Third control system for steering, braking and motion control systems in autonomous vehicles

Abstract

The invention relates to a third control system for a steering, braking, and motion control system in an autonomous vehicle. A number of illustrative variations can include methods or products for monitoring and responding to component, system, or module failures in an autonomous driving system.

Description

TECHNICAL FIELD

[0001] The field of endeavor to which this disclosure generally relates includes autonomous driving systems. BACKGROUND

[0002] Vehicles typically include a number of systems or modules for propulsion, including but not limited to systems or modules for vehicle acceleration, vehicle deceleration, and vehicle steering. SUMMARY

[0003] A number of illustrative variations can include methods or products for monitoring and responding to component, system, or module failures in autonomous driving systems.

[0004] Other illustrative variations within the scope of the present disclosure will become apparent from the detailed description provided hereinafter. It should be understood that the detailed description and specific examples, while indicating certain variations of the disclosure, are intended for purposes of illustration only and are not intended to limit the scope of the disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0005] Selected examples of variations within the scope of the present disclosure will become apparent from the detailed description and drawings in which:

[0006] Figure 1 is an illustration of an autonomous vehicle control system according to a number of variations.

[0007] Figure 2 is an illustration of a primary vehicle control system and selected functions thereof according to a number of variations.

[0008] Figure 3 is an illustration of a redundant vehicle control system and selected functions thereof according to a number of variations.

[0009] Figure 4 is an illustration of a third vehicle control system and selected functions thereof according to a number of variations.

[0010] Figure 5A is a first section of three sections of a schematic illustration of a third control system and additional components and systems that cooperate therewith.

[0011] Figure 5B is a second section of three sections of a schematic illustration of a third control system and additional components and systems that cooperate therewith.

[0012] Figure 5C is a third section of three sections of a schematic illustration of a third control system and additional components and systems that cooperate therewith.

[0013] Figure 6A is a first section of three sections of a schematic illustration of a motion control system and additional components and systems that cooperate therewith, showing primary and fallback paths.

[0014] Figure 6B is a second section of the three sections of the schematic illustration of the motion control system and additional components and systems that cooperate therewith, including an autonomous driving coordination module.

[0015] Figure 6C is a third section of the three sections of the schematic illustration of the motion control system and additional components and systems that cooperate therewith, including a powertrain engine control module and a third control system. DETAILED DESCRIPTION

[0016] The following description of variations is merely illustrative in nature and is in no way intended to limit the scope of the application, its application, or uses.

[0017] As used herein, "autonomous vehicle" means a fully autonomous vehicle or a semi-autonomous vehicle.

[0018] As used herein, "or" is to be interpreted as the inclusive "or" rather than the exclusive "or" unless expressly indicated otherwise. As a non-limiting example, if a sandwich is described herein as having "peanut butter or jelly," the "or" should be interpreted as the inclusive "or" such that the sandwich is construed as having been disclosed as including a peanut butter sandwich, a jelly sandwich, and a peanut butter and jelly sandwich.

[0019] As used herein, "road wheels," even when described with a descriptive adjective such as but not limited to in the phrase "steerable road wheels," "steerable wheels," or "driven road wheels," can refer to a traditional wheel and tire arrangement, but can also refer to any modification to a traditional wheel and tire arrangement such as but not limited to a wheel-less maglev tire, a ball tire, or any other known automotive motion appliance such as but not limited to a tread, a caster wheel, a roller, a propeller or gas propeller, a liquid propeller, or an ionically driven propeller.

[0020] As used herein, "road," even when described with a descriptive adjective, can refer to a traditional driving surface such as but not limited to a concrete or asphalt road surface, but can also refer to any driving surface or medium that a vehicle for goods or passengers can travel along or through such as but not limited to water, ice, snow, dirt, mud, air, or other gases, or general space.

[0021] As used herein, "path" generally refers to a determined course of travel for a vehicle. Additionally, as used herein, "trajectory" generally refers to a dynamic path of a vehicle that can be changed by a planner module based on at least one aspect of the vehicle's travel environment, such as but not limited to road conditions. Additionally, the vehicle's trajectory can also be based on at least one determined vehicle component, system, or module capability. Changes in the vehicle's trajectory can include the manner in which the vehicle travels with respect to vehicle travel characteristics, such as but not limited to the distance the vehicle follows any other vehicle while traveling, the speed of the vehicle, the braking strategy or driving style of the vehicle, the acceleration rate of the vehicle under any given situation, or the passing rate of the vehicle, based on at least one of the vehicle's travel environment or at least one determined vehicle component, system, or module capability.

[0022] As used herein, "minimum risk maneuver" generally refers to the safest maneuver that achieves minimum risk conditions determined by the autonomous driving system based on environmental conditions, traffic conditions, faults in the vehicle's systems, and driver availability, and can be summarized as follows:

[0023] 1. Stop immediately on the lane;

[0024] 2. Pull over to the side of the road;

[0025] 3. Continue driving to the next safest location to stop.

[0026] Figure 1 is an illustration of an autonomous vehicle control system 10 according to a number of variations, which can include a primary control system 12, a redundant control system 14, and a tertiary control system. Figure 2 is an illustration of a primary vehicle control system and selected functions thereof according to a number of variations. Figure 3 is an illustration of a redundant vehicle control system and selected functions thereof according to a number of variations. Figure 4 is an illustration of a tertiary vehicle control system and selected functions thereof according to a number of variations. Figure 5A is a first section of three sections of a schematic illustration of a tertiary control system and additional components and systems that cooperate therewith. Figure 5B is a second section of three sections of a schematic illustration of a tertiary control system and additional components and systems that cooperate therewith. Figure 5C is a third section of three sections of a schematic illustration of a tertiary control system and additional components and systems that cooperate therewith.

[0027] In a number of illustrative variations, a number of vehicle components can be capable of self-diagnosis, where they are capable of reporting their own faults or performance capabilities to at least one control system or module, such as but not limited to a primary control system or module, a redundant control system or module, or a tertiary control system or module. In some such cases, component faults can be determined by the control system or module associating component capabilities with functional safety requirements. Such functional safety requirements can be arbitrarily set or can be set based on existing standards such as laws or industry standards and can be editable.

