SENSOR FUSION VERIFICATION OF COMMAND ISSUES

Abstract

A vehicle's computer system can receive sensor data from a suite of sensors. The system can run one or more machine learning models to infer the sensor data and generate inference-based control commands to autonomously operate a range of the vehicle's controls. The system can further execute a sensor fusion module on the sensor data to generate a sensor fusion output of the vehicle's external environment. The system can then determine if there is a conflict between the inference-based control commands and the sensor fusion output.

Description

BACKGROUND

[0001] Machine learning models can be used for various purposes, such as inference tasks in the autonomous navigation of robots, automobiles, aircraft, and similar devices. End-to-end machine learning involves the direct mapping between inputs and outputs and can use a neural network to replace the chain of different machine learning and non-machine learning modules used in earlier approaches. SUMMARY

[0002] Machine learning or artificial intelligence models typically generate outputs without providing an explanation or description of the internal processes that lead to those outputs. Consequently, the internal workings of machine learning or artificial intelligence models are unknown, making their outputs unreliable. The accuracy of a machine learning or artificial intelligence model's results depends heavily on the inputs closely resembling those provided during the model's training. For example, if an autonomous vehicle controlled by a machine learning model strikes a pedestrian without braking, the model's black-box nature prevents an evaluator from tracing the model's reasoning process to understand why it struck the pedestrian.This black box problem can therefore lead to an ethical dilemma when autonomous driving systems are certified that are based solely on machine learning models or artificial intelligence models.

[0003] Autonomous or semi-autonomous vehicles perform perception and localization techniques using sensor data from a vehicle-wide sensor suite, which can include any combination of cameras, LiDAR sensors, radar sensors, ultrasonic sensors, and the like. Therefore, the sensor data can encompass any combination of image data, radar data, LiDAR data, etc. In traditional approaches, a computer system within the vehicle performs sensor fusion (e.g., using a particle filter) to combine the sensor data and dynamically generate a sensor-fused representation of the vehicle's external environment.In particular, a particulate filter can fuse sensor data from the vehicle's various sensors, and the vehicle's computer system can perform perception operations to, for example, identify tasks of interest, generate boundary polygons for each detected object, classify the tasks, and create a motion plan for the vehicle. The result is an extremely robust representation of the vehicle's static or dynamic external environment (e.g., with near 100% accuracy), including various attributes of moving external tasks (e.g., the respective trajectories and speeds of other vehicles, pedestrians, cyclists, etc.).

[0004] Alternatively, there are learning-based approaches for controlling autonomous vehicles, which use machine learning or artificial intelligence models in neural networks that process sensor data to perform machine learning inference and make decisions for driving the vehicle. Two disadvantages of learning-based approaches are that the method used to generate the results is not transparent and that the results are fragile; that is, their accuracy depends on how closely the input data matches the data used during training, and even small discrepancies between the two can lead to highly inaccurate results. These two disadvantages of learning-based approaches mean that the safety of the neural network's decision-making processes cannot be guaranteed.To certify the safety of a system, safety engineers use a V-model, which defines the desired outcomes on the one hand and determines how the system achieves these desired outcomes on the other. If a system incorporates machine learning or artificial intelligence, a safety engineer cannot certify that the defined outcomes, which depend on these elements of machine learning or artificial intelligence, are actually achieved.

[0005] In several examples described here, a vehicle computer system can forward sensor data to two subsystems that run concurrently. One subsystem incorporates, in whole or in part, artificial intelligence or machine learning models that draw inferences which, in turn, can generate inference-based control commands for the autonomous operation of a number of the vehicle's controls. The other subsystem would not contain artificial intelligence or machine learning models and would typically apply a particulate filter to the sensor data to generate a sensor fusion output of a static or dynamic environment outside the vehicle.The vehicle computer system may include a verification module that can determine whether there are currently, or in the near future (n seconds or milliseconds), conflicts between the inference-based control commands issued by the machine learning model and the sensor fusion output of the particulate filter.

[0006] Accordingly, the verification module can leverage the robustness of the sensor fusion output through the particulate filter to check in real time whether the machine learning model's decision-making is safe. If a conflict exists, the verification module can instruct the vehicle to perform a corrective action, such as ignoring a movement plan based on the inference-based control commands, and / or perform another corrective action, such as slowing the vehicle, transferring control to a driver or remote operator, or maintaining the road state, so that the sensor fusion module and the machine learning model can reach a state of consistency. This means that executing the control commands in the world as defined by the sensor fusion module would not lead to dangerous outcomes such as accidents.The inference-based commands can correspond to any operating mode of the vehicle, for example, any combination of acceleration and deceleration commands, steering commands, braking commands, and signal commands, which may correspond to, for example, a lane change, a decision to turn right or left, a decision to cross an intersection, and the like. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] The present disclosure is illustrated by means of examples and not by limitations in the figures of the accompanying drawings, in which the same reference symbols denote the same elements and in which: Fig. 1A is a block diagram representing a computer system that implements a sensor fusion module for verifying outputs from an instruction generation module according to the examples described here; Fig. 1B is a block diagram representing a vehicle computer system that implements a sensor fusion module for verifying inference-based commands generated by a vehicle neural network according to various examples; Fig. Figure 2 is a block diagram that represents an example of a system-in-package comprising several chiplets that implement the fusion and security verification of machine learning results according to the examples described here; Fig. 3A is a flowchart that describes a procedure for verifying command outputs using sensor fusion according to the examples described here; and Fig. 3B is a flowchart that describes an example procedure for verifying outputs of a machine learning model according to the examples described here; and Fig. Figure 4 is a block diagram illustrating a Computer System 400 on which certain examples described herein can be implemented. DETAILED DESCRIPTION

[0008] In certain implementations, a computer system can perform one or more of the functions described here using a learning-based approach, for example, by running an artificial neural network (e.g., a recurrent neural network, a convolutional neural network, etc.) or one or more machine learning models. Such learning-based approaches can further correspond to a computer system that stores or contains one or more machine-learned models. In one embodiment, the machine-learned models can include an unsupervised learning model. In another embodiment, the machine-learned models can include neural networks (e.g., deep neural networks) or other types of machine-learned models, including nonlinear and / or linear models. Neural networks can be feedforward neural networks, recurrent neural networks (e.g.,These include recurrent neural networks with long short-term memory, convolutional neural networks, or other forms of neural networks. Some examples of machine-learned models can utilize an attentional mechanism such as self-attention. For example, some examples of machine-learned models may include multi-headed self-attention models (e.g., transformer models).

