Vehicle automatic driving redundancy system, control method and vehicle

Abstract

The invention relates to the technical field of vehicle control, and discloses a vehicle automatic driving redundant system, a control method and a vehicle, the system comprises a main controller board, a redundant controller board, a sensor system and an actuator system; in the first working mode, the main controller collects vehicle information and planned first computing power through the first sensor group, the redundant controller collects vehicle information and planned first computing power through the second sensor group, and the main controller sends a first control instruction to the first actuator group and sends a second control instruction to the second actuator group; and when the degradation condition is detected to be triggered, the controller is switched to a second working mode, and the controller which is not disconnected generates and sends a third control instruction to the corresponding actuator group according to the vehicle information and planned second computing power so as to continue to execute the automatic driving task. According to the scheme, the main controller and the redundant controller share computing resources, sensor resources and actuator resources, the situation that one sensor system and one actuator system are independently arranged is avoided, and the system saves resources and reduces cost expenditure.

Description

Technical Field

[0001] The present invention relates to the field of vehicle control technology, and in particular to a vehicle automatic driving redundant system, a control method and a vehicle. Background Art

[0002] In the interconnected environment of intelligent connected vehicles and autonomous driving systems, in certain specific scenarios, the automated driving systems (ADS) that require the driver to take over need to give the driver a response time of no less than 10 seconds when the autonomous driving system issues an intervention request, and the ADS system must remain activated during this period; for ADS systems that do not require the driver to take over, when the operational design condition (ODC) is about to be unsatisfied, or when the ODC is suddenly unsatisfied, the ADS system must promptly execute the minimum risk strategy (MRM) and be able to bring the vehicle to a standstill. When executing MRM, the goal is to reduce the safety risk to an acceptable level; this requires that the sensors, controllers, communications and other vehicle systems (such as vehicle motion actuators, power supplies) of the ADS system must have redundant designs to avoid the inability to keep the system activated or execute MRM when a single point failure occurs.

[0003] In the current ADS system, the sensor and controller parts have the highest redundancy design cost. In the current mainstream redundancy design, two completely independent sensor and controller systems are generally used to achieve redundancy. This design cost is high and will affect the popularization and expansion of autonomous driving systems. Summary of the invention

[0004] In view of this, the present invention provides a vehicle automatic driving redundant system, a control method and a vehicle to solve the problem of high design cost of redundant backup system sensors and controllers.

[0005] In a first aspect, the present invention provides a redundant system for automatic driving of a vehicle, the system comprising: a main controller board, a redundant controller board, a sensor system, and an actuator system; wherein the main controller board comprises a main controller, the redundant controller board comprises a redundant controller, a plurality of sensors in the sensor system are divided into a first sensor group and a second sensor group, a plurality of vehicle motion actuators in the actuator system are divided into a first actuator group and a second actuator group, and the two actuator groups are redundant with each other;

[0006] The main controller is connected to the first sensor group and the first actuator group respectively, and the redundant controller is connected to the second sensor group and the second actuator group respectively; the main controller and the redundant controller are connected via an inter-board connector;

[0007] The operating mode of the system includes a first working mode and a second working mode;

[0008] Wherein, in the first working mode, the main controller collects vehicle information and the first computing power jointly planned by the two controllers through the first sensor group, and the redundant controller collects vehicle information and the first computing power jointly planned by the two controllers through the second sensor group, and the main controller sends a first control instruction to the first actuator group, and sends a second control instruction to the second actuator group, so as to coordinate the two actuator groups to jointly perform the automatic driving task;

[0009] When a degradation triggering condition is detected, the first working mode is switched to the second working mode, and the connection control of the failed or faulty part of the controller is disconnected;

[0010] In the second working mode, the controller that is not disconnected generates and sends a third control instruction to the corresponding actuator group based on the vehicle information collected by its corresponding sensor group and the planned second computing power to perform the backup autonomous driving task, and the second computing power is less than the first computing power.

[0011] The vehicle autonomous driving redundant system provided in this aspect has the ability to automatically detect degradation conditions. Once the performance degradation, failure or failure of the main controller board, redundant controller board or related components is detected, the system can immediately switch to the second working mode, and the normally connected controller takes over the control authority. After the degradation, any non-failed controller can independently run all dynamic driving tasks under the MRM. This automatic switching mechanism greatly improves the system's fault tolerance and fault response capabilities.

[0012] In addition, in the first working mode, the main controller and the redundant controller simultaneously collect vehicle information and plan computing power, that is, under normal operating conditions, the main controller and the redundant controller are jointly responsible for all dynamic driving tasks of ADS. Although the redundant controller does not directly control the actuator at this time, it also performs real-time data analysis and processing while serving as a backup. This parallel processing method helps the redundant controller to quickly and accurately take over the control task when the main controller fails, thereby avoiding interruption or delay of the autonomous driving task.

[0013] In addition, the main controller and the redundant controller are connected to the sensor system and the actuator system together, sharing computing resources, sensor resources, and vehicle motion actuator resources, avoiding the need to separately deploy a set of sensor and actuator systems. This system saves resources and reduces costs.

[0014] In combination with the first aspect, in a possible implementation, in the first working mode, the main controller receives the vehicle information collected from the first sensor group, the redundant controller receives the vehicle information collected from the second sensor group, and reports it to the main controller through the inter-board connector;

[0015] Furthermore, the main controller runs the main software stack according to the first computing power based on the vehicle information collected by itself and the vehicle information reported by the redundant controller, and sends the first control instruction to the first actuator group, and sends the second control instruction to the second actuator group.

[0016] In combination with the first aspect, in another possible implementation, in the first working mode, the main controller and the redundant controller further detect each other whether a degradation condition is triggered;

[0017] If so, the degradation is initiated, and one of the main controller and the redundant controller is selected to continue working as the target controller, cooperating with the first actuator group or the second actuator group to independently perform the autonomous driving task, and the target controller is the controller that is not disconnected.

[0018] In combination with the first aspect, in another possible implementation manner, the downgrade triggering condition includes one or more of the following:

[0019] The main controller or the redundant controller fails;

[0020] A circuit module, connection wiring or signal transmission on the main controller board or the redundant controller board fails;

[0021] Any one or more sensors in the sensor system fail;

[0022] Any one or more actuators in the actuator system fail;

[0023] Failure of the vehicle's chassis system;

[0024] The power supply unit is faulty.