[0028] In a number of illustrative variations, a vehicle for cargo or passengers can be powered by automotive power from a motor that converts stored energy into driving force for the vehicle, such as but not limited to an internal combustion engine, a battery-powered engine, a fuel cell-powered engine, or any other known motor that provides automotive driving power for a passenger or cargo vehicle. The driving force generated by the motor or conversion of stored energy into the motor can be transferred from the motor to a driving medium along which the vehicle will travel, such as but not limited to a piece of land, a road, a waterway, an airway, or any other medium along which a known vehicle will travel through space. The transfer of driving force from the motor to the driving medium can occur via any means of driven automotive motion, such as but not limited to a wheel, a tread, a caster, a roller, a propeller, a gas propeller, a liquid propeller, or an ionically driven propeller, or any other known means of driven automotive motion.

[0029] In a number of illustrative variations, a vehicle can have a steering system that allows a driver to change the direction of the vehicle or to deviate it from the path it can be traveling on. The steering system of the vehicle can also be autonomous, where the vehicle can steer itself towards a predetermined location that has been communicated to it without assistance or intervention from a driver. The vehicle can also include an obstacle avoidance system that allows the vehicle to sense objects on its path and avoid them.

[0030] In a number of illustrative variations, a vehicle can be equipped with a steering interface that can include a joystick, a trackball, a slider, a throttle, a button, a toggle, a lever, a touchscreen, a mouse, a handwheel, a rudder, a pedal, a keyboard, or any other known user input means.

[0031] In a number of illustrative variations, an autonomous driving system can be programmed with or in communication with any number of logic modules arranged to autonomously address a number of control domains within the range of vehicle steering and travel, including but not limited to vehicle acceleration, vehicle braking, autonomous path planning, performance capability monitoring and management, and an autonomous steering system for at least lateral control of the vehicle. The logic of the modules of the autonomous steering system can account for driver assistance or intervention while the vehicle is being steered or driven.

[0032] In various illustrative variations, an autonomous vehicle can be equipped with any number of sensors and monitoring systems for determining the health or degradation state of any number of vehicle systems, such as but not limited to a drive system, a brake system, an electrical system, an exhaust system, a fuel system, a suspension system, and any other vehicle system, or individual vehicle components, such as but not limited to an actuator, a gear, a pump, an injector, a plug, a cylinder, a wheel, a tire, or a steering interface that a driver can use to steer the vehicle.

[0033] In various illustrative variations, an autonomous vehicle can include a motion control system or module that can collect or receive data about vehicle motion from any vehicle system, such as but not limited to a brake system, a steering system, an engine control system, a fuel system, or a power generation and delivery system. In some such cases, a motion control system or module can be in direct or indirect communication with a path planner module. In some cases, a piece of electronic hardware, such as but not limited to a processor, a random access memory, a processor cache, a memory storage device such as but not limited to a hard disk drive or a solid state drive, can include a motion control system or module. A software element, such as but not limited to a routine, a thread, an operating system, a data structure, or a class, can also include a motion control system or module. In some cases, a motion control system or module is a system that controls the motion of an autonomous vehicle by acting on dynamically changing data, such as but not limited to wheel speed data, road condition data, brake system or module data, drive system or module data, traffic data, lane data, fuel system data, motion control system or module data, weather data, passenger data such as but not limited to biometric data or visual or gaze data. A motion control system or module can act on any data available to it according to any number of algorithms related to reasonable motion of a vehicle. A motion control system or module can act on data available to it by affecting the motion of a vehicle via any means for doing so, such as but not limited to manipulating any drive system or module, a steering system or module, a brake system or module.

[0034] In several illustrative variations, an autonomous vehicle may include a braking system or module. In some cases, the braking system or module may be able to induce vehicle braking by manipulating at least one actuator, brake caliper, magnet, stator, transmission, or any other known means of decelerating or braking a vehicle. The braking system or module may communicate with any other vehicle system or module, such as, but not limited to, a drive system or module, a steering system or module, or a motion control system or module. The braking system or module may collect or receive data related to vehicle braking or deceleration from any number of vehicle systems or modules, cameras, or sensors (including but not limited to road cameras, cabin cameras, wheel cameras, wheel speed sensors, tire pressure sensors, thermal sensors, path planner systems, brake actuator sensors, brake component degradation detection systems or modules, steering systems or modules, or motion control systems or modules), including but not limited to road condition data, traffic data, GPS data, steering system or module data, tire or wheel condition data, vehicle speed data, vehicle acceleration data, wheel speed data, wheel orientation data, tire pressure data, tire friction coefficient data, and driver biological or visual or gaze data.

[0035] In several illustrative variations, an autonomous vehicle may include a drive system or module. In some cases, the drive system or module may be able to direct vehicle power to at least one vehicle wheel via at least one of various engines, motors, drive shafts, transmissions, or any other means known for driving at least one vehicle wheel forward. The drive system or module may communicate with any other vehicle system or module, such as, but not limited to, a braking system or module, a steering system or module, or a motion control system or module. The drive system or module may collect or receive data relating to vehicle acceleration or vehicle motion from any number of vehicle systems, cameras, or sensors (including, but not limited to, road cameras, cabin cameras, wheel cameras, wheel speed sensors, tire pressure sensors, drive system sensors, engine sensors, braking system sensors, or tire sensors), including but not limited to road condition data, tire or wheel condition data, vehicle speed data, traffic data, GPS data, vehicle acceleration data, wheel speed data, wheel orientation data, braking system data, drive system performance data, fuel system data, engine performance data, tire pressure data, tire friction coefficient data, and driver biological or visual or gaze data.

