Autonomous driving path protection

Abstract

Autonomous vehicles (1000) are arranged advantageously to segregate a trajectory planning function from a safety management function. An emergency safety system (1005) for an autonomous vehicle (1000) comprises an emergency sensor unit (150) and an emergency safety module (140) installed in the autonomous vehicle (1000). The emergency safety system (1005) communicates with a separate autonomous driving module (120) which is connected to a sensor package (130).

Description

AUTONOMOUS DRIVING PATH PROTECTIONTECHNICAL FIELD

[0001] The present invention relates to the field of autonomous vehicles, and more particularly safety-related aspects of autonomous vehicles.BACKGROUND ART

[0002] Autonomous driving systems developed for use and operation in autonomous vehicles are computationally expensive and rely on demanding data throughput rates.

[0003] At a minimum, autonomous driving systems rely upon visual spectrum cameras to sense the external environment, and typically also rely upon a range of other sensors that may include LiDARs, radars and the like.

[0004] Given the computational demands of autonomous driving, the latency of such systems may be of the order of 100-200ms or more as an indicative range. Latency can vary considerably depending upon the nature of the environment, and dynamic complexity of that environment. An unspecified and variable latency is not desirable or satisfactory for safety reasons.

[0005] Safety incidents are most likely to occur in complex or dynamic environments in which latency may be expected to increase, thus compounding the likelihood of such incidents.

[0006] While the latency of current autonomous driving systems is reasonably fast, latency can extend under unfavourable circumstances owing to the unpredictable nature of computational demands of complex hardware. While this hardware is typically operating at the edge, that is, while embedded in the vehicle, this also means that computational power cannot be scaled beyond that which is already available.

[0007] Also, while this latency may compare favourably with the latency or reaction time of a human driver, which can also vary considerably for other reasons, it would be ideal to remove such latency altogether.

[0008] One objective of the present invention is to at least attempt to address one or more of these and other limitations associated with existing approaches to automated driving systems for autonomous vehicles.SUMMARY OF INVENTION

[0009] The inventive concept arises from a recognition that autonomous vehicles are arranged advantageously to segregate a trajectory planning function from a safety management function.

[0010] Disaggregating a trajectory planning function and a safety management function can have many advantages. A trajectory planning function can be swapped between different implementations that matches specific requirements, and matched with a safety management function that also matches other specific requirements.

[0011] As is evident, one should remain mindful that the performance and other characteristics of the trajectory planning function and the safety management function are compatible, and can perform in accordance with expectations.

[0012] Embodiments of the present invention accordingly use an autonomous driving module in conjunction with operation with an emergency safety module forming part of the emergency safety system as described herein.

[0013] An emergency sensor unit comprises a sensor capable of generating a stream of pointcloud data representative of reflections, typically arising from items or objects within a field of view of the emergency sensor unit and detected from an environment within this field of view. The emergency sensor unit preferably comprises a millimetre-wave radar or lidar, installed and oriented towards an end of the autonomous vehicle in a forward-facing direction for the ordinary operative direction of travel of the vehicle. Other configurations of sensor type and location are possible. In particular, emergency sensor units may be located at either end of the vehicle, or a sensor may be located along the vehicle with a 360° field of view.

[0014] The autonomous driving module plans a trajectory for the autonomous vehicle as a compound path across a predetermined time horizon. The compound path is characterised as a stream of multipath data representative of the projected trajectory of spatial co-ordinates of the autonomous vehicle, and accompanying timestamps. Planning for the compound path of the planned trajectory is determined though sensing data provided by a sensor package installed on the autonomous vehicle and may accordingly be updated based according to fresh sensing data.

[0015] As an example, one model an autonomous driving module may adopt is a cost map approach. A cost map calculates costs between the location of theautonomous vehicle and its location to account for obstacles or other factors. The autonomous driving module navigates a compound path as the path of least cost through the cost map. This may be informed by vehicle dynamics or other factors.

[0016] The range of the emergency sensor unit is designed for the specific application at hand and is typically used to cover a range (say 0-60m).