[0009] An example of a computer system that implements machine learning is a system-in-package (SIP), which can combine multiple components of a computer or electronic system onto a single chip, providing a compact and efficient solution for a wide range of applications. One advantage of a SIP is its compactness and reduced complexity, as all components are integrated onto a single chip. This reduces the need for additional circuit boards and other components, saving space, lowering power consumption, and reducing overall costs. The components of a SIP are often referred to as chiplets. These are small, self-contained semiconductor components that can be combined with other chiplets to form a SIP.

[0010] Chiplets are highly modular and scalable, enabling the creation of complex systems from smaller, simpler components. They are typically designed for specific functions or tasks, such as memory, graphics processing, or input / output (I / O). They can be interconnected with each other and with a main processor or controller via high-speed interfaces. Compared to traditional and current monolithic chip designs, chiplets offer greater modularity, scalability, and manufacturing efficiency, as well as the ability to be individually tested before being combined into a larger system.

[0011] As described in the examples, a computer hardware topology (e.g., consisting of a number of chiplets arranged on a SIP) can be tasked with executing executable files. In certain implementations, workloads programmed in an application can be executed as executable files to perform sensor data processing tasks (e.g., for autonomous driving) such as general perception, scene understanding, task detection and classification, machine learning inference, motion prediction and planning, and / or autonomous vehicle control tasks. In various aspects, the computer system can include a SIP array comprising multiple chiplets for performing the sensor data processing tasks (e.g., for autonomous driving).Accordingly, the hardware topology can include a central SIP chiplet, one or more sensor data input chiplets, any number of workload processing chiplets, ML accelerator chiplets, general computing chiplets, autonomous driving chiplets, high-bandwidth chiplets, and connections between the chiplets.

[0012] In certain examples, the sensor data input chiplet receives sensor data from the vehicle's sensor system, which can include any combination of cameras, LiDAR sensors, radar sensors, ultrasonic sensors, proximity sensors, and the like. The central chiplet can include the shared memory and reservation table into which information is entered according to the workloads (e.g., workload entries). In other examples, the set of workload processing chiplets can execute workloads as executable files using dynamic scheduling and the reservation table implemented in the shared memory of each SIP.

[0013] Upon receiving each piece of sensor data (e.g., individual images, point clouds, radar pulses, etc.), the sensor data input chiplet can indicate the availability of the sensor data in the reservation table, store the sensor data in a cache, and specify the address of the sensor data in the cache. By executing workloads according to a set of independent pipelines, a set of workload processing chiplets can monitor the reservation table for available workloads. As described herein, the initial raw sensor data can be referenced in the reservation table and processed by the workload processing chiplets through an initial set of workloads. For example, this initial processing might involve stitching images together to create a 360-degree sensor view of the vehicle's environment, allowing the chiplets to perform additional tasks on the sensor view (e.g.,Task of object recognition and task of classification).

[0014] One or more of the embodiments described herein may be implemented on a computer system. Examples of computer systems may include one or more control circuits comprising one or more processors (e.g., microprocessors), one or more processor cores, a programmable logic circuit (PLC) or a programmable logic / gate array (PLA / PGA), a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), a system-on-chip (SoC), a system-in-package (SIP), or any other control circuit. In some embodiments, the control circuit(s) and / or the computer system may be part of a vehicle control unit (also referred to as a vehicle control module) installed in a vehicle (e.g., a Mercedes-Benz). ®-car, -truck or -van) embedded in or otherwise arranged within, or forming these. For example, the vehicle control system may be or include an infotainment system control unit (e.g., an infotainment head unit), a telematics control unit (TCU), an electronic control unit (ECU), a central powertrain control (CPC), a central exterior and interior control (CEIC), a zone control system, an autonomous vehicle control system, or any other control system (the term "or" is used here synonymously with "and / or").

[0015] In one embodiment, the control circuit(s) and other processing units can be programmed by one or more computer-readable or computer-executable instructions stored on the non-volatile, computer-readable medium. The non-volatile, computer-readable medium can be a storage device, also referred to as a data storage device, which may comprise an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof.The non-volatile, computer-readable medium can be, for example, a computer floppy disk, a hard disk drive (HDD), a solid-state drive (SSD) or integrated solid-state memory, random-access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random-access memory (SRAM), dynamic random-access memory (DRAM), and / or a flash memory stick. In some cases, the non-volatile, computer-readable medium can store computer-executable instructions or computer-readable instructions.

[0016] In various embodiments, the terms "computer-readable instructions" and "computer-executable instructions" are used to describe software instructions or computer code configured to perform various tasks and operations. In various embodiments, when the computer-readable or computer-executable instructions form modules, the term "module" generally refers to a collection of software instructions or code configured to cause the control circuit to perform one or more functional tasks. The modules and computer-readable / executable instructions can be described as different operations or tasks that are performed when the control circuit(s) or other hardware components execute the modules or computer-readable instructions.

[0017] In further embodiments, the computer system may include a communication interface that enables communication over one or more networks for sending and receiving data. In certain embodiments, the communication interface may be used to communicate with one or more other computer systems. The communication interface may include any circuitry, components, software, etc., for communicating over one or more networks (e.g., a local area network, a wide area network, the internet, a secure network, a cellular network, a mesh network, and / or a peer-to-peer communication link). In some embodiments, for example, the communication interface may include one or more of the following components: a communication controller, a receiver, a transceiver, a transmitter, a port, conductors, software, and / or hardware for communicating data / information.

[0018] As provided herein, a “network” or “one or more networks” may comprise any type of network or combination of networks that enables communication between entities. In one embodiment, the network may comprise one or more of the following: a local area network, a wide area network, the internet, a secure network, a cellular network, a mesh network, a peer-to-peer communication link, or a combination thereof, and may include any number of wired or wireless connections. Communication over the network or networks may, for example, occur via a network interface using any protocols, protection schemes, encodings, formats, packaging, etc.