[0036] In several illustrative variations, an autonomous vehicle may include a steering system or module. In some cases, the steering system or module may be able to translate manipulation of a steering interface (such as, but not limited to, a handwheel) into movement of steering instruments (such as, but not limited to, steerable wheels). The drive system or module may communicate with any other vehicle system or module, such as, but not limited to, a braking system or module, a drive system or module, or a motion control system or module. The steering system or module may collect or receive data related to the vehicle's cornering ability or driving surface conditions from any number of vehicle systems, cameras, or sensors (including, but not limited to, road cameras, cabin cameras, wheel cameras, wheel speed sensors, tire pressure sensors, drivetrain sensors, engine sensors, braking system sensors, or tire sensors), including but not limited to road condition data, tire or wheel condition data, vehicle speed data, traffic data, GPS data, vehicle acceleration data, wheel speed data, wheel orientation data, steering interface position data, data on any forces applied to at least one steering interface, braking system data, drivetrain performance data, fuel system data, engine performance data, tire pressure data, tire friction coefficient data, and driver biological or visual or gaze data.

[0037] In several illustrative variations, the autonomous vehicle is self-driving, where it does not require a human driver to steer itself to a predetermined destination. In such cases, no human driver can seize control of the system in the event of a failure in the steering, braking, or motion control system. In some such cases, redundant or backup systems or modules can be used to ensure that the autonomous vehicle is not steering, driving, or braking in an uncontrolled manner by causing the autonomous vehicle to perform minimum-risk maneuvers to ensure that the passengers or cargo of the autonomous vehicle are brought to a relatively safe location on or near the road. In many cases, bringing the passengers or cargo of the autonomous vehicle to a relatively safe location on or near the road requires performing at least one of minimum-risk steering maneuvers or minimum-risk braking maneuvers to bring the vehicle and its contents or passengers to a position closer to the side of the road to a stop. In some such cases, this can result in the inability to move passengers or cargo, and may lead to timing or scheduling problems for logistics or taxi services. This inability to move may present additional tasks for another autonomous entity or human to retrieve or rescue the immobile cargo or passengers, and in some cases, may also present additional tasks for on-site repairs of the immobile autonomous vehicle. In some cases, an autonomous vehicle may include a backup steering, braking, or motion control system or module that allows the autonomous vehicle to continue its journey in a degraded state, rather than forcing the vehicle to perform minimum-risk maneuvers to ensure its safe immobility. Such a backup steering, braking, or motion control system or module is referred to herein as a redundant control system. In the event of a failure of the redundant steering, braking, or motion control system or module, the autonomous vehicle may utilize at least one of a third steering, braking, or motion control system or module to assist in performing minimum-risk maneuvers to bring the autonomous vehicle to a safe position and state. In some such cases, after the third control system or module induces the autonomous vehicle to perform minimum-risk maneuvers, the third control system or module may induce the autonomous vehicle to apply parking brakes so that the autonomous vehicle does not roll away.

[0038] In several illustrative variations, an autonomous vehicle may include a third control module or system for any of the steering, braking, or motion control systems or modules, to overcome or recover from a failure of at least one of the steering, braking, or motion control systems or modules. In this way, the autonomous vehicle can avoid the need to end its journey with minimal risk and thus trap its passengers or cargo. In some such cases, the third control system or module may consist of hardware or software different from the main control system or redundant control system. Where a piece of physical hardware (such as, but not limited to, a processor) includes the main control system or redundant control system or module, a single piece of physical hardware (such as, but not limited to, a processor) may include the third control system or module. That is, a single piece of physical hardware may be functionally independent of the hardware including the main control system or redundant control system or module, such that a failure of the hardware including the main control system or redundant control system or module does not necessarily constitute a failure of the single piece of hardware including the third control system or module. Where a piece of software (such as, but not limited to, routines, operating systems, or threads) includes the main control system or redundant control system or module, a single piece of software (such as, but not limited to, routines, operating systems, or threads) may include the third control system or module. In some such cases, a piece of software, including a third control system or module, can be separated from the main control system or redundant control system or module, ensuring that the main control system or redundant control system or module cannot affect the critical operating variables of the third control system or module. That is, software separation can be performed using any number of known methods to ensure that if the memory or operating variables of the main control system or redundant control system or module are corrupted or defective, the defective control system or module cannot negatively affect a piece of software including the third control system or module. Such software and hardware separation or differentiation can also be applied to any redundant control system or module.

[0039] In several variations, the third control system or module may have operating modes, which may include any one or more of the following: 1. Enabled mode – actively controlling braking and steering – wherein the backup controller is enabled when a complete (two-point) failure exists in the redundant steering or redundant braking system. 2. Monitoring mode – not controlling steering or braking – the backup controller is in monitoring mode when there is no failure in the redundant steering or redundant braking system. However, the backup controller will send a health status signal to the ADS every 'x' seconds. 3. Standby mode – not controlling steering or braking – the backup controller is in standby mode when a single point of failure exists in the redundant steering or redundant braking system. However, the backup controller will send a health status signal to the ADS every 'x' milliseconds. 4. Disabled mode – backup controller failure – the backup controller is in disabled mode when there is a failure in the backup controller itself. The ADS will periodically monitor the health status of the backup controller. In several illustrative variations, the third control system or module monitors the health information status regarding at least one of the steering, braking, and motion control systems or modules. In such illustrative variations, the monitored health information may indicate one or more fault points or areas in the monitored system or module. In some cases, when at least one fault occurs but the performance of the faulty control system or module does not significantly degrade, the third control system or module switches to monitoring mode to monitor vehicle performance and monitor relevant control systems for further potential related faults. In some cases, when at least one fault occurs and the performance of the faulty control system or module significantly degrades, the third control system or module switches to enabling mode. This requires the third control system or module to intervene or take over the vehicle system controlled by the faulty control system or module, and in some cases, control redundant steering actuators or brake actuators.

[0040] In several illustrative variations, any vehicle component, system, or module may have at least one identifiable fault condition. As used herein, a “fault condition” can refer to any vehicle component, system, or module that, as determined by a third control system or module, fails to function satisfactorily. In some such cases, the determination of a functional failure may be based on relevant safety standards or engineering performance objectives, such as, but not limited to, top-level requirements, first-level requirements, second-level requirements, etc. Additionally, “initial integrity” can refer to the health or degradation state of any vehicle component, system, or module as measured at the time of its manufacture or installation, or it can refer to the health or degradation state of any vehicle component, system, or module as measured at the time of the vehicle’s first start-up. Generally speaking, the “initial integrity” of a vehicle component, system, or module can refer to the suitability of the component, system, or module for its intended use based on at least one of the measurements taken from a specific or “initial” point in time. The foregoing is not intended to limit the examples or definition of “initial integrity”—other milestones in the lifespan of a vehicle component, system, or module can also be used to establish a baseline state of degradation or health, thereby defining “initial integrity.”

