Vehicle safety system for autonomous vehicles

1. A vehicle safety system for controlling a vehicle, comprising:

a first vehicle control unit including a first autopilot unit and configured to

receive a first input from a first sensing unit, a second input from a first navigation system, and a third input from an object detection electronic control unit, and

output at least a first control command based on processing the first input, the second input, and the third input;

a second vehicle control unit including a second autopilot unit and configured to

receive a fourth input from a second sensing unit, a fifth input from a second navigation system, and a sixth input from the object detection electronic control unit, and

output at least a second control command based on processing the fourth input, the fifth input, and the sixth input; and

a processor configured to select, based on at least one of the first control command and the second control command, an operating mode of the vehicle,

wherein the operating mode corresponds to one of (a) a default operating mode that allows the vehicle to operate without any change of the operating mode, (b) a minimal risk condition mode of a first type that configures the vehicle to pull over to a nearest pre-designated safety location, (c) a minimal risk condition mode of a second type that configures the vehicle to immediately stop in a current lane, or (d) a minimal risk condition mode of a third type that configures the vehicle to come to a gentle stop, and

wherein the processor is further configured to:

make a first determination whether the vehicle is healthy;

make a second determination on a health status of the first autopilot unit and a health status of the second autopilot unit based on comparisons with predetermined threshold values; and

switch, based on at least one of the first determination and the second determination, the operating mode from the default operating mode to one selected from the minimal risk condition mode of a first type that configures the vehicle to pull over to a nearest pre-designated safety location, the minimal risk condition mode of a second type that configures the vehicle to immediately stop in a current lane, and the minimal risk condition mode of a third type that configures the vehicle to come to a gentle stop.

2. The system of claim 1 , wherein the first navigation system comprises a Global Navigation Satellite System (GNSS).

3. The system of claim 2 , wherein the first sensing unit comprises a first camera and a first light detection and ranging (LiDAR) system.

4. The system of claim 3 , wherein the second sensing unit comprises a second camera, a second LiDAR system, a radar sensor, and an ultrasonic sensor.

5. The system of claim 4 , wherein the object detection electronic control unit receives a first input from a vehicle safety system (VSS) camera and a second input from a VSS radar.

6. The system of claim 1 , wherein the vehicle is operating in a level 4 (L4) autonomous driving mode.

7. The system of claim 1 , further comprising:

a first power source configured to power the first vehicle control unit; and

a second power source, different from the first power source, configured to power the second vehicle control unit.

8. The system of claim 7 , wherein the first vehicle control unit is configured to receive a first ignition signal and the second vehicle control unit is configured to receive a second ignition signal different from the first ignition signal.

9. The device of claim 1 , wherein the first vehicle control unit and the second vehicle control unit are configured to operate in a master and slave relationship such that one of the first vehicle control unit and the second vehicle control unit becomes a master and the other of the first vehicle control unit and the second vehicle control unit becomes a slave.

10. A method of controlling a vehicle, comprising:

selecting, based on a first control command from a first vehicle control unit including a first autopilot unit, an operating mode of the vehicle; and

transmitting, based on the selecting, the operating mode to an autonomous driving system,

wherein the first control command is generated by a first vehicle control unit based on input from a first plurality of sensors,

wherein, in a case that an error is detected in the first control command, a second control command is generated by a second vehicle control unit including a second autopilot unit based on input from a second plurality of sensors different from the first plurality of sensors, and

wherein the operating mode corresponds to one of (a) a default operating mode that allows the vehicle to operate without any change of the operating mode, (b) a minimal risk condition mode of a first type that configures the vehicle to pull over to a nearest pre-designated safety location, (c) a minimal risk condition mode of a second type that configures the vehicle to immediately stop in a current lane, or (d) a minimal risk condition mode of a third type that configures the vehicle to come to a gentle stop, and

wherein the method further comprises:

making a first determination whether the vehicle is healthy; and

making a second determination on a health status of the first autopilot unit and a health status of the second autopilot unit based on comparisons with predetermined threshold values; and

switching, based on at least one of the first determination and the second determination, the operating mode from the default operating mode to one selected from the minimal risk condition mode of a first type that configures the vehicle to pull over to a nearest pre-designated safety location, the minimal risk condition mode of a second type that configures the vehicle to immediately stop in a current lane, and the minimal risk condition mode of a third type that configures the vehicle to come to a gentle stop.

