and control one or more vehicle actuators in accordance with the vehicle control signals. Vehicle actuators can include, for example, a steering actuator, a braking actuator, and/or a propulsion actuator. In some implementations, the vehicle actuators can include further low-level control logic. For example, additional low-level control logic may be beneficial to control a steering motor to keep the steering rack at a desired position as commanded by the vehicle actuation system in case the vehicle actuation system does not directly control the steering motor.

In some implementations, the vehicle actuation systems can include two or more identical sets of vehicle actuation systems. Each set of vehicle actuation systems can be connected to a control lane of the vehicle control system. For instance, a first set of vehicle actuation systems can include a first powertrain control system, first steering control system, first braking control system, etc., and a second set of vehicle actuation systems can include a second powertrain control system, second steering control system, second braking control system, etc. The first set of vehicle actuation systems can be connected to a first control lane of the vehicle control system, and the second set of vehicle actuation systems can be connected to a second control lane of the vehicle control system.

In some implementations, the vehicle actuation systems can include two or more different sets of vehicle actuation systems such that a first set of vehicle actuation systems contains a different number of and/or combination of types of control systems than a second set of vehicle actuation systems. Each set of vehicle actuation systems can be connected to a control lane of the vehicle control system. For instance, a first set of vehicle actuation systems can include a powertrain control system, first steering control system, first braking control system, etc., and a second set of vehicle actuation systems can include a second steering control system, second braking control system, etc., but not a second powertrain control system. The first set of vehicle actuation systems can be connected to a first control lane of the vehicle control system, and the second set of vehicle actuation systems can be connected to a second control lane of the vehicle control system.

In some implementations, the vehicle actuation systems can include independent control systems which can be connected to the same control lane of the vehicle control system. For instance, a first control lane can be connected to a first braking control system and a second braking control system, and a second control lane can be connected to the first braking control system and/or the second braking control system.

According to aspects of the present invention, the vehicle computing system can detect one or more faults associated with one or more operations of the autonomous vehicle (e.g., determining a motion plan, implementing a motion plan, etc.). In particular, the one or more faults can be associated with one or more of the various systems implemented by the vehicle computing system on-board the autonomous vehicle (e.g., autonomy computing system, vehicle control system, vehicle actuation system, etc.).

In some implementations, the one or more various systems on-board the autonomous vehicle can each detect one or more faults associated with itself, and notify one or more other systems about the detected fault(s). As an example, the autonomous driving system or one of the vehicle actuation systems can detect one or more faults associated with it and provide one or more diagnostic signals to the vehicle control system to notify the vehicle control system about the detected fault(s). As another example, each control lane of the vehicle control system can detect one or more faults associated with it and notify the vehicle control system about the detected fault(s).

In some implementations, the one or more various systems on-board the autonomous vehicle can detect one or more faults associated with each other. As an example, if the vehicle control system fails to receive a motion plan (or updated motion plan) from the autonomous driving system within a predetermined time frame, or if the vehicle control system receives a motion plan that fails a cyclic redundancy check (CRC), then the vehicle control system can determine that the autonomous driving system has experienced a fault. As another example, if the vehicle control system fails to receive a handshake or acknowledgement signal from a vehicle actuation system within a predetermined time frame, then the vehicle control system can determine that the vehicle actuation system has experienced a fault. As another example, if the vehicle control system fails to detect a heartbeat signal from a control lane, then the vehicle control system can determine that the second control lane has experienced a fault. In this way, the vehicle computing system (e.g., one or more of the various systems implemented by the vehicle computing system) can detect a plurality of different fault types associated with the vehicle computing system. The plurality of different fault types can include, for example, a plausibility fault, communication fault, environmental operational limit fault, range or tolerance exceedance fault, hardware failure fault, software error fault, handshake or acknowledgement fault, calibration or ready status fault, or external reported fault.

A plausibility fault can be detected when the vehicle computing system determines that one or more signals exceed reasonable values based on known characteristics or past values of the signal(s). The vehicle computing system can determine that the signal(s) are implausible and flag the signal(s) and/or the corresponding system(s) as faulty. The known characteristics can include vehicle dynamic constraints, expected covariance/residual values, statistical properties, or interdependency between the signals. Extreme changes or inconsistencies in the signal(s) can be identified as implausible outright or when compared against a reference.

A communication fault can be detected when the vehicle computing system receives one or more signals over a communication channel. Signals that are received over a communication channel can have multiple sources of error. As an example, corruption of the signal(s) can be detected by end to end protection methods such as a cyclic redundancy check (CRC) or other checksum algorithm. As another example, a timing of the signal(s) reception can be delayed such that the signal(s) is no longer accurate. A timestamp associated with the signal(s) that indicates the signal content is aged (e.g., older than <NUM>) can indicate a fault. As another example, a timeout where no message is received at all after a certain amount of time from when the message is expected can indicate a fault. As another example, a sequence of messages received can indicate a fault if the order is not as expected, some content is missing, and/or the received content is mismatched.

An environmental operational limit fault can be detected when the vehicle computing system determines that it is operating outside of its intended operational limits, such as in extreme temperature, humidity, or weather conditions affecting driving surface conditions or visibility.

A range or tolerance exceedance fault can be detected when the vehicle computing system determines that one or more monitored signals or parameters have drifted or acquired unacceptable values for functional safety, based on an associated required range or tolerance.

A hardware failure fault can be detected when the vehicle computing system monitors a heartbeat or power signal of safety critical hardware components and identifies electrical shorts or disconnects, or unusual readings from the hardware component.

A software error fault can be detected when the vehicle computing system is monitoring a software component and identifies an error or unacceptable value/state. The vehicle computing system can monitor the software component via another software component that can have additional reference inputs, run on a different software layer or CPU core, or be designed and validated to a higher integrity level.

A handshake or acknowledgement fault can be detected when the vehicle computing system expects some form of a handshake or acknowledgement from a separate hardware or software component before continuing, and the vehicle computing system does not receive the handshake or acknowledgment.

A calibration or ready status fault can be detected when a calibration or some other event causes the vehicle computing system to change the ready status of a system/component to false during autonomous operation.

An external reported fault can be detected when the vehicle computing system receives an indication (e.g., diagnostic signals, flag state) from a system/component notifying the vehicle computing system of a fault associated with the system/component. In some implementations, the indication of the fault can provide levels of accuracy or quality of a signal, or express a degraded capability of the system/component.

According to aspects of the present invention, the vehicle control system can adjust a motion of the autonomous vehicle in response to detecting one or more faults associated with one or more operations of the autonomous vehicle (e.g., determining a motion plan, implementing a motion plan, etc.). During operation, the vehicle control system can receive data representing a motion plan and data representing a dynamic state of the autonomous vehicle from the autonomous driving system. The dynamic state can generally describe the position and/or orientation and/or their rates of change (e.g. velocity, acceleration, jerk, angular velocity, angular acceleration) of the vehicle in the surrounding environment. The position component of vehicle dynamic state can generally describe where the vehicle is located and the orientation component can generally describe how the vehicle is oriented with respect to the surrounding environment and trajectory. In some implementations, the dynamic state can include further derivatives of the position and/or orientation of the vehicle with respect to the surrounding environment of the vehicle and trajectory. The vehicle control system can control one or more control lanes to implement the motion plan. The one or more control lanes can continuously receive data representing the dynamic state of the autonomous vehicle to understand where the autonomous vehicle is located in relation to the motion plan. The handling of these two inputs (e.g., data representing the motion plan and data representing the dynamic state) allow the control lane to implement feedback control and correct its commands to the vehicle actuator system(s) if the received dynamic state deviates from the planned trajectory. The vehicle control system can control one or more control lanes to implement the motion plan. In particular, the vehicle control system can determine a capability associated with each of the plurality of control lanes and determine a hierarchy for the plurality of control lanes in order of decreasing capability. For example, the vehicle interface system can determine the capability of a control lane based on one or more faults associated with the control lane, one or more vehicle actuation systems associated with the control lane if one or more control lanes are associated with different sets of vehicle actuation systems, and/or one or more faults associated with the one or more vehicle actuation systems associated with the control lane.

