100 may be configured to execute a first operating system when the autonomous vehicle is in an autonomous (or even partially autonomous) driving mode and the autonomous vehicle 100 may be configured to execute a second operating system when the autonomous vehicle is not in an autonomous (or even partially autonomous) driving mode. In such an example, the first operating system may be formally verified, secure, and operate in real-time such that data collected from the sensors 212 are processed within a predetermined period of time, and autonomous driving operations are performed within a predetermined period of time, such that data is processed and acted upon essentially in real-time. Continuing with this example, the second operating system may not be formally verified, may be less secure, and may not operate in real-time as the tasks that are carried out (which are described in greater detail below) by the second operating system are not as time-sensitive the tasks (e.g., carrying out self-driving operations) performed by the first operating system.

Readers will appreciate that although the example included in the preceding paragraph relates to an embodiment where the autonomous vehicle 100 may be configured to execute a first operating system when the autonomous vehicle is in an autonomous (or even partially autonomous) driving mode and the autonomous vehicle 100 may be configured to execute a second operating system when the autonomous vehicle is not in an autonomous (or even partially autonomous) driving mode, other embodiments are within the scope of the present disclosure. For example, in another embodiment one CPU (or other appropriate entity such as a chip, CPU core, and so on) may be executing the first operating system and a second CPU (or other appropriate entity) may be executing the second operating system, where switching between these two modalities is accomplished through fabric switching, as described in greater detail below. Likewise, in some embodiments, processing resources such as a CPU may be partitioned where a first partition supports the execution of the first operating system and a second partition supports the execution of the second operating system.

The guest operating systems 216 may correspond to a particular operating system modality. An operating system modality is a set of parameters or constraints which a given operating system satisfies, and are not satisfied by operating systems of another modality. For example, a given operating system may be considered a “real-time operating system” in that one or more processes executed by the operating system must be performed according to one or more time constraints. For example, as the automation module 220 must make determinations as to operational commands to facilitate autonomous operation of a vehicle. Accordingly, the automation module 220 must make such determinations within one or more time constraints in order for autonomous operation to be performed in real time. The automation module 220 may then be executed in an operating system (e.g., a guest operating system 216 of a virtual machine 229) corresponding to a “real-time operating system” modality. Conversely, the data processing module 226 may be able to perform its processing of sensor data independent of any time constrains, and may then be executed in an operating system (e.g., a guest operating system 216 of a virtual machine 229) corresponding to a “non-real-time operating system” modality.

As another example, an operating system (e.g., a guest operating system 216 of a virtual machine 229) may comprise a formally verified operating system. A formally verified operating system is an operating system for which the correctness of each function and operation has been verified with respect to a formal specification according to formal proofs. A formally verified operating system and an unverified operating system (e.g., one that has not been formally verified according to these proofs) can be said to operate in different modalities.

The automation module 220, data collection module 224, data collection module 224, data processing module 226, hypervisor 228, and virtual machine 229 in the example of FIG. 2 are shown in RAM 206, but many components of such software typically are stored in non-volatile memory also, such as, for example, on data storage 218, such as a disk drive. Moreover, any of the automation module 220, data collection module 224, and data processing module 226 may be executed in a virtual machine 229 and facilitated by a guest operating system 216 of that virtual machine 229.

The automation computing system 116 of FIG. 2 includes disk drive adapter 230 coupled through expansion bus 232 and bus adapter 210 to CPU package(s) 204 and other components of the automation computing system 116. Disk drive adapter 230 connects non-volatile data storage to the automation computing system 116 in the form of data storage 218. Disk drive adapters 230 useful in computers configured for process scheduling based on data arrival in an autonomous vehicle according to embodiments of the present invention include Integrated Drive Electronics (‘IDE’) adapters, Small Computer System Interface (‘SCSI’) adapters, and others as will occur to those of skill in the art. Non-volatile computer memory also may be implemented for as an optical disk drive, electrically erasable programmable read-only memory (so-called ‘EEPROM’ or ‘Flash’ memory), RAM drives, and so on, as will occur to those of skill in the art.

The exemplary automation computing system 116 of FIG. 2 includes a communications adapter 238 for data communications with other computers and for data communications with a data communications network. Such data communications may be carried out serially through RS-238 connections, through external buses such as a Universal Serial Bus (‘USB’), through data communications networks such as IP data communications networks, and in other ways as will occur to those of skill in the art. Communications adapters implement the hardware level of data communications through which one computer sends data communications to another computer, directly or through a data communications network. Examples of communications adapters useful in computers configured for process scheduling based on data arrival in an autonomous vehicle according to embodiments of the present invention include modems for wired dial-up communications, Ethernet (IEEE 802.3) adapters for wired data communications, 802.11 adapters for wireless data communications, as well as mobile adapters (e.g., cellular communications adapters) for mobile data communications. For example, the automation computing system 116 may communicate with one or more remotely disposed execution environments 227 via the communications adapter 238.

The exemplary automation computing system of FIG. 2 also includes one or more Artificial Intelligence (AI) accelerators 240. The AI accelerator 240 provides hardware-based assistance and acceleration of AI-related functions, including machine learning, computer vision, etc. Accordingly, performance of any of the automation module 220, data collection module 224, data processing module 226, or other operations of the automation computing system 116 may be performed at least in part by the AI accelerators 240.