11. The method of claim 10 , wherein the first plurality of sensors comprises a first Global Navigation Satellite System (GNSS), a first inertial measurement unit (IMU), a first camera and a first light detection and ranging (LiDAR) system.

12. The method of claim 11 , wherein the second plurality of sensors comprises a second Global Navigation Satellite System (GNSS), a second inertial measurement unit (IMU), a second camera, a second light detection and ranging (LiDAR) system, a radar sensor, and an ultrasonic sensor.

13. The method of claim 12 , further comprising:

providing, upon a determination that at least one of the first plurality of sensors has generated a failure indication, an output from a corresponding sensor from the second plurality of sensors to the first vehicle control unit.

14. The method of claim 10 , wherein the first control command and the second control command are generated by the first vehicle control unit and the second vehicle control unit, respectively, further based on (a) a vehicle safety system (VSS) camera that is different from the first camera and the second camera and (b) a VSS radar that is different from the radar sensor.

15. The method of claim 10 , wherein control of the vehicle adheres to Automotive Safety Integrity Level D (ASIL D) requirements.

16. The method of claim 9 , wherein the plurality of rules the switching comprises:

(ii) switch to operation in the minimal risk condition mode of the first type if the vehicle is healthy and either the first autopilot unit or the second autopilot unit is not healthy,

(iii) switch to operation in the minimal risk condition mode of the second type if the vehicle is not healthy or both the first autopilot unit and the second autopilot unit are not healthy, and

(iv) switch to operation in the minimal risk condition mode of the third type when:

the vehicle is healthy;

switching to operation in the minimal risk condition mode of the first type is not available; and

either the first autopilot unit or the second autopilot unit is not healthy.

17. The method of claim 16 , wherein switching to operation in the minimal risk condition of the first type is not available corresponds to at least the pre-designated safety location not being accessible.

18. The method of claim 16 , wherein the first autopilot unit the second autopilot unit, or the vehicle being healthy corresponds to a health metric for the first autopilot unit, a health metric for the second autopilot unit, or a vehicle health metric, respectively, being less than or equal to a first threshold,

wherein the first autopilot unit or the second autopilot unit not being healthy corresponds to the health metric for the first autopilot unit or the health metric the second autopilot unit being greater than the first threshold, respectively, and

wherein the vehicle not being healthy corresponds to the vehicle health metric being greater than a second threshold.

19. A device for controlling a vehicle, comprising:

a processor configured to:

select, based on an input from an autonomous monitoring and diagnostic system and a first control command from a first vehicle control unit including a first autopilot unit, an operating mode of the vehicle; and

transmit, based on the selecting, the operating mode to an autonomous driving system,

wherein the first control command is generated by a first vehicle control unit based on input from a first plurality of sensors,

wherein, in a case that an error is detected in the first control command, a second control command is generated by a second vehicle control unit including a second autopilot unit based on input from a second plurality of sensors different from the first plurality of sensors, and

wherein the operating mode of the vehicle corresponds to one of (a) a default operating mode that allows the vehicle to operate without any change of the operating mode, (b) a minimal risk condition mode of a first type that configures the vehicle to pull over to a nearest pre-designated safety location, (c) a minimal risk condition mode of a second type that configures the vehicle to immediately stop in a current lane, or (d) a minimal risk condition mode of a third type that configures the vehicle to come to a gentle stop, and

wherein the processor is further configured to:

make a first determination whether the vehicle is healthy;

make a second determination on a health status of the first autopilot unit and a health status of the second autopilot unit based on comparisons with predetermined threshold values; and

switch, based on at least one of the first determination and the second determination, the operating mode from the default operating mode to one selected from the minimal risk condition mode of a first type that configures the vehicle to pull over to a nearest pre-designated safety location, the minimal risk condition mode of a second type that configures the vehicle to immediately stop in a current lane, and the minimal risk condition mode of a third type that configures the vehicle to come to a gentle stop.

20. The device of claim 19 , wherein the processor is further configured to:

detect, prior to selecting the operating mode, the error in the first control command; and

transmit, with ten milliseconds of detecting the failure, the operating mode to the autonomous driving system,

wherein selecting the operating mode is further based on the second control command.