A redundant hardware and software architecture can be designed to enable vehicles to be operated in an autonomous mode while improving the reliability and/or safety of such vehicles. A system for redundant architecture can include a set of at least two redundant sensors coupled to a vehicle and configured to provide timestamped sensor data to each of a plurality of computing unit (CU) computers. The CU computers can process the sensor data simultaneously based on at least a time value indicative of an absolute time or a relative time and based on the timestamped sensor data. The CU computers provide to a vehicle control unit (VCU) computer at least two sets of outputs configured to instruct a plurality of devices in a vehicle and cause the vehicle to be driven.

A redundant hardware and software architecture can be designed to enable vehicles to be operated in an autonomous mode while improving the reliability and/or safety of such vehicles. A system for redundant architecture can include a set of at least two redundant sensors coupled to a vehicle and configured to provide timestamped sensor data to each of a plurality of computing unit (CU) computers. The CU computers can process the sensor data simultaneously based on at least a time value indicative of an absolute time or a relative time and based on the timestamped sensor data. The CU computers provide to a vehicle control unit (VCU) computer at least two sets of outputs configured to instruct a plurality of devices in a vehicle and cause the vehicle to be driven.

An electric powered vehicle may include a battery ECU housed in a battery pack and a vehicle ECU mounted on a vehicle body and communicably connected to the battery ECU. The vehicle ECU may be configured to transmit first and second identification data for detecting communication disruptions to the battery ECU. The battery ECU may be configured to: when the battery ECU receives both the first and the second identification data, determine that the battery ECU is communicably connected to the vehicle ECU and enable a predetermined mutual monitoring function for the vehicle ECU; and when the battery ECU receives the first identification data but does not receive the second identification data, determine that the battery ECU is communicably connected to another ECU other than the vehicle ECU and disable the mutual monitoring function for the vehicle ECU.

An electric powered vehicle may include a battery ECU housed in a battery pack and a vehicle ECU mounted on a vehicle body and communicably connected to the battery ECU. The vehicle ECU may be configured to transmit first and second identification data for detecting communication disruptions to the battery ECU. The battery ECU may be configured to: when the battery ECU receives both the first and the second identification data, determine that the battery ECU is communicably connected to the vehicle ECU and enable a predetermined mutual monitoring function for the vehicle ECU; and when the battery ECU receives the first identification data but does not receive the second identification data, determine that the battery ECU is communicably connected to another ECU other than the vehicle ECU and disable the mutual monitoring function for the vehicle ECU.

A vehicle control system includes first and second control apparatus for controlling a vehicle and a power supply. Each apparatus includes a detection unit for detecting a surrounding situation of the vehicle, and a driving control unit for executing automated driving control. The power supply includes a first power supply for supplying power to the first control apparatus, and a second power supply for supplying power to the second control apparatus.

A vehicle control system includes first and second control apparatus for controlling a vehicle and a power supply. Each apparatus includes a detection unit for detecting a surrounding situation of the vehicle, and a driving control unit for executing automated driving control. The power supply includes a first power supply for supplying power to the first control apparatus, and a second power supply for supplying power to the second control apparatus.

A vehicle control system capable of ensuring safety at a low cost even when a control device fails, includes a first control device that implements at least two automatic driving-related functions based on information from external sensors and/or information from a map database, a second control device that implements fewer automatic driving-related functions than the first control device based on the information from the sensors and/or the map database, and a vehicle motion control device that automatically controls a driving state of a host vehicle based on a function planned by the first or second control device including: a backup determination unit that determines whether the future function planned by the first or second control device is backed up by the second control device; and an interface that notifies a driver that system responsibility is switched to the driver, when the backup is not available.

According to various embodiment, described herein are methods and systems for reliably detecting malfunctions in a variety of software or hardware components in an autonomous driving vehicle (ADV). In one embodiment, a redundant system can be provided on an independent computing device in an ADV to check for malfunctions in a number of software or hardware components. When no malfunction occurs in the ADV, an autonomous driving system (ADS) in the ADV operates to drive the ADV, while the redundant system can monitor the ADS in a standby mode. In the event of a malfunction, the redundant system can take over the control of the ADV, and take appropriate actions based on a severity level of the malfunction.

According to various embodiment, described herein are methods and systems for reliably detecting malfunctions in a variety of software or hardware components in an autonomous driving vehicle (ADV). In one embodiment, a redundant system can be provided on an independent computing device in an ADV to check for malfunctions in a number of software or hardware components. When no malfunction occurs in the ADV, an autonomous driving system (ADS) in the ADV operates to drive the ADV, while the redundant system can monitor the ADS in a standby mode. In the event of a malfunction, the redundant system can take over the control of the ADV, and take appropriate actions based on a severity level of the malfunction.

A device to be controlled used for an operation of a vehicle, a determination device used for controlling the device, and a control information management device different from the determination device are included. The determination device generates control information defining a control content of the device to be controlled, the control information management device includes a control information comparison unit which determines an operating state of the determination device based on the control information, and a control switching unit which changes the control of the determination device based on a determination result of the control information comparison unit, and the control information comparison unit determines, based on the control information and a plurality of pieces of control condition information which define control conditions of the device to be controlled by the determination device, which control condition information among the plurality of pieces of control condition information is to be applied.