Distributed safety monitors for automated vehicles

A vehicle control system for at least partially automatically controlling a host vehicle, the vehicle control system comprising:

• a vehicle controller configured to determine vehicle control commands for at least partially automatically controlling the host vehicle based at least in part on sensor information, the vehicle control commands each being arranged to be directly or indirectly utilized by one or more host vehicle control units resident on the host vehicle to facilitate implementation of such vehicle control commands, the vehicle controller having an ASIL rating;
• and
• a second controller that hosts one or more safety monitoring algorithms that, during at least partially automated driving, verify that selected vehicle control commands received from the vehicle controller meet selected safety criteria, wherein at least some of the one or more safety algorithms utilize verified sensor information from a second vehicle in the verification of the commands received from the vehicle controller, the verified sensor information received from the second vehicle being verified by a component on the second vehicle that is compliant with a designated safety standard;
• and
• wherein the second controller has an ASIL rating that is higher than the ASIL rating for the vehicle controller, and wherein the component on the second vehicle that verified the verified sensor information received from the second vehicle has an ASIL rating that is at least as high as the ASIL rating of the second controller.

A vehicle interface controller for use in a vehicle control system for at least partially automatically controlling a host vehicle, the vehicle interface controller being configured to receive selected vehicle control commands from a vehicle controller and to communicate such vehicle control commands to one or more host vehicle control units resident on the host vehicle in a format suitable for use by such one or more host vehicle control units, the vehicle interface controller comprising:

• one or more safety monitoring algorithms executed on the vehicle interface controller that, during the at least partially automated driving, verify that the selected vehicle control commands received from the vehicle controller meet selected safety criteria, wherein at least some of the one or more safety algorithms utilize sensor data in the verification of the commands received from the vehicle controller, wherein at least some of the one or more safety algorithms utilize verified information received from a second vehicle in the verification of the commands received from the vehicle controller, the verified information received from the second vehicle being verified by a component on the second vehicle that is compliant with a designated safety standard, and wherein the vehicle interface controller has an ASIL rating that is higher than an ASIL rating of the vehicle controller, and wherein the component on the second vehicle that verified the verified sensor information received from the second vehicle has an ASIL rating that is at least as high as the ASIL rating of the vehicle interface controller.