[0017] The present invention in one embodiment comprises An emergency safety system for an autonomous vehicle, the emergency safety system operating separately from an autonomous driving system used by the autonomous vehicle and selectively overriding the autonomous driving system in use, the emergency safety system comprising: an emergency sensor unit installed on the autonomous vehicle and generating a stream of pointcloud data indicative of return path reflections within a field of the emergency sensor unit; an emergency safety module installed in the autonomous vehicle and in communication with an autonomous driving system and configured to receive from the autonomous driving system a stream of multipoint data representative of a planned trajectory for the autonomous vehicle, and the emergency safety module also in communication with the emergency sensor unit and receiving from the emergency sensor unit the stream of pointcloud data generated by the emergency sensor unit; wherein the emergency safety module performs steps of (i) dynamically determining an emergency zone as a volume along the planned trajectory of the autonomous vehicle; (ii) detecting obstacles based upon the stream of pointcloud data received from the emergency sensor unit; (iii) determining which of the detected obstacles are within the emergency zone; and (iv) generating an emergency signal when detected obstacles are within the emergency zone; and a central control unit installed in the autonomous vehicle and in communication with the emergency safety module and the autonomous driving module to control the autonomous vehicle to the planned trajectory subject to an emergency override responsive to the emergency signal received from the emergency safety module.

[0018] The present invention in a related embodiment further comprises a corresponding method of operating an emergency safety system for an autonomousvehicle. Accordingly, the present invention in another embodiment comprises a method of operating an emergency safety system for an autonomous vehicle, the emergency safety system operating separately from an autonomous driving module used by the autonomous vehicle and selectively overriding the autonomous driving system in use, the method comprising steps performed by an emergency safety module of the emergency safety system of: receiving a stream of pointcloud data from an emergency sensor unit installed on the autonomous vehicle, the stream of pointcloud data indicative of return path reflections within a field of the emergency sensor unit; receiving a stream of multipoint data representative of a planned trajectory from the autonomous driving system; dynamically determining an emergency zone as a volume along the planned trajectory of the autonomous vehicle; detecting obstacles based upon the stream of pointcloud data received from the emergency sensor unit; determining which of the detected obstacles are within the emergency zone; and generating an emergency signal when detected obstacles are within the emergency zone.

[0019] The emergency zone is preferably determined as a volumetric space based upon a spatial envelope of the autonomous vehicle over an immediate travel duration along the planned trajectory of the autonomous vehicle, and determined based upon one or more of (i) the stream of multipoint trajectory data from the autonomous driving module, (ii) height and width of the autonomous vehicle, and (iii) velocity of the autonomous vehicle.

[0020] Certain embodiments involve brake control units installed in the autonomous vehicle and in communication with the central control unit. The generated emergency signal is transmitted to and received by the central control unit, which in response commands an emergency stop through the brake control units.

[0021] Certain embodiments of the present invention involve the autonomous driving module installed in the autonomous vehicle, and preferably forming part ofthe central control unit. Alternative embodiments of the present invention involve the autonomous driving module located and operating outside of the autonomous vehicle, which as within an immediate environment, such as a controlled local or remote industrial setting, or within an external package that can be attached to the autonomous vehicle.

[0022] The emergency safety system preferably comprises a sensor package comprising a collection of one or more sensors, and the sensor package in communication with the autonomous driving module for sensing the environment of the autonomous vehicle to inform generation of the stream of multipoint trajectory data for the planned trajectory of the autonomous vehicle.

[0023] Similarly, the sensor package may in certain embodiments be installed in the autonomous vehicle, or alternatively be external to the autonomous vehicle— for example, forming part of the immediate environment.

[0024] The approach of the present invention has various advantages.

[0025] First, segregating a trajectory planning function from an emergency safety function permits mixing of different executions of these functions in a complementary manner. As a simple example, an application may require only low demand trajectory planning but high demand safety management. This may be an application for an industrial environment in which the environment is closed and controlled, but where there is low risk of safety incidents.

[0026] Second, an emergency safety management function can be designed to operate at very low latency, whereas a trajectory planning function typical has greater, often much greater latency owing to the inevitable complexity and thus computational demand of the navigational task.

