An autonomous vehicle is operated using a main autonomy system that analyzes data collected by a sensor system of the autonomous vehicle to determine a trajectory of travel of the autonomous vehicle, and wherein the main autonomy system provides instructions to a propulsion system of the autonomous vehicle to cause the propulsion system to navigate the autonomous vehicle according to the trajectory. In response to determining that navigating the autonomous vehicle according to the trajectory is likely to result in collision, instructions are provided from a parallel autonomy system to the propulsion system to cause the autonomous vehicle to avoid collision. In response to detecting a fault in the main autonomy system, control of the propulsion system is provided from the main autonomy system to a failover autonomy system, wherein the failover autonomy system is configured to override the propulsion system.

A driving assistance device (10) is mounted in a mobile body (100). An abnormality detection unit (22) detects an abnormality in a sensor mounted in a peripheral body moving on a periphery of the mobile body (100). An assistance determination unit (23) reads a control pattern corresponding to a sensing area of a sensor whose abnormality has been detected by the abnormality detection unit (22), from a pattern storage unit (31). A path generation unit (24) generates path data indicating a moving path of the mobile body (100) to correspond to the control pattern.

According to one aspect, an autonomous vehicle includes hardware systems which receive relatively low voltage from a low voltage power distribution unit (LVPDU). An LVPDU includes a power source such as a DC-DC converter and a plurality of backup batteries. The plurality of backup batteries is configured to provide backup power to subsets of components arranged to effectively all be powered by the power source onboard the LVPDU. The backup batteries may be tested, substantially while LVPDU is being used to provide power. The backup batteries may be charged substantially in parallel.

A method for monitoring a motor vehicle including an automated driving function, including differing modes of operation for bringing the motor vehicle to a standstill, at least one energy store, in particular a battery, supplying at least one consumer which is able to bring the vehicle to a standstill, a respective load profile being assigned to the respective mode of operation, which usually occurs in this mode of operation upon activation of the consumer, at least one characteristic variable of the energy store being predicted as a function of at least one of the load profiles, and the mode of operation associated with the load profile and/or the automated driving function being unblocked, blocked, left or influenced as a function of the predicted characteristic variable of the energy store.

A method for monitoring a motor vehicle including an automated driving function, including differing modes of operation for bringing the motor vehicle to a standstill, at least one energy store, in particular a battery, supplying at least one consumer which is able to bring the vehicle to a standstill, a respective load profile being assigned to the respective mode of operation, which usually occurs in this mode of operation upon activation of the consumer, at least one characteristic variable of the energy store being predicted as a function of at least one of the load profiles, and the mode of operation associated with the load profile and/or the automated driving function being unblocked, blocked, left or influenced as a function of the predicted characteristic variable of the energy store.

Aspects of the disclosure relate to controlling a vehicle in an autonomous driving mode using trajectories. For instance, a trajectory may be received by one or more first computing devices from one or more second computing devices. While the first computing devices are controlling the vehicle in the autonomous driving mode based on the trajectory, an error may be generated by second computing devices. Whether the error is a recoverable error may be determined, and if so, the second computing devices attempt to generate a new trajectory. When the second computing devices generate the new trajectory, the vehicle may be controlled by the first computing devices according to the new trajectory.

Aspects of the disclosure relate to controlling a vehicle in an autonomous driving mode using trajectories. For instance, a trajectory may be received by one or more first computing devices from one or more second computing devices. While the first computing devices are controlling the vehicle in the autonomous driving mode based on the trajectory, an error may be generated by second computing devices. Whether the error is a recoverable error may be determined, and if so, the second computing devices attempt to generate a new trajectory. When the second computing devices generate the new trajectory, the vehicle may be controlled by the first computing devices according to the new trajectory.

According to one aspect, a vehicle includes hardware systems configured to support the autonomous or semi-autonomous operation of the vehicle. Hardware systems may include a main compute, a brain stem computer (BSC), and an aggregator/compute arrangement or redundant autonomy compute. Such hardware systems may cooperate to allow the vehicle to operate autonomously, and typically provide capabilities, e.g., redundant and/or backup capabilities, configured to enable the vehicle to continue to operate in the event that a primary system is not functioning as expected. The aggregator/compute arrangement may further be comprised of two substantially identical modules or computing assemblies, each configured to process sensor data and perform backup autonomy functionalities and/or teleoperations functionalities.

A method for controlling at least one actuator of an actuator system, including: outputting a first control signal from a first control device via a line to an actuator, wherein the actuator system has at least the first control device and a second control device, wherein the first control device is configured to control at least the actuator via the line and wherein the second control device is configured to control the actuator via the line; detecting the first control signal on the line by the second control device and suppressing the output of a second control signal to the actuator by the second control device during a time in which the first control device is outputting the first control signal to the line; determining a time by the second control device at which no first control signal is present on the line; and applying to the actuator a second control signal via the line by the second control device if no first control signal is present on the line. Also described are a related apparatus and a computer readable medium.

An in-vehicle backup control apparatus includes a discharge circuit that discharges a power storage unit and a control unit that controls the discharge circuit. The control unit sets either one of a superimposable voltage or a supply completion voltage as an interruption threshold value, the superimposable voltage being set as a voltage condition of the power storage unit when electric power is supplied simultaneously to a plurality of target loads during an abnormal state, and the supply completion voltage being set in association with one of the plurality of target loads. The control unit interrupts or delays the supply of electric power to the one of the plurality of target loads to prohibit the plurality of target loads from simultaneously operating if a charge voltage of the power storage unit reaches a value less than or equal to the interruption threshold value during the abnormal state.