Limp-home mode for autonomous vehicle using secondary autonomous sensor system

Abstract

An autonomous driving system for an autonomous vehicle includes a plurality of on-board autonomous sensors for perceiving data related to operation of the autonomous vehicle and a surrounding environment, and an autonomous driving controller in electronic communication with the plurality of on-board autonomous sensors. The autonomous driving controller is instructed to receive an alert indicating that one or more of the plurality of on-board autonomous sensors is inoperable and that a secondary autonomous sensor system including one or more replacement sensors is installed on the autonomous vehicle. The autonomous driving controller is instructed to validate the secondary autonomous sensor system according to a safety check and to perform a redundancy check between the one or more replacement sensors and the plurality of on-board autonomous sensors. In response to determining that the one or more replacement sensors are valid according to the redundancy check, the autonomous driving controller operates the autonomous vehicle in a limp-home mode.

Description

Technical Field

[0001] This disclosure relates to an autonomous vehicle employing a two-level autonomous sensor system. More specifically, this disclosure relates to an autonomous vehicle operating in a limp-home mode, which, when employing a two-level autonomous sensor system, restricts one or more autonomous driving features of the autonomous vehicle. Background Technology

[0002] Using various onboard technologies and sensors, autonomous vehicles travel from a starting point to a predetermined destination with limited or no human intervention. Autonomous vehicles include a variety of autonomous sensors, such as, but not limited to, cameras, acoustic sensors, radar, lidar, GPS, and inertial measurement units (IMUs) for detecting the vehicle's external environment and status. The vehicle's onboard controller determines a suitable route based on the user-inputted destination and information collected by the various autonomous sensors.

[0003] If one or more autonomous sensors fail, or if the vehicle's hardware malfunctions, the autonomous system may no longer be able to guide the vehicle to the user-specified destination. It should be understood that even if the autonomous system is no longer functional, other components of the autonomous vehicle, such as the steering wheel or drivetrain, may still operate. That is, the motors and drivetrain components that drive the autonomous vehicle can still function normally; however, the system controlling autonomous operation cannot guide the vehicle. One approach is to use redundant autonomous sensors to mitigate this problem; however, redundant components significantly increase the cost of the autonomous vehicle.

[0004] Therefore, while current autonomous vehicles have achieved their intended purpose, there is a need in the art for an improved system that allows autonomous vehicles to continue driving when one or more autonomous sensors fail. Summary of the Invention

[0005] According to several aspects, an autonomous driving system for an autonomous vehicle is disclosed. The autonomous driving system includes multiple onboard autonomous sensors for sensing data related to the autonomous vehicle's operation and its surrounding environment, and an autonomous driving controller that electronically communicates with the multiple onboard autonomous sensors. The autonomous driving controller is instructed to indicate that a secondary autonomous sensor system, including one or more replacement sensors, is installed on the autonomous vehicle, indicating that one or more of the multiple onboard autonomous sensors have failed. The autonomous driving controller is instructed to verify the secondary autonomous sensor system based on a safety check. The autonomous driving controller is further instructed to perform a redundancy check between the one or more replacement sensors and the multiple onboard autonomous sensors. The autonomous driving controller determines, based on the redundancy check, that data received from the one or more replacement sensors is valid. Finally, in response to determining, based on the redundancy check, that the data received from the one or more replacement sensors is valid, the autonomous driving controller operates the autonomous vehicle in limp-home mode.

[0006] On the one hand, the limp home mode restricts one or more autonomous driving features of autonomous vehicles.

[0007] On the other hand, the one or more autonomous driving features include at least one of the following: the speed of the autonomous vehicle, the specific road that allows the autonomous vehicle to travel, the predetermined destination, and the specific driving operation.

[0008] On another front, the autonomous driving system also includes a socket that is electrically connected to the corresponding plug of the secondary autonomous sensor system.

[0009] On the other hand, multiple onboard autonomous sensors include one or more of the following: one or more cameras, radar, inertial measurement unit (IMU), global positioning system (GPS), and lidar.