[0025] In combination with the first aspect, in another possible implementation manner, the main controller board further includes a first microcontroller, and the redundant controller board further includes a second microcontroller;

[0026] The first microcontroller is connected to the main controller and the second microcontroller respectively, and the second microcontroller is also connected to the redundant controller;

[0027] When the first microcontroller detects that an abnormality occurs in the main controller, the first microcontroller sends an indication signal to the second microcontroller and notifies the main controller to transfer the control authority to the redundant controller;

[0028] When receiving the indication signal from the first microcontroller, the second microcontroller notifies the redundant controller to take over the control authority, so that the redundant controller performs the backup automatic driving task through the second sensor group and the second actuator group.

[0029] In combination with the first aspect, in another possible implementation, in the first working mode, the main controller and the redundant controller start the hot standby software stack according to the planned second computing power, and the hot standby software stack is used to start and execute the autonomous driving task when the degradation condition is triggered.

[0030] In combination with the first aspect, in another possible implementation, the number of sensors included in the first sensor group is n1, the number of sensors included in the second sensor group is n2, and n1≥1, n2≥1; wherein, the detection range of the n1 sensors covers a 360° viewing angle of the vehicle, and the detection range of the n2 sensors covers a 360° viewing angle of the vehicle.

[0031] In combination with the first aspect, in another possible implementation, the system further includes a first CAN bus and a second CAN bus; the first CAN bus and the second CAN bus are used to connect the first actuator group with the main controller, and to connect the second actuator group with the redundant controller.

[0032] In a second aspect, the present invention provides a vehicle automatic driving redundant control method, the method being applied to the vehicle automatic driving redundant system in the aforementioned first aspect or any one of the embodiments of the first aspect, the control method comprising:

[0033] Under the vehicle's automated driving system, detect whether the system design operation triggers degradation conditions;

[0034] If not, the first working mode is executed, in which the main controller collects vehicle information and plans computing power through the first sensor group and the redundant controller collects vehicle information and plans computing power through the second sensor group;

[0035] The main controller sends a first control instruction to the first actuator group and a second control instruction to the second actuator group according to the vehicle information and the first computing power jointly planned by the two controllers, so as to coordinate the two actuator groups to jointly perform the autonomous driving task.

[0036] In combination with the second aspect, in a possible implementation manner, the method further includes: if yes, switching the first working mode to a second working mode, and disconnecting the failed or faulty part of the controller connection control;

[0037] In the second working mode, the controller that is not disconnected generates and sends a third control instruction to the corresponding actuator group based on the vehicle information collected by its corresponding sensor group and the planned second computing power to jointly execute the backup autonomous driving task, and the second computing power is less than the first computing power.

[0038] In combination with the second aspect, in another possible implementation, the method also includes: in the first working mode, the main controller and the redundant controller start the hot standby software stack according to the planned second computing power, and the hot standby software stack is used to start and execute the autonomous driving task when the degradation condition is triggered.

[0039] In combination with the second aspect, in another possible implementation, in the second working mode, the controller that is not disconnected generates and sends a third control instruction to the corresponding actuator group according to the vehicle information collected by the corresponding sensor group and the planned second computing power, including:

[0040] In the second working mode, the redundant controller starts and runs the hot standby software stack based on the vehicle information collected by the second sensor group and the modules running normally on the main control board, sends the third control instruction, and stops the operation of the first computing power.

[0041] In combination with the second aspect, in another possible implementation, the first computing power is a first percentage of total computing resources, used to run the main software stack in the first operating mode; wherein the total computing resources include the sum of the computing resources of the main controller and the computing resources of the redundant controller; the second computing power is a second percentage of the total computing resources, used to run the hot standby software stack in the second operating mode, and the first percentage is greater than the second percentage.

[0042] In a third aspect, the present invention provides a vehicle, the vehicle comprising a redundant system;

[0043] The redundant system is the vehicle automatic driving redundant system in the aforementioned first aspect or any one of the embodiments of the first aspect;

[0044] The vehicle autonomous driving redundant system is used to execute the vehicle autonomous driving redundant control method in the aforementioned second aspect or any embodiment of the second aspect.

[0045] In a fourth aspect, the present invention provides a controller comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the vehicle automatic driving redundant control method of the above-mentioned second aspect or any corresponding embodiment thereof by executing the computer instructions.

[0046] Optionally, the controller may be a main controller, or may also be a redundant controller.

[0047] In addition, the present invention provides a computer-readable storage medium, on which computer instructions are stored, and the computer instructions are used to enable a computer to execute the vehicle automatic driving redundant control method of the above-mentioned first aspect or any corresponding embodiment thereof.

[0048] The vehicle automatic driving redundant system, control method and vehicle provided by the present invention have the following beneficial effects:

[0049] First, improve the reliability of the autonomous driving system: This system implements the redundant design of key system components by introducing redundant controllers, second sensor groups, and second actuator groups. When the main controller or the first sensor group or the first actuator group connected to it fails, the system can quickly switch to the redundant controller board and its corresponding sensor group and actuator group to continue the autonomous driving task, thereby ensuring the continuity and safety of the autonomous driving task.

[0050] Second, enhance the fault tolerance of the system: The system provided by the present invention has the ability to automatically detect degradation conditions. Once the performance degradation or failure of the main controller board or related components is detected, the system can immediately switch to the second working mode, and the redundant controller takes over the control authority. After the degradation, any non-failed controller can independently run all dynamic driving tasks under the MRM. This automatic switching mechanism greatly improves the fault tolerance and fault response capabilities of the system.

[0051] In addition, in the first working mode, the main controller and the redundant controller simultaneously collect vehicle information and plan computing power, that is, under normal operating conditions, the main controller and the redundant controller are jointly responsible for all dynamic driving tasks of ADS. Although the redundant controller does not directly control the actuator at this time, it also performs real-time data analysis and processing while serving as a backup. This parallel processing method helps the redundant controller to quickly and accurately take over the control task when the main controller fails, thereby avoiding interruption or delay of the autonomous driving task.

[0052] Third, saving resources and costs: In the system provided by the present invention, the main controller board and the redundant controller board are connected through an inter-board connector, and the main controller and the redundant controller are jointly connected to the sensor system and the actuator system to share computing resources, sensor resources, and vehicle motion actuator resources, thereby avoiding the separate deployment of a set of redundant sensor resources and actuator resources. Compared with the two completely independent sensor and controller systems currently used to achieve redundancy, this design scheme can save a set of sensor and actuator systems, thereby saving resources and reducing cost overhead.