The vehicle control system can select a first control lane that is associated with the highest capability. The vehicle control system can silence the one or more other control lanes (e.g., control the one or more other control lanes to assume a "fail silent" mode). The vehicle control system can control each control lane to determine a primary trajectory based on the motion plan, and control the first control lane to track the primary trajectory. The vehicle control system can also control each control lane to determine a safe-stop trajectory based on the motion plan and store the safe-stop trajectory in local memory. In some implementations, if the first control lane is associated with a degraded capability, then the vehicle control system can select one or more second control lanes, and control the second control lane(s) to track the primary trajectory.

In some implementations, the vehicle control system can detect a fault associated with the autonomous driving system (e.g., a fault associated with receiving data representing a motion plan from the autonomous driving system). For example, the vehicle control system can receive one or more diagnostic signal(s) from the autonomous driving system indicative of the fault (e.g., external reported fault), and/or the vehicle control system can detect the fault based on one or more signals or data received from the autonomous driving system (e.g., plausibility fault, communication fault, calibration or ready status fault, etc.). In response, the vehicle control system can retrieve the latest locally stored safe-stop trajectory received from the autonomous driving system, and control the first control lane to track the local safe-stop trajectory. In this way, the vehicle control system can adjust a motion of the autonomous vehicle to come to a safe stop. When the vehicle control system is controlling the first control lane to track the local safe-stop trajectory, if the vehicle control system continues to receive valid data representing the dynamic state of the autonomous vehicle from the autonomous driving system, then the vehicle control system can control the first control lane to track the local safe-stop trajectory based on data received from the autonomous driving system that includes the valid dynamic state information. Alternatively, the vehicle control system can determine a dynamic state of the autonomous vehicle based on an inertial measurement unit (IMU) associated with the first control lane, and/or one or more redundant local sensors onboard the autonomous vehicle. The one or more redundant local sensors can include, for example, an odometer that can provide measured odometry data, a steering angle sensor that can provide measured steering angle data, a torque sensor that can provide measured torque data, etc. The vehicle control system can control the first control lane to track the local safe-stop trajectory based on the determined dynamic state of the autonomous vehicle. In addition, if the vehicle control system receives data indicative of a potential collision (e.g., from the collision mitigation system), then the vehicle control system can control the first control lane to adjust the local safe-stop trajectory based on the data indicative of the potential collision in order to avoid the potential collision.

In some implementations, the vehicle control system can detect a fault associated with one or more of the plurality of control lanes. For example, the vehicle control system can detect a fault associated with the first control lane (e.g., environmental operational limit fault, hardware failure fault, etc.). In response, the vehicle control system can update a capability of the first control lane based on the detected fault. If the updated capability of the first control lane is greater than a capability of a second control lane of the vehicle control system, then the vehicle control system can control the first control lane to continue tracking a trajectory of a motion plan. If the updated capability of the first control lane is less than a capability of a second control lane of the vehicle control system, then the vehicle control system can silence the first control lane, and control the second control lane to track the trajectory of the motion plan. If the vehicle control system determines that the updated capability of the first control lane or the capability of the second control lane is degraded with respect to the original capability of the first control lane, then the vehicle actuation system can control the first control lane or the second control lane to adjust a motion of the autonomous vehicle based on the degraded capability.

As another example, the vehicle control system can detect a fault associated with the second control lane (e.g., environmental operational limit fault, hardware failure fault, etc.). In response, the vehicle control system can update a capability of the second control lane based on the detected fault. If the updated capability of the second control lane indicates a loss of redundancy with respect to a critical operation/system of the autonomous vehicle (e.g., a loss of redundancy with respect to propulsion, steering, braking, etc.), then the vehicle control system can control the first control lane to adjust a motion of the autonomous vehicle based on the degraded capability of the second control lane. In particular, the vehicle control system can control the first control lane to provide one or more control signals to the autonomous driving system to request a new motion plan for an assisted safe-stop action. If the vehicle control system receives data representing the new motion plan, then the vehicle control system can control the first control lane to implement the assisted safe-stop action. If the vehicle control system detects a fault associated with receiving the new motion plan, then the vehicle control system can control the first control lane to retrieve the latest locally stored safe-stop trajectory and control the first control lane to track the local safe-stop trajectory.

In some implementations, the vehicle control system can detect a fault associated with one or more vehicle actuation systems. For example, the vehicle control system can detect a fault (e.g., external reported fault, etc.) associated with a powertrain control system connected to the first control lane. In response, the vehicle control system can update a capability of the first control lane based on the detected fault, and select a control lane based on an updated capability hierarchy of the plurality of control lanes. If the selected control lane has a degraded capability with respect to the original capability of the first control lane, then the vehicle actuation system can adjust a motion of the autonomous vehicle based on the degraded capability. In particular, the vehicle control system can determine that the powertrain control system is a critical system, and if the capability of the selected control lane does not include propulsion control of the autonomous vehicle, then the vehicle control system can control the selected control lane to provide one or more control signals to the autonomous driving system to request a new motion plan for an assisted safe-stop action. In some implementations, the request can include data indicative of the degraded capability, and the autonomous driving system can determine the new motion plan based on the degraded capability (e.g., determine the new motion plan such that the new motion plan can be implemented without propulsion control of the autonomous vehicle). If the vehicle control system receives data representing the new motion plan, then the vehicle control system can control the selected control lane to implement the assisted safe-stop action. If the vehicle control system detects a fault associated with receiving the new motion plan, then the vehicle control system can control the selected control lane to retrieve the latest locally stored safe-stop trajectory and track the local safe-stop trajectory.

As another example, the vehicle control system can detect a fault associated with a non-critical operation of the autonomous vehicle (e.g., seat control system, stereo control system, etc.). In response, the vehicle control system can update a capability of the first control lane based on the detected fault, and select a control lane based on an updated capability hierarchy of the plurality of control lanes. The vehicle control system can determine that the fault is associated with a non-critical operation, and the vehicle control system can control the selected control lane to continue implementing the motion plan even if the selected control lane has a degraded capability with respect to the original capability of the first control lane with respect to the non-critical operation.

The systems and methods described herein provide a number of technical effects and benefits. Systems and methods for controlling an autonomous vehicle with multiple control lanes for controlling a first operation of the autonomous vehicle can have a technical effect of improving safety and reliability. By enabling an autonomous vehicle, or another computing system, with multiple control lanes, the autonomous vehicle can effectively respond to a detected fault by adjusting a motion of the autonomous vehicle (e.g., implement an assisted safe-stop action, track a local safe-stop trajectory, etc.). This can allow an autonomous vehicle to complete a vehicle service if a detected fault is a non-critical fault, or to come to a safe-stop if the detected fault is a critical fault, thus affording safe and customizable performance options.

The systems and methods of the present invention that include multiple control lanes can also generally provide system-level redundancy in case of component failure in the autonomous vehicle. More particularly, utilizing a primary control lane and one or more secondary control lanes that each process independently of one another can enable a vehicle control system to determine which specific control lane can be configured to control various vehicle actuation systems of the autonomous vehicle. Such determination can also be dynamically tailored to the current operating conditions (e.g., current motion of the autonomous vehicle, type(s) of faults detected, etc.). In this way, vehicle and passenger safety can be enhanced as appropriate if an unexpected fault is encountered.