[0010] On one hand, the autonomous driving controller is instructed to determine an updated predetermined destination that differs from the original predetermined destination input by the autonomous vehicle user.

[0011] On the other hand, the updated intended destination is the repair facility.

[0012] On the other hand, safety checks showed that the correct number and type of replacement sensors were connected to the autopilot controller.

[0013] On the other hand, the autonomous driving controller is instructed to: in response to determining that the Level 2 autonomous sensor system has passed the safety check, perform data synchronization to determine the missing sensor data required by the autonomous driving controller.

[0014] On the one hand, data synchronization also includes time and location synchronization between the autonomous driving controller and the secondary controller of the secondary autonomous sensor system.

[0015] On the other hand, redundancy checks include calculating the errors between one or more replacement sensors in the Level 2 autonomous sensor system and the multiple onboard autonomous sensors that are still functioning normally on the autonomous vehicle.

[0016] On the other hand, data collected by one or more replacement sensors of a secondary autonomous sensor system is integrated with data collected by multiple onboard autonomous sensors based on parallel, centralized, or hybrid methods.

[0017] On the other hand, the parallel approach involves the second-level controller and the autonomous driving controller of the second-level autonomous sensor system executing their respective perception algorithms independently, and then merging the results together.

[0018] On one hand, the centralized approach involves the second-level controller of the second-level autonomous sensor system sending raw data generated by one or more replacement sensors directly to the autonomous driving controller.

[0019] On the other hand, the autonomous driving controller performs perception algorithms based on raw data generated by one or more replacement sensors.

[0020] On the other hand, the hybrid approach involves the second-level controller and the autonomous driving controller of the second-level autonomous sensor system sharing data when executing perception algorithms, and then merging the results together.

[0021] In one aspect, an autonomous driving system for an autonomous vehicle is disclosed, comprising multiple onboard autonomous sensors for sensing data related to the autonomous vehicle's operation and surrounding environment, and an autonomous driving controller electronically communicating with the multiple onboard autonomous sensors. The autonomous driving controller is instructed to receive a prompt indicating that one or more of the multiple onboard autonomous sensors have failed and that a secondary autonomous sensor system, including one or more replacement sensors, is installed on the autonomous vehicle. The autonomous driving controller is instructed to verify the secondary autonomous sensor system according to a safety check, wherein the safety check indicates that the correct number and type of replacement sensors are connected to the autonomous driving controller. In response to determining that the secondary autonomous sensor system has passed the safety check, the autonomous driving controller performs data synchronization to determine the missing sensor data required by the autonomous driving controller. The autonomous driving controller is instructed to perform a redundancy check between the one or more replacement sensors and the multiple onboard autonomous sensors, wherein the redundancy check includes calculating the error between the one or more replacement sensors of the secondary autonomous sensor system and the multiple onboard autonomous sensors that are still functioning normally on the autonomous vehicle. The autonomous driving controller determines, based on the redundancy check, that the data received from the one or more replacement sensors is valid. Finally, in response to determining, based on the redundancy check, that the data received from the one or more replacement sensors is valid, the autonomous driving controller operates the autonomous vehicle in a limp-home mode, wherein the limp-home mode restricts one or more autonomous driving features.

[0022] On one hand, the one or more autonomous driving features include at least one of the following: the speed of the autonomous vehicle, the specific road that allows the autonomous vehicle to travel, the predetermined destination, and the specific driving operation.

[0023] On the other hand, the autonomous driving system also includes a socket that is electrically connected to the corresponding plug of the secondary autonomous sensor system.

