Abstract: In one embodiment, method for determining capability boundary of a safety redundancy of an autonomous driving vehicle (ADV) includes obtaining a sensor layout associated with the ADV representing a system having a plurality of sensors mounted on a plurality of locations of the ADV. A zone failure risk of one or more sensors within the predetermined zones is estimated based on statistical operational data of the one or more sensors for each of the plurality of predetermined zones. An overall failure risk of the sensors is determined based on the zone failure risks of the predetermined zones based on relative locations of the sensors across the predetermined zones. A dynamic risk adjustment is determined based on the overall failure risk of the sensors, the dynamic risk adjustment representing a reliability of a sensor system associated with the ADV for estimating a safety of autonomous driving of the ADV.

Abstract: Systems and methods of determining a risk distribution associated with a multiplicity of coverage zones covered by a multiplicity of sensors of an autonomous driving vehicle (ADV) are disclosed. The method includes for each coverage zone covered by at least one sensor of the ADV, obtaining MTBF data of the sensor(s) covering the coverage zone. The method further includes determining a mean time between failure (MTBF) of the coverage zone based on the MTBF data of the sensor(s). The method further includes computing a performance risk associated with the coverage zone based on the determined MTBF of the coverage zone. The method further includes determining a risk distribution based on the computed performance risks associated with the multiplicity of coverage zones.

Abstract: In one embodiment, a method for monitoring a localization function in an autonomous driving vehicle (ADV) can use known static objects as ground truths to determine when the localization function encounter errors. The known static objects are marked on a high definition (HD) map for the real-time driving environment. When the ADV detects one or more known static objects, the ADV can use sensor data, locations of the one or more static objects, and one or more error tolerance parameters to create a localization error tolerance area surrounding a current location of the ADV. The ADV can project the tolerance area on the HD map, performs a localization operation to generate an expected location of the ADV on the HD map, and determines whether the generated location falls within the projected tolerance area.

Abstract: According to one embodiment, a motion trajectory boundary is obtained based on a trajectory that has been planned to drive an ADV for a next time period. A safe driving area boundary is determined for the ADV based on perception data perceiving a driving environment surrounding the ADV. The motion trajectory boundary and the safe drivable area boundary are projected onto a map such as an HD map. A relative location of the ADV within the map relative to the motion trajectory and the safe drivable area boundary is determined. A fail-safe action or a fail operational action may be performed based on the relative location of the ADV in view of the motion trajectory boundary and the safe drivable area boundary.

Abstract: Systems and methods of adjusting zone associated risks of a coverage zone covered by one or more sensors of an autonomous driving vehicle (ADV) operating in real-time are disclosed. As an example, the method includes defining a performance limit detection window associated with a first sensor based on a mean time between failure (MTBF) lower limit of the first sensor and a MTBF upper limit of the first sensor. The method further includes determining whether an operating time of the ADV operating in autonomous driving (AD) mode is within the performance limit detection window associated with the first sensor. The method further includes in response to determining that the operating time of the ADV operating in AD mode is within the performance limit detection window of the first sensor, adjusting a zone associated risk of the coverage zone to a performance risk of a second sensor.

Abstract: Systems and methods are disclosed for dynamically adjusting effective sensor coverage coordinates of a sensor used to assist in navigating an autonomous driving vehicle (ADV) in response to environmental conditions that may affect the ideal operation of the sensor. An ADV includes a navigation system and a safety monitor system that monitors some, or all, of the navigation system, including monitoring: dynamic adjustment of effective sensor coverage coordinates of a sensor and localization of the ADV within a high-definition map. The ADV safety monitor system further determines safety-critical objects surrounding the ADV, determines safe areas to navigate the ADV, and ensures that the ADV navigates only to safe areas. An automated system performance monitor determines whether to pass-through ADV navigation control commands, limit one or more control commands, or perform a fail-operational behavior, based on the ADV safety monitor systems.

Abstract: An ADV includes a method to combine data from multiple sensors. The method compresses video data from a camera to generate compressed video data. The compressed video data are segmented. The method time synchronizes each segment of the compressed video data with data from other sensors. The method then combines each segment of the compressed video data with the corresponding time-synchronized sensor data for the other sensors. In one embodiment, each segment of the compressed video data is independently decodable. In another embodiment, each segment of the compressed video data includes a compressed video unit that is prepended with a buffered portion of the compressed video data that immediately precede the compressed video unit. The length of the compressed video unit is smaller than the length of the independently decodable segment to offer finer granularity in time synchronizing the compressed video data with the other sensor data with a tradeoff.