[0041] In several illustrative variations, a determined fault state of any vehicle component, system, or module can be related to the overall performance of the vehicle or the performance of a specific vehicle component, system, or module, and is translated into at least one fault state determination. This at least one fault state determination can be monitored by a third control system or module to determine the appropriateness of using the third control system or module as the main control system or module for at least one vehicle system or module. Additionally, the third control system or module can monitor at least one fault state determination to determine the risk of inducing the vehicle to perform minimum-risk maneuvers to bring the vehicle to a safe stop.

[0042] In several illustrative variations, the vehicle may include multiple main steering actuators or main brake actuators and multiple redundant steering actuators or redundant brake actuators, wherein the redundant steering actuators or redundant brake actuators are configured to be operated by a third control system in the event of a failure in at least one of the main steering control system or module, a failure in at least one redundant steering control system or module, or a failure in at least one main steering actuator or main brake actuator.

[0043] In several illustrative variations, a vehicle system or component, or any combination thereof, can be operated via software or machine logic according to logical modules. In such cases, any number of modules can be combined together or divided into smaller modules.

[0044] In several illustrative variants, the autonomous vehicle may be equipped with a planner module. A planner module may refer to a module of software housed in electronically accessible memory located on the vehicle, or a module of software accessible via cloud services, or a module of software accessible via any other known means of accessibility; or it may refer to planner module software or a planner algorithm, or hardware used to execute the planner module software or algorithm. The planner module software or algorithm may be configured to execute on a dedicated processing hardware located on-board or remotely from the vehicle and to be transmitted to the vehicle.

[0045] In several illustrative variations, the planner module can plan the path and trajectory of an autonomous vehicle. The planner module can receive or calculate the planned destination by calculating or receiving destination coordinates, calculating or receiving absolute or relative position of the vehicle or its position within a potential destination network, and plan the vehicle's path based on known road or vehicle routes, previous routes taken by the vehicle, paths drawn by other vehicles on the network, or any combination of any known means of planning vehicle paths. In some such examples, the vehicle path and trajectory can be calculated or received by the autonomous planner module and modified by the planner module based at least on other data (such as, but not limited to, local terrain data, road closure data, or traffic data) received or collected by the vehicle or other vehicles in the network. As a non-limiting example, when a vehicle's planner module receives data from a connected vehicle network indicating that the vehicle has slipped on a wet road ahead and that an alternative path may not pose such a hazard, the vehicle can autonomously travel on the received, retrieved, or calculated autonomous vehicle path. In such a scenario, the vehicle's autonomous planner module can modify the vehicle's path by taking a detour that avoids roads where wet skidding is frequent. Similarly, in this illustrative variant, road conditions (such as, but not limited to, road surface friction coefficient, surface quality, and visibility conditions, such as, but not limited to, low visibility conditions caused by debris, dust, smoke, reflections, or weather conditions) can be collected, calculated, or received by the vehicle's planner module and can be used to determine whether and how to modify the planned vehicle path or trajectory. Additionally, sensors or modules monitoring the vehicle's systems or components can communicate the health conditions or status of the vehicle's systems, components, or modules to the planner module or any of the main control system or module, redundant control system or module, or third control system or module. In some cases, the autonomous vehicle may be equipped with at least one engine control unit (ECU), which can serve as the main control system or module and can communicate with the electronic power steering (EPS) system. In such a situation, any number of components (such as, but not limited to, sensors, transistors, switches, relays, amplifiers, or actuators) communicating with any number of main control systems or modules, redundant control systems or modules, or third control systems or modules may fail or shut down due to faults, such as, but not limited to, insufficient power faults in position sensors, gate drive faults in field-effect transistors (FETs), faults due to overheating in insulated-gate bipolar transistors (IGBTs), faults due to mechanical or electrical problems in switches or relays, faults in amplifiers due to insufficient power, or faults in actuators due to wear and breakage, or any other electrical, mechanical, or thermal problems with any similar or related components.In such cases, the relevant main control system or module, redundant control system or module, or third control system or module may enter a failure mode or fail due to the failure of a component with which it communicates, and this may be communicated to at least one of the main control system or module, redundant control system or module, or third control system or module, or via the vehicle capability module in a form determined by the vehicle capability module, through any system, module, or controller monitoring any such main control system or module, redundant control system or module, or third control system or module, such that the planner module may appropriately yield control to the redundant control system or module or third control system or module. As another non-limiting example, the EPS system itself may fail due to electrical or thermal problems with EPS circuit components, or due to high friction in mechanical components (such as, but not limited to, the column assist motor). In some such cases, a fault affecting vehicle steering may be transmitted via at least one vehicle capability module in the form of a fault signal or vehicle capability determination through any system where the fault occurred or in any control system or module of the monitoring system or module to the main control system or module, redundant control system or module, or third control system or module. In some such cases, any of the main control system or module, redundant control system or module, third control system or module, or its submodules or vehicle capability module may continuously or periodically poll the steering system to detect such faults or similar or related faults. When a relevant fault causing a modification of vehicle capability is presented to the main control system or module, the redundant control system or module or the third control system or module may, at least based on the fault, relinquish control of the vehicle system to at least one other controller in the group comprising the main control system or module, the redundant control system or module, and the third control system or module.

[0046] In several illustrative variations, the fault states and performance capabilities of autonomous vehicle components, systems, or modules can be determined, periodically, or continuously, depending on requirements. Fault states and performance capabilities can be based on vehicle speed or the health or degradation state of vehicle components, systems, or modules, as well as other factors such as road surface conditions and tire or wheel conditions. As a non-limiting example, factors like high speed will result in a lower curvature capability determination, while low speed may lead to a curvature capability estimate following a simple dynamic bicycle model. As another non-limiting example, a low road surface friction coefficient will result in certain performance capability determinations (such as, but not limited to, steering or braking capabilities) being lower on ice and higher on surfaces with a higher friction coefficient (such as dry concrete). Furthermore, fault state determinations can be based on performance capabilities and are therefore influenced by similar factors.