[0024] In another aspect, a non-transitory computer-readable storage medium is disclosed, which reads and stores instructions by processing circuitry, wherein the stored instructions implement method operations when executed by the processing circuitry. The method includes receiving a prompt indicating that one or more of a plurality of onboard autonomous sensors have failed and that a secondary autonomous sensor system, including one or more replacement sensors, is installed on an autonomous vehicle. The method also includes verifying the secondary autonomous sensor system according to a safety check, wherein the safety check indicates that the correct number and type of replacement sensors are connected to the autonomous driving controller. In response to determining that the secondary autonomous sensor system has passed the safety check, the method includes performing data synchronization to determine the missing sensor data required by the autonomous driving controller. The method also includes performing a redundancy check between the one or more replacement sensors and the plurality of onboard autonomous sensors. The method includes determining, based on the redundancy check, that data received from the one or more replacement sensors is valid. In response to determining, based on the redundancy check, that the data received from the one or more replacement sensors is valid, the method includes operating the autonomous vehicle in a limp-home mode, wherein the limp-home mode restricts one or more autonomous driving features.

[0025] Further applicability will become apparent from the description provided herein. It should be understood that the description and specific examples are for illustrative purposes only and are not intended to limit the scope of this disclosure. Attached Figure Description

[0026] The accompanying drawings described herein are for illustrative purposes only and are not intended to limit the scope of this disclosure in any way.

[0027] Figure 1 This is a schematic diagram of an autonomous vehicle according to an exemplary embodiment of the present disclosure, the autonomous vehicle including an autonomous driving controller, a plurality of onboard autonomous sensors and a socket for accommodating a secondary autonomous sensor system;

[0028] Figure 2 This is a schematic diagram of a secondary autonomous sensor system according to an exemplary embodiment of the present disclosure, which is connected to a socket of an autonomous vehicle;

[0029] Figure 3 This is a schematic diagram of an autonomous vehicle's autopilot controller according to an exemplary embodiment of the present disclosure, which communicates electronically with a secondary controller of a secondary autonomous sensor system;

[0030] Figure 4 This is a flowchart illustrating a method for operating an autonomous vehicle in limp-home mode according to an exemplary embodiment of the present disclosure; and

[0031] Figure 5 It is a computer program product according to an exemplary embodiment of the present disclosure, the computer program product including one or more storage media. Detailed Implementation

[0032] The following description is exemplary in nature and is not intended to limit this disclosure, application, or use.

[0033] refer to Figure 1 An autonomous vehicle 10 is shown. The autonomous vehicle 10 can be any type of vehicle, such as, but not limited to, a sedan, truck, SUV, van, or motorhome. In one non-limiting embodiment, the autonomous vehicle 10 is a fully autonomous vehicle, including an automated driving system (ADS) that performs all driving tasks. Alternatively, in another embodiment, the autonomous vehicle 10 is a semi-autonomous vehicle, including an advanced driver assistance system (ADAS) that assists the driver in steering, braking, and / or acceleration. The autonomous vehicle 10 has an autonomous driving system 12 including an automated driving controller 20. The automated driving controller 20 communicates electronically with multiple onboard autonomous sensors 22, multiple vehicle systems 24, and a socket 26. The socket 26 is electrically connected to a corresponding plug 74 of a secondary autonomous sensor system 30 (e.g., ...). Figure 2 (As shown).

[0034] As described below, the secondary autonomous sensor system 30 includes one or more replacement sensors 32. Figure 2 This is used to restore the autonomous driving capability of the autonomous vehicle 10 in the event that one or more onboard autonomous sensors 22 fail and are unable to send accurate data to the autonomous driving controller 20. Similarly, as described below, when the secondary autonomous sensor system 30 is used, the autonomous vehicle 10 operates in limp-home mode. Limp-home mode may restrict one or more autonomous driving features of the autonomous vehicle 10 until the owner arrives at a repair location.

[0035] The autonomous driving controller 20 determines the autonomous driving characteristics of the autonomous vehicle 10, such as perception, planning, localization, mapping, and control. Although Figure 1 The diagram shows that the autonomous driving controller 20 is a single controller, but it should be understood that multiple controllers may also be included. Figure 1 In the example shown, the multiple onboard autonomous sensors 22 include one or more cameras 38, radar 40, inertial measurement unit (IMU) 42, global positioning system (GPS) 44 and lidar 46; however, it should be understood that other sensors may also be used.

