The missing element of an autopilot

A real automotive revolution is under way: the self-driving car race is joined by more and more manufacturers, and driverless cars supervised by a human driver have already travelled millions of motorway kilometres. That experience has also included a number of fatal accidents.

This piece is about the autopilot type heading for a mass-production vehicle, the kind intended to claim Level 4 or 5 under the SAE classification. In essence it is two things:

vision devices: video cameras, lidar, radar and similar sensors;
a centralised, high-speed computing system with the features of a learning neural network.

That component set is interfaced to the vehicle’s motion components through standard asynchronous communication channels: CAN and its successors, Automotive Ethernet, LIN.

How the autopilot operates

Data from the vision devices is processed and synchronised. Together with the information from the car’s own sensors and systems, it is used to generate a motion vector. To hold that vector, the autopilot issues commands to the actuating mechanisms, the steering wheel, accelerator, brakes, clutch and the rest, while continuously comparing the position it has assigned with the actual one.

And that is precisely where the principal problem is.

Where it breaks: the fuzzy motion vector

The car controlled by the autopilot is made of mass-produced electromechanical motion-control systems, and they are reached over asynchronous channels. Because those channels carry data referring to different time points, the realised motion vector is fuzzy, and so is the vector the autopilot transmits relative to the synchronisation grid on which it was formed.

A vehicle interacts with its surroundings at up to around 100 Hz, roughly at 60–80 km/h. Holding about one per cent control precision then means generating the control vector in no more than about 1 ms, by the sampling theorem. When the amount of information is large, an asynchronous system takes longer than that, and the vector is already stale when it is applied.

Asynchronous communication between the motion-control systems disrupts the time grid of the vehicle’s assemblies. By control theory that makes the control loop unstable, and it is the primary cause of a car skidding on a quick change of commands. Controllability drops sharply.

The autopilot worked perfectly, but was let down by the asynchronous communication between the motion-control system components.

Speed 70 km/h

An autopilot generates one motion vector; asynchronous channels feed it data from different instants, so the realised vector disperses around it and the spread grows with speed. Past roughly 60 km/h it leaves the lane. On ASG the same vector stays tight at any speed.

The fix: one time grid, one entity

All of this can be avoided if the control system governing the motion units runs in the same time grid as the autopilot. Better still, the motion-control system itself processes the motion vector the autopilot generates and manages the vehicle’s motion.

So in a Level 4 or 5 autopilot the control platform managing the motion units has to be an integral part of that autopilot and operate in the same time grid with it. The autopilot’s computer must act as the motion-control system supervisor and treat the car as a single entity, generating its motion vector as a whole rather than issuing separate commands to the steering, the accelerator and the brakes.

One command to a group of six actuators. On a message bus the arrivals spread across the window as each message is sent in turn; on a synchronous grid every actuator in the group commits on the 1 ms line together.

Even the newest Ethernet-based vehicle-control platforms cannot fully remove the consequences of the delays at network junctions, which affect motion- control stability and are worked on as late as the implementation stage. The market and the technology both call for a change to the lower-level architecture. That is the only way to make motion control stable.

ASG: the missing component

We consider the ASG (Automotive Smart Grid) control platform the most promising baseline for this. ASG is the missing component for making a Level 4 or 5 autopilot really safe. It integrates the nodes and control systems of the vehicle into a single synchronised organism that can make decisions in real time under the guidance of an autopilot. It is also cheaper than the systems on cars built today, and several times more efficient. Installed on a vehicle, it replaces the existing control systems and removes kilometres of harness.

Hardware: identical modules on a two-wire circular channel that carries both power and data, with a single-wire supply bus for the high-current loads. Each module serves the sensors and actuators nearest to it.

In software, a control supervisor holds a system state vector window that is rewritten across every module at 1 kHz, once per millisecond. Each module runs its own fragment of the motion-vector control programs and drives the sensors and actuators in its zone. The autopilot addresses one coherent snapshot of the vehicle rather than assembling one from messages that arrived at different times.

The application of this to a production programme is set out on ASG for autonomous vehicles, and the state vector window itself on the real-time OS page.