The systems and methods of the present invention also provide an improvement to vehicle computing technology, such as autonomous vehicle computing technology. For instance, the systems and methods herein enable the vehicle technology to include a multi-lane control architecture, and to control the same. For example, the systems and methods can allow one or more computing system(s) on-board an autonomous vehicle (and/or off-board a vehicle) to control a first operation of the autonomous vehicle via multiple control lanes to effectively respond to a detected fault with respect to a primary control lane. This allows the autonomous vehicle to more safely and reliably perform autonomous navigation.

With reference now to the FIGS. , example embodiments of the present invention will be discussed in further detail.

<FIG> depicts an example computing system according to example embodiments of the present invention. The computing system <NUM> illustrated in <FIG> is provided as an example only. The components, systems, connections, and/or other aspects illustrated in <FIG> are optional and are provided as examples of what is possible, but not required, to implement the present invention. The computing system <NUM> can include one or more vehicles <NUM>. Vehicle <NUM> can be a ground-based autonomous vehicle (e.g., car, truck, bus), an air-based autonomous vehicle (e.g., airplane, drone, helicopter, or other aircraft), or other types of vehicles (e.g., boat, ship, or other watercraft). Vehicle <NUM> can be an autonomous vehicle that can drive, navigate, operate, etc. with minimal and/or no interaction from a human driver, or vehicle <NUM> can be manually controlled by a human operator. Vehicle <NUM> can be associated with a vehicle computing system <NUM>.

Vehicle <NUM> can be capable of sensing its environment, navigating its environment with minimal or no human input, and/or the like. Vehicle <NUM> can include a vehicle computing system <NUM>. Vehicle computing system <NUM> can assist in controlling vehicle <NUM>. For example, vehicle computing system <NUM> can receive data generated by one or more sensors <NUM>, attempt to comprehend an environment surrounding vehicle <NUM> by performing various processing techniques on the data generated by sensor(s) <NUM>, generate, determine, select, and/or the like a motion plan for navigating vehicle <NUM> through, within, and/or the like such surrounding environment, and/or the like. Vehicle computing system <NUM> can interface with one or more vehicle controls to operate vehicle <NUM> (e.g., in accordance with the motion plan, and/or the like).

Vehicle computing system <NUM> can include one or more computing devices <NUM> and various systems on-board the vehicle <NUM> (e.g., autonomous driving system <NUM>, vehicle control system <NUM>, vehicle actuation system(s) <NUM>, and collision mitigation system <NUM>). Computing device(s) <NUM> can include circuitry configured to perform one or more operations, functions, and/or the like described herein. For example, computing device(s) <NUM> can include one or more processor(s) <NUM>, one or more communication interfaces <NUM>, and memory <NUM> (e.g., one or more hardware components for storing executable instructions, data, and/or the like). Communication interface(s) <NUM> can enable computing device(s) <NUM>, autonomous driving system <NUM>, vehicle control system <NUM>, vehicle actuation system(s) <NUM>, and collision mitigation system <NUM> to communicate with one another, and/or can enable vehicle <NUM> (e.g., computing system <NUM>) to communicate with one or more computing systems, computing devices, and/or the like distinct from vehicle <NUM>. Memory <NUM> can include (e.g., store, and/or the like) instructions <NUM> and data <NUM>. When executed by processor(s) <NUM>, instructions <NUM> can cause vehicle <NUM> (e.g., vehicle computing system <NUM>) to perform one or more operations, functions, and/or the like described herein. Data <NUM> can include, represent, and/or the like information associated with such operations, functions, and/or the like, and data generated by sensor(s) <NUM>, and/or the like.

Sensor(s) <NUM> can include, for example, one or more cameras (e.g., visible spectrum cameras, infrared cameras, and/or the like), light detection and ranging (LIDAR) systems, radio detection and ranging (RADAR) systems, and/or the like. Sensor(s) <NUM> can generate sensor data <NUM> that is descriptive of the environment proximate to the sensor(s), including information that describes one or more locations, velocities, vectors, and/or the like of objects in the environment surrounding vehicle <NUM>. For example, a LIDAR system can generate data indicating the relative location (e.g., in three-dimensional space relative to the LIDAR system, and/or the like) of a number of points corresponding to objects that have reflected a ranging laser of the LIDAR system. Such a LIDAR system can, for example, measure distances by measuring the interference between outgoing and incoming light waves, measuring the time of flight (TOF) it takes a short laser pulse to travel from a sensor to an object and back, calculating the distance based at least in part on the TOF with respect to the known speed of light, based at least in part on a phase-shift with known wavelength, and/or the like. As another example, a RADAR system can generate data indicating one or more relative locations (e.g., in three-dimensional space relative to the RADAR system, and/or the like) of a number of points corresponding to objects that have reflected a ranging radio wave of the RADAR system. For example, radio waves (e.g., pulsed, continuous, and/or the like) transmitted by such a RADAR system can reflect off an object and return to a receiver of the RADAR system, generating data from which information about the object's location, speed, and/or the like can be determined. As another example, for one or more cameras, various processing techniques, for example, range-imaging techniques (e.g., structure from motion, structured light, stereo triangulation, and/or the like) can be performed to identify one or more locations (e.g., in three-dimensional space relative to the camera(s), and/or the like) of a number of points corresponding to objects depicted in imagery captured by the camera(s).

Autonomous driving system <NUM> can include perception system <NUM>, prediction system <NUM>, motion planning system <NUM>, and localization system <NUM>. Perception system <NUM> can retrieve, obtain, and/or the like map data <NUM>, which can provide information about an environment surrounding vehicle <NUM>. For example, map data <NUM> can provide information regarding: the identity and location of different travel ways (e.g., roadways, and/or the like), road segments, buildings, other static items or objects (e.g., lampposts, crosswalks, curbing, and/or the like); the location and directions of traffic lanes (e.g., the location and/or direction of a parking lane, turning lane, bicycle lane, and/or the like); traffic-control data (e.g., the location and/or instructions of signage, traffic lights, other traffic-control devices, and/or the like); other map data providing information that can assist vehicle computing system <NUM> in comprehending, perceiving, and/or the like an environment surrounding vehicle <NUM>, its relationship thereto, and/or the like.

Perception system <NUM> can (e.g., based at least in part on sensor data <NUM>, map data <NUM>, and/or the like) identify one or more objects proximate to vehicle <NUM> and determine, for each of such object(s), state data describing a current state of the object, for example, an estimate of the object's: size/footprint (e.g., as represented by a bounding shape such as a polygon, polyhedron, and/or the like); class (e.g., vehicle, pedestrian, and/or the like); current location (also referred to as position); speed (also referred to as velocity); acceleration; heading; orientation; yaw rate; and/or the like. In some embodiments, perception system <NUM> can determine such state data for each object over a number of iterations, for example, updating, as part of each iteration, the state data for each object. Accordingly, perception system <NUM> can detect, track, and/or the like such object(s) over time.

Prediction system <NUM> can receive state data from perception system <NUM> and can predict (e.g., based at least in part on such state data, and/or the like) one or more future locations for each object. For example, prediction system <NUM> can predict where each object will be located within the next five seconds, ten seconds, twenty seconds, and/or the like. As one example, an object can be predicted to adhere to its current trajectory according to its current speed. Additionally or alternatively, other prediction techniques, modeling, and/or the like can be used.

