Control redundancy
View Patent ↗In one embodiment, a method includes receiving data from one or more sensors associated with a vehicle; and receiving a message from a first processor. The message from the first processor includes a first control command for an actuator of the vehicle and a first certificate function. The method also includes receiving a message from the second processor. The message from the second processor includes a second control command for the actuator of the vehicle and a second certificate function. The method also includes computing a first certificate based on the first certificate function and the data; computing a second certificate based on the second certificate function and the data; determining a valid control signal based on an accuracy of the first second control command and second control command relative the first certificate and second certificate; and transmitting the valid control signal to the actuator of the vehicle.
1. A method comprising, by a computing device in a vehicle:
receiving data from one or more sensors associated with the vehicle;
receiving a first message from a first processor of the vehicle, wherein the first message from the first processor comprises a first control command for an actuator of the vehicle and a first certificate function;
receiving a second message from a second processor of the vehicle, wherein the second message from the second processor comprises a second control command for the actuator of the vehicle and a second certificate function;
computing a first certificate based on the first certificate function and the data;
computing a second certificate based on the second certificate function and the data;
determining a valid control signal based on an accuracy of the first control command calculated using the first certificate and an accuracy of the second control command calculated using the second certificate; and
transmitting the valid control signal to the actuator to cause the vehicle to perform an action.
2. The method of claim 1 , further comprising transmitting to the first processor and the second processor a third message comprising a third certificate that is computed based on the received data from the plurality of sensors.
3. The method of claim 2 , further comprising, signing the third message with a public key.
4. The method of claim 1 , wherein the property of the control command comprises a lateral acceleration, a number of degrees of steerage, linear deceleration, or linear acceleration.
5. The method of claim 1 , further comprising, verifying the received messages originated from the first and second processors based on respective public keys of the first and second processors.
6. The method of claim 1 , further comprising confirming that the value of a property of the control command from the first processor is within a narrower range than the value of a property of the control command based on the respective messages from the first processor and second processor.
7. The method of claim 1 , further comprising verifying the first certificate and second certificate correspond to an expected range of values, wherein the expected range of values are based on one or more characteristics of an autonomous vehicle.
8. The method of claim 1 , wherein the first processor and second processor calculate the control commands in response to receiving data from the plurality of sensors.
9. The method of claim 1 , wherein the first certificate and second certificate further comprise a time-stamp of the sensor data used to calculate the first control command and second control command.
10. The method of claim 1 , wherein the first processor of the vehicle has more processing power than the second processor of the vehicle.
11. One or more computer-readable non-transitory storage media embodying software that is operable when executed to cause one or more processors in a vehicle to perform operations comprising:
receiving data from one or more sensors associated with the vehicle;
receiving a first message from a first processor of the vehicle, wherein the first message from the first processor comprises a first control command for an actuator of the vehicle and a first certificate function;
receiving a second message from a second processor of the vehicle, wherein the second message from the second processor comprises a second control command for the actuator of the vehicle and a second certificate function;
computing a first certificate based on the first certificate function and the data;
computing a second certificate based on the second certificate function and the data;
determining a valid control signal based on an accuracy of the first control command calculated using the first certificate and an accuracy of the second control command calculated using the second certificate; and
transmitting the valid control signal to the actuator to cause the vehicle to perform an action.
12. The media of claim 11 , wherein the software is further operable to transmit to the first processor and second processor a third message comprising a third certificate that is computed based on the received data from the plurality of sensors.
13. The media of claim 12 , wherein the software is further operable to sign the third message with a public key.
14. The media of claim 11 , wherein the property of the control command comprises a lateral acceleration, a number of degrees of steerage, linear deceleration, or linear acceleration.
15. The media of claim 11 , wherein the software is further operable to verify the received messages originated from the first processor and second processor based on respective public keys of the first and second processors.
16. A computing system of a vehicle comprising:
one or more processors; and
one or more computer-readable non-transitory storage media coupled to one or more of the processors, the one or more computer-readable non-transitory storage media comprising instructions operable when executed by one or more of the processors to cause the computing system to perform operations comprising:
receiving data from one or more sensors associated with the vehicle;
receiving a first message from a first processor of the vehicle, wherein the first message from the first processor comprises a first control command for an actuator of the vehicle and a first certificate function;
receiving a second message from a second processor of the vehicle, wherein the message from the second processor comprises a second control command for the actuator of the vehicle and a second certificate function;
computing a first certificate based on the first certificate function and the data;
computing a second certificate based on the second certificate function and the data;
determining a valid control signal based on an accuracy of the first control command calculated using the first certificate and an accuracy of the second control command calculated using the second certificate; and
transmitting the valid control signal to the actuator to cause the vehicle to perform an action.
17. The system of claim 16 , wherein the instructions are further operable to transmit to the first processor and second processor a third message comprising a third certificate that is computed based on the received data from the plurality of sensors.
18. The system of claim 17 , wherein the instructions are further operable to sign the third message with a public key.
19. The system of claim 16 , wherein the property of the control command comprises a lateral acceleration, a number of degrees of steerage, linear deceleration, or linear acceleration.
20. The system of claim 16 , wherein the instructions are further operable to verify the received messages originated from the first processor and second processor based on respective public keys of the first and second processors.