[0019] One or more of the examples described herein provide for procedures, techniques, and actions performed by an institution to be carried out programmatically or as a computer-implemented procedure. Program-controlled here means the use of code or computer-executable instructions. These instructions may be stored in one or more memory resources of the institution. A programmatically controlled step may be performed automatically or manually.

[0020] One or more of the examples described here can be implemented using programmatic modules, engines, or components. A programmatic module, engine, or component can comprise a program, a subroutine, a part of a program, a software component, or a hardware component capable of performing one or more specified tasks or functions. As used here, a module or component can exist independently of other modules or components on a hardware component. Alternatively, a module or component can be a common element or process of other modules, programs, or machines.

[0021] Some of the examples described herein may generally require the use of computing facilities, including processing and storage resources. For example, one or more of the examples described herein may be implemented wholly or partially on computing facilities such as servers and / or personal computers using network devices (e.g., routers). Storage, processing, and network resources may all be used in connection with setting up, using, or performing any example described herein (including performing a procedure or implementing a system).

[0022] Furthermore, one or more of the examples described herein can be implemented by using instructions that can be executed by one or more processors. These instructions can be stored on a non-volatile, computer-readable medium. The machines shown or described in the following figures are examples of processing resources and computer-readable media on which instructions for implementing the examples disclosed herein can be transferred and / or executed. In particular, the numerous machines illustrated with examples of the invention include processors and various forms of storage for storing data and instructions. Examples of non-volatile, computer-readable media include permanent storage devices, such as hard disks in personal computers or servers.Other examples of computer storage media include portable storage devices such as flash memory or magnetic storage. Computers, terminals, and network-enabled devices are examples of machines and devices that use processors, memory, and instructions stored on computer-readable media. Furthermore, examples can be implemented in the form of computer programs or a computer-readable medium capable of carrying such a program. SYSTEM DESCRIPTION

[0023] Fig. Figure 1A is a block diagram representing a computer system 100 that implements a sensor fusion module 120 for verifying outputs from an instruction generation module 110 according to the examples described here. With reference to Fig. In certain examples, the instruction generation module 110 can encompass any sensor data processing resource that outputs instructions that can be considered unreliable. Conversely, the sensor fusion module 120 can produce a sensor fusion output that can be considered reliable. In certain examples, the instruction generation module 110 can be trained using traditional machine learning techniques (e.g., a chain of modules) or via end-to-end techniques (e.g., learning all steps between the initial input and the final output). However, the instruction generation module 110 does not necessarily have to be a machine learning module that executes a machine learning model or artificial intelligence.

[0024] Machine learning encompasses algorithms, networks, or models that learn from specific datasets. This learning (or training) process establishes values ​​for model parameters or network coefficients, and these models, when used, identify patterns, provide descriptions, and / or make decisions about input data. Examples of traditional or classical techniques include decision trees, linear regression algorithms, vector machines, and other adaptive learning platforms. Input data can be processed using a chain of modules containing a mix of machine learning and classification modules. Input data can also be processed using end-to-end machine learning techniques, which consist of models trained to perform tasks from raw data processing to generating final results without intermediate steps. These techniques can include neural networks (e.g.,Convolutional neural networks, recurrent neural networks, feedforward neural networks, long-term-short-term memory networks, multilayer perceptrons, etc., which consist of a collection of nodes connected in a layered structure, are used, for example, to classify unknown signals and perform inference tasks on input data. In both cases, the instruction generation module 110 can be trained using supervised, unsupervised, or continuous training techniques to, for example, generate predictions and decisions, learn patterns, adjust or improve performance, and the like.

[0025] According to the examples given herein, the computer system 100 can receive sensor data from a set of sensors 145, which may include any combination of image sensors (e.g., for capturing images or recording live video), radar sensors, ultrasonic sensors, proximity sensors, LiDAR sensors, and the like. The sensor data can be processed by the instruction generation module 110 to produce a set of instruction outputs (e.g., general instructions for controlling a set of actuators or motors, inference-based instructions, etc.). It is intended that these outputs from the instruction generation module 110 may include any outputs, such as instructions, predictions, inferences, other inferences, or decisions for which the instruction generation module 110 has been trained or programmed.As observed in the fields of neural networks, machine learning, and artificial intelligence, these outputs can be unreliable due to the black-box nature of machine learning models, artificial intelligence, and neural networks.

[0026] In various examples, the sensor fusion module 120 of the computer system 100 can perform a classic technique for fusion of sensor data to generate a sensor-fused representation of the acquired data (e.g., using a particle filter such as a Kalman filter). Unlike the operation of the instruction generation module 110, the sensor fusion module 120 includes a "white box" in which the output of the sensor fusion module 120 can be verified based on the underlying mathematics and the algorithmic description fundamental to the particle filter. Thus, the reliability of the fusion output of the sensor fusion module 120 is essentially ensured.For example, the particles, pixels, or feedback signals from the sensors 145 can be processed by the sensor fusion module 120 to generate a joint probability distribution over variables for each time step of the sensor data and to track the estimated state of the detected environment. The particle filter's internals can include adjustable attributes, such as an inverse sensor model, a decay model, consistency attributes (e.g., with free space and the static world), resampling attributes, and so on. The sensor fusion module 120 operates through a prediction phase and an update phase, in which it can generate estimates of the current state variables of the sensor data, including uncertainties, for each time step.As soon as the next measurement from the sensors 145 (including random disturbances or errors) is acquired, the estimates are updated, for example, using a weighted average, with estimates with greater confidence being weighted more heavily. In this way, the sensor fusion module 120 can operate as a recursive algorithm or procedure in real time, with the fusion output achieving 100% accuracy.

[0027] In various implementations, the computer system 100 may further include a verification module 130, which can dynamically compare the output of the instruction generation module 110 and the sensor fusion output of the sensor fusion module 120, or ensure their secure consistency or secure coexistence. The dynamic comparison may involve comparing the instruction outputs of the instruction generation module 110 with a projection into the future of the sensor fusion module 120 (e.g., a motion prediction for external entities as well as an entity controlled by the computer system 100). The instruction generation module 110 is intended to perform inference operations on the sensor data, where inference operations are an opaque box, impervious to human intelligence and understanding, making them unreliable or suspect.The sensor fusion output of the sensor fusion module 120 is a description of road users obtained through understandable / comprehensible and therefore reliable techniques. Based on this description of road users, it is possible to project any external entity (relevant to the autonomous control of the device) into the future (e.g., their positions or future locations, trajectories, respective speeds, etc.). Accordingly, the verification module 130 validates the command outputs by dynamically comparing the sensor fusion output of the sensor fusion module 120 with the application of the unreliable command outputs of the command generation module 110 to the autonomous device, searching for collisions or accidents.

