When an abnormality associated with power transmission in a power transmission path which is formed such that power of an engine or the like is able to be transmitted to driving wheels has occurred and a vehicle speed is equal to or higher than a predetermined vehicle speed, a limp-home travel control unit switches a limp-home travel mode to a first limp-home travel mode in which the power of the engine or the like is able to be transmitted to the driving wheels through the power transmission path. When an abnormality associated with power transmission in the power transmission path has occurred and the vehicle speed is lower than the predetermined vehicle speed, the limp-home travel control unit switches the limp-home travel mode to a second limp-home travel mode in which limp-home travel is performed using power of a second electric motor.

Described herein are systems, methods, and non-transitory computer-readable media for isolating commercial components from a harsh vehicle operating environment to increase the longevity of such components and to decrease their failure rate. Also described herein are systems, methods, and non-transitory computer-readable media for monitoring the operational health status of vehicle components for failure, and upon detecting failure of a component, initiating a processing task reassignment and fault recovery process. In this manner, processing load handled by the component prior to failure can be offloaded to one or more other vehicle components while a fault recovery process is initiated for the component. When the failed component is operational again, the vehicle may revert back to the task assignment in place prior to the component failure, may continue with the current task assignment, or may transition to another different task reassignment.

A redundant hardware and software architecture can be designed to enable vehicles to be operated in an autonomous mode while improving the reliability and/or safety of such vehicles. A system for redundant architecture can include a set of at least two redundant sensors coupled to a vehicle and configured to provide timestamped sensor data to each of a plurality of computing unit (CU) computers. The CU computers can process the sensor data simultaneously based on at least a time value indicative of an absolute time or a relative time and based on the timestamped sensor data. The CU computers provide to a vehicle control unit (VCU) computer at least two sets of outputs configured to instruct a plurality of devices in a vehicle and cause the vehicle to be driven.

Techniques for determining whether to limit an operation of a vehicle while operating in a manually assisted mode of operation are described herein. A vehicle computing system can monitor components of the vehicle and identify a fault associated with a component. The vehicle computing system can determine whether the fault is associated with a manual operation of the vehicle. Based on a determination that the fault is not associated with the manual operation of the vehicle (e.g., fault associated with an autonomous control component), the vehicle computing system can override the fault and enable continued operation of the vehicle in the manually assisted mode of operation. Based on a determination that the fault is associated with the manual operation of the vehicle, the vehicle computing system can cause the vehicle to cease operating.

A method proactively transitions performance of a functional operation from a primary subsystem to a secondary subsystem within a vehicle or other system having an electronic control unit (ECU). The method includes receiving health management information via the ECU when the primary subsystem is actively performing the functional operation within the system and the secondary subsystem operates in a standby mode, wherein the health information is indicative of a numeric state of health (SOH) of the primary subsystem. The method also includes comparing the numeric SOH to a calibrated non-zero threshold SOH, and then commanding, via the ECU, a transition of the performance of the functional operation to the secondary subsystem and placing the primary subsystem in the standby mode when the numeric SOH is less than the calibrated non-zero threshold SOH. A vehicle executes the method via the ECU.

A method for monitoring an autonomous driving operation of a motor vehicle within a parking facility including the following: ascertaining data for an autonomous driving operation of the motor vehicle; checking the ascertained data for errors before the data are used for the autonomous driving operation of the motor vehicle; if the check revealed that the data have no errors, then using the data to autonomously drive the motor vehicle; and if the check revealed that the data have an error, then carrying out a safety action to reduce a risk of collision for the autonomously driving motor vehicle. Also described is a corresponding device, a motor vehicle, a parking facility, and a computer program.

In a shared backup ECU, a diagnostic section diagnoses an abnormality in a plurality of ECUs which, in order to perform an individual function, execute a program that is different according to the function. A loading section loads, from a storage section storing a plurality of programs in advance, a program which is the same as a program to be executed by an abnormal unit being an ECU whose abnormality has been detected by the diagnostic section. An execution section executes the program loaded by the loading section, thereby performing a function which is the same as a function of the abnormal unit on behalf of the abnormal unit.

A method of a transportation vehicle for context-dependent processing of a potential error of a vehicle component. The method includes determining a current context of the transportation vehicle and of at least one vehicle component of the transportation vehicle that is heterogeneous in the current context. In response to at least one heterogeneous vehicle component being determined, a heterogeneous verification of the potential error is performed taking into account the at least one heterogeneous vehicle component. In response to no heterogeneous vehicle component being determined, a context-dependent relevance of the vehicle component is determined. Based on the determined context-dependent relevance, then either the potential error of the vehicle component is handled or an emergency operating mode of the transportation vehicle is initiated. Also disclosed is a transportation vehicle having a control unit to perform the method.

A redundant hardware and software architecture can be designed to enable vehicles to be operated in an autonomous mode while improving the reliability and/or safety of such vehicles. A system for redundant architecture can include a set of at least two redundant sensors coupled to a vehicle and configured to provide timestamped sensor data to each of a plurality of computing unit (CU) computers. The CU computers can process the sensor data simultaneously based on at least a time value indicative of an absolute time or a relative time and based on the timestamped sensor data. The CU computers provide to a vehicle control unit (VCU) computer at least two sets of outputs configured to instruct a plurality of devices in a vehicle and cause the vehicle to be driven.

A system that may include multiple driving related systems that are configured to perform driving related operations; a selection module; multiple fault collection and management units that are configured to monitor statuses of the multiple driving related systems and to report, to the selection module, at least one out of (a) an occurrence of at least one critical fault, (b) an absence of at least one critical fault, (c) an occurrence of at least one non-critical fault, and (d) an absence of at least one non-critical fault; and wherein the selection module is configured to respond to the report by performing at least one out of: (i) reset at least one entity out of the multiple fault collection and management units and the multiple driving related systems; and (ii) select data outputted from a driving related systems.