[0027] The implication is that a trajectory planning function can be selected without close regard to latency, though safety can be assured by suitable selection of the emergency safety management function. Thus risk can be displaced from the trajectory planning function to the emergency safety management function, in effect, and engineering decisions made upon the hardware and software that best suits requirements of the respective functions.

[0028] Also, the emergency sensor unit has a field and can detect various obstacles within its view. Implicitly the emergency safety module interprets various obstacles from the pointcloud data from the emergency safety unit, and rejectsvarious ‘false positives’ that are not intersecting within the emergency zone ahead of the autonomous vehicle. The emergency zone dynamically updates in response to the multipoint data received from the autonomous driving module.

[0029] The emergency zone is dynamically updated as the autonomous vehicle travels along planned trajectory, based upon the multipoint data received from the autonomous driving module.

[0030] Furthermore, the emergency zone as a volume has particular advantages in practical terms. Hazardous objectives can appear at any place within the emergency volume. Unanticipated hazardous obstacles may emerge and intersect the emergency zone. Examples include swinging cargo doors from trucks and vans, falling objects from adjacent worksites or other vehicles, rolling hazards such as shopping trolleys and the like.

[0031] The overall effect of separating a safety management function from a trajectory planning function is advantageously ‘uplifting’ the safety integrity of the trajectory planning, autonomous driving module and entire vehicle in certain application environments, and also in certain scenarios during development, field trials, or production use of autonomous driving systems that may not, or may not yet have the required integrity to operate in the field without additional safety mechanisms.

[0032] Many other advantages exist, as will be evident to those skilled in the relevant art.BRIEF DESCRIPTION OF DRAWINGS

[0033] FIG 1 is a schematic diagram of an autonomous vehicle according to an embodiment of the present invention, depicted with a compound path trajectory planned by an autonomous driving module for the autonomous vehicle.

[0034] FIG 2 is a schematic diagram of the autonomous vehicle of FIG 1 depicting some features of the autonomous vehicle.

[0035] FIG 3 is a sequence diagram depicting of the operation of the autonomous vehicle of FIGS 1 and 2.DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

[0036] FIG 1 depicts in schematic form an autonomous vehicle 1000 in operation, navigating to a destination ahead (not shown). A stream of pointcloud data 1010 isgenerated, and used to identify obstacles around the autonomous vehicle 1000. A a significant obstacle 1020 identified. A planned trajectory 1030 is generated as indicated, representing a trajectory planned for the autonomous vehicle 1000. The planned trajectory 1030 comprises a stream of multipoint data 1040 which segment the planned trajectory 1030 into a sequence of waypoints each comprising spatial data representative of positions specified as spatial coordinates the autonomous vehicle 1000 is expected to traverse over an immediate time horizon. The multipoint data 1040 may optionally also comprise timestamp data paired with the spatial data, so that the velocity of the autonomous vehicle 1000 across the planned trajectory 1030 is also projected.

[0037] The stream of pointcloud data 1010 may be supplemented by or substituted by alternative forms of data (not shown) such as video feed data originating from cameras, for example.

[0038] The multipoint data 1040 which maps the expected course of the autonomous vehicle 1000 along the planned trajectory 1030 assumes a static environment that fails to account for hazardous obstacles 1070 that appear in front of the autonomous vehicle 1000.

[0039] An emergency zone 1050 is defined in front of the autonomous vehicle 1000, a distance ahead of the autonomous vehicle 1000 along the planned trajectory 1030.

[0040] The emergency zone 1050 is a volumetric space that covers the envelope of the autonomous vehicle 1000 is expected to travel along the planned trajectory 1030, and well as margin of error that can be reasonably assumed.

[0041] The emergency zone 1050 desirably has a certain safety buffer, that is, the emergency zone 1050 covers more than the expected travel envelope of the autonomous vehicle 1000. This safety buffer can be designed to increase with greater distance and time from the present moment and position of the autonomous vehicle 1000.