[0047] In several illustrative variations, the primary control system or module may autonomously relinquish control of the vehicle system to at least one other control system or module, or receive a request for relinquishment from at least one other control system or module, based on the health or degradation state of the vehicle system, components, or modules, or based on a determined or faulty state of at least one vehicle capability. Similarly, when controlling the vehicle system, a redundant control system or module, or a third control system, may autonomously relinquish control of the vehicle system to at least one other control system or module, or receive a request for relinquishment from at least one other control system or module.

[0048] In several illustrative variations, the vehicle may be equipped with a main control system or module that communicates with vehicle systems, modules, or components. The main control system or module may collect or receive data regarding the health or degradation status of at least one vehicle system, module, or component. The main control system or module may track such data to translate it into logic for the operation of the autonomous vehicle. The data or operational logic may be communicated to other vehicle components, systems, or modules, or may be accessed by other vehicle components, systems, or modules. In some cases, this operational logic may be replicated to modules, systems, or components that are functionally and physically separate from the main control system or module. These functionally or physically separate modules, systems, or components may herein be referred to as redundant control systems or modules and third control systems or modules.

[0049] In several illustrative variations, any number of vehicle systems or modules may generate warnings about such concessions or changes to the control system or module, which may be communicated to the vehicle’s human passengers, the central processing module or hub, the cloud, or any other place where data may be transmitted.

[0050] Multiple variations may include products incorporating an autonomous vehicle control system, comprising a first primary motion control system, a redundant motion control system, and a third motion control system; wherein at least one of the primary control system, the redundant control system, or the third control system may be programmed to directly or indirectly self-report its own health or degradation status to at least one other control system. In multiple variations, the primary control system, the redundant control system, and the third control system may all be programmed to sequentially manage control of at least one of the vehicle motion control system functions, vehicle braking system functions, or vehicle steering system functions. In multiple variations, the primary control system, the redundant control system, and the third control system may be programmed to sequentially manage control of at least one of the vehicle motion control system functions, vehicle braking system functions, or vehicle steering system functions based at least on self-reported health or degradation status from at least one of the other control systems. In several variations, the control system can be programmed to sequentially manage control of at least one of the vehicle motion control system functions, vehicle braking system functions, or vehicle steering system functions in the following sequence: First, the main control system controls at least one vehicle function; then, based on the self-reported health or degradation state of the main control system regarding the control capability of the main control system for at least one vehicle function, a redundant control system assumes control of the at least one vehicle function; then, based on the self-reported health or degradation state of the main control system related to the ability of the main control system to control at least one vehicle function, and also based on the self-reported health or degradation state of the redundant control system related to the ability of the redundant control system to control at least one vehicle function, a third control system assumes control of the at least one vehicle function. In several variations, the third control system takes over control of the at least one vehicle function only in response to both the main control system and the redundant control system self-reporting that they are in an unacceptably healthy or degradation state regarding control of at least one vehicle function.

[0051] Multiple variations may include a product comprising an autonomous vehicle control system, the autonomous vehicle control system comprising: a main control system; a redundant control system; and a third control system; wherein the main control system may be programmed to control at least one vehicle function via at least one main vehicle component adapted to perform the vehicle function, and wherein at least one of the redundant control system or the third control system is programmed to monitor the adequacy of the health status of the main control system for controlling the at least one main vehicle component. In multiple variations, the third control system may be further programmed to monitor the adequacy of the health status of the redundant control system for controlling the at least one main vehicle component. In multiple variations, the main control system may be further programmed to monitor the adequacy of the health status of the at least one main vehicle component for performing the vehicle function. In multiple variations, the third control system is further programmed to assume control of the vehicle function if it is determined that both the main control system and the redundant control system are in a state of inadequate health or degradation for controlling the at least one main vehicle component. In multiple variations, the third control system may be further programmed to assume control of the vehicle function via at least one redundant vehicle component if it is determined that the at least one main vehicle component is in a state of inadequate health for performing the vehicle function. In several variations, the third control system is further programmed to perform minimum-risk maneuvers to safely stop the vehicle based on insufficient health status of the at least one primary vehicle component used to perform vehicle functions and insufficient health status of the third system used to control the at least one redundant vehicle component. In several variations, the third control system is further programmed to perform minimum-risk maneuvers to safely stop the vehicle based on at least one of insufficient health status of the at least one primary vehicle component used to perform vehicle functions and insufficient health status of the at least one redundant vehicle component used to perform vehicle functions.

[0052] Multiple variations may include a product comprising an autonomous vehicle control system, comprising: at least one primary vehicle component for performing vehicle braking, steering, or motion control functions; and at least one redundant vehicle component for performing vehicle braking, steering, or motion control functions; wherein the at least one redundant vehicle component is configured and arranged to perform vehicle braking, steering, or motion control functions when it is determined that the at least one primary vehicle component is in an insufficiently healthy state for performing vehicle braking, steering, or motion control functions. In multiple variations, the product may further include a third controller configured and arranged to control the at least one redundant vehicle component for performing vehicle braking, steering, or motion control functions. In multiple variations, the third controller is programmed to control the at least one redundant vehicle component if the at least one primary vehicle component ceases to perform vehicle braking, steering, or motion control functions.

[0053] refer to Figure 5A , Figure 5B and Figure 5C In several variations, the third control system 500 may include multiple control modules, which may include, but are not limited to, a third motion control 502 that may include module 504 to facilitate a third motion control function. A third steering control module 503 may provide a third steering function 505. A third braking control module 504 may provide a third braking function 505. A steering request 512 may be communicated from the third motion control module 502 to the third steering control module 503, and a braking request 514 may be communicated to the third braking control module 504.

