Autonomous vehicle or robot control

Abstract

A control system for an autonomous vehicle or robot includes multiple high-level controllers, each capable of providing high-level motion commands independently of the other high-level controllers. A low-level controller is configured to receive the high-level motion commands of one of the high-level controllers and convert the received high-level motion commands into electrical outputs for multiple electric motors / actuators for driving the vehicle / robot. A decision system is independent of the high-level controllers and configured to determine which of the high-level controllers is active. Only the active high-level controller is used to provide the high-level motion commands to the lower-level controllers.

Description

[Technical Field]

[0001] The present invention relates to a method and system for controlling an autonomous vehicle or robot. [Background technology]

[0002] Autonomous vehicles and robots typically have a control computer that makes high-level decisions about what the vehicle should do when performing a mission, such as go forward, turn left, and stop. These decisions are made by lower-level controllers and electronics that execute higher-level commands, such as turning the vehicle's wheels at 5 m / s, turning the vehicle's steering wheel to -20 degrees, or stopping the wheels from turning.

[0003] In some situations, it is desirable to have one or more backup systems so that if a failure occurs, the vehicle will not be placed in a dangerous condition.

[0004] US7576286 describes a high level microcontroller with takeover operations of one microcontroller being handled within a second microcontroller.

[0005] US20030144778 describes an engine controller with one CPU.

[0006] US9207661 describes a controller with two cores in one control unit but no redundancy against hardware failures: the switching operation is initiated by the second core.

[0007] DE102005037246 describes two controllers in lockstep, providing error detection if one gets out of step with the other.

[0008] EP0322141 describes two computers that are active and dependent on each other such that if one fails the system will fail.

[0009] US20210034479 describes two devices capable of providing high-level operational commands. However, these devices perform different functions and are susceptible to failure of the other function, which may cause operational control failure.

[0010] US20010035149 describes operational control that is divided into strategic level operational commands issued by one controller and tactical level operational commands issued by another controller based on the strategic level operational commands, and the operational control is integrated with a vehicle management controller that receives the strategic level operational commands.

[0011] CN108196547 describes that an alternative decision-making unit monitors the status of the primary decision-making unit.

[0012] These prior art controllers suffer from various drawbacks.

[0013] One aspect of the present invention seeks to provide redundancy for the high level controller.

[0014] Any document, reference, patent application or patent that may be cited in this specification is expressly incorporated herein by reference in its entirety. This means that any document, reference, patent application or patent that may be cited in this specification should be read and considered by the reader as part of this specification. The documents, references, patent applications or patents cited in this specification will not be repeated solely for the sake of brevity.

[0015] Where works, acts or items of knowledge (or combinations thereof) are discussed herein, such reference is not an acknowledgment or admission that any of the information referred to constitutes part of the common general knowledge as of the priority date of the application. Such information is included solely for the purpose of providing a context to facilitate understanding of the inventive concepts / principles and various forms or embodiments of the invention. Summary of the Invention

[0016] According to a first aspect of the present invention, there is provided a control system for an autonomous vehicle or robot, comprising: a plurality of high level controllers, each high level controller capable of providing high level operational commands independently of other said high level controllers; a low-level controller configured to receive the high-level motion commands of one of the high-level controllers and convert the received high-level motion commands into electrical outputs for a plurality of electric motors / actuators for driving the vehicle / robot; a decision system independent of the high-level controllers and configured to determine which of the high-level controllers are active, where only the active high-level controllers are used, and providing the high-level operating commands to the low-level controllers; A control system is provided, comprising:

[0017] In one embodiment, the control system further comprises a messaging system that transfers the high-level operational commands of the active high-level controller to the low-level controller, and in one embodiment, the messaging system also transfers the low-level responses of the low-level controller to the high-level controller.

[0018] In an alternative embodiment, the control system comprises a heartbeat signal detector for checking receipt by the lower-level controllers of a heartbeat signal transmitted from the active high-level controller. In one embodiment, the decision system checks receipt by the lower-level controllers of a heartbeat signal transmitted from the active high-level controller. In one embodiment, the decision system is configured such that which high-level controller is the active high-level controller is changed when the heartbeat signal is not received by the lower-level controller.

[0019] In one embodiment, the messaging system indicates to the high-level controllers which of the high-level controllers is the active high-level controller.