[0042] The emergency zone 1050 may also be adjusted to suit prevailing conditions, for example ambient lighting conditions by being greater in extent using poor lighting conditions, or whether conditions that may adversely affect steering and braking traction, or kerb weight of the autonomous vehicle 1000, and other factors of possible relevance.

[0043] The linear extent of the emergency zone 1050 along the compound path 1030 may vary according to application, conditions or other factors, as with the safety buffer used for the emergency zone 1050.

[0044] As an example, a prevailing length of the emergency zone 1050 may be selected to accord with a distance covered in a nominal time, or a multiple of estimated stopping distance. This may be selected according to design and application. The capability and responsiveness of how the stream of multipoint data 1040 is generated may also be a factor, as described below in further detail.

[0045] FIG 2 is similar to FIG 1 though is truncated to depict further detail relating to the autonomous vehicle 1000.

[0046] Autonomous vehicle 1000 comprises in this embodiment an emergency safety system 1005, which relevantly comprises a central control unit (CCU) 110, an autonomous driving module (ADM) 120, a sensor package 130 and an emergency safety module 140, and emergency sensor unit 150.

[0047] The ADM 120 is in communication with the CCU 110, and is depicted as being apart from the CCU 110 but for convenience within the emergency safety system 1005. The ADM 120 may alternatively form part of the CCU 110, as a component subsystem of the CCU 110, for example. Similarly, the ADM 120 may in other embodiments be depicted as separate from the emergency safety system 1005 entirely, either installed on the autonomous vehicle 1000, or residing beyond the autonomous vehicle 1000, and accessed via a communications network (not shown).

[0048] Sensor package 130 is depicted as apart from the emergency safety system 1005 but as with ADM 120 with which is connected can also be configured inside of the emergency safety system 1005, though operating separately from the core components of the emergency safety system 1005.

[0049] The ADM 120 is connected to a sensor package 130 for sensing the external environment of the autonomous vehicle 1000. The sensor package 130 is depicted in FIG 2 as being distributed across different positions on or around the autonomous vehicle 1000, towards each corner specifically, though this need not be the case. The sensor package 130 comprises at least one sensor, and typically a number and range of different sensors that are used collectively to interpret the environment in which the autonomous vehicle 1000 is operating. As can beappreciated, this may comprise one or cameras, one or lidars or radar sensors distributed at different positions around the autonomous vehicle 1000.

[0050] The sensor package 130 transmits one more data streams comprising a video feed in the case of a camera, and streams of pointcloud data 1010 in the case of lidar or radar sensors. Lidar or radar sensors may be adapted to cover particular distance ranges.

[0051] Datastreams received from the sensor package 130 are interpreted by the ADM 120 and used to develop a planned trajectory 1030 that is provided as a stream of multipoint data 1040 that, as described above, is representative of the planned trajectory 1030 provided to the CCU 110 for the autonomous vehicle 1000 to follow.

[0052] The calculation of the planned trajectory 1030 by the ADM 120 involves navigating through the autonomous vehicle 1000 through its immediate environment towards a broader destination. An imperative of the ADM 120 is generate a planned trajectory 1030 that safely navigates along, for example, a roadway, while also avoiding moving and stationary objects that may present collision hazards. The ADM 120 may also be programmed to account for traffic rules, maintain a safe and predictable roadway posture when operating on public roadways where other vehicles, pedestrians and so on may be encountered.

[0053] As will be appreciated, an ADM 120 is desirably fit for purpose, and that purpose is specific for the particular application intended. One ADM 120 may be intended to operate on a limited sensor package 130, and basic hardware, in a low- risk environment— for example, an automated golf cart, or factory assistance trolley. Conversely, another ADM 120 may be designed to operate in a comprehensive sensor package 130, using advanced hardware in a moderate high-risk environment— for example, automated urban taxi service or trucking application.

[0054] Operation of the ADM 120 is in any event computationally expensive and hence there is an inherent latency in generating a suitable planned trajectory 130 when relying on a large data pool to navigate a dynamic environment. As an example, the latency of an ADM 120 may be 100ms-200ms at a minimum, to select an indicative range.