The exemplary automation computing system of FIG. 2 also includes one or more graphics processing units (GPUs) 242. The GPUs 242 are configured to provide additional processing and memory resources for processing image and/or video data, including encoding, decoding, etc. Accordingly, performance of any of the automation module 220, data collection module 224, data processing module 226, or other operations of the automation computing system 116 may be performed at least in part by the GPUs 242.

FIG. 3 shows an example redundant power fabric for process scheduling based on data arrival in an autonomous vehicle. The redundant power fabric provides redundant pathways for power transfer between the power supplies 215, the sensors 212, and the CPU packages 204. In this example, the power supplies 215 are coupled to the sensors 212 and CPU packages via two switched fabrics 214a and 214b. The topology shown in FIG. 3 provides redundant pathways between the power supplies 215, the sensors 212, and the CPU packages 204 such that power can be rerouted through any of multiple pathways in the event of a failure in an active connection pathway. The switched fabrics 214a and 214b may provide power to the sensors 212 using various connections, including Mobile Industry Processor Interface (MIPI), Inter-Integrated Circuit (I2C), Universal Serial Bus (USB), or another connection. The switched fabrics 214a and 214b may also provide power to the CPU packages 204 using various connections, including Peripheral Component Interconnect Express (PCIe), USB, or other connections. Although only two switched fabrics 214a and 214b are shown connecting the power supplies 215 to the sensors 212 and CPU packages 204, it is understood that the approach shown by FIG. 3 can be modified to include additional switched fabrics 214.

FIG. 4 is an example redundant data fabric for process scheduling based on data arrival in an autonomous vehicle. The redundant data fabric provides redundant data connection pathways between sensors 212 and CPU packages 204. In this example view, three CPU packages 204a, 204b, and 204c are connected to three sensors 212a, 212b, and 212c via three switched fabrics 213a, 213b, and 213c. Each CPU package 204a, 204b, and 204c is connected to a subset of the switched fabrics 213a, 213b, and 213c. For example, CPU package 204a is connected to switched fabrics 213a and 213c, CPU package 204b is connected to switched fabrics 213a and 213b, and CPU package 204c is connected to switched fabrics 213b and 213c. Each switched fabric 213a, 213b, and 213c is connected to a subset of the sensors 212a, 212b, and 212c. For example, switched fabric 213a is connected to sensors 212a and 212b, switched fabric 213b is connected to sensor 212b and 212c, and switched fabric 213c is connected to sensors 212a and 212c. Under this topology, each CPU package 204a, 204b, and 204c has an available connection path to any sensor 212a, 212b, and 212c. It is understood that the topology of FIG. 4 is exemplary, and that CPU packages, switched fabrics, sensors, or connections between components may be added or removed while maintaining redundancy as can be appreciated by one skilled in the art.

FIG. 5 is an example view of process allocation across CPU packages for process scheduling based on data arrival in an autonomous vehicle. Shown are three CPU packages 204a, 204b, and 204c. Each CPU package 204a includes a processing unit that has been allocated (e.g., by a hypervisor 228 or other process or service) primary execution of a process and another processing unit that has been allocated secondary execution of a process. As set forth herein, primary execution of a process describes an executing instance of a process whose output will be provided to another process or service. Secondary execution of the process describes executing an instance of the process in parallel to the primary execution, but the output may not be output to the other process or service. For example, in CPU package 204a, processing unit 502a has been allocated secondary execution of “process B,” denoted as secondary process B 504b, while processing unit 502b has been allocated primary execution of “process C,” denoted as primary process C 506a.

CPU package 204a also comprises two redundant processing units that are not actively executing a process A, B, or C, but are instead reserved in case of failure of an active processing unit. Redundant processing unit 508a has been reserved as “A/B redundant,” indicating that reserved processing unit 508a may be allocated primary or secondary execution of processes A or B in the event of a failure of a processing unit allocated the primary or secondary execution of these processes. Redundant processing unit 508b has been reserved as “A/C redundant,” indicating that reserved processing unit 508b may be allocated primary or secondary execution of processes A or C in the event of a failure of a processing unit allocated the primary or secondary execution of these processes.

CPU package 204b includes processing unit 502c, which has been allocated primary execution of “process A,” denoted as primary process A 510a, and processing unit 502d, which has been allocated secondary execution of “process C,” denoted as secondary process C 506a. CPU package 204b also includes redundant processing unit 508c, reserved as “A/B redundant,” and redundant processing unit 508d, reserved as “B/C redundant.” CPU package 204c includes processing unit 502e, which has been allocated primary execution of “process B,” denoted as primary process B 504a, and processing unit 502f, which has been allocated secondary execution of “process A,” denoted as secondary process A 510b. CPU package 204c also includes redundant processing unit 508e, reserved as “B/C redundant,” and redundant processing unit 508f, reserved as “A/C redundant.”