[0020] In one embodiment, the decision system comprises a network messaging controller configured to record which high-level controller is the active high-level controller. In one embodiment, the messaging system comprises the network messaging controller.

[0021] In one embodiment, the heartbeat signal detector is configured to signal the network messaging controller that the active high-level controller should be changed if the heartbeat signal is not received by the low-level controller.

[0022] In one embodiment, the active high-level controller is configured to calculate a trajectory for the vehicle / robot and generate the high-level motion commands from the calculated trajectory.

[0023] In one embodiment, the high-level controller that is not the active high-level controller idles until it becomes the active high-level controller, hi one embodiment, idling includes synchronizing a state with a state of the active high-level controller.

[0024] In one embodiment, the control system further comprises a network switch for sharing data, including the aforementioned signals, between networked elements, including the controller and decision system.

[0025] In one embodiment, the control system further comprises a plurality of sensors, wherein the sensors are connected to a network and provide sensed data to one or more elements connected to the network.

[0026] In one embodiment, the active high-level controller consumes the sensing data from the sensors, hi one embodiment, the active high-level controller uses the sensing data to calculate the high-level operating commands.

[0027] In one embodiment, the active high-level controller transmits the high-level operational commands only to the low-level controllers over a network.

[0028] In one embodiment, the decision system configures the initial active controller based on an initial configuration upon initial startup of the control system.

[0029] In one embodiment, when a high-level controller is changed, the high-level controller that was the active controller is restarted / reset. In one embodiment, when a high-level controller is restarted / reset, the decision system sends a power cycle signal to the high-level controller being restarted / reset.

[0030] In one embodiment, the low-level controller provides feedback from sensors associated with the motors / actuators to the active high-level controller. In one embodiment, the low-level controller provides an acknowledgment response to a command from the active high-level controller. In one embodiment, the feedback is provided along with the response.

[0031] In one embodiment, the high level operational commands are communicated from the active high level controller to the low level controller via the heartbeat signal.

[0032] According to another aspect of the present invention, there is provided a method of controlling an autonomous vehicle or robot, comprising: Providing multiple high-level controllers; Providing low-level controllers; providing a decision system; activating the high-level controller; an active high-level controller providing high-level operating commands to said lower-level controllers independent of other said higher-level controllers; the low-level controller receiving the high-level motion commands of the active high-level controller and converting the received high-level motion commands into electrical outputs for a plurality of electric motors / actuators for driving the vehicle / robot; A method is provided in which the decision system determines changes to the active high-level controller independently of the high-level controller.

[0033] In one embodiment, the method includes idling the high-level controller that is not activated, hi one embodiment, the idling high-level controller synchronizes its state with the active high-level controller.

[0034] In one embodiment, the method includes forwarding the high-level operating commands of the active high-level controller to the low-level controller. In one embodiment, the method includes forwarding low-level responses of the low-level controller to the active high-level controller.

[0035] In one embodiment, the method includes checking for receipt by the low-level controller of a heartbeat signal sent from the active high-level controller, and when the heartbeat signal is not received by the low-level controller, changing which high-level controller is the active high-level controller.

[0036] In one embodiment, the method includes indicating to the high-level controller which of the high-level controllers is the active high-level controller.

[0037] In one embodiment, the method includes recording which high-level controller is the active high-level controller.

[0038] According to another aspect of the present invention, there is provided a control system for an autonomous vehicle or robot, comprising: a plurality of high-level controllers, each high-level controller capable of providing high-level operational commands to a lower-level controller; the low-level controller configured to receive the high-level motion commands of one of the high-level controllers and convert the received high-level motion commands into electrical outputs for a plurality of electric motors / actuators for driving the vehicle / robot; a plurality of sensors receiving data regarding said vehicle / robot and / or its environment; network-connected elements including the high-level controller, the low-level controller, and the sensor; A control system is provided in which the elements are independently addressable so as to have separate responsibility for being the source and / or destination of data conveyed by the network.

[0039] In one embodiment, the control system further comprises a decision system that is independent of the high-level controllers and configured to determine which of the high-level controllers are active, where only active high-level controllers are used, and provides the high-level operating commands to the lower-level controllers.

[0040] In one embodiment, the control system further comprises a messaging system that transfers the high level operational commands of the active high level controller to the low level controller.

[0041] In one embodiment, the control system comprises a network messaging controller configured to coordinate messaging over the network.