[0055] Returning to FIG 1 , CCU 110 comprises an emergency safety module(ESM) 140. ESM 140 may be implemented in software, hardware or a combinationof software or hardware. ESM 140 is connected to an emergency sensor unit (ESU) 140, which is depicted as a single sensor unit at the forward part of the autonomous vehicle 1000. As with the sensor package 130, the ESU 150 may optionally comprise multiple emergency sensors, distributed at different positions across the autonomous vehicle 1000.

[0056] The ESU 150 is selected to cover the anticipated extent of the emergency zone 1050, and preferably beyond when possible. The ESU 150 may comprise a single automatic radar sensor. ESU 150 generates a stream of pointcloud data 1060 from which objects can be identified and deemed hazardous obstacles 1070 when so identified. The stream of pointcloud data 1060 may comprise raw higher- resolution data generated from hardware components of the ESU 150, or processed lower-resolution processed data that seeks to identify specific hazardous obstacles 1070, possibly by a single point. To identity an obstacle discerned from the stream of pointcloud data 1060 as a hazardous obstacle 1070 is to some extent arbitrary. A plastic bag blowing in the wind may different little in size from a stray basketball passing towards the vehicle 1000 but represent different classes of hazards. The stream of pointcloud data 1060 generated by the ESU 150 is transmitted to the ESM 140.

[0057] The ESU 150 is preferably a radar unit that is intended for automotive autonomous vehicles, or automotive ADAS (advanced driver assistance system), whether in an electric vehicle or otherwise. Automotive radar units typically operate at millimeter wavelengths (mmWave), and corresponding frequencies (say 30- 300 GHz). Lidar units designed for automotive or industrial use can alternatively be used.

[0058] Some applications will favour use of short-range radar (SRR), which operates over say an indicative range of 0.5m to 20m.

[0059] Medium-range radar (MMR) covering an indicative range of 1 m to 60m, or long range radar (LRR) covering an indicative range of 10m to 250m can also be used as it suits the particular application.

[0060] Most applications will be covered by use of an ESU 150 using either SRR or MRR or a combination of both. The ADM 120 may offer a range of capabilities and accordingly may be able to adjust the planned trajectory 1030 to handle obstaclesbeyond a certain distance given typical operating speeds of the autonomous vehicle1000

[0061] The CCU 110 is also connected to and in communication with brake control units (BKU) 160 which are preferably positioned at each corner of the autonomous vehicle 1000 and control a brake unit (not shown) which operates to bring the autonomous vehicle 1000 to an abrupt stop when necessary. A pair of BKUs 160 positioned at the front or rear of the vehicle 1000. Braking can also be provided through the CCU 110 through actuation of traction motors (not shown).

[0062] The CCU 110, receives the generated stream of pointcloud data 1060 from the ESU 140 and operates to identify a hazardous obstacle 1070 within the field of the ESU 140, and moreover with the emergency zone 1050. When a hazardous object 1070 intersects the emergency zone 1050, the CCU 110 commands an emergency stop of the autonomous vehicle 1000 through the BKUs 160.

[0063] Any hazardous obstacles 1070 within the emergency zone 1050 can be considered a collision risk as collision is highly likely, which justifies using emergency braking. Simply put, the ADM 120 will not typically be capable of a timely and safe response to the appearance of a hazardous obstacle 1070 within the emergency zone 1050.

[0064] The ESU 140 and associated processing of the stream of pointcloud data 1060 in the CCU 110 is designed to be low latency, for example of 10ms-20ms to select an indicative range.

[0065] The latency of the ADM 120 (say 100-200ms) when assessing the entire dynamic environment is materially greater than the latency of the CCU 110 (say 10- 20ms) when assessing the bounded range of the ESU 140 focused across the protection zone 1050.

[0066] First, the ADM 120 may be selected from a broad range of performance capabilities, and in any event requires computationally intensive tasks using high data loads. By contrast, the ESM 140 can use advanced, computationally performant hardware and is executing a far less computationally demanding tasks using a a relatively modest data stream, namely the stream of pointcloud data 1060 from the ESU 150.