Abstract: Systems and methods are disclosed for an ADV to leverage pre-defined static objects along a planned route of travel to detect and counter attacks that attempt to change the destination or the planned route. The ADV may detect updates to the static objects if the planned route is changed. Based on the updated static objects, the ADV determines if there is an abnormal re-routing of the planned route or if there is a new route due to a suspicious destination change. The ADV may also leverage the static objects to detect spoofing attacks against the sensor system. The ADV may evaluate if sensors of the sensor system are able to detect and identify the static objects to identify an impaired sensor. The ADV may perform cross-check on the ability of the sensors to detect and identify dynamic objects to gain confidence that the impaired sensor is due to spoofing attacks.

Abstract: In one embodiment, a method for performing an obstacle detection for an ADV includes detecting an obstacle by a primary ADS and a secondary ADS using an obstacle detection algorithm based on sensor data provided by sensors on the ADV. In response to detecting the obstacle, a first controlled stop distance and a second controlled stop distance are calculated by the primary ADS and secondary ADS respectively based on a speed and a deceleration capability of the ADV. The first and second controlled stop distances between the primary ADS and secondary ADS are exchanged to determine a third controlled stop distance which is the maximum of the two. In response to determining that the ADV reaches within the third controlled distance between the ADV and the obstacle, a controlled stop operation is activated by the primary ADS to decelerate the ADV based on the third controlled stop distance.

Abstract: Systems and methods are disclosed for dynamically adjusting effective sensor coverage coordinates of a sensor used to assist in navigating an autonomous driving vehicle (ADV) in response to environmental conditions that may affect the ideal operation of the sensor. An ADV includes a navigation system and a safety monitor system that monitors some, or all, of the navigation system, including monitoring: dynamic adjustment of effective sensor coverage coordinates of a sensor and localization of the ADV within a high-definition map. The ADV safety monitor system further determines safety-critical objects surrounding the ADV, determines safe areas to navigate the ADV, and ensures that the ADV navigates only to safe areas. An automated system performance monitor determines whether to pass-through ADV navigation control commands, limit one or more control commands, or perform a fail-operational behavior, based on the ADV safety monitor systems.

Abstract: Systems and methods of determining a risk distribution associated with a multiplicity of coverage zones covered by a multiplicity of sensors of an autonomous driving vehicle (ADV) are disclosed. The method includes for each coverage zone covered by at least one sensor of the ADV, obtaining MTBF data of the sensor(s) covering the coverage zone. The method further includes determining a mean time between failure (MTBF) of the coverage zone based on the MTBF data of the sensor(s). The method further includes computing a performance risk associated with the coverage zone based on the determined MTBF of the coverage zone. The method further includes determining a risk distribution based on the computed performance risks associated with the multiplicity of coverage zones.

Abstract: Systems and methods of adjusting zone associated risks of a coverage zone covered by one or more sensors of an autonomous driving vehicle (ADV) operating in real-time are disclosed. As an example, the method includes defining a performance limit detection window associated with a first sensor based on a mean time between failure (MTBF) lower limit of the first sensor and a MTBF upper limit of the first sensor. The method further includes determining whether an operating time of the ADV operating in autonomous driving (AD) mode is within the performance limit detection window associated with the first sensor. The method further includes in response to determining that the operating time of the ADV operating in AD mode is within the performance limit detection window of the first sensor, adjusting a zone associated risk of the coverage zone to a performance risk of a second sensor.

Abstract: In one embodiment, method for real-time monitoring of a safety redundancy autonomous driving system operating within a predefined risk tolerable boundary includes calculating a zone failure risk score for each of predetermined zones based on a sensor failure risk score associated with each of sensors mounted on the ADV. The predetermined zones being defined based on a sensor layout of the sensors. A sensor capability coverage of the ADV is determined based on the zone failure risk score associated with each of the predetermined zones. A drivable area of the ADV is determined based on the sensor capability coverage in view of map data associated with a current location of the ADV. A trajectory is planned based on the drivable area to autonomously drive the ADV to navigate a driving environment surrounding the ADV.