[0036] Multiple onboard autonomous sensors 22 perceive data related to the operation of the autonomous vehicle 10 and its surrounding environment, which is then sent to the autonomous driving controller 20. Specifically, cameras 38 detect static and dynamic obstacles within their respective fields of view (FOV). Examples of static and dynamic obstacles include other vehicles, pedestrians, road signs, traffic lights, lane markings, and fences. In one embodiment, cameras 38 may be located at the front 50, rear 52, and opposite sides 54 of the autonomous vehicle 10, where multiple images captured by each camera 38 are stitched together to form a 360-degree panoramic view of the surrounding environment. Both radar 40 and lidar 46 can be used to detect objects and their associated distances, as well as to determine the speed and position of objects. However, lidar can be used to detect relatively small objects, while radar can be used in situations with limited visibility, such as overcast or foggy weather. Both IMU 42 and GPS 44 can be used to directly measure the vehicle's state. Specifically, IMU 44 can be used to determine angular rotation rate, acceleration, and heading, while GPS 44 can be used to determine position, speed, and time.

[0037] Multiple vehicle systems 24 include, but are not limited to, a braking system 60, a steering system 62, a transmission system 64, and a suspension system 66. The autonomous driving controller 20 sends vehicle control commands to the multiple vehicle systems 24 to guide the autonomous vehicle 10 to a predetermined destination. For example, a user of the autonomous vehicle 10 can input the predetermined destination using an input device 68 that communicates electronically with the autonomous driving controller 20. In one embodiment, the input device 68 may be a keyboard.

[0038] Figure 2 This is a schematic diagram of the secondary autonomous sensor system 30 delivered to the autonomous vehicle 10 by the unmanned aerial vehicle (UAV) 70. It should be understood that the onboard autonomous sensor 22 (such as...) is part of the autonomous vehicle 10. Figure 1 One or more sensors (as shown) may fail. However, it should also be understood that not all onboard autonomous sensors 22 are malfunctioning. Because one or more of the onboard autonomous sensors 22 are malfunctioning, one or more replacement sensors 32 provide replacement data to restore the autonomous driving capability of the autonomous vehicle 10. For example, if multiple onboard autonomous sensors 22 ( Figure 1 If one of the cameras in part 38 malfunctions, sensor 32 is replaced to provide visual data. Although Figure 2 The image shows a Level 2 autonomous sensor system 30 transported by a UAV70, but it should be understood that... Figure 2 This is merely an example. In fact, the secondary autonomous sensor system 30 can also be transported to the autonomous vehicle 10 by other means. For example, in another embodiment, the secondary autonomous sensor system 30 is transported by a vehicle.

[0039] The secondary autonomous sensor system 30 includes a plug 74 that is electrically connected to a socket 26 of the autonomous vehicle 10. Therefore, data can be transmitted to the autonomous vehicle 10's automatic driving controller 20 (e.g., [missing information]). Figure 1 (as shown) and the secondary controller 80 of the secondary autonomous sensor system 30 (as shown) Figure 3 Shared between (as shown). In, as shown Figure 2 In the example shown, the socket 26 is located on the roof 72 of the autonomous vehicle 10; however, it should be understood that... Figure 2 This is merely an example. The socket 26 can be located anywhere within the autonomous vehicle 10 to make one or more replacement sensors 32 visible. For example, if the replacement sensor 32 is a camera 38 that captures data along the front side 50 of the autonomous vehicle 10, then the socket 26 could be positioned along the front grille of the autonomous vehicle 10. Furthermore, in some embodiments, the socket 26 may be located inside the passenger compartment of the autonomous vehicle 10.

[0040] Figure 3 This is a schematic diagram of one or more replacement sensors 32 of a secondary autonomous sensor system 30 that electronically communicates with the autonomous driving controller 20 of the autonomous vehicle 10. The secondary autonomous sensor system 30 includes a secondary controller 80 and communication hardware and software 82 electrically connecting the secondary controller 80 to the autonomous driving controller 20 of the autonomous vehicle 10. The secondary controller 80 electronically communicates with one or more replacement sensors 32. In one embodiment, the secondary controller 80 includes a safety module 84, a synchronization module 86, a perception module 88, a positioning module 90, and a self-diagnostic module 92.

