Certified control for self-driving cars

Patent metadata

Field	Value
Publication number	US-11745732-B2
Application number	US-201916696546-A
Country	US
Kind code	B2
Filing date	Nov 26, 2019
Priority date	Jul 9, 2019
Publication date	Sep 5, 2023
Grant date	Sep 5, 2023

Abstract

A method for certified control of a self-driving ego vehicle is described. The method includes analyzing a safety situation of the self-driving ego vehicle to determine a proposed vehicle control action using a main controller of the self-driving ego vehicle. The method also includes presenting, by the main controller, the proposed vehicle control action to an interlock controller, including a certificate of the proposed vehicle control action. The method further includes checking a safety certification evidence from the certificate by the interlock controller using a predefined safety argument to verify the safety certification evidence of the certificate. The method also includes directing, by a low-level controller, the self-driving ego vehicle to perform a certified vehicle control action.

First claim

What is claimed is:

1. A method for certified control of a self-driving ego vehicle, comprising:
analyzing a safety situation of the self-driving ego vehicle to determine a proposed vehicle control action using a main controller of the self-driving ego vehicle;
presenting, by the main controller, the proposed vehicle control action to an interlock controller, including a certificate of the proposed vehicle control action;
checking a safety certification evidence from the certificate by the interlock controller using a predefined safety argument to verify the safety certification evidence of the certificate, by accessing sensor data from the safety certification evidence of the certificate and using the sensor data to confirm safety of the proposed vehicle control action; and
directing, by a low-level controller, the self-driving ego vehicle to perform a certified vehicle control action.

2. The method of claim 1 , in which directing further comprises passing, by the interlock controller, the proposed vehicle control action to the low-level controller if the safety certification evidence from the certificate is verified by the interlock controller.

3. The method of claim 1 , further comprising:
replacing, by the interlock controller, the proposed vehicle control action with an intervention vehicle control action if the safety certification evidence from the certificate is not verified; and
directing, by the low-level controller, the self-driving ego vehicle to perform the intervention vehicle control action.

4. The method of claim 3 , in which the intervention vehicle control action comprises braking, throttling, and/or steering.

5. The method of claim 3 , in which directing comprising translating, by the low-level controller, the certified vehicle control action into actuations of brakes, throttle, and/or steering.

6. The method of claim 3 , in which the interlock controller uses the sensor data to confirm safety of the intervention vehicle control action.

7. The method of claim 1 , in which the safety certification evidence of the certificate includes time stamped and signed evidence to verify the proposed vehicle control action is safe.

8. The method of claim 1 , in which the certified vehicle control action comprises the proposed vehicle control action.

9. The method of claim 1 , in which the certified vehicle control action comprises an intervention vehicle control action selected by the interlock controller.

10. A non-transitory computer-readable medium having program code recorded thereon for certified control of a self-driving ego vehicle, the program code being executed by a processor and comprising:
program code to analyze a safety situation of the self-driving ego vehicle to determine a proposed vehicle control action using a main controller of the self-driving ego vehicle;
program code to present, by the main controller, the proposed vehicle control action to an interlock controller, including a certificate of the proposed vehicle control action;
program code to check a safety certification evidence from the certificate by the interlock controller using a predefined safety argument to verify the safety certification evidence of the certificate, by program code to access sensor data from the safety certification evidence of the certificate and use the sensor data to confirm safety of the proposed vehicle control action; and
program code to direct, by a low-level controller, the self-driving ego vehicle to perform a certified vehicle control action.

11. The non-transitory computer-readable medium of claim 10 , further comprising:
program code to replace, by the interlock controller, the proposed vehicle control action with an intervention vehicle control action if the safety certification evidence from the certificate is not verified; and
program code to direct, by the low-level controller, the self-driving ego vehicle to perform the intervention vehicle control action.

12. The non-transitory computer-readable medium of claim 11 , in which the program code to direct comprises program code to translate, by the low-level controller, the certified vehicle control action into actuations of brakes, throttle, and/or steering.

13. The non-transitory computer-readable medium of claim 10 , further comprising program code to pass, by the interlock controller, the proposed vehicle control action to the low-level controller if the safety certification evidence from the certificate is verified by the interlock controller.

14. The non-transitory computer-readable medium of claim 10 , in which the safety certification evidence of the certificate includes time stamped and signed evidence to verify the proposed vehicle control action is safe.

15. The non-transitory computer-readable medium of claim 10 , in which the certified vehicle control action comprises an intervention vehicle control action selected by the interlock controller.

16. A system for certified control of a self-driving ego vehicle, the system comprising:
a main controller configured to analyze a safety situation of the self-driving ego vehicle to determine a proposed vehicle control action;
an interlock controller configured to receive the proposed vehicle control action and a certificate of the proposed vehicle control action from the main controller, the interlock controller further configured to verify safety certification evidence of the certificate, by accessing sensor data from the safety certification evidence of the certificate and using the sensor data to confirm safety of the proposed vehicle control action; and
a low-level controller configured to direct the self-driving ego vehicle to perform a certified vehicle control action.

17. The system of claim 16 , in which the interlock controller is further configured to the proposed vehicle control action to the low-level controller if the safety certification evidence from the certificate is verified by the interlock controller.

18. The system of claim 16 , in which the interlock controller is further configured to replace the proposed vehicle control action with an intervention vehicle control action if the safety certification evidence from the certificate is not verified.

19. The system of claim 18 , in which the low-level controller is further configured to direct the self-driving ego vehicle to perform the intervention vehicle control action.

20. The system of claim 16 , in which the low-level controller is further configured to translate the certified vehicle control action into actuations of brakes, throttle, and/or steering of the self-driving ego vehicle.

Assignees

• Toyota Res Inst Inc
• Massachusetts Inst Technology

Inventors

• Jackson Daniel
• Decastro Jonathan
• Kong Soon Ho
• Arechiga Gonzalez Nikos
• Koutentakis Dimitrios
• Leong Feng Ping Angela
• Wang Mike Meichang
• Zhang Xin

Classifications

• B60W30/09 Primary

  Taking automatic action to avoid collision, e.g. braking and steering · CPC title

• B60W10/18

  including control of braking systems · CPC title

• B60W10/20

  including control of steering systems · CPC title

• B60W30/0956

  the prediction being responsive to traffic or environmental parameters · CPC title

• G05D1/0077

  using redundant signals or controls · CPC title