[0042] In one embodiment, the network includes a network switch provided by the network messaging controller for routing data related to the coordination.

[0043] In one embodiment, the control system, wherein the network messaging controller is a publish and subscribe messaging system.In one embodiment, the control system, wherein the network messaging controller is a ROS server.

[0044] In one embodiment, the sensors are each connected to the network by a ROS adapter.

[0045] In one embodiment, the low-level controller is connected to the network by a ROS adapter.

[0046] In one embodiment, each high-level controller is connected to the network by a separate network interface adapter.

[0047] According to another aspect of the present invention, there is provided a method of controlling an autonomous vehicle or robot, comprising: a plurality of high level controllers, each capable of issuing high level operational commands; a low-level controller configured to receive the high-level motion commands of one of the high-level controllers and convert the received high-level motion commands into electrical outputs for a plurality of electric motors / actuators for driving the vehicle / robot; a plurality of sensors for receiving data relating to the vehicle / robot and / or its environment; and network-connected elements including the high-level controller, the low-level controller, and the sensor; A method is provided in which the network conveys messages between the network elements, the network elements being independently addressable so as to have separate responsibility for being the source and / or destination of data conveyed by the network.

[0048] As will be readily understood by those skilled in the art, the various aspects or embodiments described herein may be implemented alone or in combination with one or more other aspects / embodiments. Various aspects may optionally be provided in combination with one or more of the optional features described in connection with other main aspects. Furthermore, any feature described in connection with one example (or embodiment) may optionally be combined alone or with other features in various examples or embodiments.

[0049] For purposes of summarizing the present aspects, certain advantages and novel features have been described above herein. It should be understood, however, that not necessarily all such advantages may be achieved in accordance with any particular embodiment, or that not all such advantages necessarily achieve other advantages that may be taught or suggested herein, or that may be implemented in a manner that achieves or optimizes one advantage or group of advantages taught herein. [Brief explanation of the drawings]

[0050] To provide a better understanding of preferred embodiments of the present invention, the preferred embodiments will now be described in conjunction with the accompanying drawings, in which: [Figure 1] 1 is a schematic block diagram of a control system for driving a wired autonomous vehicle according to an embodiment of the present invention. FIG. [Figure 2] 1 is a flowchart illustrating a method for high-level control of drive by a wired autonomous vehicle according to an embodiment of the present disclosure. [Figure 3] 1 is a flowchart of a method for low-level control of drive by a wired autonomous vehicle according to an embodiment of the present invention.

[0051] In the drawings, like elements are referenced by like numerals throughout the figures provided. Those skilled in the art will appreciate that the elements in the figures are illustrated for simplicity and clarity and have not necessarily been drawn to scale. For example, the dimensions and / or relative positions of some of the elements in the figures may be exaggerated relative to other elements to facilitate an understanding of the various embodiments illustrating the principles described herein. Also, common but well-understood elements that are useful or necessary in commercially feasible embodiments are often not depicted in order to provide a less daunting view of these various embodiments. It will also be understood that the terms and expressions used herein adopt the ordinary meanings ascribed to such terms and expressions with respect to their corresponding respective fields of inquiry and study, unless a specific meaning is otherwise stated herein.

[0052] It should be noted that the figures are schematic only, and that the location and arrangement of components may vary according to the arrangement of the embodiment and the particular application of such embodiment.

[0053] In particular, references to location descriptions such as "lower" and "upper," and related forms of location descriptions such as "uppermost" and "lowermost," should be interpreted in the context of the embodiments shown in the figures, and should not be interpreted as limiting the intent of the principles described herein to the literal interpretation of the terms, but rather as understood by one of ordinary skill in the art.

[0054] The embodiments described herein may include one or more ranges of values ​​(e.g., size, displacement, field strength, etc.). A range of values ​​is understood to include all values ​​within the range, including the value defining the range, and values ​​adjacent to the range that produce the same or substantially the same result as the values ​​immediately adjacent to the values ​​defining the boundaries for the range.