[0041] Continue to refer to Figure 3 The autonomous driving controller 20 includes a safety module 100, a synchronization module 102, a perception module 104, a positioning module 106, and a diagnostic module 108. The autonomous driving controller 20 is instructed to receive prompts indicating that one or more of the multiple onboard autonomous sensors 22 have failed and that a secondary autonomous sensor system 30, including one or more replacement sensors 32, is installed on the autonomous vehicle 10 to restore autonomous driving capability.

[0042] Once the Level 2 Autonomous Sensor System 30 is installed and powered on, the Autopilot Controller 20 of the Autonomous Vehicle 10 performs a safety check to verify the Level 2 Autonomous Sensor System 30. Specifically, the safety check indicates that the correct number and type of replacement sensors are connected to the Autopilot Controller 20 of the Autonomous Vehicle 10. The safety check also ensures that the Autonomous Vehicle 10 is not connected to a fraudulent sensor group. For example, in one embodiment, both the safety module 84 of the Level 2 Controller 80 and the safety module 100 of the Autopilot Controller 20 can receive separate security codes from the back-end management system. If the security codes match, this ensures that there is no fraudulent sensor group within the Autonomous Vehicle 10. If the Level 2 Autonomous Sensor System 30 fails the safety check, the safety check can be repeated, or corrective measures can be taken alternatively.

[0043] In response to the determination that the Level 2 Autonomous Sensor System 30 has passed the safety check, the Level 2 Controller 80 of the Level 2 Autonomous Sensor System 30 then performs data synchronization with the Autopilot Controller 20. The data synchronization determines the missing sensor data required by the Autopilot Controller 20. That is, the data synchronization determines which onboard autonomous sensors 22 of the autonomous vehicle 10 are malfunctioning, and then instructs the Level 2 Controller 80 to send the missing sensor data; otherwise, this missing sensor data will be collected by the malfunctioning onboard autonomous sensors 22. For example, if the IMU 42 is malfunctioning, the synchronization module 102 of the Autopilot Controller 20 of the autonomous vehicle 10 will send a message indicating that IMU data needs to be obtained from the synchronization module 86 of the Level 2 Controller 80 of the Level 2 Autonomous Sensor System 30. Furthermore, the data synchronization also confirms the format of the missing sensor data exchanged between the Autopilot Controller 20 and the Level 2 Controller 80.

[0044] Data synchronization further includes time and location synchronization between the autonomous driving controller 20 and the secondary controller 80. Specifically, data synchronization includes synchronizing the clock contained in the autonomous driving controller 20 of the autonomous vehicle 10 with the clock contained in the secondary controller 80 of the autonomous sensor system 30. For example, in one embodiment, clock synchronization may involve using a global timer to ensure that the clocks of the autonomous driving controller 20 and the secondary controller 80 produce the same timestamp. The synchronization module 86 of the secondary controller 80 determines reference coordinates relative to the socket 26 and sends these reference coordinates to the synchronization module 102 of the autonomous driving controller 20.

[0045] Once safety checks and data synchronization are complete, the perception module 88 of the secondary controller 80 initiates environmental perception tasks, such as lane detection and object detection. The localization module 90 of the secondary controller 80 initiates measurements of the vehicle's state and locates the autonomous vehicle 10. In one embodiment, the perception module 88 sends the timestamp and confidence level associated with the detected object to the self-diagnosis module 92, and the localization module 90 sends a feedback signal to the self-diagnosis module 92 of the secondary controller 80. The feedback signal represents the feedback signal found in the closed-loop algorithm. The self-diagnosis module 92 then executes a diagnostic algorithm to determine the accuracy of the data received from the perception module 88 and the localization module 90 of the secondary controller 80. If the self-diagnosis module 92 determines that the data received from the perception module 88 and the localization module 90 reaches a minimum accuracy level, it transmits the data to the autonomous driving controller 20 of the autonomous vehicle 10.