[0028] If a conflict exists between the instruction outputs and the sensor fusion outputs (e.g., the instruction outputs with respect to the respective future projections as determined by the sensor fusion module 120), the verification module 130 can trigger a correction module 135 of the computer system 100 to perform a corrective action, such as discarding or ignoring the machine learning results (e.g., prediction, inference, command, etc.), sending a notification or conflict trigger to the instruction generation module 110, waiting for the next time step or iteration of the fusion output and the machine learning results, and checking whether the conflict has been resolved. In some embodiments, the correction module 185 can provide feedback to the instruction generation module 110 (e.g.,A conflict notification may be issued indicating that the commands have resulted in a conflict, potentially prompting the command generation module 110 to adjust its opaque methodology. If this does not occur, the verification module 130 may, in certain examples, generate an error message indicating that either the command generation module 110, the sensor fusion module 120, or one or more sensors 145 are malfunctioning or operating outside of their nominal parameters. This error may be displayed on a screen (e.g., an administrative computer or an interior screen of an autonomous vehicle). In certain examples, the correction module 135 may cause the computer system 100 to perform a diagnostic process to identify the source of the error and, in remotely controlled autonomous vehicle implementations, return control to a human driver or a remote operator capable of operating the vehicle remotely.In other examples, if a conflict cannot be resolved, the correction module 135 can trigger a failsafe response that either terminates autonomous operation, activates a safety mode, transfers manual control of the autonomous machine, and so on. As provided herein, a human operator can include a person inside the vehicle, a remote operator who controls the vehicle using image data (or other sensor data) from the vehicle's sensors, or a vehicle owner who can operate the vehicle with a remote control (e.g., a smartphone).

[0029] If no conflict exists, or if a conflict was resolved in a subsequent time step, the verification module 130 can forward the instruction outputs from the instruction generation module 110 as verified output, as shown in Fig. Figure 1A shows that the verification module 130 confirms the instruction outputs as correct and conflict-free based on the sensor fusion output from the sensor fusion module 120. As provided herein, the processes executed by the computer system 100 and the outputs of the instruction generation module 110 can be for any purpose and may include the verification of output instructions generated from a mixture of classical and machine learning modules or end-to-end machine learning models. SEMI-AUTONOME OR FULLY AUTONOMOUS VEHICLE

[0030] Fig. Figure 1B is a block diagram representing a vehicle computer system 155 that implements a sensor fusion module 170 for verifying inference-based commands generated by a neural network 165 of the vehicle 150 according to various examples. With reference to Fig. In 1B, the vehicle 150 can comprise a human-driven vehicle with an advanced driver assistance system (ADAS), a fully autonomous vehicle with an autonomous driving computer system (e.g., SAE Level 3 and above), or a combination of both. In variants, the vehicle 150 can comprise a robotic vehicle (e.g., a humanoid robot), an aircraft, a drone, a watercraft, or another autonomous or semi-autonomous vehicle. In various examples, the vehicle 150 can comprise a sensor suite 160, which includes any combination of lidar sensors, radar sensors, cameras, ultrasonic sensors, infrared sensors, other proximity sensors, etc. The vehicle 100 comprises a computer system 155, which can include a neural network 165 with a machine learning model 167 and a sensor fusion module 170 with a particle filter 172.

[0031] The machine learning model 167 executed in the neural network 165 and the sensor fusion module 170 (which can optionally execute a particle filter 172, as in Fig. (shown in Figure 1B) can be applied simultaneously to the sensor data to generate both inference-based control commands (ML commands) and a sensor fusion output, as shown in Figure 1B. Fig. Figure 1B shows that the computer system 155 can further include a verification module 180, which dynamically determines whether a conflict or collision exists between the ML commands issued by the machine learning model 167 and the sensor fusion output from the sensor fusion module 170. If so, the verification module 130 performs a corrective action on the motion plan of the ML model 112. If not, the verification module 130 can forward the ML commands to the vehicle control system 170, which can then operate the vehicle's control mechanisms autonomously.

[0032] As described herein, the dynamic comparison by the verification module 180 can include a comparison between the ML command outputs from the neural network 165 and a projection into the future by the sensor fusion module 170 (e.g., a motion prediction for external entities in an external environment of the vehicle 150, as well as the predicted trajectory, speed, and / or path of the vehicle 150). The neural network 165, which executes the machine learning model 167, is intended to perform inference operations on the sensor data. Inference operations are an opaque box, impervious to human intelligence and understanding, making them unreliable or suspect. The sensor fusion output of the sensor fusion module 170 is a description of the road users obtained through understandable / comprehensible and therefore reliable techniques.Based on the description of the road users, it is possible to project any external entity (for autonomous control) (e.g., their positions or future locations, trajectories, respective speeds, etc.) into the future. Accordingly, the verification module 180 validates the machine learning (ML) commands by dynamically comparing the sensor fusion output of the sensor fusion module 170 with the unreliable ML command outputs of the neural network 165, searching for collisions or accidents.

[0033] In real-world scenarios, the autonomous vehicle 150 can dynamically create and execute a motion plan through inference operations performed by the neural network 165. This involves generating control commands for the vehicle control system 190 of the vehicle 150 as the vehicle travels along a route. The vehicle control system 190 can directly or indirectly actuate the vehicle's control mechanisms 195, which may include a steering system, a braking system, an acceleration system, an energy or battery recovery system, a signaling system, and the like. The verification module 180 uses the sensor fusion output from the sensor fusion module 170 to verify that the inference-based, machine-learned commands from the neural network 165 do not conflict (e.g.,that the motion predictions of the vehicle 150 and each of the entities located outside the vehicle will not collide or come within a prohibited or dangerous proximity at a predicted time. Thus, the control commands transmitted to the vehicle control system 190 are verified using a guaranteed approach as provided herein.