[0053] Fourth, improve the flexibility and scalability of the system: The system architecture of the present invention is flexible and easy to expand or adjust according to actual needs. For example, more sensors or actuators can be added to improve the perception and execution capabilities of the system; or the computing performance and intelligence level of the system can be improved by upgrading the hardware and software of the controller board. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0055] Figure 1 is a schematic diagram of the structure of a redundant system for automatic driving of a vehicle according to an embodiment of the present invention;

[0056] Figure 2 is a schematic diagram of the structure of another vehicle automatic driving redundant system according to an embodiment of the present invention;

[0057] Figure 3a is a schematic diagram of a detection range of a sensor group covering a 360° viewing angle of a vehicle according to an embodiment of the present invention;

[0058] Figure 3b is a schematic diagram of another sensor group detection range covering a 360° viewing angle of a vehicle according to an embodiment of the present invention;

[0059] Figure 4 is a schematic diagram of a structure in which a main controller module controls automatic driving of a vehicle according to an embodiment of the present invention;

[0060] Figure 5 is a flow chart of a redundant control method for automatic driving of a vehicle according to an embodiment of the present invention;

[0061] Figure 6 is a flow chart of another vehicle automatic driving redundant control method according to an embodiment of the present invention;

[0062] Figure 7 is a schematic diagram of total computing resources occupied by another software stack startup operation according to an embodiment of the present invention;

[0063] Figure 8 is a flow chart of another vehicle automatic driving redundant control method according to an embodiment of the present invention;

[0064] Fig. 9 is a schematic diagram of the hardware structure of a controller according to an embodiment of the present invention;

[0065] Fig.10 is a schematic structural diagram of a vehicle according to an embodiment of the present invention. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0067] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0068] Furthermore, the terms “first” and “second” are used for descriptive purposes only and should not be understood as indicating or implying relative importance.

[0069] The technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0070] The technical solution provided by the embodiment of the present invention is applied to the field of vehicle control technology, especially to automated driving systems (ADS). In the current ADS system, the sensor and controller parts have higher redundancy design costs. In the mainstream redundant design, two completely independent sensor and controller systems are generally used to achieve redundancy. The high cost of this design will become the biggest obstacle to the popularization of autonomous driving systems.

[0071] In addition, traditional redundant autonomous driving perception and controller systems generally only work when the main system fails. When the main system is working normally, the redundant control system is generally in hot standby or silent state. Therefore, the redundant control system has little contribution to the perception / control of the vehicle during normal operation. This design is a waste of precious hardware resources.

[0072] In order to solve the above technical problems, an embodiment of the present invention provides a vehicle automatic driving redundant system, which not only meets the requirements of the ADS system, but also designs a redundant controller system based on the requirements of safety redundancy and sensor grouping, and also considers the requirements of the L2 assisted driving system. On the one hand, the main controller board and the redundant controller board circuit module together constitute the controller of the ADS system, and on the other hand, the main controller board alone constitutes the controller of the L2 assisted driving system, thereby saving system resources and reducing cost overhead.

[0073] The technical solution provided by the embodiment of the present invention is described in detail below.

[0074] See also Figure 1 , is a schematic diagram of the structure of a vehicle automatic driving redundant system provided in this embodiment. The system includes: a main controller board, a redundant controller board, a sensor system, and an actuator system. In addition, the system also includes a transmission bus, such as a first CAN (Controller Area Network) bus, a second CAN bus, a power supply unit, etc., which are not limited in this embodiment.

[0075] The CAN bus is a serial communication bus for real-time control, and is mainly used for communication between automotive electronic devices, as well as in the fields of industrial automation and medical equipment. In this embodiment, the first CAN bus and the second CAN bus are used to connect the first actuator group with the main controller, and to connect the second actuator group with the redundant controller.

[0076] The main controller board includes a main controller, and the redundant controller board includes a redundant controller.

[0077] Optionally, the controller may be a SOC (System on Chip), for example, the main controller may be SOC1, and the redundant controller may be SOC2. It should be understood that the main controller or the redundant controller may also be other processors or processing units, which is not limited in this embodiment.

[0078] The sensor system includes a plurality of sensors, which can be divided into a first sensor group and a second sensor group, each sensor group includes at least one sensor, and the sensors in the first sensor group and the second sensor group can overlap or not overlap.

[0079] See also Figure 2 As shown, specifically, the multiple sensors in the sensor system include: laser radar, millimeter wave radar, camera, camera module and other sensors with different architectures, which is not limited in this embodiment.

[0080] In addition, the actuator system includes a plurality of vehicle motion actuators, which can be divided into a first actuator group and a second actuator group, and the two actuator groups are redundant with each other. Each actuator group includes at least one vehicle motion actuator. The first actuator group and the second actuator group in the actuator system are used to cooperate to perform all dynamic driving tasks (DDT).

[0081] At least one vehicle motion actuator in each actuator group includes, but is not limited to, a steering system actuator, a brake system actuator, etc. In this embodiment, the first actuator group includes: a steering system 1 and a brake system 1. The second actuator group includes: a steering system 2 and a brake system 2. In addition, each actuator group may also include other vehicle motion actuators, which are not limited in this embodiment.

[0082] In this embodiment, the main controller (SOC1) is connected to the first sensor group and the first actuator group respectively, and the redundant controller (SOC2) is connected to the second sensor group and the second actuator group respectively.

[0083] See also Figure 2 In a specific implementation, the main controller (SOC1) is connected to multiple cameras, such as a group of cameras, through at least one deserializer (such as deserializers 1 to 4) for monitoring a 360° viewing angle around the vehicle, including but not limited to: front and rear view mirrors, side view mirrors, surround view mirrors, and the interior of the cabin. Similarly, the redundant controller (SOC2) is connected to another front view mirror through the deserializer 5.

[0084] In addition, the main controller (SOC1) is also connected to the laser radar through switch 1. SOC1 and SOC2 can also be connected to the millimeter wave radar through a switch, a microprocessor (MCU), and a CAN bus, respectively. For example, SOC1 is connected to the millimeter wave radar through switch 1, MCU1, and CAN_PHY (Physical Layer), CAN1 or CAN2. SOC2 is connected to the millimeter wave radar through switch 2, MCU2, and CAN_PHY, CAN1 or CAN2.

[0085] The main controller (SOC1) and the redundant controller (SOC2) are connected via an inter-board connector; specifically, the main controller (SOC1) is connected to inter-board connector 1, and the redundant controller (SOC2) is connected to inter-board connector 2. Inter-board connector 1 and inter-board connector 2 are connected via a high-speed communication bus and can be used to transmit high-speed communication signals, such as I2C signals.