[0055] Other definitions for selected terms used herein may be found within the detailed description and may apply throughout. Unless defined otherwise, all other scientific and technical terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present embodiments pertain. DETAILED DESCRIPTION OF THE INVENTION

[0056] DETAILED DESCRIPTION OF ILLUSTRATIVE EMBODIMENTS The words used in the specification are words of description rather than limitation, and it will be understood that various changes may be made without departing from the spirit and intent of any aspect of the invention. Those skilled in the art will readily appreciate that numerous modifications, variations, and combinations may be made with respect to the above-described embodiments without departing from the spirit and intent of any aspect of the invention, and that such modifications, variations, and combinations are to be considered within the scope of the inventive concept.

[0057] Throughout the following specification and claims, unless the context requires otherwise, the word "comprise" or variations such as "comprises" or "comprising" will be understood to imply the inclusion of a stated integer or group of integers but not the exclusion of any other integer or group of integers.

[0058] Furthermore, throughout the following specification and claims, unless the context requires otherwise, the word "include" or variations such as "includes" or "including" will be understood to imply the inclusion of a stated integer or group of integers but not the exclusion of any other integer or group of integers.

[0059] Referring to FIG. 1 , a control system 10 for a drive by wire autonomous vehicle is shown in an embodiment of the present invention. The control system 10 includes a high-level control system 12, a low-level control system 14, a communication system 16, and sensors 18. The autonomous vehicle may include, but is not limited to, wheeled, tracked, half-tracked, flying (wing or downward thrust rotor based (e.g., a “drone”)), water-based (ship, boat, or submersible) or rocket-powered. This control system 10 may also be used for mobile autonomous robots.

[0060] The high-level control system 12 includes multiple high-level controllers 20, 22. In this embodiment, there are two; however, it will be understood that more than two may be used. Each high-level controller 20 or 22 can provide high-level operational commands independently of the other high-level controllers. Each high-level controller is preferably a general-purpose computer configured with software specifically operating as a high-level controller, having the structure and functionality described below. The software may comprise an autonomous vehicle computing platform for controlling the vehicle's operation to accomplish a mission. For example, the autonomous vehicle computing platform may be an Nvidia Drive platform. The software includes instructions that configure the processor of the high-level controller to operate as described when executed by the processor. The instructions may be implemented in any suitable language and operate within any suitable environment (operating system). The specific aspects of the instructions may be determined by one skilled in the art to control the high-level processor in accordance with the description herein. One aspect of the present invention relates to what the high-level processor should do to operate in accordance with the description herein. Each high-level controller may be prone to failure due to not necessarily being hardened, and / or due to complex mission control software, and / or other reasons. Each high-level controller 20, 22 may be assigned an identification number (ID).

[0061] Preferably, the high-level controllers 20, 22 (or high-level processors) are physically separate devices such that failure of one does not typically cause failure of the others. Preferably, the high-level controllers 20, 22 are physically located on the robot / vehicle so as not to be affected by communication failures, for example in radio harsh or mandated radio quiet environments.

[0062] The low-level control system 14 includes a low-level controller 32 configured to receive high-level motion commands from one of the high-level controllers 20, 22 and convert the received high-level motion commands into electrical outputs for a plurality of electric motors / actuators 60 for driving the vehicle. The motors may be drive motors for moving the vehicle forward or backward. The actuators may be steering actuators for tilting the steering wheel to the angle required to turn the vehicle. Other actuator configurations, such as track drive, brake, or caster wheel drive, are also possible.

[0063] The low-level controller 32 may be a general-purpose computer configured with software that operates specifically as a low-level controller having the structure and functionality described below. The software includes instructions that, when executed by a processor in the low-level controller 32, configure the processor to operate as described. The instructions may be implemented in any suitable language and operate in any suitable environment. The specific form of the instructions will be determined by one skilled in the art to control the low-level processor in accordance with the description herein. One aspect of the present invention relates to what the low-level processor must do to operate in accordance with the description herein.

[0064] Alternatively, the low-level controller may be formed from a custom electronic device such as a programmable logic controller (PLC) and associated electronic circuitry, which can be programmed to operate with similar (but usually lower level) instructions to cause the PLC's controls to operate as described.

[0065] The communication system 16 is in the form of a messaging system for transferring high-level operational commands of the active high-level controller 20 or 22 to the low-level control system 14. The communication system 16 may include an Ethernet network or a wireless network (e.g., Bluetooth or WiFi). The communication system 16 also provides sensor data from sensors 18 that sense the vehicle's environment or characteristics. For example, the sensors 18 may include one or more of radar, lidar, a GPS system, an accelerometer or IMU, a gyroscope, a distance (e.g., ultrasonic) sensor, or a video feed. The communication system 16 comprises a computer network. The computer network preferably includes a communication switch 42. For example, the switch 42 may include an Ethernet switch.

