Autonomous Driving System Architecture Overview

Autonomous driving represents one of the most complex and transformative engineering challenges of the 21st century, integrating advancements in artificial intelligence, control theory, computer vision, and automotive systems. This chapter establishes the foundational architecture that underpins modern autonomous vehicles (AVs), providing a systematic taxonomy of functional components, their interdependencies, and the technological evolution that has shaped the current landscape. By examining the hierarchical decomposition from vehicle-level dynamics to high-level decision-making, readers will develop a mental model essential for understanding subsequent module-specific deep dives.

The SAE Autonomy Spectrum: From Driver Assistance to Full Automation

The Society of Automotive Engineers (SAE) International standard J3016, revised in 2021, provides the definitive taxonomy for automated driving systems. This six-level spectrum (L0-L5) is critical not merely as a classification scheme but as a framework that dictates system architecture, safety requirements, and human-machine interaction (HMI) design.

Level 0: No Driving Automation (Human-Only)

At L0, the human driver performs all dynamic driving tasks (DDT) — steering, braking, acceleration, and environmental monitoring. The vehicle may provide momentary warnings (e.g., forward collision alert) or intervene temporarily in emergencies (e.g., automatic emergency braking, AEB), but these systems do not constitute "driving automation" under SAE definitions. The temporal duration of intervention is strictly limited; for instance, AEB systems typically activate for less than 2 seconds and require immediate human resumption of control.

Technical Implementation: L0 systems rely on discrete sensor inputs (radar for ACC, cameras for lane departure warning) with no sensor fusion or path planning. The Electronic Control Unit (ECU) runs deterministic, rule-based algorithms with latency requirements under 100 milliseconds. The architecture is essentially an advanced driver assistance system (ADAS) without longitudinal or lateral control authority.

Level 1: Driver Assistance

L1 systems provide either lateral OR longitudinal control support, but not both simultaneously in a coordinated manner. Examples include:

• **Adaptive Cruise Control (ACC)**: Maintains set following distance using radar/lidar, controlling throttle and brakes but requiring human steering.
• **Lane Keeping Assistance (LKA)**: Provides steering torque to keep vehicle within lane markings but requires human speed control.

System Architecture: The Level 1 architecture introduces a dedicated ADAS ECU running real-time operating systems (RTOS) like QNX or AUTOSAR. The control algorithm typically employs a PID controller for longitudinal control and a proportional-derivative (PD) controller for lateral control. The system operates within an Operational Design Domain (ODD) defined by:

• Minimum lane marking contrast (reflectivity > 0.1)
• Speed range (typically 0-130 km/h for ACC)
• Environmental conditions (clear weather, daylight)

Level 2: Partial Driving Automation

L2 combines lateral AND longitudinal control in the same driving mode, enabling hands-off (but eyes-on) operation. Tesla Autopilot (early versions), GM Super Cruise (on compatible highways), and Ford BlueCruise represent commercial L2 systems.

Key Technical Characteristics:

• **Sensor Suite**: Multi-camera surround view (typically 8-12 cameras), front radar, ultrasonic sensors.
• **Processing**: Mobileye EyeQ4/Q5 or Tesla FSD Computer (HW3.0) providing 144 TOPS (Tera Operations Per Second).
• **Control Strategy**: Model Predictive Control (MPC) for trajectory tracking, with a prediction horizon of 3-5 seconds.
• **ODD Constraints**: Require fully mapped highways, clear lane markings, and functioning traffic sign recognition. The system disengages if:
• Lane markings are absent or ambiguous
• Road curvature exceeds 15 degrees
• The driver fails to provide torque on the steering wheel (hands-on detection via torque sensor)

Critical Limitation: The human driver must remain "available for intervention" at all times. The system does not monitor driver gaze or cognitive state (in most implementations), creating a "automation complacency" risk where drivers over-trust the system.

Level 3: Conditional Driving Automation

L3 represents the threshold where the system performs the entire DDT under specific conditions, with the human driver no longer required to monitor the environment continuously. The system must request human takeover when approaching its ODD boundaries.

Audi Traffic Jam Pilot (2019): The first production L3 system, limited to speeds below 60 km/h in heavy traffic on divided highways.

Architectural Shift:

• **Redundancy**: Dual steering actuators, dual braking systems (electro-hydraulic + mechanical), redundant power supplies.
• **Environmental Sensing**: Addition of LiDAR (typically 5-16 beam solid-state) for 3D environment modeling.
• **Decision Logic**: Finite State Machines (FSM) for traffic jam scenarios, with defined "minimal risk maneuvers" (e.g., slow to stop, pull to shoulder).
• **Human-Machine Interface**: HMI must provide "takeover request" (TOR) with adequate time (typically 10-15 seconds) for human to resume control.

Mathematical Model of Takeover Time: The total takeover time $T_{total}$ comprises: $$T_{total} = T_{TOR} + T_{perception} + T_{decision} + T_{motor}$$

Where:

• $T_{TOR}$: Time to receive and acknowledge the Takeover Request (2-3 seconds)
• $T_{perception}$: Time to acquire situational awareness (2-4 seconds)
• $T_{decision}$: Cognitive processing time (1-2 seconds)
• $T_{motor}$: Physical movement to controls (1-2 seconds)

Total: 6-11 seconds. At 60 km/h (16.7 m/s), the vehicle travels 100-183 meters during takeover, necessitating substantial safety margins.

Level 4: High Driving Automation

L4 systems operate without human intervention within their defined ODD, which may be geographically bounded (e.g., specific city zones) or weather-constrained. If the system encounters conditions outside its ODD, it must perform a minimal risk maneuver (MRM) — typically slowing to a safe stop and alerting authorities.

Waymo One (Phoenix, AZ): The most prominent L4 deployment, operating in a 160 km² geofenced area with weather constraints (no heavy rain, fog, or snow).

Architectural Requirements:

• **Redundant Sensor Fusion**: LiDAR (typically 5-6 units for 360° coverage), radar (long-range 200m, short-range 80m), cameras (front, side, rear).
• **Computing**: Dual computing platforms with hot redundancy (e.g., Waymo Driver uses two Intel CPUs + GPUs, or Tesla HW3.0 with dual FSd chips).
• **Validation**: Requires 100+ million miles of simulation plus 10+ million miles of real-world testing to demonstrate statistical safety superiority over human drivers (target: <1 fatality per 100 million miles vs. human baseline of 1.25 fatalities per 100 million miles in US).

Safety Framework: The functional safety concept follows ISO 26262 ASIL-D (Automotive Safety Integrity Level D) for critical components. The system must demonstrate: $$P_{failure} < 10^{-8} \text{ per hour for catastrophic hazards}$$

Level 5: Full Driving Automation

L5 systems possess the capability to perform all DDT under all conditions encountered on roads, without any geographic or environmental constraints. No production vehicle has achieved L5 as of 2024. The primary challenges include:

• **Edge Case Handling**: Unpredictable human behavior, extreme weather (blizzards, sandstorms), unmapped roads.
• **Regulatory Framework**: Absence of international homologation standards for L5 vehicles.
• **Ethical Decision Making**: Resolution of trolley problem scenarios in unavoidable collision situations.

The Four Pillars: Perception, Decision, Planning, and Control

The autonomous driving software stack is traditi