As set forth in the example view of FIG. 5, primary and secondary instances processes A, B, and C are each executed in an allocated processing unit. Thus, if a processing unit performing primary execution of a given process fails, the processing unit performing secondary execution may instead provide output of the given process to a receiving process or service. Moreover, the primary and secondary execution of a given process are executed on different CPU packages. Thus, if an entire processing unit fails, execution of each of the processes can continue using one or more processing units handling secondary execution. The redundant processing units 508a-f allow for allocation of primary or secondary execution of a process in the event of processing unit failure. This further prevents errors caused by processing unit failure as parallel primary and secondary execution of a process may be restored. One skilled in the art would understand that the number of CPU packages, processing units, redundant processing units, and processes may be modified according to performance requirements while maintaining redundancy.

For further explanation, FIG. 6 sets forth a diagram of an execution environment 227 accordance with some embodiments of the present disclosure. The execution environment 227 depicted in FIG. 6 may be embodied in a variety of different ways. The execution environment 227 may be provided, for example, by one or more physical or virtual machine components consisting of bare-metal applications, operating systems such as Android, Linux, Real-time Operating systems (RTOS), Automotive RTOS, such as AutoSAR, and others, including combinations thereof. The execution environment 227 may also be provided by cloud computing providers such as Amazon AWS, Microsoft Azure, Google Cloud, and others, including combinations thereof. Alternatively, the execution environment 227 may be embodied as a collection of devices (e.g., servers, storage devices, networking devices) and software resources that are included in a computer or distributed computer or private data center. Readers will appreciate that the execution environment 227 may be constructed in a variety of other ways and may even include resources within one or more autonomous vehicles or resources that communicate with one or more autonomous vehicles.

The execution environment 227 depicted in FIG. 6 may include storage resources 608, which may be embodied in many forms. For example, the storage resources 608 may include flash memory, hard disk drives, nano-RAM, 3D crosspoint non-volatile memory, MRAM, non-volatile phase-change memory (‘PCM’), storage class memory (‘SCM’), or many others, including combinations of the storage technologies described above. Readers will appreciate that other forms of computer memories and storage devices may be utilized as part of the execution environment 227, including DRAM, SRAM, EEPROM, universal memory, and many others. The storage resources 608 may also be embodied, in embodiments where the execution environment 227 includes resources offered by a cloud provider, as cloud storage resources such as Amazon Elastic Block Storage (‘EBS’) block storage, Amazon S3 object storage, Amazon Elastic File System (‘EFS’) file storage, Azure Blob Storage, and many others. The example execution environment 227 depicted in FIG. 6 may implement a variety of storage architectures, such as block storage where data is stored in blocks, and each block essentially acts as an individual hard drive, object storage where data is managed as objects, or file storage in which data is stored in a hierarchical structure. Such data may be saved in files and folders, and presented to both the system storing it and the system retrieving it in the same format.

The execution environment 227 depicted in FIG. 6 also includes communications resources 610 that may be useful in facilitating data communications between components within the execution environment 227, as well as data communications between the execution environment 227 and computing devices that are outside of the execution environment 227. Such communications resources may be embodied, for example, as one or more routers, network switches, communications adapters, and many others, including combinations of such devices. The communications resources 610 may be configured to utilize a variety of different protocols and data communication fabrics to facilitate data communications. For example, the communications resources 610 may utilize Internet Protocol (‘IP’) based technologies, fibre channel (‘FC’) technologies, FC over ethernet (‘FCoE’) technologies, InfiniBand (‘IB’) technologies, NVM Express (‘NVMe’) technologies and NVMe over fabrics (‘NVMeoF’) technologies, and many others. The communications resources 610 may also be embodied, in embodiments where the execution environment 227 includes resources offered by a cloud provider, as networking tools and resources that enable secure connections to the cloud as well as tools and resources (e.g., network interfaces, routing tables, gateways) to conFIG. networking resources in a virtual private cloud. Such communications resources may be useful in facilitating data communications between components within the execution environment 227, as well as data communications between the execution environment 227 and computing devices that are outside of the execution environment 227 (e.g., computing devices that are included within an autonomous vehicle).

The execution environment 227 depicted in FIG. 6 also includes processing resources 612 that may be useful in useful in executing computer program instructions and performing other computational tasks within the execution environment 227. The processing resources 612 may include one or more application-specific integrated circuits (‘ASICs’) that are customized for some particular purpose, one or more central processing units (‘CPUs’), one or more digital signal processors (‘DSPs’), one or more field-programmable gate arrays (‘FPGAs’), one or more systems on a chip (‘SoCs’), or other form of processing resources 612. The processing resources 612 may also be embodied, in embodiments where the execution environment 227 includes resources offered by a cloud provider, as cloud computing resources such as one or more Amazon Elastic Compute Cloud (‘EC2’) instances, event-driven compute resources such as AWS Lambdas, Azure Virtual Machines, or many others.

The execution environment 227 depicted in FIG. 6 also includes software resources 613 that, when executed by processing resources 612 within the execution environment 227, may perform various tasks. The software resources 613 may include, for example, one or more modules of computer program instructions that when executed by processing resources 612 within the execution environment 227 are useful in training neural networks configured to determine control autonomous vehicle control operations. For example, a training module 614 may train a neural network using training data including sensor 212 data and control operations recorded or captured contemporaneous to the training data. In other words, the neural network may be trained to encode a relationship between an environment relative to an autonomous vehicle 100 as indicated in sensor 212 data and the corresponding control operations effected by a user or operation of the autonomous vehicle. The training module 614 may provide a corpus of training data, or a selected subset of training data, to train the neural network. For example, the training module 614 may select particular subsets of training data associated with particular driving conditions, environment states, etc. to train the neural network.