[0054] A third steering actuator 506 may be provided in a third control system 500 and may be used to apply steering motor torque function 527 and provide functionality for sensing steering actuator position 529. Steering motor torque signal 515 may be provided by a third steering control 503, and the third steering actuator may provide right tie rod force 524 and left tie rod force 526. The third control system 500 may include a left wheel brake actuator 508, which may provide applied braking torque function 531 and provide functionality for sensing left wheel speed 533. A third brake control module 504 may provide a left wheel brake torque request 518 to the left wheel brake actuator 508, and the left wheel brake actuator 508 may apply left braking torque 528 or left wheel speed adjustment 530. The third control system 500 may include a right wheel brake actuator 510 and provide applied brake motor torque 538 and functionality for sensing left wheel speed 537. The third braking control module 504 can provide a right wheel braking torque request 520 to the right wheel brake actuator 510, resulting in a right braking torque 532 and a right wheel speed adjustment 534. In several variations, the third motion control can be accomplished by a single module that includes electronically coordinated positioning to sense and control both the third steering and brake actuators. The third motion, steering, and braking software and hardware electronics can be integrated into a single physical module.

[0055] Now for reference Figure 5BIn several variations, multiple vehicle components and systems can be communicatively connected to the third control system 500. For example, the vehicle battery and ignition system 636 can be communicatively connected to supply battery voltage and vehicle ignition information to the third control system 500. The autonomous driving condition module 642 includes a minimum risk maneuvering (MRM) plan 644, and the EGO motion positioning 646 can be communicatively connected to the third control system 502 to provide motion trajectory information 648, attitude and position information 650, autonomous driving (AD) system status information 652, and third control system status 654. The primary / redundant control system 656 can be communicatively connected to the third control system 500 to provide motion control system status information 656. A vehicle data exchange system 660, including brake lights 652, vehicle dynamic signals 664, steering wheel angles 666, and a stationary management request 668, can be communicatively connected to provide vehicle information 658 to the third control system 500. The third control system 500 ( Figure 6A Parking brake actuator technology can be used to support redundant parking braking capability when the main parking brake is lost due to a failure of the main / redundant braking system. After the third control system 500 executes MRM in support of the stationary management request 668 from the vehicle, unsafe roll of the autonomous vehicle will be prevented.

[0056] Now for reference Figure 5C In several variations, multiple vehicle components and systems may be communicatively connected to a third control system 504 that controls them and can provide feedback thereto. These multiple vehicle components and systems include, for example, but not limited to, a propulsion system 572, a left front wheel assembly 574, a right front wheel assembly 576, a left rear wheel assembly 578, and a right rear wheel assembly 580.

[0057] Now for reference Figure 6A , Figure 6B and Figure 6CIn several variations, the system may include a motion control system—a primary and fallback path 600—which may include a primary control module 602 and a fallback control module 604. The primary control module 602 may transmit a primary motion request 608 to an arbitration motion control source module 606. Similarly, the fallback motion control module 604 may transmit a fallback motion request 618 to the arbitration motion control source module 608. The arbitration motion control source module 608 may determine which control system should be used to control various vehicle components based on the failure or insufficient health of the primary motion control module 602 and / or the fallback motion control module 604. If the primary control module 602 has failed or has insufficient health, the arbitration motion control source module 606 switches control to a backup control module 604. If the fallback control module 604 also fails or has insufficient health, the arbitration motion control source module 606 switches control to enable a third control system 640 (which, along with...) Figure 5A The third control 638 (identical to the third control system 500 shown) is a third control. The arbitration motion control source module 606 can issue an engine request 622 to the powertrain system 654, which may include the powertrain engine control module 656. The arbitration motion control source module 606 can issue a braking request to the redundant braking actuation system 626 for either the main brake actuation 628 or the redundant brake actuation 630 (depending on which control module has been enabled). The arbitration motion control source module 606 can send a steering request to the redundant steering actuation module 632 for either the first steering actuator 634 or the second steering actuation 637, depending on whether the main motion control module 602 or the reversing motion control module 604 has been enabled or controlled. The autonomous driving coordination system 612 can provide the third motion trajectory and vehicle position 618 (from the third motion control function (642)) to the third motion control function (642). Figure 6B The diagnostic feedback data path 700 from the braking actuation system 626 and the diagnostic feedback data path 702 from the powertrain system 654 can be provided to both the motion control system 600 and the third control system 640.

[0058] like Figure 6B As illustrated in the schematic diagram, in several variations, an autonomous driving coordination system 612, which may include an autonomous driving motion planner module 614, may be communicatively connected to a motion control system—primary and reversal path system 600—to provide trajectory and vehicle position 616 and a third motion trajectory and vehicle position 618.

[0059] refer to Figure 6C In several variations, the third control system 640 may include a third control function module 642, which is communicatively connected 650 to the third steering actuator 646 and communicatively connected 652 to the brake actuator 648. Figure 6CThe third control system 640 shown in the figure is as follows: Figure 5A The third control system 500 shown in the diagram operates as described.

[0060] The control systems and subsystems described herein may further include one or more controllers (not shown) that communicate with actuators and sensors to receive and process sensor inputs and transmit actuator output signals and output signals to the system or subsystem. One or more controllers may include one or more suitable processors and storage devices (not shown). The memory may be configured to provide storage of data and instructions that provide at least some of the functions of the system and / or subsystem that can be executed by one or more processors. At least some of the methods may be enabled by one or more computer programs and various engine system data or instructions stored in the memory as lookup tables, mappings, models, etc. In any case, the control system and subsystem control vehicle system parameters by receiving input signals from sensors, executing instructions or algorithms based on the sensor input signals, and transmitting appropriate output signals to various actuators and to the system or subsystem. The control system and subsystem may include several modules within one or more controllers. As used herein, the term "model" includes any construction that uses variables (such as lookup tables, mappings, algorithms, and / or the like) to represent something. A model is a specific and concrete application of a precise design and performance specification for any given system. Modules may include sensors, controllers, actuators, or other modules or control modules. The following description of variations is merely illustrative of components, elements, actions, products, and methods contemplated within the scope of this invention and is not intended to limit the scope in any way by the specific disclosures or omissions. The components, elements, actions, products, and methods described herein may be combined and rearranged in ways other than those explicitly described herein and still be considered to fall within the scope of this invention.

