Autonomous vehicle failure mode management

• US 10,571,908 B2
• Filed: 08/15/2016
• Issued: 02/25/2020
• Est. Priority Date: 08/15/2016
• Status: Active Grant

• Current Assignee: Ford Global Technologies, LLC (Ford Motor Company)
• Original Assignee: Ford Global Technologies, LLC (Ford Motor Company)
• Inventors: Joyce, John P., Lauffer, Scott J., Abbas, Samer
• Primary Examiner(s): Shudy, Angelina
• Application Number:
  US15/236,780
• Publication Number:
  US 20180046182A1
• Time in Patent Office: 1,289 Days
• Field of Search: 701 26
• CPC Class Codes: B60W 2540/221 Physiology, e.g. weight, heartbeat, health or special needs
• CPC Class Codes: B60W 2555/20 Ambient conditions, e.g. wind or rain
• CPC Class Codes: B60W 2556/45 External transmission of data to or from the vehicle
• CPC Class Codes: B60W 50/0225 Failure correction strategy
• CPC Class Codes: B60W 60/0018 by employing degraded modes, e.g. reducing speed, in response to suboptimal conditions
• CPC Class Codes: B60W 60/0059 Estimation of the risk associated with autonomous or manual driving, e.g. situation too complex, sensor failure or driver incapacity
• CPC Class Codes: G01C 21/3415 Dynamic re-routing, e.g. recalculating the route when the user deviates from calculated route or after detecting real-time traffic data or accidents
• CPC Class Codes: G01C 21/3453 Special cost functions, i.e. other than distance or default speed limit of road segments
• CPC Class Codes: G05D 1/0055 with safety arrangements
• CPC Class Codes: G05D 1/0088 characterized by the autonomous decision making process, e.g. artificial intelligence, predefined behaviours using knowledge based models G06N5/00
• CPC Class Codes: G07C 5/008 communicating information to a remotely located station transmission systems for measured values G08C
• CPC Class Codes: G07C 5/02 Registering or indicating driving, working, idle, or waiting time only apparatus forming part of taximeters G07B13/00
• CPC Class Codes: G07C 5/0808 Diagnosing performance data testing of vehicles G01M17/00; testing of electrical installation on vehicles G01R31/005
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks

Abstract

A first computer including a processor is programmed to receive an indication of a failure mode in a vehicle and wirelessly transmit the indication of the failure mode to a remote server. The computer is further programmed to receive a revised route to a destination based at least in part on the failure mode and operate the vehicle along the revised route.

Claims

1. A system, comprising:

a vehicle computer and a remote server,

wherein the vehicle computer is programmed to;

determine a first risk level for operating a vehicle based on (1) a trouble code indicating a failure of a specified vehicle electronic control unit or sensor and (2) stored data specifying the first risk level for the failure of the specified vehicle electronic control unit or sensor;

transmit the first risk level to a remote server;

then, after transmitting the first risk level, receive, from the remote server, an instruction to take an action; and

operate the vehicle to take the action; and

wherein the remote server is programmed to;

receive the first risk level from the vehicle computer;

based on the first risk level and additional data that includes a stored weight that is applied to the additional data, determine a second risk level for the failure of the specified vehicle electronic control unit or sensor;

based on the second risk level, determine an action for the vehicle; and

transmit the action to the vehicle computer.

2. The system of claim 1, wherein the vehicle computer is further programmed to:

halt the vehicle based on determining that the initial risk level of the failure is greater than a threshold; and

begin to move the vehicle again based on the action in the instruction from the remote server.

3. The system of claim 1, wherein the action includes operating by revising a route to a destination based on determining that revising the route reduces the second risk level with respect to the first risk level.

4. The system of claim 1, wherein the second risk level is based on first weather data along an original route and second weather data along a revised route.

5. The system of claim 1, wherein the additional data is received from a source different than the vehicle computer or the remote server.

6. The system of claim 1, wherein the vehicle computer is further programmed to:

determine, that within a time period specified for transmitting the initial data to the remote server, that the vehicle computer did not receive a response from the remote server; and

halt the vehicle based on determining that the vehicle computer did not receive the response.

7. The system of claim 1, wherein the additional data includes data indicating a back-up system on the vehicle that can replace some of the functionality of the failure;

and the revised risk level is based in part on the data indicating the back-up system.

8. The system of claim 7, wherein the additional data includes a reliability of the back-up system.

9. The system of claim 1, wherein the additional data includes data from other vehicles of a same type, and the revised risk level is based in part on the data from the other vehicles of the same type.

10. A method comprising:

determining a first risk level for operating a vehicle based on (1) a trouble code indicating a failure of a specified vehicle electronic control unit or sensor and (2) stored data specifying the first risk level for the failure of the specified vehicle electronic control unit or sensor;

transmitting the first risk level from a vehicle computer to a remote server;

receiving the first risk level in the remote server;

based on the first risk level and additional data that includes a stored weight that is applied to the additional data, determining, in the remote server, a second risk level for the failure of the specified vehicle electronic control unit or sensor and, based on the second risk level, an action for the vehicle;

then transmitting an instruction including the action from the remote server to the vehicle computer

receiving, from the remote server, the instruction to take the action; and

operating the vehicle to take the action.

11. The method of claim 10, further comprising:

halting the vehicle based on determining that the initial risk level of the failure is greater than a threshold; and

beginning to move the vehicle again based on the action in the instruction from the remote server.

12. The method of claim 10, wherein the action includes operating by revising a route to a destination based on determining that revising the route reduces the second risk level with respect to the first risk level.

13. The method of claim 12, wherein the second risk level is based on first weather data along an original route and second weather data along a revised route.

14. The method of claim 10, further comprising:

determining, that within a time period specified for transmitting the initial data to the remote server, that the vehicle computer did not receive a response from the remote server; and

halting the vehicle based on determining that the vehicle computer did not receive the response.