News, 24 July 2025
Pony.ai’s autonomous driving system, specifically its automotive-grade controller designed for Level 4 (L4) capabilities, has successfully completed over two million kilometers of real-world road testing. This generation of the autonomous driving system is engineered for extended durability, aiming for a operational life of a decade or 600,000 kilometers.
A domain controller for autonomous driving or what it is often called- ‘Domain Control Unit’ or DCU, is the “brain” and “nerve center” of an autonomous vehicle. It’s a powerful, centralized computer that manages a specific set of critical functions related to self-driving. DCU consolidates many of the individual ECU (Electronic Control Unit) functions into a single unit. Traditional vehicles have many individual ECUs, each responsible for a specific function like engine control, braking, infotainment.
Pony.ai domain controller utilizes three NVIDIA OrinX chips in the main unit with a fourth OrinX chip dedicated to system redundancy, delivering 1,016 TOPS of computing power. Through a co-designed hardware-software architecture, Pony.ai custom-developed the domain controller to meet the comprehensive system and functional requirements of fully driverless Robotaxis, as well as the performance and safety demands of L4 autonomous driving algorithms. As a result, the controller achieves a 50% to 80% reduction in size, weight, power consumption, and cost—significantly optimizing hardware expenses.
Functioning as the central computing hub, this controller integrates a wide array of sensors, essential functions and supporting controllers required for Robotaxi operation. These include system power management, interactive display, hazard warning lights, gateways, and Global Navigation Satellite System (GNSS). By integrating these features into a single unit, Pony.ai has reduced wiring complexity and the number of individual components, streamlining vehicle layout, lowering manufacturing costs, and minimizing potential failure points. Furthermore, it simplifies assembly line processes, making mass production faster and more efficient. The domain controller supports both liquid cooling and passive cooling. When the liquid cooling system encounters malfunction, the redundant system ensures safe pull-over with passive cooling.
The system incorporates a multi-layered safety architecture and degradation strategies, delivering “Fail Operational” capability. In the event of a primary system failure, the controller can seamlessly switch to the redundant system or the Minimum Risk Condition Controller (MRCC) to ensure safe vehicle control. Even if the main system’s power or chassis communication fails, the redundant system can still maintain critical perception (including blind spot coverage) and safe driving capabilities. This allows the vehicle to navigate intersections or ramps and safely pull over, minimizing the risk of traffic disruption or collisions.