[0086] Optionally, both the board connector 1 and the board connector 2 can be a BTB board connector (Board-to-Board connector), which is a component used to connect different circuit boards (PCB, Printed Circuit Board) in electronic equipment. It can be used to provide a reliable electrical connection, allowing signals, power or data to be transmitted between one circuit board and another. It is a transmitter of signals, power and data, and has super strong transmission capabilities. In this embodiment, it is used to transmit high-speed signals, such as PCIe signals, between the main controller board and the redundant controller board.

[0087] See also Figure 2 The system may also include more or fewer other modules, such as a power supply unit, an MCU (Microcontroller Unit) power supply, an IMU (Inertial Measurement Unit), etc.

[0088] Specifically, the main controller board includes a first microprocessor (Microcontroller Unit 1, MCU1), IMU1, power supply 1, MCU power supply, SOC power supply, switch 1 and multiple CAN_PHY. Among them, power supply 1 is the main power supply of the main control board, which is used to transmit power to the MCU power supply and the SOC power supply. The MCU power supply supplies power to MCU1 and IMU1, and the SOC power supply supplies power to SOC1 and deserializers 1 to 4.

[0089] Similarly, the redundant controller board includes a second microprocessor (Microcontroller Unit 2, MCU2), IMU2, power supply 2, another MCU power supply, another SOC power supply, switch 2 and multiple CAN_PHY. The redundant controller is connected to the actuator system through switch 2, MCU2 and multiple CAN_PHY. Power supply 2 serves as a backup power supply for the redundant controller board and supplies power to the MCU power supply and SOC power supply on the redundant controller board. The MCU power supply supplies power to MCU2 and IMU2, and the SOC power supply supplies power to SOC2 and deserializer 5.

[0090] In addition, IMU is a sensor used to measure and track the attitude (such as direction, angle and speed) of an object.

[0091] It should be understood that the vehicle automatic driving redundant system in this embodiment may also include other more or fewer units or modules, and this embodiment is not limited to this.

[0092] The solution provided in this embodiment can be applied to a typical ADS system, which includes the above-mentioned sensor system, which includes a variety of heterogeneous sensors, including but not limited to: front and rear view cameras, side view cameras, surround view cameras, millimeter wave radars and laser radars. These sensors are divided into a first sensor group and a second sensor group, and both sensors cover a 360° detection range of the vehicle body. Different sensor groups can take into account the perception accuracy and perception distance required under different weather, different environments and different vehicle speed conditions according to their characteristics.

[0093] For example Figure 3a Shown is a schematic diagram of a 360° range around a vehicle detected by sensors included in the first sensor group; Figure 3b The figure shows a schematic diagram of the 360° range of the vehicle's surroundings detected by the sensors included in the second sensor group.

[0094] Optionally, the number of sensors included in the first sensor group is n1, the number of sensors included in the second sensor group is n2, and n1≥1, n2≥1; wherein, the detection range of n1 sensors covers the 360° viewing angle of the vehicle, and the detection range of n2 sensors covers the 360° viewing angle of the vehicle, ensuring that whichever group of sensors is used can detect the 360° viewing angle range of the entire vehicle.

[0095] In the ADS system, the embodiment of the present invention provides two operating modes, namely: a first working mode and a second working mode.

[0096] Among them, in the first working mode, the controllers on the main control board and the redundant control board start working at the same time, the main controller SOC1 collects vehicle information and the first computing power jointly planned by the two controllers through the first sensor group, and the redundant controller SOC2 collects vehicle information and the first computing power jointly planned by the two controllers through the second sensor group, such as the first computing power of the shared demand, and the first computing power is used to execute the main software stack. The main controller SOC1 sends the first control instruction to the first actuator group, and sends the second control instruction to the second actuator group, so as to coordinate the two actuator groups to jointly perform the autonomous driving task.

[0097] In the first working mode, the main controller SOC1 executes the control of the vehicle redundant system according to the first computing power, and on the one hand receives the vehicle information collected from the first sensor group, such as the taken photos, images, collected driving speed, acceleration and other information; on the other hand, the redundant controller SOC2 collects the vehicle information through the second sensor group, such as the taken photos, images, collected driving speed, acceleration and other information, and reports this information to the main controller SOC1 through the inter-board connector, and then the main controller SOC1 receives the vehicle information collected by the second sensor group.

[0098] The main controller SOC1 generates and sends a first control instruction to the first actuator group, and sends a second control instruction to the second actuator group according to the vehicle information collected by itself, the vehicle information reported by the redundant controller SOC2 and the first computing power.

[0099] Specifically, the first control instruction can be sent to the first actuator group through the MCU1 of the main controller SOC1 and the first CAN bus; and the second control instruction can be sent to the second actuator group through the MCU1 and the second CAN bus. The number of the first control instruction and the second control instruction can be one or more, such as sending n3 first control instructions to n3 vehicle motion actuators of the first actuator group, and sending n4 second control instructions to n4 vehicle motion actuators of the second actuator group.

[0100] When a triggering degradation condition is detected, the first working mode is switched to the second working mode, and the part of the controller that fails or fails is disconnected from the control. The part of the controller may be a main controller, a redundant controller, or a module or line on any controller board that fails or fails.

[0101] Among them, one of the conditions for triggering the degradation is a fault on the main controller board, such as a fault in the main controller SOC1, a fault in the MCU1, or a fault in a circuit module, a connection line, or a signal transmission on the main controller board, etc. When the degradation condition is triggered, the first working mode is switched to the second working mode.

[0102] In the second working mode, the controller that is not disconnected generates and sends a third control instruction to the corresponding actuator group based on the vehicle information collected by the corresponding sensor group and the planned second computing power to execute the backup automatic driving task, wherein the second computing power is less than the first computing power. In addition, the execution of the backup automatic driving task can continue to execute the self-driving task of the aforementioned main controller.

[0103] One implementation method is that the redundant controller SOC2 runs the hot standby software stack with the second computing power based on the vehicle information collected by the second sensor group and in combination with some circuits or modules that are normally connected in the main controller board, generates and sends a third control instruction to the second actuator group to cooperate with the second execution group to continue to perform the autonomous driving task. At this time, the faulty or failed lines in the main controller board are cut off, and the control authority is transferred to the redundant controller. In this embodiment, when some circuits or main controllers on the main controller board fail or fail, a downgrade operation is triggered, and the system uses the second computing power to start the hot standby software stack to execute MRM to continue to perform the autonomous driving task.