[0067] Use of the ESM 150 is inherently a confined task that can operate at low latency, effectively zero latency when considering that the responsivenessprincipally rests with the physical constraints of brakes can bring the autonomous vehicle 1000 to rest.

[0068] FIG 3 is a sequence diagram of the process involved in operation of the autonomous vehicle of FIGS 1 and 2.

[0069] Sensor package 130 installed on autonomous vehicle 1000 transmits a datastream to the ADM 120 in step 202.

[0070] The ADM 120 continually maps the compound path 1030 based upon the sensor datastream in step 204. The ADM 120, based upon the compound path 1030, generates and transmits a stream of multipoint data 1040 to the CCU 110 in step 206.

[0071] The ESU 150 transmits a stream of pointcloud data 1060 to the ESM 140 in step 208. At the ESM 140, the stream of pointcloud data 1060 received from the ESU 150 is used to detect objects 1070 captured in the stream of pointcloud data 1060 from the ESU 150 in step 210.

[0072] The CCU 110 commands the autonomous vehicle 1000 to track along the waypoints defined by the stream of multipoint data 1040 in step 214, which is achieved by coordinating control of various edge control devices and thus the respective edge devices of the vehicle 1000.

[0073] The CCU 110 also streams a definition of the protection zone 1050 based upon the stream of multipoint data 1040 received from the ADM 120 in step 206.

[0074] The protection zone definition is streamed to the to the ESM 140 in step 216

[0075] At the ESM 140, a determination is made if objects 1070 detected in step 210 are inside the protection zone 1050 as received in step 216.

[0076] When an object 1070 intersects the emergency zone 1050 in step 218, the ESM 140 notifies the CCU 110 of an emergency stop is required in step 220, which is required owing to an imminent collision expected between the autonomous vehicle 1000 and the object 1070 should the autonomous vehicle 1000 continue tracking to the stream of multipoint data 1040 provided by the ADM 120.

[0077] The CCU 110 accordingly commands an emergency stop from the BKU 160 in step 222 and also notifies the ADM 120 of an emergency stop in step 224.

[0078] The BKU 160 controls the brakes to apply a stopping braking force in step 226, and notifies the CCU 110 that a stop is completed in step 228. The CCU 110 notifies the ADM 120 that a stop is complete in step 230, and confirms that the stop is complete to the ESM 140 in step 230.

[0079] As will be appreciated, many variations and alternatives implementations can be made to the described embodiment.

Claims

CLAIMS1 . An emergency safety system for an autonomous vehicle, the emergency safety system operating separately from an autonomous driving system used by the autonomous vehicle and selectively overriding the autonomous driving system in use, the emergency safety system comprising: an emergency sensor unit installed on the autonomous vehicle and generating a stream of pointcloud data indicative of return path reflections within a field of the emergency sensor unit; an emergency safety module installed in the autonomous vehicle and in communication with an autonomous driving system and configured to receive from the autonomous driving system a stream of multipoint data representative of a planned trajectory for the autonomous vehicle, and the emergency safety module also in communication with the emergency sensor unit and receiving from the emergency sensor unit the stream of pointcloud data generated by the emergency sensor unit; wherein the emergency safety module performs steps of (i) dynamically determining an emergency zone as a volume along the planned trajectory of the autonomous vehicle; (ii) detecting obstacles based upon the stream of pointcloud data received from the emergency sensor unit; (iii) determining which of the detected obstacles are within the emergency zone; and (iv) generating an emergency signal when detected obstacles are within the emergency zone; and a central control unit installed in the autonomous vehicle and in communication with the emergency safety module and the autonomous driving module to control the autonomous vehicle to the planned trajectory subject to an emergency override responsive to the emergency signal received from the emergency safety module.

2. An emergency safety system according to claim 1 , wherein the emergency zone is determined as a volumetric space based upon a spatial envelope of the autonomous vehicle over an immediate travel duration along the plannedtrajectory of the autonomous vehicle, and determined based upon one or more of (i) the stream of multipoint trajectory data from the autonomous driving module, (ii) height and width of the autonomous vehicle, (iii) velocity of the autonomous vehicle, (iv) kerb weight of the autonomous vehicle.

