A vehicle travel control device executes trajectory following control to make the vehicle follow a target trajectory. A delay time represents control delay of the trajectory following control. A delay compensation time is at least a part of the delay time. The trajectory following control includes: displacement estimation processing that estimates a displacement of the vehicle in the delay compensation time; and delay compensation processing that corrects a deviation between the vehicle and the target trajectory based on the estimated displacement to compensate the control delay. The displacement estimation processing is effective in an effective period and ineffective in an ineffective period. When the ineffective period is included in the delay time of the trajectory following control, the displacement estimation processing is executed in a temporary mode by using sensor-detected information in the effective period without using the sensor-detected information in the ineffective period.

An autonomous driving control system comprises a main controller, a backup controller, main execution apparatuses and backup execution apparatuses. The backup controller is configured to decompose, when receiving a main control instruction from the main controller, the main control instruction to obtain backup control instructions corresponding to the backup execution apparatuses respectively, and send the backup control instructions to the backup execution apparatuses correspondingly; and the control system is configured to control, when detecting that an abnormality occurs in any one device of the main execution apparatuses, the backup execution apparatus corresponding to the device in which the abnormality has occurred to execute a corresponding backup control instruction. The system can solve the problem that an autonomous driving control system cannot operate normally when any controller or actuation mechanism fails at a single point.

Provided is an in-vehicle control system capable of reducing an increase in cost accompanying advancement of a fallback operation. Therefore, the in-vehicle control system includes: a plurality of control circuits 3 and 4 respectively including control units that perform data communication with each other; an external environment recognition sensor a5; and a plurality of wirings 11, 12, 13, and 14 connecting the external environment recognition sensor a5 and the plurality of control circuits 3 and 4. The plurality of control circuits 3 and 4 include: a first power supply unit that supplies power to the external environment recognition sensor a5 via a corresponding wiring among the plurality of wirings 11, 12, 13, and 14; and a first detection unit that detects an abnormality related to the power supplied to the external environment recognition sensor a5. A control unit in a control device including a first detection unit that has detected the abnormality is controlled to acquire data of the external environment recognition sensor a5 from a control unit included in the other control device.

Among other things, we describe techniques for implementing a vehicle response to sensor failure. In general, one innovative aspect of the subject matter described in this specification can be embodied in methods that include receiving information from a plurality of sensors coupled to a vehicle, determining that a level of confidence of the received information from at least one sensor of a first subset of sensors of the plurality of sensors is less than a first threshold, comparing a number of sensors in the first subset of sensors to a second threshold, and adjusting the driving capability of the vehicle to rely on information received from a second subset of sensors of the plurality of sensors, wherein the second subset of sensors excludes the at least one sensor of the first subset of sensors.

A system that may include multiple driving related systems that are configured to perform driving related operations; a selection module; multiple fault collection and management units that are configured to monitor statuses of the multiple driving related systems and to report, to the selection module, at least one out of (a) an occurrence of at least one critical fault, (b) an absence of at least one critical fault, (c) an occurrence of at least one non-critical fault, and (d) an absence of at least one non-critical fault; and wherein the selection module is configured to respond to the report by performing at least one out of: (i) reset at least one entity out of the multiple fault collection and management units and the multiple driving related systems; and (ii) select data outputted from a driving related systems.

A computer system for verifying vehicle software configuration may be provided. The computer system may include a processor and a non-transitory, tangible, computer-readable storage medium having instructions stored thereon that, in response to execution by the processor, cause the processor to: (1) transmit, to a vehicle computing system, an authentication request including a hash algorithm specification; (2) receive, from the vehicle computing system, a current configuration hash value and a vehicle identifier; (3) retrieve a trusted data block from a memory based upon the vehicle identifier, the trusted data block including a stored configuration hash value and a smart contract code segment; (4) execute the smart contract code segment, the smart contract code segment including a failsafe code segment; and/or (5) transmit the authentication response to the vehicle computing system, and cause the vehicle computing system to execute the failsafe code segment.

Cost is reduced when a duplication configuration including up to a power supply is adopted. An in-vehicle electronic control device that executes calculation processing of vehicle control using information acquired by an external sensor includes: a first calculation unit that executes the calculation processing; and a second calculation unit that is communicably connected to the first calculation unit, in which the first calculation unit and the second calculation unit are supplied with power from different power supplies, and execute calculation processing of vehicle control that is different from each other in a normal state, the first calculation unit outputs an action plan of a vehicle, the second calculation unit outputs a signal to be input to an actuator for operating a vehicle, and when the first calculation unit or the second calculation unit fails, a calculation unit in a normal state executes calculation processing of degenerated vehicle control.

An automatic driving vehicle is running in an automatic driving mode effected by a driving control device. An operator is able to instruct via a SLOW DOWN button on a touch panel that the automatic driving vehicle is to be decelerated or stopped. Should any anomaly occur to the SLOW DOWN button, a message or the like is displayed on a touch panel to encourage operation of an emergency stop switch. When the operator operates the emergency stop switch, emergency stop control is executed.

A vehicle is a vehicle on which an ADK is mountable. The vehicle includes: a VP that controls the vehicle in accordance with an instruction from the ADK; and a VCIB that serves as an interface between the ADK and the VP. The VP outputs an accelerator pedal position signal in accordance with an amount of depression of an accelerator pedal by a driver, and outputs an accelerator pedal intervention signal, to the ADK through the VCIB. The accelerator pedal intervention signal indicates that the accelerator pedal is depressed, when the accelerator pedal position signal indicates that the amount of depression is larger than a threshold value, and indicates beyond autonomy acceleration of the vehicle, when an acceleration request in accordance with the amount of depression is higher than a system acceleration request.

A system 100 for autonomous vehicle operation can include: a low-level safety platform 130; and can optionally include and/or interface with any or all of: an autonomous agent 102, a sensor system, a computing system 120, a vehicle communication network 140, a vehicle control system 150, and/or any suitable components. The system functions to facilitate fallback planning and/or execution at the autonomous agent. Additionally or alternatively, the system can function to transition the autonomous agent between a primary (autonomous) operation mode and a fallback operation mode.