Motion-planning system <NUM> can generate, determine, select, and/or the like a motion plan for vehicle <NUM>, for example, based at least in part on state data of object(s) provided by perception system <NUM>, predicted future location(s) of object(s) provided by prediction system <NUM>, and/or the like. For example, utilizing information about current location(s) of object(s), predicted future location(s) of object(s), and/or the like, motion-planning system <NUM> can generate, determine, select, and/or the like a motion plan for vehicle <NUM> that it determines (e.g., based at least in part on one or more operation parameters, and/or the like) best navigates vehicle <NUM> relative to the object(s).

Motion-planning system <NUM> can provide the motion plan to vehicle control system <NUM>, which can directly and/or indirectly control vehicle <NUM> via the one or more vehicle actuation system(s) <NUM> in accordance with the motion plan. The vehicle control system <NUM> can generate vehicle control signals to track a trajectory in the motion plan and provide the vehicle control signals to the vehicle actuation system(s) <NUM> (e.g., powertrain control system(s) <NUM>, steering control system(s) <NUM>, braking control system(s) <NUM>, etc.). The vehicle actuation system(s) <NUM> can control vehicle <NUM> via one or more actuators, devices, and/or the like that control gas, power flow, steering, braking, and/or the like in accordance with the vehicle control signals.

Localization system <NUM> can be any device or circuitry for analyzing the position of the vehicle <NUM>. The localization system <NUM> can determine a dynamic state of the vehicle based on one or more localization techniques. In some implementations, the localization system <NUM> can determine a position of the vehicle <NUM> within the surrounding environment (e.g., across six axes) based at least in part on the sensor data <NUM>. In some implementations, the localization system <NUM> can determine the position of the vehicle <NUM> based on the sensor data <NUM> and map data <NUM>. In some implementations, the localization system <NUM> can determine a position of the vehicle <NUM> with only three degrees of freedom consisting of a two-dimensional translation and a heading angle. The localization system <NUM> can provide data indicative of the location of the autonomous vehicle to one or more of the various autonomy systems of the autonomous driving system <NUM> (e.g., perception system <NUM>, prediction system <NUM>, motion planning system <NUM>, etc.) and to the vehicle control system <NUM>. For example, the motion planning system <NUM> can determine a motion plan for the autonomous vehicle based at least in part on the location of the autonomous vehicle within the surrounding environment. As another example, the vehicle control system <NUM> can use the data representing the dynamic state of the autonomous vehicle when implementing a motion plan in order to adjust vehicle control signals to the vehicle <NUM> to account for errors in tracking and disturbances from the surrounding environment of the vehicle <NUM> (e.g., uneven roads, potholes, objects, etc.).

Collision mitigation system <NUM> can monitor a surrounding environment of the vehicle <NUM> using sensor data <NUM> generated by sensor(s) <NUM> to detect a potential collision between the vehicle <NUM> and an object in the surrounding environment. When a potential collision is detected, the collision mitigation system <NUM> can provide data indicative of the potential collision to the vehicle control system <NUM>, so that the vehicle control system <NUM> can adjust a motion of the vehicle <NUM> to avoid the potential collision (e.g., when the autonomous driving system <NUM> is unable to provide a motion plan to the vehicle control system <NUM>).

Autonomous driving system <NUM> (e.g., perception system <NUM>, prediction system <NUM>, motion-planning system <NUM>), vehicle control system <NUM>, vehicle actuation system(s) <NUM>, and/or collision mitigation system <NUM> can include logic utilized to provide functionality described herein. Autonomous driving system <NUM> (e.g., perception system <NUM>, prediction system <NUM>, localization system <NUM>, motion-planning system <NUM>), vehicle control system <NUM>, vehicle actuation system(s) <NUM>, and/or collision mitigation system <NUM> can be implemented in hardware (e.g., circuitry, and/or the like), firmware, software configured to control one or more processors, one or more combinations thereof, and/or the like. For example, instructions <NUM>, when executed by processor(s) <NUM>, can cause vehicle <NUM> (e.g., vehicle computing system <NUM>) to implement functionality of autonomous driving system <NUM> (e.g., perception system <NUM>, prediction system <NUM>, localization system <NUM>, motion-planning system <NUM>), vehicle control system <NUM>, vehicle actuation system(s) <NUM>, and/or collision mitigation system <NUM> as described herein.

In some implementations, vehicle <NUM> can include one or more redundant local sensors <NUM>. The redundant local sensor(s) <NUM> can include, for example, an odometer that can provide measured odometry data, a steering angle sensor that can provide measured steering angle data, a torque sensor that can provide measured torque data, etc. The redundant local sensor(s) <NUM> can provide the measured sensor data to one or more control lanes of the vehicle control system <NUM>, and the one or more control lanes of the vehicle control system <NUM> can use the measured sensor data to determine a dynamic state of the vehicle <NUM> (e.g., if there is a fault associated with the localization system <NUM>). In some implementations, the redundant local sensor(s) <NUM> are independent of the sensor(s) <NUM>, so that the vehicle control system <NUM> can determine a dynamic state of the vehicle <NUM> if there is a fault associated with sensor(s) <NUM>. In some implementations, the redundant local sensor(s) are locally embedded within the vehicle control system <NUM>.

In some implementations, the vehicle control system <NUM> can arbitrate between data received from the autonomous driving system <NUM> and data received from the collision mitigation system <NUM>, if the vehicle control system <NUM> determines that the received data conflicts and there is a discrepancy between how to control the vehicle. The vehicle control system <NUM> can determine which action is more conservative and implement the more conservative action. For example, if the data received from the autonomous driving system <NUM> indicates that the vehicle control system <NUM> should control the vehicle <NUM> to implement a soft braking action, but the data received from the collision mitigation system <NUM> indicates that the vehicle control system <NUM> should control the vehicle <NUM> to implement a hard braking action, then the vehicle control system <NUM> can determine to implement the hard braking action (even if there is no fault detected or associated with the autonomous driving system <NUM>).

In some implementations, data <NUM> can include fault reaction parameters data that describes an action in response to a specific combination of faults detected by the vehicle computing system <NUM>. For example, the fault reaction parameters data can indicate that a fault corresponding to braking control system(s) <NUM> of the vehicle <NUM> is a critical fault, and that a fault corresponding to an audio control system of the vehicle <NUM> is not a critical fault.

As another example, if the vehicle control system <NUM> includes a dual-lane control architecture, then the fault reaction parameters data can indicate that a first fault causing a loss of control of braking control system(s) <NUM> via a first control lane is critical because a second fault with respect to braking control system(s) <NUM> would cause the vehicle control system <NUM> to be unable to control braking of vehicle <NUM>.

As yet another example, if vehicle control system <NUM> includes a three-lane control architecture, then the fault reaction parameters data can indicate that a first fault causing a loss of control of braking control system(s) <NUM> via a first control lane is not critical, and a second fault with respect to braking control system(s) <NUM> via a second control lane is critical because a third fault with respect to braking control system(s) <NUM> via a third control lane would cause the vehicle computing system <NUM> to be unable to control a motion of vehicle <NUM>. In the case of the three-lane control architecture, in response to the vehicle computing system <NUM> detecting the first fault corresponding to the first control lane, the fault reaction parameters data can describe an action of using the second control lane to control the vehicle <NUM> and complete a vehicle service; and in response to the vehicle computing system <NUM> detecting the second fault corresponding to the second control lane, the fault reaction parameters data can describe an action of using the third control lane to control the vehicle <NUM> and implement an assisted safe-stop action.

