Restarting operations for recovery processes in autonomous systems

Patent metadata

Field	Value
Publication number	US-12479475-B2
Application number	US-202318490292-A
Country	US
Kind code	B2
Filing date	Oct 19, 2023
Priority date	Oct 19, 2023
Publication date	Nov 25, 2025
Grant date	Nov 25, 2025

Abstract

Disclosed are embodiments for facilitating restarting operations for recovery processes in autonomous systems. In some aspects, an embodiment includes determining that an autonomous vehicle (AV) is experiencing a failure condition; identifying a plurality of restart operations to apply to one or more components of the AV contributing to the failure condition; prior to applying a restart operation of the plurality of restart operations, determining that safety conditions corresponding to the restart operation are satisfied; and applying the plurality of restart operations to the AV in accordance with an increasing order of disruptiveness of each of the restart operations to operations of the AV.

First claim

What is claimed is:

1 . A method comprising:
determining, by a processing device of an autonomous vehicle (AV), that the AV is experiencing a failure condition; identifying, by the processing device, a plurality of restart operations to apply to one or more components of the AV contributing to the failure condition, wherein the plurality of restart operations comprise at least a node communication connection restart of at least one node communication connection of a software stack of the AV, a node restart of at least one node of the software stack, a subsystem restart of at least one subsystem of the software stack, and a full restart of the software stack; prior to applying a restart operation of the plurality of restart operations, determining that safety conditions corresponding to the restart operation are satisfied; and applying the plurality of restart operations to the AV in accordance with an increasing order of disruptiveness of each of the plurality of restart operations to operations of the AV, wherein each of the plurality of restart operations are applied separately until occurrence of at least one of a resolution of the failure condition of the AV or completion of the plurality of restart operations.

2 . The method of claim 1 , wherein the safety conditions for the node communication connection restart comprise restarting a connection between multiple nodes of the software stack while the AV, including the software stack, continues to operate to allow the AV to navigate an environment.

3 . The method of claim 1 , wherein the safety conditions for the node restart and for the subsystem restart comprise at least one of:
a minimal risk condition being satisfied by the AV, wherein the minimal risk condition comprises the AV being pulled over and fully stopped with an emergency brake activated and zero occupancy of the AV; or positive confirmation of successful handover of control of the AV to a secondary operational system of the AV.

4 . The method of claim 1 , wherein the safety conditions for the full restart comprise a minimal risk condition being satisfied by the AV, wherein the minimal risk condition comprises the AV being pulled over and fully stopped with an emergency brake activated and zero occupancy of the AV.

5 . The method of claim 1 , wherein the node communication connect restart comprises:
detecting a disconnect of a communication connection of a node of the one or more components of the AV; and initiating a handshake protocol to establish the communication connection of the node via a shared memory segment.

6 . The method of claim 1 , wherein the node restart comprises:
detecting, by a process orchestrator of the AV, a failure of a node of the one or more components of the AV; confirming that the safety conditions for the node restart are satisfied; causing a shutdown and restart process of the node to be executed on the AV; and facilitating a node communication connection restart for the node upon restart of the node.

7 . The method of claim 1 , wherein the subsystem restart comprises:
detecting, by a process orchestrator of the AV, a failure of a plurality of nodes of the one or more components of the AV; identifying a subsystem of the AV, the subsystem corresponding to the plurality of nodes; confirming that the safety conditions for the subsystem restart are satisfied; causing a shutdown and restart process of the plurality of nodes of the subsystem to be executed on the AV; and facilitating a node communication connection restart for each of the plurality of nodes upon restart of the plurality of nodes of the subsystem.

8 . The method of claim 1 , wherein the full stack restart comprises:
detecting, by a process orchestrator of the AV, a failure corresponding to an AV stack of the AV; confirming that the safety conditions for the full restart are satisfied; causing a shutdown and restart process of the AV stack to be executed on the AV; and facilitating a node communication connection restart for each of a plurality of nodes of the AV stack upon restart of the AV stack.

9 . The method of claim 1 , wherein the node restart comprises a fast restart technique, the fast restart technique comprising restarting the at least one node without interrupting a remainder of the software stack of the AV prior to a timeout condition occurring.

10 . An apparatus comprising:
one or more hardware processors of an autonomous vehicle (AV) to:
determine that the AV is experiencing a failure condition;
identify a plurality of restart operations to apply to one or more components of the AV contributing to the failure condition, wherein the plurality of restart operations comprise at least a node communication connection restart of at least one node communication connection of a software stack of the AV, a node restart of at least one node of the software stack, a subsystem restart of at least one subsystem of the software stack, and a full restart of the software stack;
prior to applying a restart operation of the plurality of restart operations, determine that safety conditions corresponding to the restart operation are satisfied; and
apply the plurality of restart operations to the AV in accordance with an increasing order of disruptiveness of each of the plurality of restart operations to operations of the AV, wherein each of the plurality of restart operations are applied separately until occurrence of at least one of a resolution of the failure condition of the AV or completion of the plurality of restart operations.

11 . The apparatus of claim 10 , wherein the safety conditions for the node restart and for the subsystem restart comprise at least one of:
a minimal risk condition being satisfied by the AV, wherein the minimal risk condition comprises the AV being pulled over and fully stopped with an emergency brake activated and zero occupancy of the AV; or positive confirmation of successful handover of control of the AV to a secondary operational system of the AV; wherein the safety conditions for the full restart comprise the minimal risk condition being satisfied by the AV.

12 . The apparatus of claim 10 , wherein the node communication connect restart comprises:
detecting a disconnect of a communication connection of a node of the one or more components of the AV; and initiating a handshake protocol to establish the communication connection of the node via a shared memory segment.

13 . The apparatus of claim 10 , wherein the node restart comprises:
detecting, by a process orchestrator of the AV, a failure of a node of the one or more components of the AV; confirming that the safety conditions for the node restart are satisfied; causing a shutdown and restart process of the node to be executed on the AV; and facilitating a node communication connection restart for the node upon restart of the node.

14 . The apparatus of claim 10 , wherein the subsystem restart comprises:
detecting, by a process orchestrator of the AV, a failure of a plurality of nodes of the one or more components of the AV; identifying a subsystem of the AV, the subsystem corresponding to the plurality of nodes; confirming that the safety conditions for the subsystem restart are satisfied; causing a shutdown and restart process of the plurality of nodes of the subsystem to be executed on the AV; and facilitating a node communication connection restart for each of the plurality of nodes upon restart of the plurality of nodes of the subsystem.

15 . The apparatus of claim 10 , wherein the full restart comprises:
detecting, by a process orchest

Assignees

• Gm Cruise Holdings Llc

Inventors

• Hoare John
• Gross Drew
• Sinha Sneha
• Courbet Florian
• Loman Daniel
• Pasternak Andreas
• Sorrels Kais
• Buslovskyy Serhiy
• Kollar Ryan
• Lenoff Jonathan

Classifications

• B60W50/0205

  Diagnosing or detecting failures; Failure detection models · CPC title

• B60W50/0225 Primary

  Failure correction strategy · CPC title

• G06F11/0796

  Safety measures, i.e. ensuring safe condition in the event of error, e.g. for controlling element · CPC title

• G06F11/0739

  in a data processing system embedded in automotive or aircraft systems · CPC title

• G06F11/1438

  Restarting or rejuvenating · CPC title