An in-vehicle backup control apparatus includes a discharge circuit that discharges a power storage unit and a control unit that controls the discharge circuit. The control unit sets either one of a superimposable voltage or a supply completion voltage as an interruption threshold value, the superimposable voltage being set as a voltage condition of the power storage unit when electric power is supplied simultaneously to a plurality of target loads during an abnormal state, and the supply completion voltage being set in association with one of the plurality of target loads. The control unit interrupts or delays the supply of electric power to the one of the plurality of target loads to prohibit the plurality of target loads from simultaneously operating if a charge voltage of the power storage unit reaches a value less than or equal to the interruption threshold value during the abnormal state.

In exemplary embodiments, methods, systems, and vehicles are provided, with the vehicle including vehicle systems, a communication bus, a first processor, and a communication bus transceiver. The first processor is configured to at least facilitate: determining whether a potential safety concern is present pertaining to control the vehicle systems; and providing communications along the communication bus of the vehicle, the communications including an indication of the potential safety concern. The communication bus transceiver is coupled to the first processor and configured to at least facilitate: recognizing the indication of the potential safety concern; and inhibiting the control for the vehicle systems when the indication of the potential safety concern is recognized by the communication bus transceiver.

In exemplary embodiments, methods, systems, and vehicles are provided, with the vehicle including vehicle systems, a communication bus, a first processor, and a communication bus transceiver. The first processor is configured to at least facilitate: determining whether a potential safety concern is present pertaining to control the vehicle systems; and providing communications along the communication bus of the vehicle, the communications including an indication of the potential safety concern. The communication bus transceiver is coupled to the first processor and configured to at least facilitate: recognizing the indication of the potential safety concern; and inhibiting the control for the vehicle systems when the indication of the potential safety concern is recognized by the communication bus transceiver.

A system that may include multiple driving related systems that are configured to perform driving related operations; a selection module; multiple fault collection and management units that are configured to monitor statuses of the multiple driving related systems and to report, to the selection module, at least one out of (a) an occurrence of at least one critical fault, (b) an absence of at least one critical fault, (c) an occurrence of at least one non-critical fault, and (d) an absence of at least one non-critical fault; and wherein the selection module is configured to respond to the report by performing at least one out of: (i) reset at least one entity out of the multiple fault collection and management units and the multiple driving related systems; and (ii) select data outputted from a driving related systems.

A system that may include multiple driving related systems that are configured to perform driving related operations; a selection module; multiple fault collection and management units that are configured to monitor statuses of the multiple driving related systems and to report, to the selection module, at least one out of (a) an occurrence of at least one critical fault, (b) an absence of at least one critical fault, (c) an occurrence of at least one non-critical fault, and (d) an absence of at least one non-critical fault; and wherein the selection module is configured to respond to the report by performing at least one out of: (i) reset at least one entity out of the multiple fault collection and management units and the multiple driving related systems; and (ii) select data outputted from a driving related systems.

Cost is reduced when a duplication configuration including up to a power supply is adopted. An in-vehicle electronic control device that executes calculation processing of vehicle control using information acquired by an external sensor includes: a first calculation unit that executes the calculation processing; and a second calculation unit that is communicably connected to the first calculation unit, in which the first calculation unit and the second calculation unit are supplied with power from different power supplies, and execute calculation processing of vehicle control that is different from each other in a normal state, the first calculation unit outputs an action plan of a vehicle, the second calculation unit outputs a signal to be input to an actuator for operating a vehicle, and when the first calculation unit or the second calculation unit fails, a calculation unit in a normal state executes calculation processing of degenerated vehicle control.

Cost is reduced when a duplication configuration including up to a power supply is adopted. An in-vehicle electronic control device that executes calculation processing of vehicle control using information acquired by an external sensor includes: a first calculation unit that executes the calculation processing; and a second calculation unit that is communicably connected to the first calculation unit, in which the first calculation unit and the second calculation unit are supplied with power from different power supplies, and execute calculation processing of vehicle control that is different from each other in a normal state, the first calculation unit outputs an action plan of a vehicle, the second calculation unit outputs a signal to be input to an actuator for operating a vehicle, and when the first calculation unit or the second calculation unit fails, a calculation unit in a normal state executes calculation processing of degenerated vehicle control.

Vehicles may be composed of a relatively few number of “modules” that are assembled together during a final assembly process. An example vehicle may include a body module, a first drive module coupled to a first end of the body module, and a second drive module coupled to a second end of the body module. One or both of the drive modules may include a pair of wheels, a battery, an electric drive motor, and/or a heating ventilation and air conditioning (HVAC) system. One or both of the drive modules may also include a crash structure to absorb impacts. If a component of a drive module fails or is damaged, the drive module can be quickly and easily replaced with a new drive module, minimizing vehicle down time.

A system for addressing failure in an autonomous agent includes a driving subsystem, a control subsystem, a central computing subsystem, and an autonomous vehicle (AV) sensor subsystem. The system can optionally additionally include a power subsystem, a vehicle chassis subsystem, a communication subsystem, a distributed computing and/or processing subsystem, a supplementary sensor subsystem, and/or any other components. A method for addressing failure can include any or all of: detecting and responding to a failure; and operating the vehicle. Additionally or alternatively, the method 200 can include any other processes.

A vehicular autonomous driving system includes a time division multiplexed (TDM) bus, an autonomous driving (AD) controller coupled to the TDM bus, and a plurality of AD sensors coupled to the TDM bus. The AD sensors are configured to collect AD data and transmit collected AD data to the AD controller on the TDM bus in an assigned time slot at a first power level. A first AD sensor of the plurality of AD sensors is configured to, based upon collected AD data, detect an AD emergency event. In response to the detection, the first AD sensor is configured to transmit an AD emergency message on the TDM bus in a non-assigned time slot and at a second power level that exceeds the first power level. The AD sensor may transmit the AD emergency message in a particular sub-slot of the non-assigned time slot.