In some implementations, the fault reaction parameters data can include a redundancy threshold value for one or more operations of vehicle <NUM>. The redundancy threshold can be an integer value equal to or greater than -<NUM>, and indicate a redundancy level for each of the operations.

A redundancy threshold value of -<NUM> for an operation can indicate a non-critical operation that does not require any redundancy. In the event of a fault with respect to an operation with a redundancy threshold value of -<NUM>, the vehicle computing system <NUM> can implement a motion plan (to complete a vehicle service) without control of the operation, and the vehicle computing system <NUM> can determine that the fault is not a critical fault.

A redundancy threshold value of <NUM> (zero) for an operation can indicate a critical operation. The vehicle computing system <NUM> can determine that any fault with respect to an operation with a redundancy threshold value of <NUM> (zero) is a critical fault.

A redundancy threshold value of <NUM> or greater for an operation can indicate that the vehicle computing system <NUM> should withstand, at any given time, a number of faults equal to the threshold value with respect to the operation, while maintaining control of the operation.

For example, the fault reaction parameters data can include a redundancy threshold value of <NUM> for a braking operation of vehicle <NUM> with a dual-lane control architecture. In the dual-lane control architecture, braking control system(s) <NUM> can be controlled via a first control lane or a second control lane. If a fault with respect to braking control system(s) <NUM> via one of the control lanes were to occur, then the vehicle computing system <NUM> can maintain braking control of the vehicle <NUM> via the other control lane, therefore the redundancy threshold condition is satisfied at a time before an occurrence of the fault. However, if a fault does occur with respect to braking control system(s) <NUM> via the first control lane, and the vehicle control system <NUM> switches braking control to the second control lane, then the redundancy threshold condition is not satisfied at a time after the fault occurs because the vehicle control system <NUM> would not be able to control the braking operation of the vehicle <NUM> in the event of another fault with respect to braking control system(s) <NUM>, and the vehicle control system <NUM> can determine that the fault is a critical fault.

<FIG> depicts an example of a vehicle actuation system(s) <NUM> according to example embodiments of the present invention. As shown in <FIG>, the vehicle actuation system(s) <NUM> can include a plurality of powertrain control system(s) <NUM> (e.g., first powertrain control system <NUM>, second powertrain control system <NUM>, and third powertrain control system <NUM>), a plurality of steering control systems <NUM> (e.g., first steering control system <NUM>, second steering control system <NUM>, and third steering control system <NUM>), and a plurality of braking control system(s) <NUM> (e.g., first braking control system <NUM>, second braking control system <NUM>, and third braking control system <NUM>). The first powertrain control system <NUM>, first steering control system <NUM>, and first braking control system <NUM> can be arranged in a first set <NUM> of vehicle component(s) <NUM> that are connected to a first control lane of the vehicle control system <NUM>. The second powertrain control system <NUM>, second steering control system <NUM>, and second braking control system <NUM> can be arranged in a second set <NUM> of vehicle component(s) <NUM> that are connected to a second control lane of the vehicle control system <NUM>. The third powertrain control system <NUM>, third steering control system <NUM>, and third braking control system <NUM> can be arranged in a third set <NUM> of vehicle component(s) <NUM> that are connected to a third control lane of the vehicle control system <NUM>.

<FIG> depicts a diagram <NUM> of vehicle control system <NUM> with a dual-lane control architecture. As shown in <FIG>, the vehicle control system <NUM> can include a first control lane <NUM> and a second control lane <NUM>. The first control lane <NUM> is connected with a first set of vehicle actuation system(s) <NUM>, including a first powertrain control system <NUM>, a first steering control system <NUM>, and a first braking control system <NUM>; and the second control lane <NUM> is connected with a second set of vehicle actuation system(s) <NUM>, including a second steering control system <NUM>, and a second braking control system <NUM>. The first powertrain control system <NUM> can include a first propulsion actuator for controlling a propulsion/acceleration of vehicle <NUM>; the first steering control system <NUM> and the second steering control system <NUM> can include a first and second steering actuator, respectively, that function independently of each other, for controlling vehicle <NUM>; and the first braking control system <NUM> and the second braking control system <NUM> can include a first and second braking actuator, respectively, that function independently of each other, for controlling vehicle <NUM>.

According to an aspect of the present invention, the vehicle computing system <NUM> can control the autonomous driving system <NUM> to provide data representing a motion plan and data representing a dynamic state of the autonomous vehicle to the first control lane <NUM> and the second control lane <NUM> simultaneously.

According to an aspect of the present invention, the vehicle control system <NUM> can designate one of the first control lane <NUM> or the second control lane <NUM> as a primary lane, and the other as a secondary lane (e.g., based on a capability of the first control lane <NUM> and a capability of the second control lane <NUM>). Vehicle control system <NUM> can use the primary lane to control vehicle <NUM> so that both the first control lane <NUM> and the second control lane <NUM> are not simultaneously attempting to control the same operation of the vehicle <NUM>.

The vehicle control system <NUM> of the present invention determines that first control lane <NUM> has a greater capability than second control lane <NUM> because, for example, the first control lane <NUM> has a capability of propulsion control via the first powertrain control system <NUM> and the second control lane <NUM> does not have a capability of propulsion control. Vehicle control system <NUM> designates first control lane <NUM> as the primary lane and second control lane <NUM> as the secondary lane. The vehicle control system <NUM> can control first control lane <NUM> to implement a motion plan from the autonomous driving system <NUM> (using the first powertrain control system <NUM>, first steering control system <NUM>, and first braking control system <NUM>) and silence the second control lane <NUM> (e.g., control the second control lane <NUM> to assume a "fail silent" mode). By designating the first control lane <NUM> as the primary lane, vehicle <NUM> can be controlled when the motion plan is implemented by the first control lane <NUM>, but not when the motion plan is implemented by the second control lane <NUM>.

<FIG> depicts a diagram <NUM> of the vehicle control system <NUM> with a multi-lane control architecture. As shown in <FIG>, the vehicle control system <NUM> can include a first control lane <NUM>, a second control lane <NUM>, up to a n-th control lane <NUM>.

The first control lane <NUM> is connected with a first set of vehicle actuation system(s) <NUM> (e.g., a first powertrain control system <NUM>, a first steering control system <NUM>, a first braking control system <NUM>, and one or more other control system(s) <NUM>); the second control lane <NUM> is connected with a second set of vehicle actuation system(s) <NUM> (e.g., a second powertrain control system <NUM>, a second steering control system <NUM>, a second braking control system <NUM>, and one or more other control system(s) <NUM>); and the n-th control lane is connected with a n-th set of vehicle control(s) systems <NUM> (e.g., a n-th powertrain control system <NUM>, a n-th steering control system <NUM>, a n-th braking control system <NUM>, and one or more other control system(s) <NUM>).

Each powertrain control system (<NUM>, <NUM>,. , <NUM>) can include a respective propulsion actuator that functions independently, for controlling vehicle <NUM>; each steering control system (<NUM>, <NUM>,. , <NUM>) can include a respective steering actuator that functions independently, for controlling vehicle <NUM>; each braking control system (<NUM>, <NUM>,. , <NUM>) can include a respective braking actuator that functions independently, for controlling vehicle <NUM>; and each of the one or more other control system(s) (<NUM>, <NUM>,. , <NUM>) can include a respective actuator that functions independently, for controlling vehicle <NUM>.