[0104] Optionally, in a specific embodiment, in the first working mode, MCU2 and MCU1 run the same control software, which includes a main software stack and a hot standby software stack. However, in the first working mode, the hot standby software stack is started but does not output control instructions to the vehicle motion actuator. Only when the system fails or fails and the degradation condition is triggered, the second working mode is switched to start and execute the hot standby software stack, execute the minimum risk strategy MRM, and output the third control instruction to the second actuator group to coordinate with the vehicle motion actuator of the second actuator group to continue to perform the autonomous driving task.

[0105] The vehicle motion actuators in the second actuator group include transverse and longitudinal actuators, such as a braking system, a steering system, etc.

[0106] In the ADS system of this embodiment, the main controller, redundant controller, sensor system and actuator system are grouped and connected to the main controller board and the redundant controller board respectively. The main controller and the redundant controller are connected through a high-speed BTB connector. The sensor data received by the two controller boards can be shared with each other through a high-speed bus. The SOC1 and SOC2 in the two controller boards can also interact with each other in calculating intermediate states and results through a high-speed communication bus, thereby realizing computing power expansion.

[0107] In the ADS system, according to regulatory requirements, when the design operating condition (Operational Design Condition, ODC) is not met, the degradation condition is triggered. The triggering degradation condition includes: detecting that the ADS system status is abnormal, such as controller failure (such as main controller SOC1 or redundant controller SOC2 failure), sensor failure (such as any one or more sensor failures in the sensor system), circuit module, connection wiring or signal transmission failure on the main controller board or redundant controller board, or any one or more vehicle motion actuators in the actuator system Failure or abnormality, such as chassis system, power system failure (such as power supply unit failure), the ADS system can perform working mode downgrade operations and execute the minimum risk strategy MRM.

[0108] To avoid the entire ADS system being completely exited and unable to execute MRM after multiple point failures, when a single point failure occurs in the above systems (including the main controller, redundant controller, sensors, and other vehicle systems), the ADS system should enter a degraded mode. In the degraded mode, MRM can be executed by the surviving controller modules (main controller or redundant controller) and their connected sensors and actuators.

[0109] In one implementation, in the first working mode, the main controller and the redundant controller also detect each other whether the degradation condition is triggered; if so, the degradation is initiated, and the second working mode is switched to select one of the main controller and the redundant controller as the target controller to continue working, disconnect the controller that has failed or failed, and cooperate with the first actuator group or the second actuator group to perform the autonomous driving task independently, and the target controller is the normally operating controller. In this embodiment, the target controller is a redundant controller.

[0110] In the ADS system, generally two actuator groups are included, and the two actuator groups are redundant with each other; they communicate with the main controller board and the redundant controller board through two CAN buses. When the main controller works normally, it receives control instructions from the main controller board; and when the main controller fails, it receives control instructions from the redundant controller.

[0111] In addition, the main controller and the redundant controller also detect each other whether the degraded condition is triggered, which can be realized by the first MCU (MCU1) and the second MCU (MCU2). Specifically, when the first MCU detects that the main controller SOC1 is abnormal, it sends an indication signal to the second MCU and notifies the main controller SOC1 to transfer the control authority to the redundant controller SOC2. When the second MCU receives the indication signal from the first MCU, it notifies the redundant controller SOC2 to take over the control authority, so that the redundant controller SOC2 performs the autonomous driving task MRM alone through the second sensor group and the second actuator group.

[0112] In this embodiment, the redundant controller SOC2 takes over the control right and executes MRM alone in the second working mode as an example, and the target controller is SOC2 at this time. Similarly, when the redundant controller SOC2 fails, the main controller SOC1 can continue to control the first sensor group and the first actuator group, cut off or do not receive the measurement data reported from the redundant controller board, so that the main controller SOC1 executes MRM alone. At this time, the target controller is SOC1.

[0113] In this embodiment, in the above Figure 3a It shows that the detection range of the first sensor group covers a 360° viewing angle of the vehicle, Figure 3b It is shown that the detection range of the second sensor group covers a 360° viewing angle of the vehicle.

[0114] It should be noted that grouping multiple sensors in the sensor system is only one implementation method. The grouping can be reasonably adjusted according to needs in specific products. The key to adjusting the grouping is to ensure that the viewing angle range of the two sensor groups alone can cover the 360° viewing angle of the entire vehicle, and have more than two heterogeneous sensors, and have long-distance detection capabilities in the two key directions of forward and backward (at least greater than 100 meters), so as to ensure the safety of performing MRM tasks in high-speed scenarios or severe weather conditions.

[0115] In addition, the ADS system includes two power supplies, wherein the main power supply supplies power to various circuits or modules in the main controller board, and the backup power supply supplies power to various circuits or modules on the redundant controller board.

[0116] The vehicle automatic driving redundant system provided by the present invention has the following beneficial effects:

[0117] First, improve the reliability of the autonomous driving system: This system implements the redundant design of key system components by introducing redundant controllers, second sensor groups, and second actuator groups. When the main controller or the first sensor group or the first actuator group connected to it fails, the system can quickly switch to the redundant controller board and its corresponding sensor group and actuator group to continue the autonomous driving task, thereby ensuring the continuity and safety of the autonomous driving task.

[0118] Second, enhance the fault tolerance of the system: The system provided by the present invention has the ability to automatically detect degradation conditions. Once the performance degradation or failure of the main controller board or related components is detected, the system can immediately switch to the second working mode, and the redundant controller takes over the control authority. After the degradation, any non-failed controller can independently run all dynamic driving tasks under the MRM. This automatic switching mechanism greatly improves the fault tolerance and fault response capabilities of the system.

[0119] In addition, in the first working mode, the main controller and the redundant controller simultaneously collect vehicle information and plan computing power, that is, under normal operating conditions, the main controller and the redundant controller are jointly responsible for all dynamic driving tasks of ADS. Although the redundant controller does not directly control the actuator at this time, it also performs real-time data analysis and processing while serving as a backup. This parallel processing method helps the redundant controller to quickly and accurately take over the control task when the main controller fails, thereby avoiding interruption or delay of the autonomous driving task.

[0120] Third, saving resources and costs: In the system provided by the present invention, the main controller board and the redundant controller board are connected through an inter-board connector, and the main controller and the redundant controller are jointly connected to the sensor system and the actuator system to share computing resources, sensor resources, and vehicle motion actuator resources, thereby avoiding the separate deployment of a set of redundant sensor resources and actuator resources. Compared with the two completely independent sensor and controller systems currently used to achieve redundancy, this design scheme can save a set of sensor and actuator systems, thereby saving resources and reducing cost overhead.