[0046] In one embodiment, once the secondary autonomous sensor system 30 is installed on the autonomous vehicle 10, the autonomous driving controller 20 of the autonomous vehicle 10 determines an updated predetermined destination that differs from the original predetermined destination input by the user of the autonomous vehicle 10. For example, the updated predetermined destination could be, for instance, a repair shop or the user's home. For example, if the user initially selected their home or residence as the predetermined destination, then in one embodiment, the updated predetermined location might be a repair shop.

[0047] Once the Level 2 Autonomous Sensor System 30 is installed, the Autopilot Controller 20 also performs redundancy checks between one or more replacement sensors 32 and multiple onboard autonomous sensors 22. The redundancy check determines that data received from the one or more replacement sensors 32 is valid. Specifically, data received from the one or more replacement sensors 32 is valid if it does not contain fault or inaccurate information. If one or more replacement sensors 32 cannot be verified, the Level 2 Controller 80 of the Level 2 Autonomous Sensor System 30 can repeat the safety check and data synchronization.

[0048] The diagnostic module 108 of the autonomous driving controller 20 performs a redundancy check by calculating the error between one or more replacement sensors 32 of the secondary autonomous sensor system 30 and the multiple onboard autonomous sensors 22 that are still functioning normally on the autonomous vehicle 10. In response to determining that the error falls within a predetermined range, the diagnostic module 108 of the autonomous driving controller 20 determines that one or more replacement sensors 32 are valid. The predetermined range ensures that one or more replacement sensors 32 collect data within an acceptable range. For example, if the camera 38 of the autonomous vehicle 10 and one or more replacement sensors 32 of the secondary autonomous sensor system 30 detect an object, both the autonomous driving controller 20 and the secondary controller 80 calculate the size, position, and distance of the object. If the error between the object size, position, and distance calculated by the autonomous driving controller 20 and the secondary controller 80 falls within the predetermined range, the camera 38 of the secondary autonomous sensor system 30 passes the redundancy check.

[0049] In response to determining that one or more replacement sensors 32 pass a redundancy check, the autonomous driving controller 20 operates in limp-home mode. Limp-home mode restricts one or more autonomous driving features of the autonomous vehicle 10. In one embodiment, the restricted one or more autonomous driving features include the autonomous vehicle's speed, specific roads permitted for the autonomous vehicle to travel on, a predetermined destination, specific driving maneuvers, distance to other vehicles, and acceleration. For example, the autonomous vehicle 10's speed may be limited to a maximum speed, or the autonomous vehicle 10 may be unable to perform specific driving maneuvers, such as driving in a high-speed lane on a highway. In one embodiment, the autonomous driving controller 20 broadcasts a message to surrounding vehicles and objects indicating that the autonomous vehicle 10 is operating in limp-home mode.

[0050] When operating in limp-home mode, the secondary controller 80 continuously operates, transmitting sensor data to the autonomous driving controller 20 of the autonomous vehicle 10. Sensor data collected by one or more replacement sensors 32 of the secondary autonomous sensor system 30 is integrated with data collected by multiple onboard autonomous sensors 22 based on parallel, centralized, or hybrid methods. Parallel methods involve the perception module 88 of the secondary controller 80 and the perception module 104 of the autonomous driving controller 20 independently executing their respective perception algorithms and then combining the results. Centralized methods involve the secondary controller 80 directly sending raw data generated by one or more replacement sensors 32 to the perception module 104 of the autonomous driving controller 20. The perception module 104 of the autonomous driving controller 20 then executes a perception algorithm based on the raw data generated by one or more replacement sensors 32. Hybrid methods involve the perception module 88 of the secondary controller 80 and the perception module 104 of the autonomous driving controller 20 sharing data while executing perception algorithms and then combining the results. In one embodiment, the data integration method (i.e., parallel, centralized, or hybrid method) is selected based on the type of replacement sensor 32 and / or the results of verifying the replacement sensor 32.