According to an aspect of the present invention, the autonomous driving system <NUM> can provide a motion plan to each of the control lanes (<NUM>, <NUM>,. , <NUM>) simultaneously. The vehicle control system <NUM> can designate one of the control lanes (<NUM>, <NUM>,. , <NUM>) as a primary lane, and the remaining control lanes as secondary lanes. Vehicle control system <NUM> can control the primary lane to implement the motion plan and control vehicle <NUM>, and silence the secondary lanes. By designating first control lane <NUM> as the primary lane, vehicle <NUM> can be controlled when the motion plan is implemented via the first control lane <NUM>, but not when the motion plan is implemented via the remaining control lanes (<NUM>,.

<FIG>, <FIG>, and <FIG> depict flow diagrams of example methods <NUM>, <NUM>, and <NUM> associated with various aspects for controlling an autonomous vehicle according to example embodiments of the present invention. One or more portion(s) of the methods <NUM>, <NUM>, and <NUM> can be implemented as operations by one or more computing system(s) such as, for example, the computing system <NUM> or computing device(s) <NUM> shown in <FIG>. Moreover, one or more portion(s) of the methods <NUM>, <NUM>, and <NUM> can be implemented as an algorithm on the hardware components of the system(s) described herein (e.g., as in <FIG>) to, for example, detect and respond to a fault causing a loss of control over one or more component(s) of the vehicle <NUM>.

<FIG>, <FIG>, and <FIG> depict a first, second, and n-th fault that are associated with an operation of the vehicle <NUM>. Those of ordinary skill in the art, using the disclosures provided herein, will understand that a fault can cause a loss of control over one or more operations of the vehicle <NUM>, and the methods <NUM>, <NUM>, and <NUM> can be iterated for each such operation associated with the fault. Additionally, those of ordinary skill in the art will understand that a fault can be associated with one or more control lanes, and methods <NUM>, <NUM>, and <NUM> can be iterated for each such control lane.

<FIG> depicts a diagram of a method <NUM> for controlling the vehicle <NUM> when a first fault that affects an operation of the vehicle <NUM> is detected. At (<NUM>), the method <NUM> can include detecting a first fault (e.g., a fault associated with receiving the data representing the motion plan, a fault associated with one or more of the plurality of control lanes, or a fault associated with one or more vehicle actuation systems associated with the one or more of the plurality of control lanes, etc.). For example, the first fault can cause the vehicle control system <NUM> to lose control over a first operation of the vehicle <NUM>: via the first control lane <NUM> when the first control lane <NUM> is designated as the primary lane; via the first control lane <NUM> when the first control lane <NUM> is designated as a secondary lane; via the second control lane <NUM> when the second control lane <NUM> is designated as a secondary lane; or via the second control lane <NUM> when the second control lane <NUM> is designated as the primary lane.

At (<NUM>), the method <NUM> can include determining whether the first operation can be controlled via a second lane. For example, if the vehicle control system <NUM> loses steering control because of a fault with the first steering control system <NUM> connected to the first control lane <NUM> (first lane), then the vehicle control system <NUM> can determine whether the steering of the vehicle <NUM> can be controlled by the second steering control system <NUM> connected to the second control lane <NUM> (second lane).

As another example, if the vehicle control system <NUM> loses steering control because of a fault with the second steering control system <NUM> connected to the second control lane <NUM> (first lane), then the vehicle control system <NUM> can determine whether the steering of the vehicle <NUM> can be controlled by the first steering control system <NUM> on the first control lane <NUM> (second lane).

At (<NUM>), if the method <NUM> determines at (<NUM>) that the first operation can be controlled via a second lane, the method <NUM> can include switching control of the first operation to the second lane. For example, if the vehicle control system <NUM> loses steering control because of a fault with the first steering control system <NUM> connected to the first control lane <NUM> (first lane) when the first control lane <NUM> is designated as the primary lane, then the vehicle control system <NUM> can switch steering control of the vehicle <NUM> to the second steering control system <NUM> connected to the second control lane <NUM> (second lane) by designating the second control lane <NUM> as the primary lane for controlling the steering of the vehicle <NUM>.

As another example, if the vehicle control system <NUM> loses steering control because of a fault with the second steering control system <NUM> connected to the second control lane <NUM> (first lane) when the first control lane <NUM> (second lane) is designated as the primary lane for controlling the steering of the vehicle <NUM>, then the vehicle control system <NUM> can determine to take no action because the steering is being controlled by the first control lane <NUM> (second lane).

At (<NUM>), if the method <NUM> determines at (<NUM>) that the first operation cannot be controlled via a second lane, or after the method <NUM> switches control of the first operation to the second lane at (<NUM>), the method <NUM> can include determining if the first fault is critical. For example, the vehicle control system <NUM> can access the fault reaction parameters data to determine if the first fault is a critical fault. A critical fault can include a fault that causes a loss of control over a critical system onboard the vehicle <NUM> (e.g., autonomous driving system <NUM>, vehicle control system <NUM>, vehicle actuation system(s) <NUM>, etc.) or a fault that causes a loss of redundancy with respect to a critical system onboard the vehicle <NUM> such that the vehicle <NUM> is no longer robust to a single point of failure.

At (<NUM>), if the method <NUM> determines at (<NUM>) that the first fault is a critical fault, then method <NUM> can include determining if the first fault is associated with the autonomous driving system <NUM> (e.g., a fault associated with receiving the data representing the motion plan).

At (<NUM>), if the method <NUM> determines at (<NUM>) that the first fault is not a critical fault, then method <NUM> can include implementing a motion plan. For example, if the first fault causes the vehicle control system <NUM> to lose control of a stereo control system, and determines that the first fault is not a critical fault, then the vehicle control system <NUM> can implement the motion plan (to complete a vehicle service) without controlling the first operation.

At (<NUM>), if the method <NUM> determines at (<NUM>) that the first fault is a critical fault, but that the first fault is not associated with generating a motion plan by the autonomous driving system <NUM> or receiving data representing the motion plan by the vehicle control system <NUM>, then method <NUM> can include receiving a new motion plan associated with an assisted safe-stop action, and tracking an assisted safe-stop trajectory in the new motion plan. For example, the vehicle control system <NUM> can request the autonomous driving system <NUM> to provide a new motion plan for safely stopping the autonomous vehicle (e.g., assisted safe-stop action) and the vehicle control system <NUM> can implement the new motion plan by tracking an assisted safe-stop trajectory in the new motion plan. In addition to receiving data representing the new motion plan from the autonomous driving system <NUM>, the vehicle control system <NUM> can receive data representing a dynamic state of the vehicle <NUM> from the autonomous driving system <NUM> (e.g., via the localization system <NUM>). The vehicle control system <NUM> can track the assisted safe-stop trajectory based on the received data representing the dynamic state of the vehicle <NUM>. Alternatively, if the first fault is associated with the localization system <NUM>, then the vehicle control system <NUM> can determine a dynamic state of the vehicle <NUM> based on an IMU and/or one or more redundant local sensors <NUM> associated with the vehicle control system <NUM>, and the vehicle control system <NUM> can track the assisted safe-stop trajectory based on the determined dynamic state.

At (<NUM>), if the method <NUM> determines at (<NUM>) that the first fault is a critical fault, and that the first fault is associated with motion planning, then method <NUM> can include tracking a local safe-stop trajectory. For example, if the vehicle control system <NUM> determines that the first fault is a critical fault because the first fault is associated with receiving data representing a motion plan from the autonomous driving system <NUM>, then the vehicle control system <NUM> can retrieve a locally stored safe-stop trajectory previously received from the autonomous driving system <NUM> and track the local safe-stop trajectory. If the vehicle control system <NUM> continues to receive valid data representing a dynamic state of the vehicle <NUM> from the autonomous driving system <NUM> (e.g., via the localization system <NUM>), then the vehicle control system <NUM> can track the local safe-stop trajectory based on the received data representing the dynamic state of the vehicle <NUM>. Alternatively, the vehicle control system <NUM> can determine a dynamic state of the vehicle <NUM> based on an IMU and/or one or more redundant local sensors <NUM> associated with the vehicle control system <NUM>, and the vehicle control system <NUM> can track the local safe-stop trajectory based on the determined dynamic state.