[0034] If a conflict exists, as described here, the verification module 180 can trigger a remediation module 185 to perform a corrective action, such as discarding or ignoring the inference-based control commands, sending a conflict message back to the neural network 165 indicating that a conflict exists, waiting for the next time step or iteration of the fusion output and machine learning commands, and / or checking whether the conflict has been resolved in the next time step. For example, in certain implementations, the remediation module 185 can provide feedback to the neural network 165 indicating that the ML commands have resulted in a conflict, which may cause the neural network 165 to adjust its opaque methodology to resolve the conflict.

[0035] In a driving scenario, the inference-based commands issued by neural network 165 can include a lane change action, a turning action, a proceed action (e.g., through a stop sign, a traffic light, a pedestrian crossing, or an emergency vehicle), a stopping action (e.g., to pick up or drop off passengers, to allow emergency vehicles to pass, etc.), a parking or exiting action, a stopping action, a signaling action, an evasive action, yielding the right-of-way, and the like. Each of these actions can be embodied in a motion plan of neural network 165, which can determine the layered actions of vehicle 150 for the next n seconds (e.g., the projected future time).The movement plan can include an overall route to a destination as well as a more immediate plan for movement along the route, which may include all the actions described above.

[0036] Each action can be implemented using the inference-based commands from neural network 165. However, according to the examples described here, if an inference-based command conflicts with the sensor fusion output of the particulate filter 172, executed by sensor fusion module 170, the verification module 180 can cause the command to be ignored or aborted and trigger the correction module 185 to perform a corrective action. In some aspects, the correction module 185 can send a conflict message to neural network 165, which may contain a source of conflict within the sensor fusion output, such as a potential collision task (e.g., a vehicle, a pedestrian, or a task that was not identified or was incorrectly identified by neural network 165).In such aspects, the neural network 165 can resolve the conflict itself and update the inference-based commands, which can then be verified by the verification module 180.

[0037] In some variants, the verification module 180 can override the inference-based command of the neural network 165 if a conflict exists (e.g., abort a lane change or acceleration action, decelerate the vehicle and maintain a lane within the current lane, etc.). After overriding the inference-based command, the verification module 180 can compare the next outputs of the neural network 165 and the sensor fusion module 170, determine that no conflict exists, and forward the verified control commands to the vehicle control system 190 for execution. Accordingly, it is assumed that the vast majority of conflicts can be resolved autonomously in this way, thus providing the autonomous or semi-autonomous vehicle 150 with an additional layer of safety.

[0038] If conflicts persist between the inference-based commands and the sensor fusion output, as provided herein, the verification module 180 can, for example, generate an error message indicating that one of the machine learning models 167, the particulate filter 172, or one or more sensors of the sensor suite 160 is faulty or operating outside of its nominal parameters. This error can be displayed on a screen inside the autonomous vehicle. In certain examples, the correction module 185 can cause the computer system 155 to perform a diagnostic process to identify the source of the error and attempt to resolve the conflict itself.In other examples, the remediation module 185 can trigger a failsafe that notifies a vehicle occupant or a remote operator to take over control of the vehicle 150, or can cause the vehicle control system 190 to stop the vehicle and park it in a safe place.

[0039] Thus, the in Fig. 1B depicted vehicle computer system 155 an autonomous or semi-autonomous vehicle implementation of the in relation to Fig. 1A described computer system 100. As in Fig. As shown in Figure 1B, the sensor fusion module 170 (which, for example, executes a particle filter 172) works simultaneously with the neural network 165, which executes the machine learning model 167, and the verification module 180 ensures that inference-based commands, which are considered unreliable due to the black-box nature of machine learning and artificial intelligence, are dynamically verified so that the control commands ultimately executed by the vehicle control system 190 are safe for both the occupants of the vehicle 150 and all objects outside the vehicle 150. SYSTEM-IN-PACKAGE

[0040] Fig. Figure 2 is a block diagram representing an example of a System-in-Package (SIP) 200, comprising several chiplets that implement the fusion and security verification of machine learning outputs, as described in the examples presented here. Depending on the implementation, the features related to the Fig. 1A and Fig. 1B described computer systems 100, 155 on the in Fig. 2 shown SIP 200 can be implemented, which can include various chiplets, such as a sensor data input chiplet 210, a central chiplet 220 with a mailbox 230, one or more high bandwidth (HBM) chiplets 235, 255, one or more general computing chiplets 245, a chiplet 250 for accelerating machine learning and a chiplet 240 for autonomous driving.

[0041] The in Fig. The example SIP 200 shown may include additional components, and the components of the System-in-Package 200 may be arranged in various alternative configurations that differ from the example shown. Therefore, the System-in-Package 200 consists of Fig. 2 is described here as an example arrangement for illustration purposes and is not intended to limit the scope of the present disclosure in any way. In certain embodiments, the arrangements described in Fig. The hardware components and arrangements shown in the 2 are included in a specific hardware topology for optimizing computational tasks, as described in the present disclosure.

[0042] With reference to Fig. 2. A sensor data input chiplet 210 of the SIP 200 can receive sensor data from various vehicle sensors 205 of the vehicle. These vehicle sensors 205 can include any combination of image sensors (e.g., single cameras, binocular cameras, fisheye cameras, etc.), LiDAR sensors, radar sensors, ultrasonic sensors, proximity sensors, and the like. The sensor data input chiplet 210 can automatically transfer the received sensor data to a cache memory 231 of the central chiplet 220 upon receipt. The sensor data input chiplet 210 can also include an image signal processor (ISP) responsible for acquiring, processing, and enhancing images captured by the various vehicle sensors 205. The ISP takes in the raw image data and performs a series of complex image processing operations, such as…Color, contrast, and brightness correction, noise reduction, and image enhancement are performed to create a higher-quality image ready for further processing or analysis by the other chiplets of the SIP 200. The ISP can also include features such as autofocus, image stabilization, and advanced scene recognition to further improve the quality of the captured images. The ISP can then store the higher-quality images in the 231 cache memory.