[0051] It should be understood that the limp-home mode includes its own planning and control algorithms. Specifically, based on set constraints and information from secondary sensor characteristics (such as accuracy), a planning algorithm dedicated to the limp-home mode calculates new paths and operational decisions for the autonomous vehicle 10's autonomous driving. Based on the planned operations, the new path, and the secondary sensor information, the autonomous driving controller 20 calculates actuator commands, such as propulsion torque or steering angle in the limp-home mode.

[0052] Figure 4 This is a flowchart of method 200 for operating an autonomous vehicle in limp-home mode. (Reference) Figure 3 and Figure 4 Method 200 may begin at block 202. In block 202, the secondary autonomous sensor system 30 is mounted on the autonomous vehicle 10. Then, method 200 may proceed to block 204.

[0053] At block 204, the autonomous vehicle 10's autopilot controller 20 determines an updated predetermined destination. For example, in one embodiment, the updated predetermined destination is a repair location. Then, method 200 may proceed to block 206.

[0054] In block 206, the autonomous driving controller 20 performs a redundancy check between one or more replacement sensors 32 and multiple onboard autonomous sensors 22 to confirm that the data received from the one or more replacement sensors 32 is valid. Specifically, the method then proceeds to block 206A. In block 206A, the diagnostic module 108 of the autonomous driving controller 20 calculates the error between the one or more replacement sensors 32 of the secondary autonomous sensor system 30 and the multiple autonomous sensors 22 that are still functioning normally. Then, method 200 proceeds to decision block 206B.

[0055] In decision block 206B, if the error is not within the predetermined range, method 200 can proceed to block 206C, where the limp-home mode is not activated. Then, method 200 can terminate or take corrective action.

[0056] Return to decision box 206B. If the error is within the predetermined range, method 200 can proceed to box 208.

[0057] At block 208, in response to determining that one or more replacement sensors 32 are valid based on a redundancy check, the autonomous driving controller 20 operates the autonomous vehicle in limp-home mode. As described above, limp-home mode restricts one or more autonomous driving features, such as the speed of the autonomous vehicle or the predetermined destination. Method 200 can then proceed to block 210.

[0058] In block 210, the autonomous driving controller 20 sets new restrictions on planning and control operations. Specifically, the limp-home mode restricts one or more autonomous driving features, such as the speed of the autonomous vehicle 10 or specific driving actions. Method 200 can then proceed to block 212.

[0059] In block 212, the autonomous driving controller 20 broadcasts a message to surrounding vehicles and objects, indicating that the autonomous vehicle 10 is operating in limp-home mode. Then, method 200 can proceed to block 214.

[0060] In block 214, the secondary controller 80 continues to operate, transmitting sensor data to the autonomous vehicle 10's automatic driving controller 20 until the autonomous vehicle 10 reaches the updated predetermined destination. Then, method 200 can proceed to block 216.

[0061] In decision block 216, if autonomous vehicle 10 has not yet reached the updated predetermined destination, method 200 returns to block 206 to perform redundancy checks again. If autonomous vehicle 10 has already reached the updated predetermined destination, method 200 proceeds to block 218, at which point autonomous vehicle 10 stops. For example, the autonomous vehicle may have already arrived at the repair location. Method 200 can then terminate.

[0062] Now for reference Figure 5 Computer program product 300 includes one or more non-transitory computer-readable storage media 302. Computer-readable program code or logic 304 is stored on the storage media 302 to provide and facilitate one or more aspects of the embodiments described herein. The program code or logic is created using a compiler or assembler, for example, instructions that implement various aspects of the embodiments when executed. When program code is created and stored on a tangible medium, it is referred to as a computer-readable medium. Some examples of computer-readable media include, but are not limited to, electronic storage modules (RAM), flash memory, and optical discs (CDs). The computer program product medium can be read by processing circuitry in a computer system for execution by the processing circuitry.