[0066] In one embodiment, the active high-level controller 20 or 22 is configured to receive signals from the sensors 18 via the communication system 16. In particular, the active high-level controller 20 or 22 consumes sensor data from the sensors 18. In one embodiment, the active high-level controller 20 or 22 is configured to calculate a vehicle trajectory based on the received signals and the mission. The active high-level controller 20 or 22 is also configured to generate high-level motion commands from the calculated trajectory. In an embodiment, the active high-level controller 20 or 22 transmits the high-level motion commands only to the low-level control system 14 via the network 16. Typically, communication from the high-level controller 20, 22 to the low-level control system 14 is hardwired to be immune to wireless communication interference or outages.

[0067] The control system 10 further comprises a decision system that is independent of the high-level controllers 20, 22 and configured to determine which of the high-level controllers 20 or 22 should be operated. In one embodiment, only the active high-level controller 20 or 22 is used, providing high-level operating commands to the low-level control system 14.

[0068] In one embodiment, the decision system comprises an element of the low-level control system 14. In one embodiment, the element is the low-level controller 32. In one embodiment, the decision system includes an element of the communication system 16. In one embodiment, the element (of the communication system 16) is a server device 40.

[0069] In one embodiment, the decision system comprises a heartbeat signal detector for checking receipt by the low-level controller 32 of a heartbeat signal transmitted from the active high-level controller 20 or 22. The decision system is configured such that the active high-level controller 20 or 22 is altered when a heartbeat signal is not received by said low-level controller 32. In one embodiment, the low-level controller 32 is configured to operate as the heartbeat signal detector. In one embodiment, the active high-level controller 20 or 22 is configured to operate as a heartbeat signal generator and is configured to transmit a heartbeat signal to the low-level controller 32 over the communication network 16.

[0070] In one embodiment, the messaging system server device 40 is configured to indicate to the high-level controllers 20, 22 which of the high-level controllers is the active high-level controller 20 or 22.

[0071] In one embodiment, the server 40 is a network messaging controller configured to record which high-level controller 20, 22 is the active high-level controller.

[0072] In one embodiment, a heartbeat signal detector (a functionality of the low-level controller 32) is configured to signal a network messaging controller (of the server 40) via the communication network 16. The heartbeat signal detector is configured to signal that the active high-level controller 20 or 22 is to be changed when the above-mentioned heartbeat signal is not received by the heartbeat signal detector (a functionality of the low-level controller 32).

[0073] In one embodiment, each high-level controller 20, 22 that is not the active high-level controller 20 or 22 is configured to idle until it becomes the active high-level controller. In one embodiment, idling includes synchronizing its state with that of the active high-level controller 20 or 22. Synchronizing the state is sufficient for the high-level controller 20 or 22 to take over as the active controller as seamlessly as possible. Typically, idling includes receiving sensor inputs received by the active high-level controller. Idling may further include processing the inputs as if it were the active high-level controller and not generating outputs to the lower-level controllers. Thus, inactive high-level controllers are typically not suspended. Resuming a suspended machine may result in a long delay in the handover from the current active high-level controller to the inactive controller.

[0074] In one embodiment, the decision system is configured to set the initial active controller according to an initial configuration upon first power-up of the control system 10. In one embodiment, the initial configuration is recorded on the server 40.

[0075] In one embodiment, when a high-level controller 22 or 20 is changed, the high-level controller 20 or 22 that was the active controller is restarted / reset. In one embodiment, when a high-level controller is restarted / reset, the decision system is configured to send a power cycle signal to the high-level controller 20 or 22 to be restarted / reset. A failure of the active high-level controller may be corrected by a restart / reset, especially if the failure is a system hang.

[0076] In one embodiment, the motor / actuator 60 has an associated sensor 62 configured to provide feedback to the low-level controller 32. In one embodiment, the feedback ensures that the motor / actuator 60 is operating as controlled. For example, a drive wheel may need to rotate at 20 rpm to generate a specific number of revolutions, and a respective sensor measures the rotational output of the motor driving the drive wheel. In one embodiment, the low-level controller 32 is configured to provide feedback from the sensor 62 associated with the motor / actuator to the active high-level controller 20 or 22. In one embodiment, the low-level controller 32 is configured to provide an acknowledgment response to the active high-level controller's commands. In one embodiment, feedback from the sensor 62 provides a response to a high-level command.

