A travel control apparatus includes a state detection unit that detects whether each of at least three power sources of the autonomous driving system including one or more electricity storage devices and one or more power generators is in a normal state or in a malfunctioning state; and a mode setting unit that sets a fail operation mode corresponding to a type of at least one of the power sources upon determination that the at least one of the power sources is in the malfunctioning state.

An external control apparatus performs a main calculation, and a vehicle-mounted control apparatus transmits a control command for controlling an automatic driving vehicle, based on a calculation result. In a vehicle control system according to the present disclosure, the vehicle-mounted control apparatus determines whether or not the calculation result of the external control apparatus satisfies an allowable condition. In the case where the allowable condition is satisfied, the vehicle is controlled based on the result of the main calculation by the external control apparatus, and in the case where the allowable condition is not satisfied, the vehicle is controlled based on the result of a backup calculation by the vehicle-mounted control apparatus; therefore, the vehicle can continue stable traveling.

An external control apparatus performs a main calculation, and a vehicle-mounted control apparatus transmits a control command for controlling an automatic driving vehicle, based on a calculation result. In a vehicle control system according to the present disclosure, the vehicle-mounted control apparatus determines whether or not the calculation result of the external control apparatus satisfies an allowable condition. In the case where the allowable condition is satisfied, the vehicle is controlled based on the result of the main calculation by the external control apparatus, and in the case where the allowable condition is not satisfied, the vehicle is controlled based on the result of a backup calculation by the vehicle-mounted control apparatus; therefore, the vehicle can continue stable traveling.

A vehicle can safely transfer the control of a vehicle to a driver when a fault occurs in an autonomous navigation system. In particular, the vehicle includes: a first sensor to obtain front information of the vehicle; a second sensor to acquire peripheral information of the vehicle; a first controller to perform an autonomous driving function based on the front information; a second controller to perform the autonomous driving function based on the obtained front information and the peripheral information; and a communicator to transmit the front information and the peripheral information to the second controller. The first controller may stop the transmission of a control signal of the first controller when a failure has occurred in the first controller, and the second controller may stop the transmission of a control signal of the second controller when a failure occurs in the second controller.

According to various embodiment, described herein are methods and systems for reliably detecting malfunctions in a variety of software or hardware components in an autonomous driving vehicle (ADV). In one embodiment, a redundant system can be provided on an independent computing device in an ADV to check for malfunctions in a number of software or hardware components. When no malfunction occurs in the ADV, an autonomous driving system (ADS) in the ADV operates to drive the ADV, while the redundant system can monitor the ADS in a standby mode. In the event of a malfunction, the redundant system can take over the control of the ADV, and take appropriate actions based on a severity level of the malfunction.

According to various embodiment, described herein are methods and systems for reliably detecting malfunctions in a variety of software or hardware components in an autonomous driving vehicle (ADV). In one embodiment, a redundant system can be provided on an independent computing device in an ADV to check for malfunctions in a number of software or hardware components. When no malfunction occurs in the ADV, an autonomous driving system (ADS) in the ADV operates to drive the ADV, while the redundant system can monitor the ADS in a standby mode. In the event of a malfunction, the redundant system can take over the control of the ADV, and take appropriate actions based on a severity level of the malfunction.

A vehicle, operating system of a vehicle and a method of operating a vehicle is disclosed. A local electronic control unit is operated at the vehicle in order to control the vehicle. A backup electronic control unit is operated at a remote computing platform for control of the vehicle. A control of the vehicle is transferred from the local electronic control unit to the backup electronic control unit upon occurrence of a fault at the local electronic control unit.

A vehicle, operating system of a vehicle and a method of operating a vehicle is disclosed. A local electronic control unit is operated at the vehicle in order to control the vehicle. A backup electronic control unit is operated at a remote computing platform for control of the vehicle. A control of the vehicle is transferred from the local electronic control unit to the backup electronic control unit upon occurrence of a fault at the local electronic control unit.

There is provided a control apparatus having two or more control units that are connected with one another through a communication path; each of the control units has a switching processing section that selects the control unit that is made to continue the operation of software for the control unit in which an abnormality has been detected, based on an operational requirement for software in which an abnormality has been detected and the security state and control state of the control unit other than the control unit in which the abnormality has been detected.

An emergency maneuver control system includes a path planning control device, which is designed to determine an emergency maneuver trajectory in a highly automated or autonomous operating mode of the vehicle; a longitudinal guidance actuator control device which is coupled to the path planning control device and is designed to provide longitudinal guidance control commands derived from the emergency maneuver trajectory and, in the event of an emergency maneuver situation, to cause the at least one longitudinal guidance actuator to execute the longitudinal guidance control commands; and a transverse guidance actuator control device which is coupled to the path planning control device and is designed to provide transverse guidance control commands derived from the emergency maneuver trajectory and, in the event of an emergency maneuver situation, to cause the at least one transverse guidance actuator to execute the transverse guidance control commands.