[0061] Variant 1 may include a product comprising: an autonomous vehicle control system, comprising: a first primary motion control system; a redundant motion control system; and a third motion control system; wherein at least one of the primary control system, the redundant control system, or the third control system is programmed to report its own health or degradation status directly or indirectly to at least one of the other control systems.

[0062] Variant 2 may include the product as described in Variant 1, wherein the main control system, the redundant control system, and the third control system are all programmed to sequentially manage control of at least one of the vehicle motion control system functions, the vehicle braking system functions, or the vehicle steering system functions.

[0063] Variation 3 may include the product described in any of Variations 1-2, wherein the main control system, the redundant control system, and the third control system are programmed to successively manage control of at least one of the vehicle motion control system functions, vehicle braking system functions, or vehicle steering system functions based at least on a self-reported health or degradation state of at least one of the other control systems.

[0064] Variant 4 may include the product described in any of Variant 1-3, wherein the control system is programmed to sequentially manage control of at least one of the vehicle motion control system functions, vehicle braking system functions, or vehicle steering system functions in the following sequence: First, the main control system controls at least one vehicle function; then, based on the self-reported health or degradation state of the main control system relating to the main control system's ability to control the at least one vehicle function, a redundant control system assumes control of the at least one vehicle function; then, based on both the self-reported health or degradation state of the main control system relating to the main control system's ability to control the at least one vehicle function, and the self-reported health or degradation state of the redundant control system relating to the redundant control system's ability to control the at least one vehicle function, a third control system assumes control of the at least one vehicle function.

[0065] Variation 5 may include the product described in any of Variations 1-4, wherein the third control system takes over from the main control system and the redundant control system only in response to the main control system and the redundant control system reporting that they are in an unacceptably healthy or degraded state of control over at least one vehicle function, in order to control the at least one vehicle function.

[0066] Variant 6 may include a product comprising: an autonomous vehicle control system, the autonomous vehicle control system comprising: a main control system; a redundant control system; and a third control system; wherein the main control system is programmed to control at least one vehicle function via at least one main vehicle component adapted to perform vehicle functions, and wherein at least one of the redundant control system or the third control system is programmed to monitor the adequacy of the health status of the main control system for controlling the at least one main vehicle component.

[0067] Variation 7 may include the product as described in Variation 6, wherein the third control system is further programmed to monitor the adequacy of the health status of the redundant control system for controlling the at least one main vehicle component.

[0068] Variation 8 may include the product as described in any of Variations 6-7, wherein the main control system is further programmed to monitor the adequacy of the health status of the at least one main vehicle component used to perform vehicle functions.

[0069] Variation 9 may include the product described in any of Variations 6-8, wherein the third control system is further programmed to assume control of vehicle functions if it is determined that both the main control system and the redundant control system are in an insufficiently healthy or degraded state for controlling the at least one main vehicle component.

[0070] Variation 10 may include the product described in any of Variations 6-9, wherein the third control system is further programmed to assume control of the vehicle functions via at least one redundant vehicle component if it is determined that the at least one primary vehicle component is in an insufficiently healthy state for performing vehicle functions.

[0071] Variation 11 may include the product as described in any of Variations 6-10, wherein the third control system is further programmed to perform minimum-risk maneuvers to bring the vehicle to a safe stop based on the inadequacy of the health status of the at least one primary vehicle component for performing vehicle functions and the inadequacy of the health status of the redundant system for controlling the at least one redundant vehicle component.

[0072] Variation 12 may include the product described in any of Variations 6-11, wherein the third control system is further programmed to perform minimum-risk maneuvers to bring the vehicle to a safe stop based on at least one of insufficient health status of the at least one primary vehicle component used to perform vehicle functions and insufficient health status of the at least one redundant vehicle component used to perform vehicle functions.

[0073] Variation 13 may include a product comprising: a redundant vehicle control system for an autonomous vehicle control system, comprising: at least one primary vehicle component for performing vehicle braking, steering, or motion control functions; and at least one redundant vehicle component for performing vehicle braking, steering, or motion control functions; wherein the at least one redundant vehicle component is configured and arranged to perform vehicle braking, steering, or motion control functions when it is determined that the at least one primary vehicle component is in an insufficiently healthy state for performing vehicle braking, steering, or motion control functions.

[0074] Variant 14 may include the product as described in Variant 13, and further include a third controller configured and arranged to control the at least one redundant vehicle component for performing vehicle braking, steering, or motion control functions.

[0075] Variant 15 may include a product comprising: a vehicle motion controller configured and arranged to monitor an autonomous vehicle steering, braking, or drive system, wherein the autonomous vehicle steering, braking, or drive system includes at least one steering, braking, or drive component, and wherein the vehicle motion controller is configured to determine at least one steering, braking, or drive system capability during an operational period of the autonomous vehicle steering, braking, or drive system by monitoring the health or degradation state of at least one steering, braking, or drive component via onboard vehicle sensors, and wherein the vehicle motion controller is configured to transmit the determined steering, braking, or drive system capability of the at least one steering, braking, or drive component to at least one other vehicle system.

[0076] Variation 16 may include the product as described in Variation 15, wherein the vehicle motion controller is not vehicle-mounted.

[0077] Variation 17 may include the product as described in Variation 15, wherein the operation period of the autonomous vehicle steering, braking or drive system is a period comprising a number of intermittent drive periods during which the vehicle using the autonomous vehicle steering, braking or drive system is started, driven and then stopped.

[0078] Variant 18 may include the product as described in Variant 15, and further includes a planner module configured to receive and interpret communicated determined steering, braking, or drive system capabilities from a vehicle motion controller, and to determine an autonomous vehicle path based at least on the communicated determined steering, braking, or drive system capabilities.

[0079] Variation 19 may include the product as described in Variation 15, wherein the planner module is not vehicle-mounted.

[0080] Variant 20 may include a product comprising a module that integrates and coordinates positioning electronics to sense and control both the third steering and braking actuators of an autonomous vehicle.

[0081] Variation 21 may include the product as described in Variation 20, and further includes a redundant vehicle control system for autonomous vehicles, comprising:

[0082] At least one main vehicle component for performing vehicle braking, steering, or motion control functions; and,

[0083] At least one redundant vehicle component is used to perform vehicle braking, steering, or motion control functions.

