A safety architecture for autonomous vehicles

A method comprising:

• generating, by one or more processors, primary data for performing normal system functionality;
• generating, by the one or more processors, secondary data for performing alternative system functionality;
• providing, by the one or more processors, the primary data as a primary output of a first stage responsive to determining validity of the primary data;
• providing, by the one or more processors, the secondary data as a secondary output of the first stage responsive to determining validity of the secondary data;
• and
• providing, by the one or more processors, a system output responsive to determining the validities of the primary data and the secondary data.

A system comprising:

• a primary planner unit that generates primary path data for moving a device from a first location to a second location;
• a safing planner unit that generates safing path data for moving the device in presence of one or more adverse conditions during the moving of the device in accordance with the primary path data;
• a primary planner safety gate that receives the primary path data from the primary planner unit, determines whether the primary path data provides for the moving of the device in accordance with the primary path data in a safe manner, and provides the primary path data as a verified primary path output in response to a determination that the primary path data provides for the moving of the device in accordance with the primary path data in the safe manner;
• a safing planner safety gate that receives the safing path data from the safing planner unit, determines whether the safing path data provides for the moving of the device so as to avoid the one or more adverse conditions, and provides the safing path data as a verified safing path output in response to a determination that the safing path data provides for the moving of the device so as to avoid the one or more adverse conditions;
• a primary trajectory executor unit that receives the verified primary path output and generates primary trajectory data from a current waypoint of the device based on the verified primary path output;
• a safing trajectory executor unit that receives the verified safing path output and generates safing trajectory data from a current waypoint of the device based on the verified safing path output;
• a primary trajectory safety gate that receives the primary trajectory data from the primary trajectory executor unit, determines whether the primary trajectory data is consistent with a current state of the device, and provides the primary trajectory data as a verified primary trajectory output in response to a determination that the primary trajectory data is consistent with the current state of the device;
• a safing trajectory safety gate that receives the safing trajectory data from the safing trajectory executor unit, determines whether the safing trajectory data is consistent with the current state of the device, and provides the safing trajectory data as a verified safing trajectory output in response to a determination that the safing trajectory data is consistent with the current state of the device;
• and
• a priority selector that is coupled to the primary trajectory safety gate to receive the verified primary trajectory output, to the safing trajectory safety gate to receive the verified safing trajectory output, and to a controller to provide control data, the priority selector provides as the control data one of:
• the verified primary trajectory output if the verified primary trajectory output is received, the verified safing trajectory output if only the verified safing trajectory output is received, or a default output if neither the verified primary trajectory output nor the verified safing trajectory output is received.