An in-vehicle system includes: a first in-vehicle device installed in a vehicle; a second in-vehicle device controlled in accordance with a signal output from the first in-vehicle device; a first in-vehicle ECU communicably connected to the first in-vehicle device and the second in-vehicle device by signal lines; and a second in-vehicle ECU communicably connected to the first in-vehicle device and the second in-vehicle device by the signal lines. The first in-vehicle ECU and the second in-vehicle ECU are connected by a communication line of a type different from a type of the signal lines, and a communication path from the first in-vehicle device to the second in-vehicle device includes a first path relayed by the first in-vehicle ECU and a second path relayed by the second in-vehicle ECU.

An in-vehicle system includes: a first in-vehicle device installed in a vehicle; a second in-vehicle device controlled in accordance with a signal output from the first in-vehicle device; a first in-vehicle ECU communicably connected to the first in-vehicle device and the second in-vehicle device by signal lines; and a second in-vehicle ECU communicably connected to the first in-vehicle device and the second in-vehicle device by the signal lines. The first in-vehicle ECU and the second in-vehicle ECU are connected by a communication line of a type different from a type of the signal lines, and a communication path from the first in-vehicle device to the second in-vehicle device includes a first path relayed by the first in-vehicle ECU and a second path relayed by the second in-vehicle ECU.

Among other things, we describe techniques for implementing a vehicle response to sensor failure. In general, one innovative aspect of the subject matter described in this specification can be embodied in methods that include receiving information from a plurality of sensors coupled to a vehicle, determining that a level of confidence of the received information from at least one sensor of a first subset of sensors of the plurality of sensors is less than a first threshold, comparing a number of sensors in the first subset of sensors to a second threshold, and adjusting the driving capability of the vehicle to rely on information received from a second subset of sensors of the plurality of sensors, wherein the second subset of sensors excludes the at least one sensor of the first subset of sensors.

Among other things, we describe techniques for implementing a vehicle response to sensor failure. In general, one innovative aspect of the subject matter described in this specification can be embodied in methods that include receiving information from a plurality of sensors coupled to a vehicle, determining that a level of confidence of the received information from at least one sensor of a first subset of sensors of the plurality of sensors is less than a first threshold, comparing a number of sensors in the first subset of sensors to a second threshold, and adjusting the driving capability of the vehicle to rely on information received from a second subset of sensors of the plurality of sensors, wherein the second subset of sensors excludes the at least one sensor of the first subset of sensors.

Systems, methods, and non-transitory computer readable media may be configured to facilitate usage of vehicle redundant processing resource. A primary processing resource may be dedicated to navigation control of a vehicle. A redundant processing resource may be provided for performing one or more tasks of the navigation control of the vehicle based on a failure of the primary processing resource. One or more available portions of the redundant processing resource may be used for performing one or more tasks of non-navigation control of the vehicle.

A vehicle having a control element for the speed, acceleration or direction of the vehicle, multiple identical or redundant computing devices (e.g., each implemented as a system on chip (SoC)) to separately generate driving commands in parallel during autonomous driving of the vehicle, and a command controller coupled between the control element and the computing devices. The commands may have one or more matching groups, where commands within each respective group agree with each other and thus vote for a candidate command representing the group. The computing device outputs a candidate command that represents the largest group for execution by the control element.

Aspects of the disclosure relate to controlling a vehicle in an autonomous driving mode. The system includes a plurality of sensors configured to generate sensor data. The system also includes a first computing system configured to generate trajectories using the sensor data and send the generated trajectories to a second computing system. The second computing system is configured to cause the vehicle to follow a receive trajectory. The system also includes a third computing system configured to, when there is a failure of the first computer system, generate and send trajectories to the second computing system based on whether a vehicle is located on a highway or a surface street.

A storage device includes a first memory device, a second memory device and a storage controller. The first memory device buffers a plurality of unit time interval data. The plurality of unit time interval data are received in each of a plurality of monitoring time intervals. The second memory device stores at least one of the plurality of unit time interval data. The storage controller controls an amount of data flushed from the first memory device to the second memory device based on one of first and second flush commands. The storage controller compares a shock measurement value representing a magnitude of an external shock with a shock reference value. When the shock measurement value is less than or equal to the shock reference value, the storage controller provides the first flush command to the first memory device to flush first unit time interval data.

A vehicle system includes a first vehicle platform including a first computer configured to operate by means of electric power from a first electric power source and perform traveling control of a vehicle, a second vehicle platform including a second computer configured to operate by means of electric power from a second electric power source different from the first electric power source and perform traveling control of the vehicle, and an autonomous driving platform including a third computer configured to perform autonomous driving control of the vehicle by transmitting a control instruction including data for autonomously driving the vehicle to the first computer when the first vehicle platform is in a normal state and perform autonomous stoppage control of the vehicle by transmitting a control instruction including data for causing the vehicle to autonomously stop to the second computer when the first vehicle platform is in an abnormal state.

The present disclosure relates to a control system for selectively controlling a vehicle, ensuring high integrity of decisions taken by the control system when controlling the vehicle. The present disclosure also relates to a corresponding computer implemented method and to a computer program product.