Systems and methods for a vehicle controller safety monitor
Systems and methods are directed to monitoring the status of a vehicle controller or other autonomy system during operation of an autonomous vehicle. In one example, a system includes one or more processors; and memory storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations. The operations include obtaining a message from a vehicle controller. The operations further include, based at least partly on the message, determining whether a failure mode exists. The operations further include providing, in response to determining the failure mode exists, one or more commands to implement a safety measure response for the autonomous vehicle.
1. A system comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations, the operations comprising:
obtaining a message from a vehicle controller;
based at least partly on the message, determining whether a failure mode exists, wherein determining whether the failure mode exists comprises:
generating a timestamp for the message from the vehicle controller;
determining a time difference between a current time and the timestamp; and
determining the failure mode exists when the time difference exceeds an error threshold and another message has not been received from the vehicle controller; and
providing, in response to determining the failure mode exists, one or more commands to implement a safety measure response for an autonomous vehicle.
2. The system of claim 1 , wherein determining whether the failure mode exists further comprises receiving a not-ready signal from the autonomous vehicle.
3. The system of claim 1 , wherein determining whether the failure mode exists further comprises receiving an error mode signal from one or more autonomous vehicle subsystems.
4. The system of claim 1 , wherein determining whether the failure mode exists comprises:
initializing a timer upon receipt of the message from the vehicle controller; and
determining the failure mode exists based at least in part on the timer.
5. The system of claim 1 , wherein the safety measure response comprises providing commands to one or more vehicle control interfaces to implement a safe stop.
6. The system of claim 1 , wherein the safety measure response comprises providing one or more alerts regarding the failure mode to a driver and disengaging autonomous operation of the autonomous vehicle.
7. The system of claim 1 , wherein the one or more processors is separate from one or more processors associated with the vehicle controller.
8. A computer-implemented method for providing a safety monitor comprising:
obtaining, by a computing system comprising one or more computing devices, a message from a vehicle controller;
determining, by the computing system, whether a failure mode exists, wherein determining whether the failure mode exists comprises:
generating a timestamp for the message from the vehicle controller;
determining a time difference between a current time and the timestamp; and
determining the failure mode exists when the time difference exceeds an error threshold and another message has not been received from the vehicle controller; and
providing, by the computing system in response to determining the failure mode exists, one or more commands to implement a safety measure response for an autonomous vehicle.
9. The computer-implemented method of claim 8 , wherein determining whether the failure mode exists further comprises receiving, by the computing system, a not-ready signal from the autonomous vehicle.
10. The computer-implemented method of claim 8 , wherein determining whether the failure mode exists further comprises receiving, by the computing system, an error mode signal from one or more autonomous vehicle subsystems.
11. The computer-implemented method of claim 8 , wherein determining whether the failure mode exists comprises:
initializing, by the computing system, a timer upon receipt of the message from the vehicle controller; and
determining, by the computing system, the failure mode exists based at least in part on the timer.
12. The computer-implemented method of claim 8 , wherein the safety measure response comprises providing, by the computing system, commands to one or more vehicle control interfaces to implement a safe stop.
13. The computer-implemented method of claim 8 , wherein the safety measure response comprises providing, by the computing system, one or more alerts regarding the failure mode to a driver and disengaging autonomous operation of the autonomous vehicle.
14. The computer-implemented method of claim 8 , wherein the safety monitor is executing on one or more separate processors from the vehicle controller.
15. An autonomous vehicle comprising:
a vehicle computing system, the vehicle computing system comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations, the operations comprising:
obtaining a message from a vehicle controller;
determining whether a failure mode exists, wherein determining whether the failure mode exists comprises:
generating a timestamp for the message from the vehicle controller;
determining a time difference between a current time and the timestamp; and
determining the failure mode exists when the time difference exceeds an error threshold and another message has not been received from the vehicle controller; and
providing, in response to determining the failure mode exists, one or more commands to implement a safety measure response for the autonomous vehicle.
16. The autonomous vehicle of claim 15 , wherein determining whether the failure mode exists further comprises one or more of:
receiving a not-ready signal from the autonomous vehicle; and
receiving an error mode signal from one or more autonomous vehicle subsystems.
17. The autonomous vehicle of claim 15 , wherein determining whether the failure mode exists comprises:
initializing a timer upon receipt of the message from the vehicle controller; and
determining a failure mode exists based at least in part on the timer.