[0077] In one embodiment, high-level operational commands are communicated from the active high-level controller 20 or 22 to the low-level controller 32 via a heartbeat signal.

[0078] Referring to FIG. 2, there is shown an example of a method 100 for controlling the high-level controllers 20, 22. In the method 100, the high-level controllers are booted (102). The high-level controllers load the BIOS, then the operating system, and then the software applications mentioned above. During the boot process, the high-level controllers obtain a local network address (which may be fixed for the device or assigned, such as by a DHCP server operating as part of the server 40). The server 40 receives a message from each high-level controller 20, 22 indicating that it has booted successfully and that its software applications are running. The server 40 checks for this successful boot at 104. If one or both of the high-level controllers fail to boot successfully, the respective high-level controller may be power-cycled (typically by a command from the server 40 sent to its network adapter) or some other recovery may be initiated at 106.

[0079] When the high-level controllers 20, 22 start up successfully, one of them is assigned as the active high-level controller. Typically, the low-level controller 32 determines which of the high-level controllers 20, 22 will be the active controller and notifies the server 40, although there may be a default selection. The server 40 then notifies the high-level controllers 20, 22 which controller is the active controller.

[0080] Each high-level controller checks the received identification number of the active controller against its own identification number. If each high-level controller is not the active controller, it enters idle mode at 112. In idle mode, the high-level controller synchronizes its data with that of the active high-level controller so that if it switches to active controller, it can quickly take over this role.

[0081] At 114, each high-level controller 20, 22 reevaluates whether it has been notified to take over as the active controller, and if not, continues in idle mode (116). Each high-level controller 20, 22 begins executing (or takes over) its mission when notified to take over as the active high-level controller, or when it is initially assigned as a high-level controller. This is done by receiving / consuming sensor data and, based on this, issuing high-level commands to the low-level control system 14 in the form of messages including heartbeat signals and control commands. These messages are addressed to the low-level control system 14 and transmitted via the communication system 16.

[0082] Referring to FIG. 3, there is an example of a control method 200 for the low-level control system 14. In method 200, the low-level controllers are activated (202). The low-level controllers determine which of the high-level controllers 20, 22 will be the active controller. There may be a default selection of which high-level controller is assigned as the active controller (i.e., there is a pre-set primary controller), or the selection may be made by other means (e.g., alternating if there are two, or round-robin if there are more than two, or by random allocation). The low-level control system 14 notifies the server 40 at 204 which of the controllers 20, 22 is the active high-level controller. Alternative means of notifying the high-level controllers are also acceptable, such as the low-level controller notifying the high-level controller directly.

[0083] At 206, the low-level control system 14 begins listening for messages. As described above, the messages listened for are heartbeat signals and high-level vehicle control commands. A timer counts down to receive the heartbeat signals. Each heartbeat signal may have a timestamp to determine whether it is up-to-date. At 208, it is determined whether the heartbeat signal was received within a required time. If the heartbeat signal is not received within the required time, then at 210, it is assumed that there is a problem with the active controller. In this case, a command to perform a power cycle is sent to the active controller, and one of the other high-level controllers is then set in its internal memory / registry as the active high-level controller. This allows one of the other high-level controllers to take over control of the vehicle. This is sent to the server 40, which in turn sends it to the other high-level controllers 20, 22 so that they are informed of which is the new active high-level controller. After this, the flow returns to step 206.

[0084] If the heartbeat signal is received in time, then at 212, a control message is activated by outputting an electrical signal to the motor / actuator 60. Also, the heartbeat signal countdown timer is reset. Additionally, an acknowledgement message with the current motor / actuator feedback is sent to the active high-level controller 20 or 22. The process then proceeds to step 208.

[0085] In the communications network 16, each of the multiple high-level controllers 20, 22, the low-level control system 14, the multiple sensors 18 (and the server 40) is independently addressable so as to have separate responsibility for being the source and / or destination of data transmitted by the network 16.

[0086] In one embodiment, the network messaging controller is a publish and subscribe messaging system. In one embodiment, the server 40 comprising the network messaging controller is a ROS server.