[0043] In some aspects, the sensor data input chiplet 210 publishes identifying information for each element of the sensor data (e.g., images, point cloud maps, etc.) to a mailbox 230 of a central chiplet 220, which serves as a central mailbox for synchronizing executable files for the various chiplets. The identifying information can include detailed information such as an address in the cache memory 231 where the data is stored, the type of sensor data, which sensor acquired the data, and a timestamp indicating when the data was acquired.

[0044] To communicate with the central chiplet 220, the sensor data input chiplet 210 transmits data via a connection 211a. Connections 211a-f each represent die-to-die (D2D) interfaces between the chiplets of the SIP 200. In some aspects, the connections include a high-bandwidth data path used for general-purpose data ( ) to the cache memory 231, and a high-reliability data path for transmitting functional safety and scheduler information to the mailbox 230. As provided herein, the high-reliability data paths, which facilitate functional safety (FuSa) and condition monitoring communication, include a high level of safety (e.g., ASIL-D) as specified in Fig. 2 is represented by S4 212 of the sensor data input chiplet 210, S4 222 of the central chiplet 222, S4 network-on-chip (NOC) 223 of the central chiplet 220, S4 242 of the autonomous driving chiplet 240, S4 247 of the general computing chiplet(s) 245 and S4 252 of the ML accelerator chiplet 250.

[0045] Depending on bandwidth requirements, a connection can include more than one die-to-die interface. For example, connection 211a can include two interfaces to provide higher-bandwidth communication between the sensor data input chiplet 210 and the central chiplet 220. In one embodiment, connections 211b and f implement a memory controller interface, and connections 211a and ce implement the UCle (Universal Chiplet Interconnect Express) standard and communicate in an indirect mode so that each chiplet can access the remote memory as if it were local memory. This is achieved through the use of a dedicated Network on Chip (NoC) Network Interface Unit (NIU), which prevents interference between the network-connected devices and provides hardware support for Remote Direct Memory Access (RDMA) operations.In indirect UCle mode, the host processor sends requests to the NIU, which then accesses the remote storage and returns the data to the host processor. This approach enables efficient and low-latency access to remote storage, which is particularly advantageous in distributed computing systems and data-intensive applications. Furthermore, indirect UCle mode offers a high degree of flexibility, as it can be used with a wide variety of network topologies and protocols.

[0046] In various examples, the SIP 200 can contain additional chiplets that can store, modify, or otherwise process the sensor data cached by the sensor data input chiplet 210. The SIP 200 can contain an autonomous driving chiplet 240 that can perform the perception, sensor fusion, trajectory prediction, and / or other algorithms for autonomous driving of the autonomous vehicle. The autonomous driving chiplet 240 can be connected to a dedicated HBM RAM chiplet 235, to which the autonomous driving chiplet 240 can publish all status information, variables, statistical information about the system, and / or processed sensor data as processed by the autonomous driving chiplet 240.As provided herein, the autonomous driving chiplet 240 can therefore implement sensor fusion and facilitate the verification of inference-based commands issued by the machine learning and / or artificial intelligence aspects of the SIP 200.

[0047] In various examples, the SIP 200 can further include an ML Accelerator Chiplet 240, which is specialized for accelerating AI workloads, such as image inference or other sensor inference using machine learning, to achieve high performance and low power consumption for these workloads. The ML Accelerator Chiplet 240 can include an engine for efficiently processing graph-based data structures commonly used in AI workloads and a highly parallel processor that enables efficient processing of large datasets. The ML Accelerator Chiplet 240 can also include dedicated hardware accelerators for common AI operations such as matrix multiplication and convolution, as well as a memory hierarchy that optimizes memory access for AI workloads with often complex memory access patterns.

[0048] The general computing chiplets 245 can provide general computing power for the system-on-chip 200. For example, the general computing chiplets 245 can include powerful central processing units and / or graphics processing units that support the computing tasks of the central chiplet 220, the autonomous driving chiplet 240, and / or the machine learning accelerator chiplet 250.

[0049] In various implementations, the mailbox 230 can store programs and instructions for executing autonomous driving tasks. The mailbox 230 of the central chiplet 220 can also contain a reservation table that provides the various chiplets with the information they need to perform their individual tasks (e.g., sensor data elements and their storage locations). The central chiplet 220 also includes the large cache memory 231, which provides validation and flush operations for stored data with support.

[0050] Cache errors and displacements from the cache memory 231 are sent by a high-bandwidth RAM chiplet 255 (HBM), which may contain application-shared memory 257 connected to the central chiplet 220. The HBM RAM chiplet 255 can contain status information, variables, statistical information, and / or sensor data for all other chiplets and can be accessed by multiple chiplets of the SIP 200. In certain examples, the information stored in the HBM RAM chiplet 255 can be retained for a predetermined period (e.g., ten seconds) before the data is cleared or otherwise erased. For example, if a fault occurs in the autonomous vehicle, the information stored in the HBM RAM chiplet 255 can contain all the information necessary to diagnose and correct the fault.The cache memory 231 keeps current data available with low latency and lower power consumption compared to accessing data from the HBM RAM chiplet 255.

[0051] As described herein, the mailbox 230 can include a mailbox architecture in which a reflex program, comprising a set of instructions, is used to execute workloads through the central chiplet 220, general computing chiplets 245, and / or the autonomous driving chiplet 240. In certain examples, the central chiplet 220 can additionally use a functional safety (FS) program utilizing the high-reliability network (e.g., represented by S4 212, S4 242, S4 247, S4 252, S4 222, and S4-NOC 223) that compares and verifies the output of the respective pipelines to ensure the consistency of the machine learning (ML) inference operations.

[0052] In various implementations, the machine learning model can be executed using the central chiplet 220, general computing chiplets 245, and / or an accelerator chiplet 250, while the particulate filter can be implemented on the autonomous drive chiplet 240. This applies to the Fig. 1A and Fig. The verification module 130, 180 described in Section 1B can be implemented in the central chiplet 220, which can receive the machine learning outputs within the SIP 200 as well as the sensor fusion performed by the autonomous driving chiplet 240. As described herein, the verification module 130, 180 can be implemented as a verification program in the central chiplet 220, which determines whether a conflict exists between (i) the machine learning output of the ML accelerator chiplet 250 and / or general computing chiplet 245 and (ii) the sensor fusion output of the autonomous driving chiplet 240, as described in the present disclosure.

