Baidu USA LLC

Nio Usa, Inc.

Nio Technology (anhui) Co., Ltd.

Xiaodong Liu

Ning Qu

Bo Guo

Alexander Jeffrey Smith

Yaoming Shen

Miaosen Shen

Yadunandana Yellambalase

Stephen C Holland

In one embodiment, method for determining capability boundary of a safety redundancy of an autonomous driving vehicle (ADV) includes obtaining a sensor layout associated with the ADV representing a system having a plurality of sensors mounted on a plurality of locations of the ADV. A zone failure risk of one or more sensors within the predetermined zones is estimated based on statistical operational data of the one or more sensors for each of the plurality of predetermined zones. An overall failure risk of the sensors is determined based on the zone failure risks of the predetermined zones based on relative locations of the sensors across the predetermined zones. A dynamic risk adjustment is determined based on the overall failure risk of the sensors, the dynamic risk adjustment representing a reliability of a sensor system associated with the ADV for estimating a safety of autonomous driving of the ADV.

Method for determining capability boundary and associated risk of a safety redundancy autonomous system in real-time

Systems of an autonomous vehicle and the operations thereof are provided. Autonomous vehicles may rely on data inputs, processes, and output commands. Errors due to translation errors, failed or faulty equipment, connections, and other components may cause a dynamic vehicle path to approach a dynamic safe zone or vice versa. If so, a warning message may be sent and processed by the motion control system, when the vehicle is responding to commands correctly, or actuator control, when the vehicle is not responding to commands correctly. Should a safe zone be redrawn to exclude the vehicle's path, a failure message is sent to the appropriate system for mitigation.

Vehicle path-planner monitor and controller

Systems and methods of determining a risk distribution associated with a multiplicity of coverage zones covered by a multiplicity of sensors of an autonomous driving vehicle (ADV) are disclosed. The method includes for each coverage zone covered by at least one sensor of the ADV, obtaining MTBF data of the sensor(s) covering the coverage zone. The method further includes determining a mean time between failure (MTBF) of the coverage zone based on the MTBF data of the sensor(s). The method further includes computing a performance risk associated with the coverage zone based on the determined MTBF of the coverage zone. The method further includes determining a risk distribution based on the computed performance risks associated with the multiplicity of coverage zones.

Systems and methods to determine risk distribution based on sensor coverages of a sensor system for an autonomous driving vehicle

In one embodiment, a method for monitoring a localization function in an autonomous driving vehicle (ADV) can use known static objects as ground truths to determine when the localization function encounter errors. The known static objects are marked on a high definition (HD) map for the real-time driving environment. When the ADV detects one or more known static objects, the ADV can use sensor data, locations of the one or more static objects, and one or more error tolerance parameters to create a localization error tolerance area surrounding a current location of the ADV. The ADV can project the tolerance area on the HD map, performs a localization operation to generate an expected location of the ADV on the HD map, and determines whether the generated location falls within the projected tolerance area. If the generated location falls outside the projected tolerance area, indicating a localization function of the ADV encounter errors, the ADV can generate an alarm to alert a human driver to switch to a manual driving mode. If no human driver is available in the ADV, the ADV can activate a vision-based fail-safe localization procedure.

Method of monitoring localization functions in an autonomous driving vehicle

According to one embodiment, a motion trajectory boundary is obtained based on a trajectory that has been planned to drive an ADV for a next time period. A safe driving area boundary is determined for the ADV based on perception data perceiving a driving environment surrounding the ADV. The motion trajectory boundary and the safe drivable area boundary are projected onto a map such as an HD map. A relative location of the ADV within the map relative to the motion trajectory and the safe drivable area boundary is determined. A fail-safe action or a fail operational action may be performed based on the relative location of the ADV in view of the motion trajectory boundary and the safe drivable area boundary.

Method to monitor control system of autonomous driving vehicle with multiple levels of warning and fail operations

Systems and methods of adjusting zone associated risks of a coverage zone covered by one or more sensors of an autonomous driving vehicle (ADV) operating in real-time are disclosed. As an example, the method includes defining a performance limit detection window associated with a first sensor based on a mean time between failure (MTBF) lower limit of the first sensor and a MTBF upper limit of the first sensor. The method further includes determining whether an operating time of the ADV operating in autonomous driving (AD) mode is within the performance limit detection window associated with the first sensor. The method further includes in response to determining that the operating time of the ADV operating in AD mode is within the performance limit detection window of the first sensor, adjusting a zone associated risk of the coverage zone to a performance risk of a second sensor.