[0087] In one embodiment, sensors 18 are each connected to the network by a network adapter, such as ROS adapters 44, 46, and 48. In one embodiment, low-level controller 32 is connected to the network by a network adapter, such as ROS adapter 30.

[0088] In one embodiment, each high-level controller is connected to the network by a separate network interface adapter.

[0089] Exemplary code for software to execute the High Level Controller (HLC) process is as follows:

[0090]

number

[0091] Exemplary code for software to implement the Low Level Controller (LLC) process is as follows:

[0092]

number

[0093] The present invention has the advantage that each component is independent and does not require the functionality of other computers (if the lower level is unavailable, the higher level cannot issue any control commands, but the higher level can still start up and interact with the network).

[0094] This design has two main advantages: 1. The communication channel between the HLC and LLC is not a fixed line (i.e., serial) but allows software switching between HLC devices; and 2. The sensors are not owned by any other component (each sensor sits behind a single board computer (SBC) adapter). The single board computer adapter acts as an interface to the network. a. This allows one HLC to subscribe to a sensor via its network address.

[0095] The central network in this embodiment includes a Robot Operating System (ROS), which is a publish / subscribe communication system that allows HLCs to easily subscribe to data published by sensors and LLCs to subscribe to messages published by HLCs.

[0096] 1.1.1 HLC switching execution The HLC switching procedure is performed by the LLC on the network side. The LLC consists of two parts: 1. Microcontroller: Takes driving commands (speed, steering angle) and converts them into electrical signals that drive actuators that control the vehicle. 2. Ros Adapter: Acts as an interface to the ROS network, subscribes to control messages from the HLC and passes them to the LLC via serial.

[0097] In an alternative implementation, the decision to switch high-level controllers is made outside of the LLC, although the actual switch occurs from the LLC. In one embodiment, there may be an additional heartbeat from low level to high level. This may not be for switching high-level controllers, but may be for safety purposes (e.g., the vehicle applies the parking brake if no command is received by the active high-level controller).

[0098] The Ros adapter 30 is responsible for processing the active HLC, which provides an abstraction layer between the low-level controller 32 and the source of the message. This allows the controller 32 to focus on executing the drive commands. This functional focus increases the reliability of the low-level control system 14.

[0099] Modifications and variations that will be apparent to one skilled in the art are intended to be within the scope of the present invention.

Claims

1. 1. A control system for an autonomous vehicle or robot, comprising: a plurality of high level controllers, each high level controller capable of providing high level operational commands independently of other said high level controllers; a low-level controller configured to receive the high-level motion commands of one of the high-level controllers and convert the received high-level motion commands into electrical outputs for a plurality of electric motors / actuators for driving the vehicle / robot; a decision system independent of the high-level controllers and configured to determine which of the high-level controllers are active, where only the active high-level controller is used, and provide the high-level operational commands to the low-level controllers; a messaging system that forwards the high-level operational commands of the active high-level controllers to the low-level controllers; the decision system comprises a heartbeat signal detector for checking receipt by the low-level controller of a heartbeat signal transmitted from the active high-level controller; A control system, wherein the decision system is configured such that which high-level controller is the active high-level controller is changed when the heartbeat signal is not received by the low-level controller.

2. 2. The control system of claim 1, wherein the messaging system also forwards low-level responses of the low-level controller to the high-level controller.

3. 2. The control system of claim 1, A control system wherein the messaging system indicates to the high-level controllers which of the high-level controllers is the active high-level controller.

4. 4. The control system of claim 3, A control system, wherein the decision system comprises a network messaging controller configured to record which high-level controller is the active high-level controller.

5. 5. The control system of claim 4, The heartbeat signal detector is configured to signal the network messaging controller that the active high-level controller should be changed if the heartbeat signal is not received by the low-level controller.

6. 2. The control system of claim 1, A control system, wherein the active high-level controller is configured to calculate a trajectory for the vehicle / robot and generate the high-level motion commands from the calculated trajectory.

7. 2. The control system of claim 1, A control system wherein the high-level controllers that are not the active high-level controllers idle until they become the active high-level controllers.

8. 8. The control system of claim 7, A control system wherein idling includes synchronizing states with the states of said active high level controller.

9. 2. The control system of claim 1, The control system further comprises a network switch for sharing data, including the signals, between elements connected to a network, including the high-level controller, the low-level controller, and a decision system.