[0121] Fourth, improve the flexibility and scalability of the system: The system architecture of the present invention is flexible and easy to expand or adjust according to actual needs. For example, more sensors or actuators can be added to improve the perception and execution capabilities of the system; or the computing performance and intelligence level of the system can be improved by upgrading the hardware and software of the controller board.

[0122] In another embodiment, the vehicle automatic driving redundant system provided by the present invention also supports L2 assisted driving control. Specifically, assuming an L2 assisted driving control system, the system only includes a main controller board, and sensors and actuators are connected to the main controller SOC1 on the main controller board, and the DDT is completed by the main controller SOC1 alone.

[0123] Specifically, the system block diagram is as follows: Figure 4 As shown, under the L2 assisted driving control system (referred to as "L2 system"), the main controller connects to at least one sensor of the sensor system, and connects to at least one vehicle motion actuator in the actuator system through the first MCU; the main controller controls at least one vehicle motion actuator to perform the autonomous driving task based on the perception result of at least one sensor and the planned computing power. At this time, the redundant controller and the second MCU on the redundant controller board are on standby and do not start working, that is, the redundant controller board does not need to start working.

[0124] In the L2 system, the main controller SOC1 accesses all sensors in the sensor system and all vehicle motion actuators in the actuator system, and performs path planning and vehicle operation control based on the perception results reported by all connected sensors. In this working mode, SOC1 mainly runs the perception and planning software, and MCU1 runs the control software. In addition, multiple deserializers are used to access cameras or sensors, and at least one actuator and millimeter wave radar in the actuator system are accessed through CAN_PHY (CAN bus physical layer).

[0125] In the L2 system, a group of vehicle motion actuators are generally provided to communicate with the main controller SOC1 through 1-2 CAN buses. In addition, only one main power supply is required to output power to the main controller SOC1 and MCU1 on the main controller board.

[0126] In this embodiment, self-driving control is implemented under the dual systems of ADS system and L2 assisted driving system, making the vehicle's automatic driving redundant control system more functional and adaptable.

[0127] In another embodiment of the present invention, a vehicle automatic driving redundant control method is also provided, which is applied to the above Figure 1 or Figure 2 The vehicle autonomous driving redundant system shown in Figure 5 FIG. 1 is a flow chart of a redundant control method for automatic driving of a vehicle according to an embodiment of the present invention. The control method includes:

[0128] Step S101: Under the vehicle automatic driving system, detect whether the system design operation triggers a degradation condition.

[0129] Specifically, in the ADS system, whether the design operating condition ODC triggers the degradation condition can be determined by mutual detection between MCU1 and MCU2, or by the main controller SOC1 and the redundant controller SOC2 during the communication process.

[0130] Furthermore, the conditions for determining whether a degradation is triggered include: failure of a main controller or a redundant controller; failure of a circuit module, connection wiring or signal transmission on the main controller board or the redundant controller board; failure of any one or more sensors in the sensor system; failure of any one or more vehicle motion actuators in the actuator system; failure of the vehicle's chassis system; or one or more of the power supply unit failures in the system.

[0131] Step S102: If no, that is, no system failure or malfunction is detected, the first working mode is executed. In the first working mode, the main controller collects vehicle information through the first sensor group and the redundant controller collects vehicle information through the second sensor group.

[0132] Step S103: The main controller sends a first control instruction to the first actuator group and a second control instruction to the second actuator group according to the vehicle information and the first computing power jointly planned by the two controllers, so as to coordinate the two actuator groups to jointly perform the autonomous driving task.

[0133] The specific implementation process is the same as the description of the “first working mode” in the aforementioned embodiment. Please refer to the aforementioned embodiment and will not be repeated here.

[0134] Optional, such as Figure 6 As shown, after the above steps S101 to S103, the following further includes: in the first working mode, MCU1 and MCU2 mutually detect in real time whether the ODC triggers a degradation condition, that is, executing step S101.

[0135] Step S104: If yes, the first working mode is switched to the second working mode, and the failed or malfunctioning part of the controller connection control is disconnected.

[0136] Step S105: In the second working mode, the controller that is not disconnected generates and sends a third control instruction to the corresponding actuator group based on the vehicle information collected by its corresponding sensor group and the planned second computing power to perform the backup autonomous driving task.

[0137] The second computing power is less than the first computing power. In addition, the standby autonomous driving task is a continuation of the autonomous driving task in the aforementioned step S103.

[0138] In a specific example, when SOC1 fails and is disconnected, it switches to the second working mode, and the redundant controller SCO2 takes over the control authority. The redundant controller SCO2 generates and sends a third control instruction to the second actuator group based on the vehicle information collected by the second sensor group and the planned second computing power, so as to cooperate with the second execution group to continue to perform the autonomous driving task.

[0139] Similarly, in step S101, if a triggering condition for degradation is detected, but it is determined that a fault or failure occurs on the redundant controller board, such as a SOC2 fault or an MCU2 fault, the degradation operation is still performed at this time, and the main controller SOC1 and MCU1 execute MRM according to the planned second computing power control. At the same time, the circuit control actuator and sensor data collection on the redundant controller board are cut off or shut down.

[0140] In the control method of this embodiment, the controller in the L2 assisted driving system can completely reuse the main controller module in the ADS system, but the number of connected sensors and actuators is different. Therefore, a complete modular and platform design can be achieved.

[0141] Specifically, the software control aspect includes the following steps for using and allocating computing resources:

[0142] In the first working mode, the main controller and the redundant controller jointly run the main software stack to execute the first working mode according to the planned first computing power, and at the same time, use the second computing power to start the hot standby software stack, which is used to start and execute the automatic driving task when the degradation condition is triggered. When the degradation condition is triggered, the first working mode is downgraded to the second working mode. In the second working mode, the controller that is not disconnected starts and runs the hot standby software stack according to the vehicle information collected by its corresponding sensor group and the planned second computing power, sends the third control instruction, and stops the work of the first computing power, that is, stops running the main software stack.

[0143] For example Figure 7As shown, when the main software stack starts running, the first computing power is a first percentage of the total computing resources, such as 80%; the total computing resources include the sum of the computing resources of the main controller SOC1 and the computing resources of the redundant controller SOC2. When the hot standby software stack starts running, the second computing power is a second percentage of the total computing resources, such as 20%, and the first percentage is greater than the second percentage, such as 80%>20%.

