How do we actually decide what commands to send the steering, brakes, transmission, and throttle? Here's the plan.
Inputs to the driving module
The driving module accepts three basic types of inputs from planning and sensor systems - steering messages, maximum speed messages, and authorization to advance messages.
Steering messages come from only one source, the path controller. The path controller decides where to go.
Maximum speed messages
Maximum speed messages come from multiple sources, and, of course, the lowest speed requested applies.
Authorization to advance messages
These messages indicate that the message source considers it safe to advance by the indicated distance. Authorization to advance messages come from multiple sources, and are combined by the driving module.
Processing by the driving module
Authorization to advance messages come in regularly, and the vehicle speed is adjusted so that it will not overrun the current combined authorization to advance.
Vehicle dynamics model
This proposed vehicle model is simplistic by automotive standards, but since we're not trying to explore the limits of what the vehicle can do, probably adequate.
Allowed acceleration and deceleration is defined by an ellipse in the vehicle coordinate system. Control inputs must be constrained to stay within the acceleration ellipse. Vehicle tilt generates gravitational acceleration, of course, which gets added in.. This is a model used in auto racing. The width of the ellipse can be calculated from the usual skid pad G-load data. The length (front/back direction) can be calculated from the stopping distance. We probably derate these numbers by 25% or so.
Indications of activity from the traction control system shrink the ellipse for a period of time. This allows us to react to slippery surfaces.
From the current turn radius and the acceleration ellipse, the current stopping distance can be calculated for any speed. Conversely, the maximum safe speed can be calculated for any stopping distance. Using the active "authorization to advance" information, a maximum speed can be calculated which will not overrun the acceleration ellipse. Speed limits are applied to that value to give us our goal speed.
The active "authorization to advance" is used up as the vehicle moves forward. Unless further authorization to advance messages come in, the vehicle will slow to stay under the deceleration curve implied by the acceleration ellipse. In normal operation, "authorization to advance" messages are coming in several times per second, so that the vehicle is not forced to change speed.
Given a goal speed, we brake down to it or accelerate up to it as required, staying within the constraints of the acceleration ellipse.
This should give us reasonable vehicle behavior. The appropriate things happen going uphill and downhill, with longer stopping distances being provided for when going downhill. Curves are handled reasonably, with abrupt acceleration and braking constrained by the acceleration ellipse. Vehicle tilt also results in appropriate constraints.
Steering needs both acceleration and jerk limits. We can probably deal with the jerk issue simply by constraining the steering rate. Steering should also be subject to the acceleration ellipse. In theory, this would cause us to steer into a skid. But we may not want to do that. If we have a vehicle with active traction control, like the GMC trucks, we probably want to let that system deal with skids, and restrict ourselves to not making the problem worse. So we should not actively steer out of the acceleration ellipse, but if it moves, we don't try to steer back into it. We let braking handle that.
Whether we need to work actively to prevent rollover is an important question. I don't know enough to answer that question.
Braking is probably our toughest control loop. We know the goal, though: to achieve a desired deceleration value. A standard PID controller with a tight control loop from the inertial system probably will do the job. We'll need a fast actuator.
This is very similar to braking control, but we want more filtering (maybe about 200ms worth) so we don't try to make throttle corrections too fast.
Ordinarily, we're always in "Drive". But, when faced with a very low speed limit, we may switch to "low". If we have controllable 4WD gear (lockers, hubs, transfer case low ranges) we might also switch it on at that time. It's not clear whether we need rock-crawling capability, but if the vehicle has it, we should be able to turn it on. We're more likely to use it to get unstuck.
(to be written)
Getting stuck, and getting unstuck.