10. 2. The control system of claim 1, further comprising a plurality of sensors; The sensor is connected to a network and provides sensing data to one or more elements connected to the network.

11. 11. The control system of claim 10, The active high-level controller consumes the sensing data from the sensor.

12. 12. The control system of claim 11, The active high-level controller uses the sensing data to calculate the high-level operating commands.

13. 2. The control system of claim 1, A control system in which the active high-level controller transmits the high-level operating commands only to the low-level controllers over a network.

14. 2. The control system of claim 1, A control system, wherein the decision system sets an initial active controller based on an initial configuration upon initial startup of the control system.

15. 2. The control system of claim 1, A control system in which the low level controller provides feedback from sensors associated with the electric motor / actuator to the active high level controller.

16. 2. The control system of claim 1, A control system in which the low level controller provides an acknowledgment response to commands from the active high level controller.

17. 2. The control system of claim 1, A control system wherein the high-level operating commands are communicated from the active high-level controller to the low-level controller via the heartbeat signal.

18. 1. A method for controlling an autonomous vehicle or robot, comprising: Providing multiple high-level controllers; Providing a low-level controller; Providing a decision system; activating the high level controller; an active high-level controller providing high-level operating commands to said lower-level controllers independent of other said higher-level controllers; the low-level controller receiving the high-level motion commands of the active high-level controller and converting the received high-level motion commands into electrical outputs for a plurality of electric motors / actuators for driving the vehicle / robot; the decision system determines changes to the active high-level controller independently of the high-level controller; providing a messaging system for forwarding the high-level operational commands of the active high-level controller to the low-level controller; Including, the decision system comprises a heartbeat signal detector for checking receipt by the low-level controller of a heartbeat signal transmitted from the active high-level controller; The method, wherein the decision system is configured to change which high-level controller is the active high-level controller when the heartbeat signal is not received by the low-level controller.

19. 1. A control system for an autonomous vehicle or robot, comprising: a plurality of high-level controllers, each high-level controller capable of providing high-level operational commands to a lower-level controller; a low-level controller configured to receive the high-level motion commands of one of the high-level controllers and convert the received high-level motion commands into electrical outputs for a plurality of electric motors / actuators for driving the vehicle / robot; a decision system independent of the high-level controllers and configured to determine which of the high-level controllers are active, where only the active high-level controllers are used, and providing the high-level operating commands to the low-level controllers; a plurality of sensors for receiving data relating to the vehicle / robot and / or its environment; network-connected elements including the high-level controller, the low-level controller, and the sensor; a messaging system that transfers the high-level operational commands of the active high-level controller to the low-level controller; said elements being independently addressable so as to have separate responsibility for being the source and / or destination of data conveyed by said network; the decision system comprises a heartbeat signal detector for checking receipt by the low-level controller of a heartbeat signal transmitted from the active high-level controller; A control system, wherein the decision system is configured such that which high-level controller is the active high-level controller is changed when the heartbeat signal is not received by the low-level controller.

20. 1. A method for controlling an autonomous vehicle or robot, comprising: a plurality of high level controllers, each capable of issuing high level operational commands; a low-level controller configured to receive the high-level motion commands of one of the high-level controllers and convert the received high-level motion commands into electrical outputs for a plurality of electric motors / actuators for driving the vehicle / robot; a plurality of sensors for receiving data relating to the vehicle / robot and / or its environment; and providing networked elements including the high-level controller, the low-level controller, a decision system and the sensor; an active high-level controller providing high-level operating commands to said lower-level controllers independent of other said higher-level controllers; providing a messaging system for forwarding the high-level operational commands of the active high-level controller to the low-level controller; the network conveys messages between the network elements, the network elements being independently addressable so as to have separate responsibility for being the source and / or destination of data conveyed by the network; the decision system comprises a heartbeat signal detector for checking receipt by the low-level controller of a heartbeat signal transmitted from the active high-level controller; The method, wherein the decision system is configured to change which high-level controller is the active high-level controller when the heartbeat signal is not received by the low-level controller.

21. 20. A control system as claimed in claim 1 or 19, wherein each of the high level controllers is implemented on a different physical machine.

22. 20. The control system of claim 1 or 19, wherein each of the high-level controllers is implemented only on the vehicle or robot.

Images