[0144] In this embodiment, computing resources are partitioned in two SOCs, the main controller and the redundant controller:

[0145] Most of the computing resources in the two SOCs (e.g. 80%, which can be adjusted dynamically as needed) are used to run the normal task software stack (main software stack) to support the vehicle's full autonomous driving DDT. A small portion of the computing resources in the two SOCs (e.g. 20%, which can be adjusted dynamically as needed) run a hot standby task software stack in the background to support the degraded autonomous driving DDT under MRM.

[0146] When all systems are working normally, for example, in the first working mode, the first computing power is used to run the main software stack to control the driving of the vehicle; when a single point failure occurs in any controller, sensor, actuator, power supply unit, communication unit, line, etc. in the main controller board or redundant controller board, the execution of the main software stack is stopped and switched to the hot standby task in the subsystem where the failure has not occurred, that is, the hot standby software stack is started and run using the second computing power to continue controlling the vehicle to complete the MRM downgrade DDT and finally achieve safe parking.

[0147] In this embodiment, in the hot standby software stack, since it is necessary to ensure lateral and longitudinal vehicle control, it is actually equivalent to realizing a complete set of L2 system functions, or the intelligent driving software developed for the L2 system can be reused without redevelopment and reused on the original software, thereby effectively reducing the BOM cost and development cost of the ADS system.

[0148] Optionally, in another specific embodiment, as Figure 8 As shown, the method also includes:

[0149] Step S201: Under the L2 assisted driving system, the main controller connects at least one sensor of the sensor system, and connects at least one vehicle motion actuator in the actuator system through the first MCU.

[0150] Step S202: The main controller controls at least one vehicle motion actuator to perform the autonomous driving task according to the perception result of at least one sensor and the planned third computing power. The third computing power can be a third percentage of the total computing resources, such as 70% to 90%.

[0151] At this time, the redundant controller SOC2 and the second MCU on the redundant controller board are ready to standby.

[0152] The method provided in this embodiment realizes computing resource sharing and sensor reuse in software. In an ADS system or L2 system, when both the main controller and the redundant controller are working normally, all computing power and sensor resources can be fully used for DDT, making the best use of all resources to achieve the best performance indicators. In traditional solutions, redundant controllers and sensors are usually completely silent or hot standby during normal dynamic driving tasks, and their resources cannot be fully used by normal DDT, which will lead to a waste of some computing resources.

[0153] In hardware implementation, in the system provided by the above embodiment of the present invention, the main controller SOC1 or the redundant controller SOC2 may further include: one or more processors 10 and a memory 20. Fig. 9 FIG. 1 is a schematic diagram of a hardware structure of a controller. In addition, the controller may further include at least one communication interface 30 .

[0154] Among them, at least one communication interface 30 includes a high-speed interface and a low-speed interface. The various components are connected to each other using different buses and can be installed on a common motherboard or in other ways as needed. The processor can process instructions executed in the controller SOC1 or SOC2, including instructions stored in or on the memory to display graphical information of the GUI on an external input / output device (such as a display device coupled to the interface).

[0155] In some optional embodiments, multiple processors and / or multiple buses can be used with multiple memories and multiple storages if desired. Similarly, multiple modules or circuits can be connected, with each device providing part of the necessary operations (e.g., as a server array, a group of blade servers, or a multi-processor system). Fig. 9 A processor 10 is taken as an example.

[0156] The processor 10 may be a central processing unit (CPU), a network processor or a combination thereof. The processor 10 may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0157] Among them, the memory 20 stores instructions that can be executed by at least one processor 10, so that the at least one processor 10 executes the vehicle automatic driving redundant control method shown in the above embodiment.

[0158] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created according to the use of the main controller or the redundant controller, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the autonomous driving redundant system via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0159] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory. In addition, the at least one communication interface 30 is used for the controller to communicate with other devices or controller modules.

[0160] It should be noted that the internal modules or circuit compositions of the above-mentioned main controller board and redundant controller board may have different schemes, including but not limited to a single SOC, a single MCU, a single switch, etc. In addition, the access methods of sensors and vehicle motion actuators are not limited to deserializers, CAN_PHY, Ethernet, etc.

[0161] In addition, the sensor grouping access schemes of the primary controller and the redundant controller may also be different, with the grouping being customized by the system.

[0162] In addition, in addition to the actuator system, the above-mentioned vehicle autonomous driving redundant system may also include other vehicle systems, including but not limited to the chassis system (steering system, braking system) and the power supply system, and may also include the body system, DSSAD (Data Storage System for Automated Driving, data storage system for autonomous driving vehicles), networking system, etc., which is not limited in this embodiment.

[0163] In addition, an embodiment of the present invention further provides a vehicle, such as Fig.10 As shown, the vehicle includes a redundant system. Specifically, the redundant system is as described above. Figure 1 or Figure 2 The vehicle autonomous driving redundant system is shown. In addition, the vehicle may also include other systems or devices.

[0164] Among them, the vehicle automatic driving redundant system is used to perform the above Figure 5 , Figure 6 or Figure 8 The redundant control method for vehicle autonomous driving is shown.

[0165] The vehicle provided in this embodiment adopts a vehicle automatic driving redundant system, in which the main controller board and the redundant controller board together constitute the controller of the ADS system, and the main controller board alone constitutes the controller of the L2 assisted driving system. Under normal operating conditions, the main controller and the redundant controller are jointly responsible for the DDT of the ADS. When the downgrade adjustment is triggered and downgraded to the second working mode, any non-failed controller can independently run the DDT under the MRM and continue to perform the automatic driving task.

[0166] An embodiment of the present invention also provides a computer-readable storage medium, and the above-mentioned method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented by downloading through a network and originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware.

[0167] The storage medium may be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid state drive, etc.; further, the storage medium may also include a combination of the above-mentioned types of memories. It is understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by the computer, processor or hardware, the redundant control method shown in the above embodiment is implemented.

[0168] Embodiments of the present application may also provide a computer program product, including computer program instructions, which, when executed by a processor, cause the processor to perform the steps in the above method. Wherein, the computer program product may be written in any combination of one or more programming languages ​​to perform program codes for performing the operations of the disclosed embodiments, wherein the programming languages ​​include object-oriented programming languages, such as Java, C++, etc., and also include conventional procedural programming languages, such as "C" language or similar programming languages. The program code may be executed entirely on a user computing device, partially on a user device, as an independent software package, partially on a user computing device, partially on a remote computing device, or entirely on a remote computing device or server.