[0063] Overall, referring to the accompanying drawings, the autonomous vehicle and the Level 2 autonomous sensor system offer several technical benefits and advantages. Specifically, the Level 2 autonomous sensor system provides a method that allows the autonomous vehicle to operate even if one or more onboard autonomous sensors fail, eliminating the need for redundant sensors and thus avoiding increased costs. In contrast, current conventional autonomous vehicle systems require the vehicle to stop and be towed to a repair shop when one or more autonomous sensors fail. Furthermore, the disclosed autonomous driving system provides a limp-home mode, enabling the autonomous vehicle to operate with limited capabilities until it reaches a repair shop.

[0064] The controller can be electronic circuitry, combinational logic circuitry, a field-programmable gate array (FPGA), a processor (shared, dedicated, or grouped) that executes code, some of the above elements, or a combination of some or all of the above elements, as in a system-on-a-chip. Furthermore, the controller can be a microprocessor-based controller, such as a computer having at least one processor, memory (RAM and / or ROM), and associated input and output buses. The processor can run under the control of an operating system residing in memory. The operating system can manage computer resources; therefore, computer program code, as one or more computer software applications (such as applications residing in memory), can have instructions that are executed by the processor. In an alternative embodiment, the processor can directly execute the application program, in which case the operating system can be omitted.

[0065] The descriptions in this disclosure are merely exemplary in nature, and any changes that do not depart from the spirit and scope of this disclosure should fall within its scope. Such changes should not be considered as a departure from the spirit and scope of this disclosure.

Claims

1. An autonomous driving system for an autonomous vehicle, the autonomous driving system comprising: a plurality of on-board autonomous sensors for perceiving data related to operation of the autonomous vehicle and the surrounding environment; a receptacle; and an autonomous driving controller in electronic communication with the plurality of on-board autonomous sensors and the receptacle, wherein the receptacle electrically connects the autonomous driving controller to a corresponding plug of a secondary autonomous sensor system, and wherein the autonomous driving controller is instructed to: receive an indication that one or more of the plurality of on-board autonomous sensors is malfunctioning and that a secondary autonomous sensor system including one or more replacement sensors is installed on the autonomous vehicle; verify the secondary autonomous sensor system according to a safety check; perform a redundancy check between the one or more replacement sensors and the plurality of on-board autonomous sensors; determine that data received from the one or more replacement sensors is valid according to the redundancy check; and in response to determining that data received from the one or more replacement sensors is valid according to the redundancy check, operate the autonomous vehicle in a limp-home mode. The limp-home mode restricts one or more autonomous driving features of the autonomous vehicle. The one or more autonomous driving features include at least one of: a speed of the autonomous vehicle, specific roads on which the autonomous vehicle is allowed to travel, a predetermined destination, and a specific driving operation.

2. The autonomous driving system of claim 1, wherein, The plurality of on-board autonomous sensors includes one or more of: one or more cameras, radar, an inertial measurement unit (IMU), a global positioning system (GPS), and a lidar.

3. The autonomous driving system of claim 2, wherein, The autonomous driving controller is instructed to:

4. The autonomous driving system of claim 1, wherein, determine an updated predetermined destination that is different from an original predetermined destination input by a user of the autonomous vehicle.

5. The autonomous driving system of claim 1, wherein, The updated predetermined destination is a repair site. The safety check indicates that the correct number and type of replacement sensors are connected to the autonomous driving controller.

6. The autonomous driving system of claim 5, wherein, The autonomous driving controller is instructed to:

7. The autonomous driving system of claim 1, wherein, in response to determining that the secondary autonomous sensor system has passed the safety check, perform a data synchronization for determining missing sensor data required by the autonomous driving controller.

8. The autonomous driving system of claim 1, wherein, The data synchronization further includes a time and location synchronization between the autonomous driving controller and a secondary controller of the secondary autonomous sensor system. ​ 9. The autonomous driving system of claim 8, wherein, ​

Images