Systems and methods to enhance early detection of performance induced risks for an autonomous driving vehicle

A vehicle control unit (e.g., a control unit for an automobile) receives feedback from an intelligent voltage/current sensor and a DC/DC controller. The DC/DC controller comprises a first switch for controlling power from a primary power source (e.g., low voltage power supplied from a high voltage battery). The intelligent voltage/current sensor senses power output from the primary power source. The vehicle control unit processes feedback from the intelligent voltage/current sensor and/or the DC/DC controller to determine if a failure has occurred in the primary power source. In response to determining the failure in the primary power source, the vehicle control unit disables the power from the primary power source using a second switch (e.g., a switch in a relay).

System and method for providing ASIL D fail operational power systems in automated vehicle applications

Systems and methods are disclosed for dynamically adjusting effective sensor coverage coordinates of a sensor used to assist in navigating an autonomous driving vehicle (ADV) in response to environmental conditions that may affect the ideal operation of the sensor. An ADV includes a navigation system and a safety monitor system that monitors some, or all, of the navigation system, including monitoring: dynamic adjustment of effective sensor coverage coordinates of a sensor and localization of the ADV within a high-definition map. The ADV safety monitor system further determines safety-critical objects surrounding the ADV, determines safe areas to navigate the ADV, and ensures that the ADV navigates only to safe areas. An automated system performance monitor determines whether to pass-through ADV navigation control commands, limit one or more control commands, or perform a fail-operational behavior, based on the ADV safety monitor systems.

Method to define safe drivable area for automated driving system

Systems and methods are disclosed for an ADV to leverage pre-defined static objects along a planned route of travel to detect and counter attacks that attempt to change the destination or the planned route. The ADV may detect updates to the static objects if the planned route is changed. Based on the updated static objects, the ADV determines if there is an abnormal re-routing of the planned route or if there is a new route due to a suspicious destination change. The ADV may also leverage the static objects to detect spoofing attacks against the sensor system. The ADV may evaluate if sensors of the sensor system are able to detect and identify the static objects to identify an impaired sensor. The ADV may perform cross-check on the ability of the sensors to detect and identify dynamic objects to gain confidence that the impaired sensor is due to spoofing attacks.

Methods to detect spoofing attacks on automated driving systems

In one embodiment, a method for performing an obstacle detection for an ADV includes detecting an obstacle by a primary ADS and a secondary ADS using an obstacle detection algorithm based on sensor data provided by sensors on the ADV. In response to detecting the obstacle, a first controlled stop distance and a second controlled stop distance are calculated by the primary ADS and secondary ADS respectively based on a speed and a deceleration capability of the ADV. The first and second controlled stop distances between the primary ADS and secondary ADS are exchanged to determine a third controlled stop distance which is the maximum of the two. In response to determining that the ADV reaches within the third controlled distance between the ADV and the obstacle, a controlled stop operation is activated by the primary ADS to decelerate the ADV based on the third controlled stop distance.

Method for enhancing in-path obstacle detection with safety redundancy autonomous system

Fail-operational architecture with functional safety monitors for automated driving system

Method to dynamically determine vehicle effective sensor coverage for autonomous driving application

Embodiments of the present disclosure are directed to using Automotive Safety Integrity Level (ASIL) decomposition and a functional deployment strategy to redundantly distribute functionality across existing controllers. Accordingly, each of a plurality of non-redundant controllers of the vehicle can execute a plurality of functions. The controllers can comprise a vehicle controller and a controller for each of a plurality of different powertrain systems. The plurality of functions can comprise one or more functions for each of the plurality of powertrain systems and each of the functions can execute on multiple controllers. When a failure of one controller occurs, this can be detected either by a controller's build-in internal monitor or by a two-way comparison or three-way voting by external controllers. The functions executing on the failed controller can be transitioned to other controllers based on prior execution of those functions by the other controllers.

Highly-integrated fail operational e-powertrain for autonomous driving application

Embodiments include a power device for an electric vehicle. The power device includes a first bus associated with a first voltage, and a second bus associated with a second voltage, different than the first voltage. The power device includes a plurality of switching elements coupled to a first battery, a second battery, the first bus and the second bus. On/off states of the plurality of switching elements control electrical connections to the first bus, the second bus, the first battery and the second battery according to an operation mode.

Growing community of inventors

San Jose, CA, United States of America

Xiaodong Liu