[0169] The above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, rather than to limit them. Although the embodiments of the present invention are described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some of the technical features therein by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A vehicle automatic driving redundant system, characterized in that: The system comprises: a main controller board, a redundant controller board, a sensor system, and an actuator system; wherein the main controller board comprises a main controller, the redundant controller board comprises a redundant controller, the multiple sensors in the sensor system are divided into a first sensor group and a second sensor group, the multiple vehicle motion actuators in the actuator system are divided into a first actuator group and a second actuator group, and the two actuator groups are redundant with each other; The main controller is connected to the first sensor group and the first actuator group respectively, and the redundant controller is connected to the second sensor group and the second actuator group respectively; the main controller and the redundant controller are connected via an inter-board connector; The operating mode of the system includes a first working mode and a second working mode; Wherein, in the first working mode, the main controller collects vehicle information and the first computing power jointly planned by the two controllers through the first sensor group, and the redundant controller collects vehicle information and the first computing power jointly planned by the two controllers through the second sensor group, and the main controller sends a first control instruction to the first actuator group, and sends a second control instruction to the second actuator group, so as to coordinate the two actuator groups to jointly perform the automatic driving task; When a triggering degradation condition is detected, the first operating mode is switched to the second operating mode, and the failed or faulty controller connection control is disconnected; In the second working mode, the controller that is not disconnected generates and sends a third control instruction to the corresponding actuator group based on the vehicle information collected by its corresponding sensor group and the planned second computing power to perform the backup autonomous driving task, and the second computing power is less than the first computing power.

2. The system according to claim 1, characterized in that In the first working mode, the main controller receives vehicle information collected from the first sensor group, and the redundant controller receives vehicle information collected from the second sensor group, and reports it to the main controller through the inter-board connector; Furthermore, the main controller runs the main software stack according to the first computing power based on the vehicle information collected by itself and the vehicle information reported by the redundant controller, and sends the first control instruction to the first actuator group, and sends the second control instruction to the second actuator group.

3. The system according to claim 2, characterized in that In the first working mode, the main controller and the redundant controller further detect each other to see whether a degradation condition is triggered; If so, the degradation is initiated, and one of the main controller and the redundant controller is selected to continue working as the target controller, cooperating with the first actuator group or the second actuator group to independently perform the autonomous driving task, and the target controller is the controller that is not disconnected.

4. The system according to claim 3, characterized in that The downgrade triggering conditions include one or more of the following: The main controller or the redundant controller fails; A circuit module, connection wiring or signal transmission on the main controller board or the redundant controller board fails; Any one or more sensors in the sensor system fail; Failure of any one or more vehicle motion actuators in the actuator system; Failure of the vehicle's chassis system; A power supply unit in the system is faulty.

5. The system according to claim 4, characterized in that The main controller board also includes a first microcontroller, and the redundant controller board also includes a second microcontroller; The first microcontroller is connected to the main controller and the second microcontroller respectively, and the second microcontroller is also connected to the redundant controller; When the first microcontroller detects that an abnormality occurs in the main controller, the first microcontroller sends an indication signal to the second microcontroller and notifies the main controller to transfer the control authority to the redundant controller; When receiving the indication signal from the first microcontroller, the second microcontroller notifies the redundant controller to take over the control authority, so that the redundant controller performs the backup automatic driving task through the second sensor group and the second actuator group.

6. The system according to claim 1, characterized in that In the first working mode, the main controller and the redundant controller start the hot standby software stack according to the planned second computing power, and the hot standby software stack is used to start and execute the autonomous driving task when the degradation condition is triggered.

7. The system according to any one of claims 1 to 6, characterized in that: The number of sensors included in the first sensor group is n1, the number of sensors included in the second sensor group is n2, and n1≥1, n2≥1; The detection range of the n1 sensors covers a 360° viewing angle of the vehicle, and the detection range of the n2 sensors covers a 360° viewing angle of the vehicle.

8. The system according to claim 5, characterized in that The system also includes a first CAN bus and a second CAN bus; The first CAN bus and the second CAN bus are used to connect the first actuator group with the main controller, and to connect the second actuator group with the redundant controller.

9. A redundant control method for automatic driving of a vehicle, characterized in that: The method comprises: Under the vehicle's automated driving system, detect whether the system design operation triggers degradation conditions; If not, a first working mode is executed, in which the main controller collects vehicle information through the first sensor group and the redundant controller collects vehicle information through the second sensor group; The main controller sends a first control instruction to the first actuator group and a second control instruction to the second actuator group according to the vehicle information and the first computing power jointly planned by the two controllers, so as to coordinate the two actuator groups to jointly perform the autonomous driving task.

10. The method according to claim 9, characterized in that The method further comprises: If yes, the first working mode is switched to the second working mode, and the failed or faulty controller connection control is disconnected; In the second working mode, the controller that is not disconnected generates and sends a third control instruction to the corresponding actuator group based on the vehicle information collected by its corresponding sensor group and the planned second computing power to perform the backup autonomous driving task, and the second computing power is less than the first computing power.

11. The method according to claim 9, characterized in that The method further comprises: In the first working mode, the main controller and the redundant controller start the hot standby software stack according to the planned second computing power, and the hot standby software stack is used to start and execute the autonomous driving task when the degradation condition is triggered.

12. The method according to claim 10, characterized in that In the second working mode, the controller that is not disconnected generates and sends a third control instruction to the corresponding actuator group according to the vehicle information collected by the corresponding sensor group and the planned second computing power, including: In the second working mode, the redundant controller starts and runs the hot standby software stack based on the vehicle information collected by the second sensor group and the normally operating modules on the main controller board, sends the third control instruction, and stops the operation of the first computing power.

13. The method according to claim 12, characterized in that The first computing power is a first percentage of total computing resources, used to run the main software stack in the first working mode; wherein the total computing resources include the sum of the computing resources of the main controller and the computing resources of the redundant controller; The second computing power is a second percentage of the total computing resources, which is used to run the hot standby software stack in the second working mode, and the first percentage is greater than the second percentage.

14. A vehicle, characterized in that: The vehicle includes a redundant system; The redundant system is a vehicle automatic driving redundant system as claimed in any one of claims 1 to 8; The vehicle autonomous driving redundant system is used to execute the vehicle autonomous driving redundant control method as described in any one of claims 9 to 13.

Images