# US 12,179,779 B2 · Apparatus for controlling to cope with failure in autonomous driving system and method thereof > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,179,779 B2 - Document ID: US12179779B2 - Status: Granted - Kind: B2 - Application number: 17/738,961 - Filed: 2022-05-06 - Published: 2023-03-23 - Granted: 2024-12-31 - Earliest claimed: 2021-09-23 - Assignees: Hyundai Motor Company; Kia Corporation; Hyundai Autoever Corp. - Applicants: Hyundai Motor Company; Kia Corporation; HYUNDAI AUTOEVER Corp. - Inventors: Hong Yeol Lim; Eun Ho Lee - Web page: https://patentgrep.com/patent/US12179779B2 ## CPC - B60W 50/0225: {Failure correction strategy} - B60W 50/0205: {Diagnosing or detecting failures; Failure detection models} - B60W 60/00: Drive control systems specially adapted for autonomous road vehicles - B60W 60/0015: {specially adapted for safety} - G06F 11/0739: {in a data processing system embedded in automotive or aircraft systems} - G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)} - G06F 11/1458: {Management of the backup or restore process} - G06F 11/1446: Point-in-time backing up or restoration of persistent data - B60W: CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An apparatus of controlling to cope with a failure in an autonomous driving system and a method thereof are provided. The apparatus determines whether a failure in one or more applications for performing a function about autonomous driving occurs and sequentially performs step-by-step failure response control corresponding to a safety rating of the application in which the failure occurs, when the failure in the application occurs. The apparatus stably performs an autonomous driving function. ## Claims ### Claim 1 An apparatus of controlling to cope with failures in an autonomous driving system, the apparatus comprising: a storage configured for storing information related to a predetermined safety rating for one or more applications which perform a function about autonomous driving; and a processor configured to determine whether a failure in an application among the one or more applications occurs and sequentially perform step-by-step failure response control corresponding to a safety rating of the application in which the failure occurs, when the failure in the application occurs, wherein the processor is configured to: reset a portion of the autonomous driving system, associated with the application in which the failure occurs, step by step, and reset the portion of the autonomous driving system step by step, in accordance with a number of resets corresponding to the safety rating. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the processor is configured to stop resetting the portion of the autonomous driving system, when the application in which the failure occurs is recovered while resetting the portion of the autonomous driving system step by step and to operate normally the application in which the failure occurs. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the processor is configured to sequentially perform the step-by-step failure response control, including a reset for the application in which the failure occurs, a reset for an operation system (OS) about the application in which the failure occurs, and a reset for a controller about the application in which the failure occurs, in a predetermined order. ### Claim 4 (depends on 3) The apparatus of claim 3, wherein the processor is configured to back up data for the application in which the failure occurs to a volatile or non-volatile memory, before performing the reset for the application in which the failure occurs and the reset for the OS about the application in which the failure occurs and to back up data for the application in which the failure occurs to the non-volatile memory, before performing the reset for the controller about the application in which the failure occurs. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein the processor is configured to back up data for the application in which the failure occurs before performing each reset. ### Claim 6 (depends on 5) The apparatus of claim 5, wherein the processor is configured to evaluate reliability of the backed-up data and to determine whether to use the backed-up data, based on a driving situation after performing each reset and the evaluated reliability. ### Claim 7 (depends on 1) The apparatus of claim 1, wherein the processor is configured to deliver data before resetting the application in which the failure occurs and an error occurrence code for the failure to another application in which the failure does not occur among the one or more applications, when there is a request to deliver data between the application in which the failure occurs and another application while resetting the application in which the failure occurs. ### Claim 8 (depends on 1) The apparatus of claim 1, wherein the processor is configured to determine the failure in the one or more applications, based on at least one of whether the application is enabled, whether running of the application is greater than a time limit, a logic execution order, an order of execution of a task with dependence, or whether there is data synchronization. ### Claim 9 (depends on 1) The apparatus of claim 1, wherein the processor is configured to record a failure code, when the application in which the failure occurs is not recovered, after performing the step-by-step failure response control, to deliver a maintenance request to a user, and to end a controller about the application in which the failure occurs. ### Claim 10 A method for controlling to cope with failures in an autonomous driving system, the method comprising: determining, by a processor, whether a failure in one or more applications for performing a function about autonomous driving occurs; and sequentially performing, by the processor, step-by-step failure response control corresponding to a safety rating of an application in which the failure occurs among the one or more applications, when the failure in the application occurs, wherein the sequential performing of the step-by-step failure response control by the processor includes: resetting, by the processor, a portion of the autonomous driving system, associated with the application in which the failure occurs, step by step, and wherein the resetting of the portion of the autonomous driving system, associated with the application in which the failure occurs, step by step by the processor includes: resetting, by the processor, the portion of the autonomous driving system step by step, depending on a number of resets corresponding to the safety rating. ### Claim 11 (depends on 10) The method of claim 10, wherein the resetting of the portion of the autonomous driving system, associated with the application in which the failure occurs, step by step by the processor includes: stopping, by the processor, resetting the portion of the autonomous driving system, when the application in which the failure occurs is recovered while resetting the portion of the autonomous driving system step by step and normally operating the application in which the failure occurs. ### Claim 12 (depends on 10) The method of claim 10, wherein the sequential performing of the step-by-step failure response control by the processor includes: sequentially performing, by the processor, the step-by-step failure response control, including a reset for the application in which the failure occurs, a reset for an operation system (OS) about the application in which the failure occurs, and a reset for a controller about the application in which the failure occurs, in a predetermined order. ### Claim 13 (depends on 10) The method of claim 10, further including: backing up, by the processor, data for the application in which the failure occurs before performing each reset. ### Claim 14 (depends on 13) The method of claim 13, further including: evaluating, by the processor, reliability of the backed-up data; and determining, by the processor, whether to use the backed-up data, based on a driving situation after performing each reset and the evaluated reliability. ### Claim 15 (depends on 10) The method of claim 10, wherein the resetting of the portion of the autonomous driving system, associated with the application in which the failure occurs, step by step by the processor includes: delivering, by the processor, data before resetting the application in which the failure occurs and an error occurrence code for the failure to another application in which the failure does not occur among the one or more applications, when there is a request to deliver data between the application in which the failure occurs and another application while resetting the application in which the failure occurs. ### Claim 16 (depends on 10) The method of claim 10, wherein the determining of whether the failure occurs by the processor includes: determining, by the processor, the failure in the one or more applications, based on at least one of whether the application is enabled, whether running of the application is greater than a time limit, a logic execution order, an order of execution of a task with dependence, or whether there is data synchronization.