[0084] The at least one redundant vehicle component is configured and arranged to perform vehicle braking, steering, or motion control functions when it is determined that the at least one primary vehicle component is in an insufficiently healthy state for performing vehicle braking, steering, or motion control functions.

[0085] Variant 22 includes a third control system for vehicles, which includes a parking brake actuator system to support redundant parking brake capability if the vehicle’s main parking brake is lost due to a failure of the main / redundant braking system.

[0086] Variation 23 may include the product of Variation 21, wherein the parking brake actuator system is configured and arranged to prevent unsafe roll of the vehicle after a third control system supporting a stationary management request from the vehicle performs minimal-risk maneuvers.

[0087] Variant 24 may include a third controller for use in an autonomous vehicle having a main controller, a redundant controller, and a third controller, wherein the main controller, the redundant controller, and the third controller control at least one of the steering, braking, or drive systems of the autonomous vehicle, and the third controller is configured to have at least one of the following operating modes:

[0088] Active control of braking and steering activation modes—where the third controller is activated when a complete two-point failure exists in the redundant steering system or redundant braking system;

[0089] The monitoring mode is characterized by the third controller not controlling steering or braking when there is no fault in either the redundant steering system or the redundant braking system, and the third controller repeatedly sends health status signals to the autonomous driving condition module.

[0090] The standby mode is used when there is a single point of failure in the redundant steering system or redundant braking system and the third controller does not control the steering or braking of the autonomous vehicle, and the third controller repeatedly sends the health status signal to the autonomous driving condition module.

[0091] Disabled mode when there is a fault in the third controller.

[0092] Variation 25 may include a third controller as described in Variation 24, wherein the third controller is configured to have each of an enabled mode, a monitoring mode, a standby mode, and a disabled mode. The above description of selected variations within the scope of the invention is substantially illustrative only, and therefore variations or variants thereof should not be considered as departing from the spirit and scope of the invention.

Claims

1. An autonomous vehicle control system, the autonomous vehicle control system comprising: Main control system; Redundant control system; as well as, Third control system; At least one of the main control system, the redundant control system, or the third control system is programmed to directly or indirectly report its own health or degradation status to at least one of the other control systems. The main control system, the redundant control system, and the third control system are programmed to sequentially manage control of at least one of the vehicle motion control system function, the vehicle braking system function, or the vehicle steering system function in the following sequence: First, the main control system controls at least one vehicle function, which includes vehicle acceleration, vehicle deceleration and / or vehicle steering. Then, based on the self-reported health or degradation status of the main control system in relation to the main control system's capability to control at least one vehicle function, the redundant control system assumes control of the at least one vehicle function. Then, based on both the self-reported health or degradation status of the main control system, which relates to the ability of the main control system to control the at least one vehicle function, and the self-reported health or degradation status of the redundant control system, which also relates to the ability of the redundant control system to control the at least one vehicle function, the third control system assumes control of the at least one vehicle function. The main control system is programmed to control at least one vehicle function via at least one main vehicle component adapted to perform the vehicle function, and at least one of the redundant control system or the third control system is programmed to monitor the adequacy of the health status of the main control system for controlling the at least one main vehicle component. The third control system is further programmed to assume control of the vehicle function via at least one redundant vehicle component if it is determined that the at least one main vehicle component is in an insufficiently healthy state for performing the vehicle function. The third control system is further programmed to perform minimum-risk maneuvers to bring the vehicle to a safe stop based on the inadequacy of the health status of the at least one primary vehicle component used to perform the vehicle functions and the inadequacy of the health status of the third control system used to control the at least one redundant vehicle component.

2. The autonomous vehicle control system according to claim 1, wherein, The third control system takes over from the main control system and the redundant control system only in response to the main control system and the redundant control system reporting that they are in an unacceptably healthy or degraded state of control over at least one vehicle function, in order to control the at least one vehicle function.

3. The autonomous vehicle control system according to claim 1, wherein, The third control system is further programmed to monitor the adequacy of the health status of the redundant control system used to control the at least one main vehicle component.

4. The autonomous vehicle control system according to claim 1, wherein, The main control system is further programmed to monitor the adequacy of the health status of at least one main vehicle component used to perform the vehicle functions.

5. The autonomous vehicle control system according to claim 3, wherein, The third control system is further programmed to assume control of the vehicle functions if it is determined that both the main control system and the redundant control system are in an insufficiently healthy or degraded state for controlling the at least one main vehicle component.

6. The autonomous vehicle control system according to claim 5, wherein, The third control system is further programmed to perform minimum-risk maneuvers to bring the vehicle to a safe stop based on at least one of insufficient health status of the at least one primary vehicle component used to perform the vehicle function and insufficient health status of the at least one redundant vehicle component used to perform the vehicle function.

7. The autonomous vehicle control system according to claim 1, further comprising: At least one main vehicle component used to perform vehicle braking, steering, or motion control functions; and, At least one redundant vehicle component for performing the vehicle's braking, steering, or motion control functions; The at least one redundant vehicle component is configured and arranged to perform the vehicle braking, steering, or motion control functions when it is determined that the at least one primary vehicle component is in an insufficiently healthy state for performing the vehicle braking, steering, or motion control functions.

8. The autonomous vehicle control system according to claim 7, wherein, The at least one redundant vehicle component includes a redundant steering system and a redundant braking system, and the third control system is configured to have at least one of the following operating modes: (a) An active control mode for braking and steering—whereby the third control system is activated when a complete two-point failure exists in the redundant steering system or the redundant braking system. (b) Monitoring mode, wherein the third control system does not control steering or braking when there is no fault in either the redundant steering system or the redundant braking system, and wherein the third control system repeatedly sends a health status signal to the autonomous driving condition module. (c) A standby mode when the redundant steering system or redundant braking system has a single point of failure and the third control system does not control the steering or braking of the autonomous vehicle, wherein the third control system repeatedly sends a health status signal to the autonomous driving condition module. (d) Disabled mode when a fault exists in the third control system.

Images