[0053] While that in relation to Fig. 2 described SIP 200 which in relation to Fig. 1A and Fig. Since the verification modules 130 and 180 shown and described in Section 1B can be implemented, it is conceivable that these verification modules can be implemented on any computer system that performs general computing, machine learning, and / or artificial intelligence on any data source. Thus, the methods described in this disclosure can be executed on front-end computing devices (e.g., personal computers, vehicle computer systems, etc.) or back-end computing devices such as servers, data centers, data clusters, and the like. METHODOLOGY

[0054] Fig. 3A is a flowchart that describes a procedure for verifying command outputs according to the examples described here. Fig. 3B is a flowchart that describes an example procedure for verifying the outputs of a machine learning model in a vehicle implementation, as illustrated in the examples presented here. The following descriptions of the Fig. 3A and Fig. 3B can refer to reference symbols that represent various characteristics as they relate to the Fig. 1A, Fig. 1B and / or 2 are shown and described. Furthermore, those related to the Fig. 3A and Fig. The procedures described in 3B are executed by an example computer system 100, 155, as in relation to the Fig. 1A and Fig. 1B shows and describes a System-in-Package (SIP) 200, as in relation to Fig. 2 shown and described, and / or any computer, server, or collection of servers implementing general computing functions, machine learning, and / or artificial intelligence (e.g., as in Fig. 4 computer systems shown and described below (400).

[0055] With reference to Fig. 3A A computer system 100 may include a subsystem that implements an instruction generation module 110 (e.g., a programmed module with unreliable instruction outputs) or one or more machine learning models. The computer system 100 may further include a subsystem that implements a sensor fusion module 120. In block 300, the computer system 100 may receive data from one or more sensor data sources 145. In block 305, the computer system 100 may process the sensor data using an instruction generation module 110. In block 310, the instruction generation module 110 may then generate a set of instructions. As provided herein, the set of instructions may include instructions for implementing a motion plan for a vehicle, robot, drone, watercraft, or other machine.It is intended that the command generation module 110 can execute one or more machine learning models that can be applied to all or part of the received sensor data, and thus inference-based outputs can be generated by the command generation module based on the machine learning models applied to all or part of the received data.

[0056] In block 315, computer system 100 can also execute a sensor fusion module 120 on the received sensor data to generate a sensor fusion output (e.g., a known safe output). As provided herein, the sensor fusion output has verifiable reliability and can include a projection into the future of an entity controlled by the instruction generation module 110 and all entities outside the controlled entity. In block 320, computer system 100 can perform a verification of the instructions issued by the instruction generation module 110 using the sensor fusion output of sensor fusion module 120. In decision block 325, computer system 100 can then determine whether there is a conflict between the instruction outputs and the sensor fusion output.If this is the case, in block 330, a verification module 130 of the computer system 100 can perform one or more remedial actions as described in this disclosure. In certain examples, the computer system 100 can loop and continue processing the sensor data using the instruction generation module in block 305, and then iterate through blocks 310, 320, and 325 again to determine whether a conflict exists. In certain implementations, if a conflict persists, after performing the remedial action in block 330, the computer system 100 can enter a safe mode or request assistance in block 340. Conversely, if no conflict exists, the verification module 130 of the computer system 100 can output the correctly verified instruction outputs received from the instruction generation module 110 in block 335.

[0057] Fig. 3B is a flowchart that describes an example procedure for verifying the outputs of a machine learning model in a vehicle implementation, as illustrated in the examples presented here. For example, a vehicle computer system 155 might consist of Fig. 1B and / or a SIP 200 from Fig. 2 those relating to Fig. Perform the steps described in section 3B. Referring to Fig. In block 350, a vehicle computer system 155 can receive sensor data from a sensor suite 160 of the vehicle 150. In block 355, the vehicle computer system 155 can execute one or more machine learning models 167 to perform inference operations on the sensor data. In block 360, the machine learning model(s) 167 can then generate inference-based control commands based on the inference operations.

[0058] In connection with this, the vehicle computer system 155 can execute a sensor fusion module 170 (e.g., a particulate filter 172) in block 365, which performs sensor fusion of the sensor data to generate a sensor-fused output of a static or dynamic environment outside the vehicle 150. In various examples, the vehicle computer system 155 can perform a verification of the inference-based control commands using the sensor fusion output of the sensor fusion module 170 in block 370. In decision block 375, the vehicle computer system 155 can determine whether there is a conflict between the inference-based control commands and the sensor fusion output. If so, the vehicle computer system 155 can perform a remedial action in block 380, as described in the present disclosure.In further examples, the computer system 100 can repeat the loop and continue processing the sensor data using the machine learning model in block 355, and again iterate through blocks 360, 370 and 375 to determine if there is a conflict.

[0059] As described herein, the corrective action may include ignoring a motion plan in accordance with the inference-based control commands, informing the command generation module, and / or another corrective action, such as slowing the vehicle, transferring control to a driver or remote operator, maintaining a road state, and / or waiting for the next time step to achieve a state of agreement between the sensor fusion module 170 (e.g., the particulate filter 172) and the machine learning model 167. Several other examples of corrective actions are described herein.For example, if a conflict persists over one or more iterations, the remediation module 185 can perform remediation actions, such as maintaining a lane-following state and canceling a prepared action by the neural network 165. In further examples, in block 390, the remediation module 185 can cause the vehicle to stop at a safe location and maintain a standstill state, park the vehicle, transmit a conflict message (e.g., to the command generation module or the backend computer system or to a remote operator), and / or exit autonomous mode and transfer control of the vehicle to a human driver or a remote operator.

[0060] In various scenarios, sequential time steps are intended to resolve the conflict themselves. If no conflict exists, the vehicle computer system 155 in block 385 can cause the verified inference-based control commands to be executed at the various control mechanisms 195 of the vehicle 150. For example, a verification module 180 can forward the verified inference-based control commands to a vehicle control system 190 of the vehicle 150 to execute the motion plan. EXAMPLE OF A DIAGRAM OF THE HARDWARE OF A COMPUTER SYSTEM

[0061] Fig. Figure 4 is a block diagram illustrating a Computer System 400 on which the examples described here can be implemented. A Computer System 400 can be implemented, for example, on a server or a combination of servers. For instance, the Computer System 400 can be implemented as part of a network service, as shown in the Fig. 1A to 3B described. In connection with the Fig. 1A and Fig. 1B The computer system 100, 155 can be implemented using a computer system 400, as described in Fig. 4 is described. The computer systems 100, 155 can also be implemented using a combination of several computer systems 400, as described in connection with Fig. 4 are described.

