Embodiments provide a vehicle computer coupled to a vehicle. The vehicle computer may be configured to compute (e.g., generate) a first (e.g., regular, main) trajectory and a second (e.g., fail-safe, minimal risk maneuver) trajectory for the vehicle. Embodiments may provide a fault detection interval during which the second trajectory may be activated due to missing updated trajectory input. Embodiments may also provide a recovery detection interval during which an updated regular trajectory may be generated and followed instead of the fail-safe trajectory if a valid trajectory update is received. Accordingly, embodiments allow for an early activation of a fail-safe trajectory compared to conventional systems, while also allowing the system to recover (e.g., revert back to a modified version of the first trajectory) if a valid trajectory update is received during a recovery detection interval.

An on-board vehicle computer system is configured to detect a condition of a vehicle; identify a de-rate cause for the vehicle in a hierarchical set of de-rate causes, wherein the de-rate cause is associated with the condition; select a de-rate type from a set of possible de-rate types based at least in part on the de-rate cause; select an initial de-rate level from a set of possible de-rate levels based at least in part on the de-rate cause; present an operator notification associated with the de-rate cause via an operator interface; activate a de-rate for the vehicle according to the de-rate type and the initial de-rate level; detect a change in the vehicle condition; and update the initial de-rate level based at least in part on the change in the vehicle condition.

A control system for controlling one or more torque generating devices on a heavy-duty vehicle comprising a primary sensor system with a primary sensor control unit configured to interpret an output signal of the primary sensor system, wherein the primary sensor control unit is configured to determine a first load value associated with the heavy-duty vehicle, and one or more tire sensor devices mounted on one or more tires of the heavy-duty vehicle, and a tire sensor control unit configured to interpret an output signal of the one or more tire sensor devices, wherein the tire sensor control unit is configured to determine a second load value associated with the heavy-duty vehicle, wherein the control system is arranged to base control of the heavy-duty vehicle on the second load value in case of malfunction in the primary sensor system and/or in the primary sensor control unit.

A method for controlling autonomous driving for an autonomous driving vehicle, includes collecting sensing information on autonomous driving in an autonomous driving mode, calculating an initial longitudinal control value based on the sensing information on the autonomous driving, correcting the initial longitudinal control value based on the sensing information, and performing a longitudinal driving control by transmitting the corrected longitudinal control value to a lower controller.

Described herein are systems, methods, and non-transitory computer-readable media for implementing automated vehicle safety response measures to ensure continued safe automated vehicle operation for a limited period of time after a vehicle component or vehicle system that supports an automated vehicle driving function fails. When a critical vehicle component/system such as a vehicle computing platform fails, the vehicle is likely no longer capable of performing calculations required to safely operate and navigate the vehicle in an autonomous manner, or at a minimum, is no longer able to ensure the accuracy of such calculations. In such a scenario, the automated vehicle safety response measures disclosed herein can ensure—despite failure of the vehicle component/system—continued safe automated operation of the vehicle for a limited period of time in order to bring the vehicle to a safe stop.

A lane-keeping system suitable for use on an automated vehicle includes a camera, an inertial-measurement-unit, and a controller. The camera is configured to detect a lane-marking of a roadway traveled by a vehicle. The inertial-measurement-unit is configured to determine relative-motion of the vehicle. The controller in communication with the camera and the inertial-measurement-unit. When the lane-marking is detected the controller is configured to steer the vehicle towards a centerline of the roadway based on a last-position, and determine an offset-vector indicative of motion of the vehicle relative to the centerline of the roadway. When the lane-marking is not detected the controller is configured to: determine an offset-position relative to the last-position based on information from the inertial-measurement-unit, determine a correction-vector used to steer the vehicle from the offset-position towards the centerline of the roadway based on the last-position and the offset-vector, and steer the vehicle according to the correction-vector.

A system 100 for autonomous vehicle operation can include: a low-level safety platform 130; and can optionally include and/or interface with any or all of: an autonomous agent 102, a sensor system, a computing system 120, a vehicle communication network 140, a vehicle control system 150, and/or any suitable components. The system functions to facilitate fallback planning and/or execution at the autonomous agent. Additionally or alternatively, the system can function to transition the autonomous agent between a primary (autonomous) operation mode and a fallback operation mode.

A control architecture for electrified braking and electrified steering of a vehicle supplies a steering actuator and a steering controller with power from a first one of at least two energy supply units. Two brake actuators are supplied with power from a second one of the at least two energy supply units. A first brake actuator is associated with a first wheel of the vehicle and a second brake actuator is associated with a second wheel of the vehicle. The first brake actuator and/or the second brake actuator is/are actuated to perform a steering function for the vehicle.

A management domain unit is connected, via an independent virtual network (95) using a hypervisor unit, to a separate management domain unit (B) (10B) of a separate electronic control unit ECU (B) (1) having the separate management domain unit (B) (10B) and a separate basic domain unit (A) (50B) which substitutes for a basic domain unit. When an abnormality of the basic domain unit is detected, the management domain unit halts operation of the basic domain unit, and causes the separate management domain unit (B) (10B) possessed by the separate electronic control unit ECU (B) (1) to start operation of the separate basic domain unit (A) (50B).

A method may include distributing target torque to target engine torque of an engine and target motor torque of a motor according to a predetermined control logic according to driver demand torque, comparing torques which determines whether actual torques of the engine and the motor are smaller than the target engine torque and the target motor torque, comparing whether a time period during which a state where a state where the torque of the engine or the motor is insufficient is maintained is a predetermined reference time or more, determining that any one of the engine and the motor is failed, when the time during which a state where the state where the torque of the engine or the motor is insufficient is maintained is the reference time or more, and controlling limp-home which limits the target engine torque of the engine, the target motor torque of the motor, and the regenerative braking amount of the motor.