The software resources 613 may include, for example, one or more modules of computer program instructions that when executed by processing resources 612 within the execution environment 227 are useful in deploying software resources or other data to autonomous vehicles 100 via a network 618. For example, a deployment module 616 may provide software updates, neural network updates, or other data to autonomous vehicles 100 to facilitate autonomous vehicle control operations.

The software resources 613 may include, for example, one or more modules of computer program instructions that when executed by processing resources 612 within the execution environment 227 are useful in collecting data from autonomous vehicles 100 via a network 618. For example, a data collection module 620 may receive, from autonomous vehicles 100, collected sensor 212, associated control operations, software performance logs, or other data. Such data may facilitate training of neural networks via the training module 614 or stored using storage resources 608.

FIG. 7 sets forth an example distributed automation computing system 700 of an autonomous vehicle 100 according to some embodiments of the present disclosure. The distributed automation computing system 700 includes various interconnected nodes that correspond to components of both an automation computing system 116 and sensors 212. The distributed automation computing system 700 also includes the various communications pathways interconnecting these nodes.

The distributed automation computing system 700 includes one or more sensor nodes 702a-n. Each sensor node 702a-n corresponds to a particular sensor 212 of an autonomous vehicle 100. For example, each sensor node 702a-n may include a camera, a radar sensor, a GPS sensor, a lidar sensor, or other sensors as can be appreciated. The distributed automation computing system 700 also includes one or more compute nodes 704a-n. Each compute node 704a-n is a physical or logical subdivision or grouping of physical computing resources. As an example, each compute node 704a-n may include a particular CPU package, system-on-a-chip (SOC), or other computing device or apparatus. As another example, each compute node 704a-n may include a particular core or processor of a multi-core or multi-processor system. Accordingly, each compute node 704a-n is capable of independently performing some computing operation, such as executing a particular program, thread, model, process, and the like.

The distributed automation computing system 700 also includes a network 704. The network 704 includes communications pathways and resources that interconnect the sensor nodes 704a-n and compute nodes 704a-n. As an example, the network 704 includes wired or wireless network components and pathways, switched fabrics, system busses or interconnects, or other data communications resources as can be appreciated.

In some embodiments, the network 704 is configured with predefined pathways between particular sensor nodes 702a-n and compute nodes 704a-n, as well as between compute nodes 704a-n, based on particular necessary execution or processing dependencies. In other embodiments, the network 704 is dynamically configurable or routable such that any sensor node 702a-n may communicate with any compute node 704a-n and such that any compute node 704a-n may communicate with any other compute node 704a-n.

In some embodiments, each compute node 704a-n is synchronized to a same clock to facilitate hard or soft real-time system implementations. In some embodiments, each sensor node 704a-n is also synchronized to the same clock. In some embodiments, the distributed automation computing system 700 is implemented as a hard real-time system whereby particular operations must be performed by the sensor nodes 702a-n and compute nodes 704a-n within defined time constraints (e.g., particular time windows, particular deadlines per operation, and the like). As an example, a sensor node 702a-n may be required to deliver sensor data at a particular interval. As another example, a compute node 704a-n may be required to process received data (e.g., sensor data or data output from another compute node 704a-n) by a particular deadline. Where a particular operation is not performed within the requisite time constraint, a system failure may occur. For example, the distributed automation computing system 700 may be disabled such that autonomous driving functions are disabled.

In other embodiments, as will be described in further detail below, the distributed automation computing system 700 is implemented using a soft real-time system. As a soft real-time system, particular operations are targeted to be performed within particular time constraints as with a hard real-time system. However, unlike a hard real-time system, a failure to perform a particular operation within a time constraint does not cause the distributed automation computing system 700 to enter a failure state. As an example, the distributed automation computing system 700 may implement a degraded performance mode in order to allow the distributed automation computing system 700 to continue operating if an operation fails to meet a time constraint.

FIG. 8 shows an example process flow 800 in a distributed automation computing system 700. The example data process 800 depicts a linear process flow 800 in the distributed automation computing system 700. One skilled in the art will appreciate that the use of a linear process flow 800 is merely illustrative and used for simplicity, and that in some embodiments, each node a distributed automation computing system 700 may receive inputs from potentially many nodes and may also provide outputs to potentially many nodes. Moreover, one skilled in the art will appreciate that the distributed automation computing system 700 may implement acyclic or cyclic data paths, or combinations thereof, depending on particular design considerations and data processing requirements and dependencies.

The example process flow 800 shows one or more sensor nodes 802 providing sensor data 804 to a compute node 806a. The input sensor data 804 is then processed by the compute node 806a using a particular model 808a to generate model output data 810a. This model output data 810a is then provided to a compute node 806b. The compute node 806b then processes the received model output data 810a (and potentially other data from other nodes) using a model 808b to generate model output data 810b. This dependent and processing of data by compute nodes 806a,b-n continues until the compute node 806n processes some amount of received data using a particular model 808n to generate model output data 810n.