<FIG> depicts a diagram of a method <NUM> for controlling the vehicle <NUM> with a dual-lane control architecture, when a second fault that affects a first operation is detected.

At (<NUM>), the vehicle control system <NUM> can include detecting a second fault associated with a first operation of the vehicle <NUM> (e.g., a fault associated with receiving the data representing the motion plan, a fault associated with one or more of the plurality of control lanes, or a fault associated with one or more vehicle actuation systems associated with the one or more of the plurality of control lanes, etc.). The second fault can occur subsequent to a first fault associated with the first operation. For example, the vehicle computing system can detect the first fault that causes the vehicle control system <NUM> to lose control of a stereo control system connected to the first lane, and then detect the second fault that causes the vehicle control system <NUM> to lose control of a stereo control system connected to the second lane.

At (<NUM>), the method <NUM> can include determining whether the second fault is critical. For example, the vehicle control system <NUM> can access the fault reaction parameters data to determine if the second fault is a critical fault.

At (<NUM>), if the method <NUM> determines at (<NUM>) that the second fault is a critical fault, then method <NUM> can include determining if the second fault is associated with motion planning (e.g., generating a motion plan by the autonomous driving system <NUM> or receiving data representing the motion plan by the vehicle control system <NUM>).

At (<NUM>), if the method <NUM> determines at (<NUM>) that the second fault is not a critical fault, the method <NUM> can include implementing a motion plan. For example, if the second fault causes the vehicle control system <NUM> to lose control of a stereo control system connected to the second lane, and the vehicle control system <NUM> determines that the second fault is not a critical fault, then the vehicle control system <NUM> can implement the motion plan (to complete a vehicle service) without controlling the stereo.

At (<NUM>), if the method <NUM> determines at (<NUM>) that the second fault is a critical fault, but determines at (<NUM>) that the second fault is not associated with motion planning, then method <NUM> can include receiving a new motion plan for an assisted safe-stop action, and tracking an assisted safe-stop trajectory in the new motion plan.

At (<NUM>), if the method <NUM> determines at (<NUM>) that the second fault is a critical fault, and at (<NUM>) that the second fault is associated with the autonomous driving system <NUM>, then method <NUM> can include tracking a local safe-stop trajectory. For example, if the vehicle control system <NUM> determines that the second fault is a critical fault because the second fault is associated with receiving data representing a motion plan from the autonomous driving system <NUM>, then the vehicle control system <NUM> can retrieve a locally stored safe-stop trajectory previously received from the autonomous driving system <NUM> and track the local safe-stop trajectory.

<FIG> depicts a diagram of a method <NUM> for controlling the vehicle <NUM> with a multi-lane control architecture with n or more control lanes, when a n-th fault that affects a first operation is detected. The vehicle control system <NUM> can detect n-<NUM> faults that are associated with the first operation, and then detect the n-th fault that is associated with the first operation.

At (<NUM>), the vehicle control system <NUM> can include detecting a n-th fault (e.g., a fault associated with receiving the data representing the motion plan, a fault associated with one or more of the plurality of control lanes, or a fault associated with one or more vehicle actuation systems associated with the one or more of the plurality of control lanes, etc.).

At (<NUM>), the method <NUM> can include determining whether the first operation can be controlled via a n+<NUM> control lane. For example, the vehicle control system <NUM> can determine if the vehicle <NUM> includes a multi-lane control architecture with n+<NUM> control lanes, and if so the vehicle control system <NUM> can determine if the first operation can be controlled via a n+<NUM> control lane. The n+<NUM> control lane can be organized in a hierarchy of decreasing capability such that control lane n+<NUM> has a capability less than or equal to control lane n.

As another example, if the vehicle control system <NUM> determines that the vehicle <NUM> does not include a multi-lane control architecture with n+<NUM> control lanes, or that the n-th fault is associated with the autonomous driving system <NUM>, then the vehicle control system <NUM> can determine that the first operation cannot be controlled via a n+<NUM> control lane.

At (<NUM>), if the method <NUM> determines at (<NUM>) that the first operation can be controlled via a n+<NUM> control lane, the method <NUM> can include switching control of the first operation to the n+<NUM> control lane. For example, if n-th fault causes the vehicle control system <NUM> to lose steering control of the vehicle <NUM>, then the vehicle control system <NUM> can switch steering control of the vehicle <NUM> to the n+<NUM> control lane by designating the n+<NUM> control lane as the primary lane for controlling the steering.

At (<NUM>), if the method <NUM> determines at (<NUM>) that the first operation cannot be controlled via a n+<NUM> control lane, or after the method <NUM> switches control of the first operation to the n+<NUM> control lane at (<NUM>), the method <NUM> can include determining whether a redundancy threshold condition for the first operation is satisfied. For example, the vehicle control system <NUM> can access the fault reaction parameters data to determine a redundancy threshold value for the first operation, and determine if the n-th fault is a critical fault.

At (<NUM>), if the method <NUM> determines at (<NUM>) that the redundancy threshold condition for the first operation is not satisfied, the method <NUM> can include determining if the first fault is associated with motion planning (e.g., generating a motion plan by the autonomous driving system <NUM> or receiving data representing the motion plan by the vehicle control system <NUM>).

At (<NUM>), if the method <NUM> determines at (<NUM>) that the redundancy threshold condition is satisfied, the method <NUM> can include implementing a motion plan. For example, if the n-th fault causes the vehicle control system <NUM> to lose control of a stereo control system connected to a n-th control lane, and the vehicle control system <NUM> determines that a redundancy threshold value for stereo control is -<NUM>, then the vehicle control system <NUM> can implement the motion plan (to complete a vehicle service) without controlling the stereo.

At (<NUM>), if the method <NUM> determines at (<NUM>) that the redundancy threshold condition is not satisfied and the n-th fault is a critical fault, and at (<NUM>) that the first fault is not associated with the autonomous driving system <NUM>, then method <NUM> can include receiving a new motion plan associated with an assisted safe-stop action, and tracking an assisted safe-stop trajectory in the new motion plan.

At (<NUM>), if the method <NUM> determines at (<NUM>) that the redundancy threshold condition is not satisfied and the n-th fault is a critical fault, and at (<NUM>) that the first fault is associated with the autonomous driving system <NUM>, then the vehicle control system <NUM> can retrieve a locally stored safe-stop trajectory previously received from the autonomous driving system <NUM> and track the local safe-stop trajectory.

<FIG> depicts elements performed in a particular order for purposes of illustration and discussion. Those of ordinary skill in the art, using the disclosures provided herein, will understand that the elements <FIG> discussed herein can be adapted, rearranged, expanded, omitted, combined, and/or modified in various ways without deviating from the scope of the present invention.

At (<NUM>), the method <NUM> can include determining a motion plan of an autonomous vehicle. For example, the autonomous driving system <NUM> onboard the vehicle <NUM> can determine a motion plan for controlling a motion of the vehicle <NUM>, based on sensor data <NUM> from sensor(s) <NUM>. The motion plan can include one or more primary trajectories and a safe-stop trajectory associated with each primary trajectory. In some implementations, the autonomous driving system <NUM> can also determine a dynamic state of the autonomous vehicle.

