Determination of reliability of vehicle control commands using a voting mechanism

1. A method implemented on a vehicle, the method comprising:

receiving, in a command controller, multiple commands respectively from multiple computing devices configured on the vehicle, the multiple commands configured to adjust operations of a control element of the vehicle during autonomous driving;

matching, by the command controller, the multiple commands with each other to identify votes for the multiple commands, wherein a vote count of each respective command in the multiple commands identifies a number of matching ones in the multiple commands that match with the respective command;

identifying, by the command controller, a first command from the multiple commands based on a winning vote count of the first command;

forwarding, from the command controller, the first command for execution via the control element of the vehicle; and

in response to a determination that within the multiple commands there is a tie in the winning vote count between two commands that do not match with each other, initiating testing of memories of at least a portion of the multiple computing devices and breaking the tie between the two winning commands based on a failed memory test in the portion of the multiple computing devices.

2. The method of claim 1 , wherein the first command has the winning vote count when a vote count of the first command is above a threshold.

3. The method of claim 2 , wherein the threshold is more than half of a count of the multiple computing devices.

4. The method of claim 2 , wherein the threshold is less than half of a count of the multiple computing devices.

5. The method of claim 2 , further comprising:

stopping the matching to identify additional matches within the multiple commands in response to a determination that the first command has a vote count that is above the threshold.

6. The method of claim 1 , wherein the testing comprises:

testing the memories of the tested computing devices in parallel, section by section to identify a second command in the two commands having the tie, the second command being generated by the computing device that failed the memory test;

wherein the first command is different from the second command in the two commands having the tie.

7. The method of claim 2 , wherein the forwarding is performed before completion of the matching in identifying all possible matches within the multiple commands and is in response to a determination that the first command has a vote count that is above the threshold.

8. The method of claim 7 , further comprising:

after the forwarding, continuing the matching to identify, among the multiple commands, a second command that does not match the first command; and

testing a memory of a first computing device among the multiple computing devices, wherein the second command is provided from the first computing device to the command controller.

9. The method of claim 8 , wherein the testing the memory of the first computing device includes:

comparing content retrieved from the memory of the first computing device with content retrieved from a memory of a second computing device among the multiple computing devices, the first command is provided from the second computing device.

10. The method of claim 9 , further comprising:

copying a portion of the content from the second computing device to the first computing device to replace a corresponding portion of the content previously stored in the first computing device in repairing a redundant function of the first computing device in producing commands to the command controller.

11. The method of claim 1 , further comprising:

skipping memory tests of the multiple computing devices in response to a determination that the first command has the winning vote count.

12. A vehicle, comprising:

a control element;

multiple computing devices having redundant functions in generating multiple commands during autonomous driving of the vehicle, the command to be effectuated by the control element of the vehicle;

a command controller coupled between the control element and the multiple computing devices, wherein in response to receiving the multiple commands from the multiple computing devices, the command controller:

matches the multiple commands with each other to identify votes for the multiple commands, wherein a vote count of each respective command in the multiple commands identifies a number of matching ones in the multiple commands that match with the respective command;

identify a first command from the multiple commands based on a winning vote count of the first command;

forwards the first command for execution via the control element of the vehicle;

in response to a determination that within the multiple commands there is a tie in winning vote count between two commands that do not match with each other, initiating testing of memories of at least a portion of the multiple computing devices and breaking the tie between the two winning commands based on a failed memory test in the portion of the multiple computing devices.

13. The vehicle of claim 12 , wherein each of the multiple computing devices are sealed in one integrated circuit package for a system on chip; and the command controller is external to the system on chip.

14. The vehicle of claim 12 , further comprising:

at least one sensor to generate input data for the computing device, wherein the computing device generates the command based on the input data.

15. The vehicle of claim 14 , wherein the at least one sensor includes at least one of:

a camera;

an infrared camera;

a sonar;

a radar; and

a lidar.

16. The vehicle of claim 14 , wherein the one of the two commands forwarded for execution causes the control element to adjust at least one of:

acceleration of the vehicle;

speed of the vehicle; and

direction of the vehicle.

17. A non-transitory computer storage medium storing instructions which when executed by a controller of a vehicle causes the controller to perform a method, the method comprising:

receiving, in the controller, multiple commands respectively from multiple computing devices configured on the vehicle, the multiple commands configured to adjust operations of a control element of the vehicle during autonomous driving;

matching, by the controller, the multiple commands with each other to identify votes for the multiple commands, wherein a vote count of each respective command in the multiple commands identifies a number of matching ones in the multiple commands that match with the respective command;

identifying, by the controller, a first command from the multiple commands based on a winning vote count of the first command;

forwarding, from the controller, the first command for execution via the control element of the vehicle; and

in response to a determination that within the multiple commands there is a tie in the winning vote count between two commands that do not match with each other, initiating testing of memories of at least a portion of the multiple computing devices and breaking the tie between the two winning commands based on a failed memory test in the portion of the multiple computing devices.