Abstract: In one embodiment, method for determining capability boundary of a safety redundancy of an autonomous driving vehicle (ADV) includes obtaining a sensor layout associated with the ADV representing a system having a plurality of sensors mounted on a plurality of locations of the ADV. A zone failure risk of one or more sensors within the predetermined zones is estimated based on statistical operational data of the one or more sensors for each of the plurality of predetermined zones. An overall failure risk of the sensors is determined based on the zone failure risks of the predetermined zones based on relative locations of the sensors across the predetermined zones. A dynamic risk adjustment is determined based on the overall failure risk of the sensors, the dynamic risk adjustment representing a reliability of a sensor system associated with the ADV for estimating a safety of autonomous driving of the ADV.

Abstract: In one embodiment, a method for performing an obstacle detection for an ADV includes detecting an obstacle by a primary ADS and a secondary ADS using an obstacle detection algorithm based on sensor data provided by sensors on the ADV. In response to detecting the obstacle, a first controlled stop distance and a second controlled stop distance are calculated by the primary ADS and secondary ADS respectively based on a speed and a deceleration capability of the ADV. The first and second controlled stop distances between the primary ADS and secondary ADS are exchanged to determine a third controlled stop distance which is the maximum of the two. In response to determining that the ADV reaches within the third controlled distance between the ADV and the obstacle, a controlled stop operation is activated by the primary ADS to decelerate the ADV based on the third controlled stop distance.

Abstract: An ADV includes a method to combine data from multiple sensors. The method compresses video data from a camera to generate compressed video data. The compressed video data are segmented. The method time synchronizes each segment of the compressed video data with data from other sensors. The method then combines each segment of the compressed video data with the corresponding time-synchronized sensor data for the other sensors. In one embodiment, each segment of the compressed video data is independently decodable. In another embodiment, each segment of the compressed video data includes a compressed video unit that is prepended with a buffered portion of the compressed video data that immediately precede the compressed video unit.

Abstract: A first request is received from a first processing node to produce data blocks of a first data stream representing a first communication topic. The first processing node is one of the processing nodes handling a specific function. Each of the processing nodes is executed within a specific node container having a specific operating environment. A global memory segment is allocated from a global memory to store the data blocks of the first data stream. A first local memory segment is mapped to the global memory segment. The first local memory segment is allocated from a first local memory of a first node container containing the first processing node. The first processing node directly accesses the data blocks of the first data stream stored in the global memory segment by accessing the mapped first local memory segment within the first node container.

Abstract: Systems and methods are disclosed for dynamically adjusting effective sensor coverage coordinates of a sensor used to assist in navigating an autonomous driving vehicle (ADV) in response to environmental conditions that may affect the ideal operation of the sensor. An ADV includes a navigation system and a safety monitor system that monitors some, or all, of the navigation system, including monitoring: dynamic adjustment of effective sensor coverage coordinates of a sensor and localization of the ADV within a high-definition map. The ADV safety monitor system further determines safety-critical objects surrounding the ADV, determines safe areas to navigate the ADV, and ensures that the ADV navigates only to safe areas. An automated system performance monitor determines whether to pass-through ADV navigation control commands, limit one or more control commands, or perform a fail-operational behavior, based on the ADV safety monitor systems.

Abstract: In one embodiment, a method of transitioning from autonomous driving (AD) to manual driving (MD) mode for an autonomous driving vehicle (ADV) is disclosed. The method includes determining whether AD-to-MD transition is allowed in a current location of the ADV. The method further includes determining whether a current driving scenario is safe for the AD-to-MD transition. The method further includes in response to determining that the AD-to-MD transition is allowed in the current location and the current driving scenario is safe for the AD-to-MD transition, enabling the AD-to-MD transition. The method further includes determining whether there is a request for the AD-to-MD transition. The method further includes in response to determining there is the request, computing a current vehicle motion trajectory of the ADV. The method further includes comparing the current vehicle motion trajectory with a motion trajectory derived from inputs of a driver of the ADV.

Abstract: Systems and methods are disclosed for an ADV to leverage pre-defined static objects along a planned route of travel to detect and counter attacks that attempt to change the destination or the planned route. The ADV may detect updates to the static objects if the planned route is changed. Based on the updated static objects, the ADV determines if there is an abnormal re-routing of the planned route or if there is a new route due to a suspicious destination change. The ADV may also leverage the static objects to detect spoofing attacks against the sensor system. The ADV may evaluate if sensors of the sensor system are able to detect and identify the static objects to identify an impaired sensor. The ADV may perform cross-check on the ability of the sensors to detect and identify dynamic objects to gain confidence that the impaired sensor is due to spoofing attacks.