The example process flow 800 corresponds to a soft real-time system whereby each node (e.g., sensor node 802 and compute node 806a,b-n) performs particular operations within a target time constraint. For example, in some embodiments, the time constraint includes a time window of a recurring interval. In some embodiments, the time window corresponds to a pipeline time window. For example, each compute node 806a-n is configured to perform some particular stage of a pipeline, and thereby perform amount of computation (e.g., processing some amount of input data, generating some amount of output data) within each iteration of the pipeline time window. In this example process flow 800, the various pipeline time windows are demarked using lines 820.

In some embodiments, during a given pipeline time window, a compute node 806a-n may be configured to process various portions of received input data. The various portions of input data may be received from different sources, or may arrive at separate times from a same source. Each portion of received input data may be processed using a particular process. For example, a particular thread or a particular model 808a,b-n (which may be executed by a particular thread) may be used to process each portion of input data. Accordingly, each compute node 806a,b-n may implement a process schedule defining an order at which a given process (e.g., a given model 808a,b-n) is executed to process a given portion of input data.

In a hard real-time system, the ordering in a process schedule is based priorities for given processes and time values associated with processing a given portion of data (e.g., a completion deadline, a computation time). In contrast, in some embodiments, the soft real-time system processes input data as it is received. In other words, a process for ordering a particular portion of input data is added to the process schedule in response to the input data being received. Thus, the ordering of the process schedule for a given compute node 806a,b-n is dependent on an order of receipt for the input data.

As the process schedule identifies a particular process or model to process the input data, the particular process or model is determined based on various heuristics. As an example, in some embodiments, the particular process is determined based on a type of data that is received. As another example, in some embodiments, the particular process is determined based on a failure to receive some portion of the input data. This will be described in further detail below in the context of a degraded operating mode.

In some embodiments, the particular process is based on an estimated processing time for the input data. For example, assume each process or model has a known or estimated processing time for input data determined a priori. In this example, multiple models 808a,b-n may be used to process a given portion of input data, with each model 808a,b-n having a different estimated processing time. For example, models 808a,b-n with higher estimated processing time may produce higher quality output, output with reduced errors or noise, outputs with higher confidence values, and the like when compared to those with lower processing times.

Accordingly, assuming that multiple processes must be executed within a given time window, the process or model 808a,b-n for a given portion of input data may be selected in order to maximize an amount of processing time performed within the time window (e.g., to maximize processor utilization) while preferentially processing all received portions of input data. As another example, in order to process all portions of received input data within the time window, a process or model 808a,b-n may be selected with a reduced estimated processing time in order to fit within the time window.

Where a particular time constraint is not satisfied for a particular operation, or if a particular operation is anticipatorily determined to be incapable of being performed within a time constraint, one or more of the nodes may enter a degraded performance mode to accommodate for the failure. As an example, assume that a particular compute node 806a,b-n expects to receive input (e.g., sensor data 804a or model output data 810a,b-n) at a particular interval. Where a source of that input fails to provide the input by the time the interval occurs, either due to a failure in the source node or in the communications pathway to the receiving compute node 806a,b-n, the compute node 806a,b-n may then enter a degraded performance mode to account for the missing input.

While in a degraded performance mode, a compute node 806a,b-n may select a model 808a,b-n for processing what input data was received, if any, in order to be able to provide an output to those compute nodes 806a,b-n depending on its output. In other words, a model 808a,b-n may be selected from a plurality of models 808a,b-n depending on the nature of the failure. Such output may have reduced confidence scores or increased error values, but allows compute nodes 806a,b-n depending on the output to perform their operations.

For example, assume that a compute node 806a is configured to process sensor data at each interval of a pipeline time window. Accordingly, the compute node 806a must receive sensor data from sensor nodes 802 at every interval. In this example, assume that the compute node 806a expects to receive image data from two camera sensors in order to perform some operation based on stereoscopic image data, such as depth estimation.

Where the compute node 806a receives the image data from both cameras, the compute node 806a may process the received image data using a model 808a trained to perform depth estimation using stereoscopic image data. Where the compute node 806a receives image data from one camera but not another, the compute node 806a may process the received image data using a model 808a trained to perform depth estimation using a single image and one or more motion vectors (e.g., based on previous image data from one or both cameras). Where the compute node 806a fails to receive any image data, the compute node 806a may use a model 808a that generates extrapolated or predicted images from previous image data and calculates depth estimation using the extrapolated images. Thus, each model 808a may generate a same type of output (e.g., a depth estimation) from different types or amounts of input data (e.g., stereoscopic image data, a single image and motion vectors, past image data, and the like). The output of each model 808a may include confidence scores or error values depending on the particular failure, allowing the calculations of downstream compute nodes 806b-n to account for the failure while still allowing system performance to continue.