3. An emergency safety system according to claim 1 or 2, wherein the emergency zone is determined as a volumetric space based upon a spatial envelope of the autonomous vehicle over an immediate travel duration along the planned trajectory of the autonomous vehicle, and is determined based upon one or more of (v) ambient lighting conditions, and (vi) weather conditions and road conditions.

4. An emergency safety system according to any one of claims 1 to 3, further comprising brake control units installed in the autonomous vehicle and in communication with the central control unit, wherein the generated emergency signal is transmitted to and received by the central control unit, which in response commands an emergency stop through the brake control units.

5. An emergency safety system according to any one of claims 1 to 4, further comprising a sensor package, the sensor package comprising a collection of one or more sensors, and the sensor package in communication with the autonomous driving module for sensing the environment of the autonomous vehicle to inform generation of the stream of multipoint data representative of the planned trajectory of the autonomous vehicle.

6. An emergency safety system according to any one of claims 1 to 5, wherein the emergency sensor unit comprises a sensor selected from the group comprising a millimetre-wave radar and a lidar.

7. An emergency safety system according to any one of claims 1 to 6, wherein the autonomous driving module is installed in the autonomous vehicle.

8. An emergency safety system according to any one of claims 1 to 7, wherein the autonomous driving module is embedded in the central control unit.

9. An emergency safety system according to any one of claims 1 to 8, wherein the emergency safety module is embedded in the central control unit.

10. A method of operating an emergency safety system for an autonomous vehicle, the emergency safety system operating separately from an autonomous driving module used by the autonomous vehicle and selectively overriding the autonomous driving system in use, the method comprising steps performed by an emergency safety module of the emergency safety system of: receiving a stream of pointcloud data from an emergency sensor unit installed on the autonomous vehicle, the stream of pointcloud data indicative of return path reflections within a field of the emergency sensor unit; receiving a stream of multipoint data representative of a planned trajectory from the autonomous driving system; dynamically determining an emergency zone as a volume along the planned trajectory of the autonomous vehicle; detecting obstacles based upon the stream of pointcloud data received from the emergency sensor unit; determining which of the detected obstacles are within the emergency zone; and generating an emergency signal when detected obstacles are within the emergency zone.

11. A method according to claim 10, further comprising a step of determining the emergency zone as a volumetric space based upon a spatial envelope of the autonomous vehicle over an immediate travel duration along the planned trajectory of the autonomous vehicle, and determining based upon one or more of (i) the stream of multipoint trajectory data from the autonomous driving module, (ii) height and width of the autonomous vehicle, (iii) velocity of the autonomous vehicle, and (iv) kerb weight of the autonomous vehicle.

12. A method according to claim 10 or 11 , further comprising a step of determining the emergency zone as a volumetric space based upon a spatial envelope of the autonomous vehicle over an immediate travel duration along the planned trajectory of the autonomous vehicle, and is determined based upon one or more of (v) ambient lighting conditions, and (vi) weather conditions and road conditions.

13. A method according to any one of claims 10 to 12, further comprising a step of receiving at the central control unit the generated emergency signal generated at the emergency safety unit, and in response commanding from the central control unit an emergency stop through brake control units installed in the autonomous vehicle and in communication with the central control unit.

14. A method according to any one of claims 10 to 13, further comprising a sensor package, the sensor package comprising a collection of one or more sensors, and the sensor package in communication with the autonomous driving module for sensing the environment of the autonomous vehicle to inform generation of the stream of multipoint data representative of the planned trajectory of the autonomous vehicle.

15. A method according to any one of claims 10 to 14, wherein the emergency sensor unit comprises a sensor selected from the group comprising a millimetre-wave radar and a lidar.

16. A method according to any one of claims 10 to 15, wherein the autonomous driving module is installed in the autonomous vehicle.

17. A method according to any one of claims 10 to 16, wherein the autonomous driving module is embedded in the central control unit.

18. An emergency safety system according to any one of claims 10 to 7, wherein the emergency safety module is embedded in the central control unit.

Images