Decentralized minimum risk condition vehicle control

• US 10,611,381 B2
• Filed: 10/24/2017
• Issued: 04/07/2020
• Est. Priority Date: 10/24/2017
• Status: Active Grant

• Current Assignee: Ford Global Technologies, LLC (Ford Motor Company)
• Original Assignee: Ford Global Technologies, LLC (Ford Motor Company)
• Inventors: Khalifeh, Ahmad, Tang, Beni, Hamilton, Kathryn, Tatipamula, Sagar Avaneendra, Nuesch, Sandro Patrick, Hegde, Rashmi
• Primary Examiner(s): Kiswanto, Nicholas
• Application Number:
  US15/792,029
• Publication Number:
  US 20190118827A1
• Time in Patent Office: 896 Days
• CPC Class Codes: B60W 2050/021 Means for detecting failure or malfunction
• CPC Class Codes: B60W 50/0205 Diagnosing or detecting failures; Failure detection models
• CPC Class Codes: B60W 50/029 Adapting to failures or work around with other constraints, e.g. circumvention by avoiding use of failed parts
• CPC Class Codes: G05D 1/0055 with safety arrangements

Abstract

A vehicle computer includes a memory and a processor programmed to execute instructions stored in the memory. The instructions include receiving a first minimum risk condition (MRC) event recommendation from a first platform controller and a second MRC event recommendation from a second platform controller, selecting one of the first and second MRC event recommendations as a selected MRC event, controlling an autonomous host vehicle according to the selected MRC event.

Claims

1. A vehicle computer comprising:

a memory; and

a processor programmed to execute instructions stored in the memory, the instructions including;

receiving a first minimum risk condition (MRC) event recommendation from a first control module and a second MRC event recommendation from a second control module via a vehicle communication bus to which the first control module, the second control module, and the vehicle computer are connected;

selecting one of the first and second MRC event recommendations as a selected MRC event, the selected MRC event including instructions to one or more actuators; and

based on the selected MRC event and the instructions to the one or more actuators, outputting motion control instructions via the vehicle communications bus to one of the first control module, the second control module, or a third control module to output to the actuators to control an autonomous host vehicle according to the selected MRC event.

2. The vehicle computer of claim 1, wherein the processor is programmed to receive the first and second MRC event recommendations as a result of the first and second control modules, respectively, each detecting a vehicle system failure, wherein the vehicle system failure detected by the first control module is different from the vehicle system failure detected by the second control module.

3. The vehicle computer of claim 1, wherein the processor is programmed to generate a third MRC event recommendation and wherein selecting the selected MRC event includes selecting from among the first, second, and third MRC event recommendations.

4. The vehicle computer of claim 3, wherein the processor is programmed to generate the third MRC event recommendation as a result of the processor detecting a failure associated with a virtual driver system.

5. The vehicle computer of claim 1, wherein the processor is programmed to receive the motion control signals from an autonomous vehicle control module and output the motion control signals to at least one of the first control module, the second control module, and the third control module.

6. The vehicle computer of claim 1, wherein the processor is programmed to select one of the first and second MRC event recommendations as the selected MRC event based on a severity associated with the first MRC event recommendation and a severity associated with the second MRC event recommendation, wherein the severities of the first MRC event recommendation and the second MRC event recommendation are different.

7. The vehicle computer of claim 6, wherein the processor is programmed to select the first MRC event recommendation as the selected MRC event as a result of determining that the severity associated with the first MRC event recommendation is greater than the severity associated with the second MRC event recommendation and wherein the processor is programmed to select the second MRC event recommendation as the selected MRC event as a result of determining that the severity associated with the second MRC event recommendation is greater than the severity associated with the first MRC event recommendation.

8. The vehicle computer of claim 1, wherein the processor is programmed to select a fourth MRC event recommendation based on an aggregate severity of the first MRC event recommendation and the second MRC event recommendation, wherein the fourth MRC event recommendation is different from the first MRC event recommendation and the second MRC event recommendation.

9. A vehicle system comprising:

an automated vehicle platform including a first control module programmed to output a first MRC event recommendation and a second control module programmed to output a second MRC event recommendation, each MRC event recommendation including instructions to one or more actuators; and

a minimum risk condition (MRC) control module programmed to receive the first MRC event recommendation and the second MRC event recommendation from the first and second control modules over a communications bus, select one of the first MRC event recommendation and the second MRC event recommendation as a selected MRC event, and output the instructions associated with the selected MRC event to one of the first control module, the second control module, or a third control module to output to the actuators to control an autonomous host vehicle according to the selected MRC event.

10. The vehicle system of claim 9, wherein the MRC controller is programmed to receive the first and second MRC event recommendations from the first and second control modules, respectively, each detecting a system failure, wherein the system failure detected by the first control module is different from the system failure detected by the second control module.

11. The vehicle system of claim 9, wherein the MRC controller is programmed to detect a vehicle sensor failure and to generate a third MRC event recommendation and wherein selecting the selected MRC event includes selecting from among the first, second, and third MRC event recommendations.

12. The vehicle system of claim 9, wherein the MRC controller is programmed to receive the motion control signals from an autonomous control module and output the motion control signals to at least one of the first control module, the second control module, and the control module.

13. The vehicle system of claim 9, wherein the MRC controller is programmed to select one of the first and second MRC event recommendations as the selected MRC event based on a severity associated with the first MRC event recommendation and a severity associated with the second MRC event recommendation, wherein the severities of the first MRC event recommendation and the second MRC event recommendation are different.

14. The vehicle system of claim 13, wherein the MRC controller is programmed to select the first MRC event recommendation as the selected MRC event as a result of determining that the severity associated with the first MRC event recommendation is greater than the severity associated with the second MRC event recommendation.

15. The vehicle system of claim 13, wherein the MRC controller is programmed to select the second MRC event recommendation as the selected MRC event as a result of determining that the severity associated with the second MRC event recommendation is greater than the severity associated with the first MRC event recommendation.

16. A method comprising:

receiving a first minimum risk condition (MRC) event recommendation from a first control module over a communications bus;

receiving a second MRC event recommendation from a second control module over the communications bus;

selecting one of the first and second MRC event recommendations as a selected MRC event, the selected MRC event including instructions to one or more actuators; and

based on the selected MRC event and the instructions to the one or more actuators, outputting motion control instructions via the vehicle communications bus to one of the first control module, the second control module, or a third control module to output to the actuators to control an autonomous host vehicle according to the selected MRC event.

17. The method of claim 16, further comprising generating a third MRC event recommendation and wherein selecting the selected MRC event includes selecting from among the first, second, and third MRC event recommendations.

18. The method of claim 16, wherein selecting one of the first and second MRC event recommendations as the selected MRC event is based on a severity associated with the first MRC event recommendation and a severity associated with the second MRC event recommendation,

wherein the severities of the first MRC event recommendation and the second MRC event recommendation are different,

wherein the first MRC event recommendation is selected as the selected MRC event as a result of determining that the severity associated with the first MRC event recommendation is greater than the severity associated with the second MRC event recommendation, and

wherein the second MRC event recommendation is selected as the selected MRC event as a result of determining that the severity associated with the second MRC event recommendation is greater than the severity associated with the first MRC event recommendation.