In some embodiments, where a compute node 806a,b-n has entered a degraded performance mode due to a failure to meet a particular time constraint (e.g., a failure to receive input within a particular time constraint, a failure to generate output within a time constraint), the compute nodes 806a,b-n may perform various catch up operations in subsequent time windows (e.g., subsequent iterations of a pipeline time window). For example, assuming that some portion of input data was received after the end of a particular deadline such that it could not be processed within a particular pipeline time window, in some embodiments the late input data may be processed in a next pipeline time window. Accordingly, the particular process schedule for the compute node 806a,b-n may be adjusted so that the late input data may be processed along with performing the other requisite functionality for that pipeline time window. For example, particular models 808a,b-n may be selected for particular operations that have reduced expected processing times in order to allow the additional processing of the late input data. As another example, in some embodiments, the pipeline time window across all compute nodes 806a,b-n may be temporarily increased to allow for delayed or overdue processes to be performed. The pipeline time window may then be reduced back to an original value when it is determined that each compute node 808a,b-n is satisfying all time constraints within the extended pipeline time window, indicating that there is no additional catching up or late data to process. One skilled in the art will appreciate that these features for adjusting to and recovering from various degraded performance modes are unavailable in existing solutions for autonomous vehicles that require hard real-time systems where a failure to meet a particular time constraint or deadline would result in system failure.

For further explanation, FIG. 9 sets forth a flow chart illustrating an exemplary method for process scheduling based on data arrival according to some embodiments of the present disclosure. The method of FIG. 9 may be implemented, for example, in a distributed automation computing system 700 such as that as is depicted in FIG. 7. The method of FIG. 9 includes receiving 902 (e.g., by a node 920 from one or more other nodes 930) a plurality of portions of data 904. The node 920 may include, for example, a compute node 704a-n of FIG. 7, a compute node 806a,b-n of FIG. 8, and the like. The one or more other nodes 930 may include, for example, one or more sensor nodes 702a-n or compute nodes 704a-n of FIG. 7, one or more sensor nodes 802 or compute nodes 806a,b-n of FIG. 8, or combinations thereof. Accordingly, the data 904 may include sensor data 804, model output data 810a-n or other data output by compute nodes 704a-n, 706a,b-n, or combinations thereof.

In some embodiments, each portion of the data 904 is received 902 by the node 902 from a same other node 930. For example, the other node 930 may be configured to perform various operations, process various inputs, and the like, and for each operation output a particular portion of data 904 to the node 920. In other embodiments, each portion of the data 904 is received 902 by the node 902 from multiple other nodes 930.

The method of FIG. 9 also includes generating 906 a process schedule 908 by scheduling, for each portion of data 904 of the plurality of portions of data 904, a process for processing a corresponding portion of data 904 within a time window. An ordering of the process schedule 908 corresponds to an order of arrival for the plurality of portions of data 904. For example, as each portion of data 904 is received, an entry is added to the process schedule 908 for execution during the time window. In contrast to solutions for hard real-time systems where the ordering of a process schedule is based on time values or attributes associated with a particular process or received data (e.g., a shortest time to process, a soonest deadline, and the like), the ordering of the process schedule 908 is ordered according to the order of data 904 arrival.

In some embodiments, the time window corresponds to a pipeline time window whereby each node 920,930 is configured to iteratively perform some operation or operations within the pipeline time window, with the operations of a given node 920,930 being dependent on the processing of a parent node 920,930 during last pipeline time window. Unlike event-based scheduling where data is simply processed as it arrives, the distributed automation computing system 700 operates within particular time bounds and pipelining requirements of a soft real-time system.

Each entry for the process schedule 908 defines an order in which a particular portion of data 904 is to be processed by virtue of executing a particular process indicated in the process schedule 908. In some embodiments, particular portions of data 904 are configured to be performed by a predefined or default process. In some embodiments, as will be described in further detail below, a particular process is selected for processing a portion of data 904 based on various heuristics.

In some embodiments, the process added to the process schedule 908 for a given portion of data 904 corresponds to a particular model (e.g., a model 808a,b-n of FIG. 8). Thus, executing a particular process in the process schedule 908 causes execution of a particular model 808a,b-n, whereby the given portion of data 904 is provided as input to the model 808a,b-n to generate some output (e.g., model output data 810a,b-n). Where the process added to the process schedule 908 for a given portion of data 904 is selected from multiple processes, a particular model 808a,b-n is selected from multiple models 808a,b-n executable by the node 920.

The method of FIG. 9 also includes executing 910 (e.g., by the node 920), during the time window, the process schedule 908. In some embodiments, executing 910 the process schedule 908 includes executing a particular process (e.g., a particular model 808a,b-n) applied to a particular portion of data 904 according to an ordering in the process schedule 908. As an example, executing a particular process may include starting or resuming a particular thread corresponding to the process, executing a particular function or block of code associated with the process, providing the particular portion of data 904 as input to a particular model 808a,b-n, and the like.

The process schedule 908 is executed within the time window in that operations added to the process schedule 908 for execution in a particular time window (e.g., within a pipeline time window) or according to other time constraints or deadlines are executed within that particular time window. Thus, the distributed automation computing system 700 maintains soft real-time functionality during execution of the process schedule 908.

In some embodiments, the plurality of portions of data 904 are received 902 and their entries added to the process schedule 908 during a particular pipeline time window for execution during a next pipeline time window. In other words, data 904 is received and their process schedule 908 entries added during window N, and these entries are executed during window N+1. In some embodiments, one or more portions of data 904 are received and their entries added to the process schedule 908 during a same pipeline time window in which they will be executed.