[0062] In one embodiment, the computer system 400 comprises processing resources 410, main memory 420, read-only memory (ROM) 430, a storage device 440, and a communication interface 450. The computer system 400 includes at least one processor 410 for processing information stored in main memory 420, for example, in random-access memory (RAM) or other dynamic storage device, for storing information and instructions that can be executed by the processor 410. The main memory 420 can also be used to store temporary variables or other intermediate information during the execution of instructions to be carried out by the processor 410. The computer system 400 can also include the ROM 430 or other static storage device for storing static information and instructions for the processor 410.A storage device 440, such as a hard disk drive, an optical disk, or a solid-state drive (SSD), is intended for storing information and commands.

[0063] The communication interface 450 enables the computer system 400 to communicate with one or more networks 480 (e.g., a cellular network) via the network connection (wireless or wired). Through the network connection, the computer system 400 can communicate with one or more computer units, one or more servers, and / or one or more autonomous vehicles. In various examples, the main memory 420 can store one or more machine learning models 422 (or instruction generation instructions that do not involve machine learning but are inherently unreliable) that can be executed by the processors 410 to perform machine learning inference on sensor data received via the network 480 (e.g., a UCL connection). Additionally, the main memory 420 can store sensor fusion instructions 424 that are executed by the processors 410 to perform machine learning inferences based on the received data (e.g., a UCL connection).B. using a particle filter) to generate a sensor fusion output. In further examples, the main memory 420 can store verification instructions 426 that can compare the outputs of the machine learning model(s) 422 and the sensor fusion to verify the results of the machine learning model(s) 422, as described in the present disclosure.

[0064] The examples described herein relate to the use of the Computer System 400 to implement the techniques described herein. According to one example, these techniques are executed by the Computer System 400 in response to the Processor 410 executing one or more sequences of one or more instructions contained in the main memory 420. Such instructions may be read into the main memory 420 from another machine-readable medium, such as the memory device 440. The execution of the instruction sequences contained in the main memory 420 causes the Processor 410 to perform the processes and steps described herein. In alternative implementations, hardwired circuitry may be used instead of, or in combination with, software instructions to implement the examples described herein.Therefore, the examples described are not limited to a specific combination of hardware circuits and software.

[0065] It is intended that the examples described herein may be extended to individual elements and concepts described herein independently of other concepts, ideas, or systems, and that the examples may include combinations of elements mentioned anywhere in this application. Although the examples herein are described in detail with reference to the accompanying drawings, it is understood that the concepts are not limited to these specific examples. Therefore, many modifications and variations will be obvious to those skilled in the art. Accordingly, the scope of the concepts is to be defined by the following claims and their equivalents.Furthermore, it is provided that a feature described individually or as part of an example can be combined with other individually described features or parts of other examples, even if the other features and examples do not mention the specific feature. The absence of a description of combinations should therefore not preclude the possibility of claiming rights to such combinations.

Claims

[1] A computer system for a vehicle, comprising: one or more processors; and a memory that stores instructions which, when executed by the one or more processors, cause the computer system to: Receiving sensor data from a sensor unit of the vehicle; executes one or more machine learning models to draw conclusions from the sensor data and generate control commands based on these conclusions to autonomously operate a range of the vehicle's controls, a sensor fusion module executes the sensor data to generate a sensor fusion output of an external environment of the vehicle; Determine if there is a conflict between the inference-based control commands and the sensor fusion output of the sensor fusion module; If a conflict exists between the inference-based control commands and the sensor fusion output of the sensor fusion module, cause the vehicle to perform a corrective action; and If there is no conflict between the inference-based control commands and the sensor fusion output of the sensor fusion module, execute a motion plan according to the inference-based control commands. [2] Computer system according to claim 1, wherein the remedy comprises exiting an autonomous mode and transferring control of the vehicle to a human operator. [3] Computer system according to claim 1, wherein the execution of the motion plan comprises transmitting the inference-based control commands to a vehicle control system of the vehicle in order to operate the vehicle controls autonomously according to the motion plan. [4] Computer system according to claim 1, wherein the one or more machine learning models are executed in a neural network consisting of one or more chiplets of a system-in-package of the computer system. [5] Computer system according to claim 1, wherein the sensor fusion module performs a particle filter on the sensor data to generate the sensor fusion output. [6] Autonomous vehicle, encompassing: a sensor suite; a set of vehicle control systems; a vehicle control system for autonomously operating the set of vehicle controls; and a system-in-package comprising several chiplets that perform the following operations: Receiving sensor data from the sensor suite; Running one or more machine learning models to draw conclusions from the sensor data and to generate control commands based on these conclusions for the autonomous operation of the vehicle controls; Executing a sensor fusion module on the sensor data to generate a sensor fusion output of an external environment of the autonomous vehicle; Determine if there is a conflict between the inference-based control commands and the sensor fusion output of the sensor fusion module; If a conflict exists between the inference-based control commands and the sensor fusion output of the sensor fusion module, cause the vehicle to perform a corrective action; and If there is no conflict between the inference-based control commands and the sensor fusion output of the sensor fusion module, execute a motion plan that corresponds to the inference-based control commands. [7] Autonomous vehicle according to claim 6, wherein the remedy comprises stopping the vehicle in a safe place. [8] Autonomous vehicle according to claim 6, wherein the remedy comprises exiting an autonomous mode and transferring control of the vehicle to a human operator. [9] Autonomous vehicle according to claim 6, wherein the execution of the motion plan comprises transmitting the inference-based control commands to a vehicle control system of the vehicle in order to autonomously operate the vehicle controls in accordance with the motion plan. [10] Autonomous vehicle according to claim 6, wherein the sensor fusion module implements a particle filter to generate the sensor fusion output.

Images