At (<NUM>), the method <NUM> can include providing the motion plan to a plurality of control lanes. For example, the autonomous driving system <NUM> can provide data representing the motion plan to a plurality of control lanes of the vehicle control system <NUM>. In some implementations, the autonomous driving system <NUM> can provide data representing the dynamic state of the autonomous vehicle to the plurality of control lanes of the vehicle control system <NUM>. The plurality of control lanes can be configured to implement the motion plan to control the motion of the vehicle <NUM>. The plurality of control lanes can include at least a first control lane and a second control lane. The vehicle control system <NUM> can control the first control lane to implement the motion plan (e.g., designate the first control lane as a primary lane, and designate the second control lane as a secondary lane). In some implementations, the vehicle control system <NUM> can control the first control lane to implement the motion plan by determining a primary trajectory based on the data representing the motion plan, controlling the first control lane to generate one or more first vehicle control signals to track the primary trajectory, and provide the one or more first vehicle control signals to one or more first vehicle actuation systems <NUM> connected to the first control lane. In some implementations, the vehicle control system <NUM> can control the first control lane and the second control lane to implement the motion plan. The vehicle control system <NUM> can control the first control lane to generate one or more first vehicle control signals to track the primary trajectory, and provide the one or more first vehicle control signals to one or more first vehicle actuation systems <NUM> connected to the first control lane; and control the second control lane to generate one or more second vehicle control signals to track the primary trajectory, and provide the one or more second vehicle control signals to one or more second vehicle actuation systems <NUM> connected to the second control lane.

At (<NUM>), the method <NUM> can include detecting a first fault associated with implementation of the motion plan. For example, the vehicle control system <NUM> can detect one or more faults associated with implementation of the motion plan by the first control lane or the second control lane. In some implementations, the vehicle control system <NUM> can detect one or more faults associated with implementation of the motion plan by one or more of the plurality of control lanes. The one or more faults can include, for example, at least one of a fault associated with receiving the data representing the motion plan, a fault associated with one or more of the plurality of control lanes, or a fault associated with one or more vehicle actuation systems <NUM> associated with the one or more of the plurality of control lanes.

At (<NUM>), the method <NUM> can include controlling the autonomous vehicle in response to the fault. For example, in response to the one or more faults, the vehicle control system <NUM> can control the first control lane or the second control lane to adjust the motion of the vehicle <NUM> based at least in part on one or more fault reaction parameters associated with the one or more faults. In some implementations, the one or more fault reaction parameters can indicate a capability of the one or more control lanes in response to the one or more faults. Controlling the vehicle <NUM> in response to the fault can include determining a new motion plan or tracking a local safe-stop trajectory.

In some implementations, the vehicle control system <NUM> can determine a capability of the first control lane based on the one or more fault reaction parameters associated with the one or more faults, and control the first control lane to adjust the motion of the vehicle <NUM> based at least in part on the capability of the first control lane.

In some implementations, the vehicle control system <NUM> can determine a capability of the first control lane and the second control lane based on the one or more fault reaction parameters associated with the one or more faults, and control the first control lane and the second control lane to adjust the motion of the vehicle <NUM> based at least in part on the capability of the first control lane and the second control lane.

In some implementations, the vehicle control system <NUM> can determine a capability of the first control lane and the second control lane based on the one or more fault reaction parameters associated with the one or more faults, and control the second control lane to adjust the motion of the vehicle <NUM> based at least in part on the capability of the second control lane and the second control lane.

In some implementations, the vehicle control system <NUM> can determine a capability of the plurality of control lanes in response to the one or more faults, determine the second control lane as a control lane with the highest capability from the plurality of control lanes, and control the second control lane to adjust the motion of the vehicle <NUM> based at least in part on one or more fault reaction parameters associated with the one or more faults.

At (<NUM>), the method <NUM> can include determining a new motion plan. For example, the vehicle control system <NUM> can provide one or more control signals to the autonomous driving system <NUM> that instruct the autonomous driving system <NUM> to determine a stopping action based on the one or more fault reaction parameters associated with the one or more faults. In response to providing the one or more control signals to the autonomous driving system <NUM>, the vehicle control system <NUM> can receive data representing a motion plan from the autonomous driving system <NUM>. The data representing the new motion plan can correspond to the stopping action, and the vehicle control system <NUM> can control the first control lane or the second control lane to implement the new motion plan corresponding to the stopping action.

At (<NUM>), the method <NUM> can include tracking a local safe-stop trajectory. For example, the vehicle control system <NUM> can retrieve a locally stored safe-stop trajectory that was previously received in the data representing the motion plan. The vehicle control system <NUM> can control the first control lane to generate one or more vehicle control signals to track the local safe-stop trajectory, and to provide the one or more vehicle control signals to one or more vehicle actuation systems <NUM> connected to the first control lane.

In some implementations, the vehicle control system <NUM> can control the first control lane to determine a dynamic state of the vehicle <NUM>. In particular, the dynamic state of the vehicle <NUM> can be determined by an inertial measurement unit (IMU) and/or additional sensors associated with the first control lane. The vehicle control system <NUM> can control the first control lane to adjust the local safe-stop trajectory based on the dynamic state of the vehicle <NUM>.

In some implementations, the vehicle control system <NUM> can receive data representing a potential collision with one or more objects in an environment proximate to the vehicle <NUM>. The vehicle control system <NUM> can receive the data from the collision mitigation system <NUM> onboard the vehicle <NUM>. The vehicle control system <NUM> can control the first control lane to adjust the local safe-stop trajectory based on the data representing the potential collision (e.g., to avoid the potential collision).

Computing tasks discussed herein as being performed at computing device(s) remote from the vehicle can instead be performed at the vehicle (e.g., via the vehicle computing system), or vice versa. Such configurations can be implemented without deviating from the scope of the present invention. The use of computer-based systems allows for a great variety of possible configurations, combinations, and divisions of tasks and functionality between and among components. Computer-implemented operations can be performed on a single component or across multiple components. Computer-implemented tasks and/or operations can be performed sequentially or in parallel. Data and instructions can be stored in a single memory device or across multiple memory devices.

Claim 1:
A computer-implemented method, the method comprising:
receiving motion planning data for an autonomous vehicle (<NUM>);
determining a first control lane (<NUM>; <NUM>) of a plurality of control lanes (<NUM>, <NUM>; <NUM>-<NUM>) for implementing a motion plan based on the motion planning data,
wherein the plurality of control lanes comprises at least the first control lane and a second control lane (<NUM>; <NUM>) different than the first control lane, wherein the first control lane is connected with a first set of vehicle actuation systems (<NUM>; <NUM>, <NUM>, <NUM>; <NUM>, <NUM>, <NUM>, <NUM>) corresponding to the first control lane, wherein the second control lane is connected with a second set of vehicle actuation systems (<NUM>; <NUM>, <NUM>; <NUM>, <NUM>, <NUM>, <NUM>) corresponding to the second control lane,
wherein the first set of vehicle actuation systems comprises at least one first actuation system that is not present in the second set of vehicle actuation systems;
wherein the first control lane is configured to provide a first capability based, at least in part, on the first set of vehicle actuation systems, wherein the second control lane is configured to provide a second capability based, at least in part, on the second set of vehicle actuation systems, and wherein the first capability is greater than the second capability;
designating the first control lane as a primary lane and the second control lane as a secondary lane based on the first capability and the second capability;
determining a fault associated with implementing the motion plan via the designated primary lane;
silencing the designated primary lane; and
controlling the designated secondary lane to adjust a motion of the autonomous vehicle based at least in part on the capability of the designated secondary lane.