For further explanation, FIG. 10 sets forth a flow chart illustrating another example method for process scheduling based on data arrival according to some embodiments of the present disclosure. The method of FIG. 10 is similar to FIG. 9 in that the method of FIG. 10 includes receiving 902 (e.g., by a node 920 from one or more other nodes 930) a plurality of portions of data 904; generating 906 a process schedule 908 by scheduling, for each portion of data 904 of the plurality of portions of data 904, a process for processing a corresponding portion of data 904 within a time window; and executing 910, during the time window, the process schedule 908.

The method of FIG. 10 differs from FIG. 9 in that generating 906 the process schedule 908 comprises selecting 1002, for a given portion of data 904, a particular process from a plurality of selectable processes. For example, a particular model 808a,b-n may be selected from a plurality of selectable models 804a,b-n. Although the following discussion will describe the selection of a particular model 804a,b-n, it is understood that the following discussion is applicable to other types of selectable processes, such as threads, blocks of code, functions, and the like.

The particular model 808a,b-n may be selected based on a type of data 904 received. In other words, the one or more heuristics include a type of data 904 received. For example, assume that a node 930 is able to provide, to the receiving node 920, data 904 of various types or classifications. The different data types may differ based on particular attributes, including size, resolution, confidence or error scores, or other attributes as can be appreciated. The particular model 808a,b-n may then be selected based on the data type. As an example, one model 808a,b-n may be preferentially selected for processing data 904 with high confidence scores or low error scores, while another 808a,b-n may be preferentially selected for processing data 904 with low confidence scores or high error scores. As another example, one model 808a,b-n may be preferentially selected for processing high resolution or high fidelity data 904 while another model 808a,b-n may be preferentially selected for low resolution or low fidelity data 904.

As another example, the particular model 808a,b-n may be selected based on which portions of data 904 are received. In other words, the one or more heuristics include which portions of data 904 are received, or a failure to receive some portion of data 904. As an example, assume that the node 920 has different models 808a,b-n for processing a full expected received dataset, a partially received dataset, and an empty or null dataset (e.g., expected data 904 was not received at all). Accordingly, the particular model 808a,b-n may be selected based on what data 904, if any, was received. As will be described in further detail below, selection of a model 808a,b-n due to a partial or total failure to receive some portion of data 904 may cause the node 920 to enter a degraded performance mode. In some embodiments, which portions of data 904 are received or not received may also be considered a type of data as referenced above. For example, a type of data may include full expected data, partial expected data, an absence of expected data (e.g., null or empty data), and the like.

In some embodiments, each selectable model 808a,b-n may correspond to a particular estimated processing time indicating an estimated amount of time for the model 808a,b-n to process some amount of input data 904. In other words, the one or more heuristics include an estimated processing time for a model 808a,b-n. Accordingly, the particular model 808a,b-n may be selected based on the estimated processing times for the models 808a,b-n. As an example, assume that multiple portions of data 904 should be processed within a pipeline time window.

The models 808a,b-n for processing each portion of data 904 may be selected such that their combined estimated processing times do not exceed the total duration of the pipeline time window, or some other time threshold (e.g., the duration of the pipeline time window minus some offset). As another example, the models 808a,b-n for selecting each portion of data 904 may be selected in order to maximize the amount of processing time used (e.g., maximizing processor utilization) while falling below the pipeline time window duration or another time threshold.

Once a particular model 808a,b-n has been selected for processing the particular portion of data 904, an entry is added to the process schedule 908 to execute that model. One skilled in the art will appreciate that, in some embodiments, each model 808a,b-n may be selected for processing a single portion of received data 904 or for processing multiple portions of received data 904.

Although the above discussion describes an ordering of the process schedule 908 corresponding to an order in which the data 904 was received, in other embodiments the order of the process schedule 908 is also based on the one or more heuristics described above. As another example, in some embodiments, a particular process (e.g., a particular model 808a,b-n) is selected from the selectable processes based on the order in which the portion of data 904 to be processed is received.

For further explanation, FIG. 11 sets forth a flow chart illustrating an exemplary method for implementing degraded performance modes in an autonomous vehicle according to some embodiments of the present disclosure. The method of FIG. 11 may be implemented, for example, in a distributed automation computing system 700 such as that as is depicted in FIG. 7. The method of FIG. 11 includes detecting 1102 (e.g., by a node 1120) a failure associated with receiving first expected data (shown as expected data 1104) from one or more other nodes 1130. The node 1120 may include, for example, a compute node 704a-n of FIG. 7, a compute node 806a,b-n of FIG. 8, and the like. The one or more other nodes 1130 may include, for example, one or more sensor nodes 702a-n or compute nodes 704a-n of FIG. 7, one or more sensor nodes 802 or compute nodes 806a,b-n of FIG. 8, or combinations thereof. Accordingly, the expected data 1104 may include sensor data 804, model output data 810a-n or other data output by compute nodes 704a-n, 706a,b-n, or combinations thereof.

The expected data 1104 includes some amount of data 1104 generated or provided by the one or more nodes 1130 that the node 1120 expects to receive according to some policy, rules, conditions, and the like. As an example, assume that the one or more other nodes 1130 are configured to provide the expected data 1104 to the node 1120 at a predefined interval, at some point during each of a recurring time window (e.g., a pipeline time window), or according to some other frequency or triggered condition.

Accordingly, in some embodiments, a failure to receive the expected data 1104 includes detecting that the time window (or potentially some other time constraint associated with receiving the expected data 1104) has passed with some portion of the expected data 1104 not being received. As an example, in some embodiments, detecting 1102 the failure includes detecting that no portion of the expected data 1104 was received. As another example, in some embodiments, detecting 1102 the failure includes detecting that a portion of the expected data 1104 was received while a another portion of the expected data 1104 was not received.

The method of FIG. 11 also includes selecting 1106, based on the failure, a model 1108 (e.g., a model 806a,b-n). The selected 1106 model 1108 is a model 1108 configured to process what portions of the expected data 1104 were received, if any. For example, a particular model 1108 may be selected for processing partial expected data 1104 where a portion, but not all, of the expected data 1104 was received. As another example, a particular model 1108 may be selected where no expected data 1104 is received to cause the failure. Such a model 1108 may be configured to generate predicted or extrapolated expected data 1104 based on previously received instances of expected data 1104 (e.g., received during previous time windows and the like). The extrapolated expected data 1104 may be used by the model 1108 or provided as input to another selected model 1108 to generate some output 1114 as will be described in further detail below.

In other words, selecting 1106, based on the failure 1108, a model 1108 includes selecting 1110 the model 1108 from a plurality of models 1108 configured to provide a same type of output based on different types of input. As will be described in further detail below, the selected 1106 model 1108 will be used to provide an output 1114 to one or more other nodes 1150 expecting some output from the node 1120. In other words, the output 1114 of the node 1120 is treated as expected data 1104 for the nodes 1150 configured to receive the output 1114. Accordingly, in order to ensure that he node 1150 and other downstream nodes continue to function, the node 1120 provides output 1114 in some expected format and according to some expected time constraints based on the different types of failures that may occur, should any occur.

The method of FIG. 11 also includes providing 1112 an output 1114 associated with the first expected data 1104. As is set forth above, the output 1114 is the result of providing what portions of the expected data 1104 are received, if any, to the selected model 1108. By providing output 1114 to the nodes 1150, the nodes 1150 and its related downstream nodes are able to function in the event of a data reception failure. This is in contrast to hard real-time systems where such a failure to receive expected data 1104 would cause a system failure. Instead, the distributed automation computing system 700 enters a degraded performance mode whereby different models 1108 are selected to provide output 1114 in the event of a failure.

Consider an example where a node 1120 is configured to receive image data from two cameras (e.g., two nodes 1130) at each instance of a pipeline time window. Further assume that the node 1120 is configured to provide a depth estimation for various objects identified in the image data to a downstream node 1150. During each pipeline stage of a normal performance mode, the node 1120 selects a model 1108 for generating a depth estimation based on stereoscopic image data received from the two cameras. Using the selected model 1108, the stereoscopic image data is processed using the model 1108 to generate a depth estimation included in an output 1114. The output 1114 is then provided to one or more downstream nodes 1150.

Continuing with this example, assume that a failure (e.g., in a camera or in a communications pathway from the camera to the node 1120) causes the node 1120 to only receive a single image from a single camera. The node 1120 is therefore unable to calculate the motion estimation using stereoscopic image data. Instead of causing a system failure as in a hard real-time system, the node 1120 enters a degraded performance mode and selects a model 1108 that calculates a depth estimation using a frame of image data (e.g., the received portion of expected data 1104) and one or more motion vectors (e.g., based on previously received image data). The depth estimation is then provided in the output 1114 to the downstream nodes 1150.

As another example using the node 1120 configured to perform depth estimation using stereoscopic image data, assume that a failure occurs such that no image data is provided to the node 1120. In other words, no expected data 1104 is received by the node 1120. The node 1120 selects 1108 a model for generating a depth estimation by generating extrapolated or predicted image data from previously received image data. The predicted image data may then be provided to another model 1108 to generate the depth estimation, or used within the same model 1108 as intermediate data for generating the depth estimation. The depth estimation is then indicated in the output 1114 provided to the downstream nodes 1150. These exemplary models 1108 provide a same type of output 1114 (e.g., a depth estimation) using different types of input data (e.g., full expected data 1104, partial expected data 1104, null expected data 1104, and the like.

One skilled in the art will appreciate the advantage of the approaches described herein as it allows a distributed automation computing system 700 to continue functioning in the event that a time constraint or deadline is not met, in contrast to hard real-time systems where such a failure would cause a system failure cascading to all downstream nodes. For example, particular regulatory requirements may dictate that autonomous vehicle must support degraded performance modes whereby the autonomous vehicle may continue to perform autonomous driving function in the event of some degree of operational failure.

For further explanation, FIG. 12 sets forth a flow chart illustrating an exemplary method for implementing degraded performance modes in an autonomous vehicle according to some embodiments of the present disclosure. The method of