A cabin-driving fusion redundancy system and method based on dynamic resource scheduling
The cabin-driver fusion redundancy system with dynamic resource scheduling solves the problems of insufficient perception and response delay in intelligent vehicles under adverse weather or complex scenarios, and achieves high reliability, low latency, safe takeover and improved resource utilization, meeting the real-time and safety requirements of advanced autonomous driving.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- WUHAN JIANGXIA CHUNENG AUTOMOBILE TECHNOLOGY R&D CO LTD
- Filing Date
- 2026-04-03
- Publication Date
- 2026-07-03
AI Technical Summary
Existing intelligent vehicle redundant control systems suffer from insufficient perception capabilities, large response delays, and low hardware resource utilization in adverse weather or complex scenarios, failing to meet the real-time and safety requirements of advanced autonomous driving.
A cockpit-driving fusion redundancy system based on dynamic resource scheduling is adopted. A dual-path heterogeneous redundancy access is constructed through an intelligent sensor hub. Combined with a shared memory pool and a dynamic resource scheduling kernel, the virtualization and rapid reallocation of computing resources are realized, ensuring that the intelligent cockpit domain controller takes over when the intelligent driving domain controller fails.
It achieves highly reliable and seamless secure takeover, reduces takeover latency to less than 100 milliseconds, improves hardware resource utilization, reduces system costs, and enhances system robustness and functional safety.
Smart Images
Figure CN122331397A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of intelligent vehicle electronic and electrical architecture technology, specifically to a redundant control system and method for intelligent driving, and more particularly to a cabin-driver fusion redundant system and method based on dynamic resource scheduling. Background Technology
[0002] As automotive intelligence advances towards Level 3 and above autonomous driving, system functional safety has become a core challenge. Currently, intelligent vehicles generally adopt an architecture that separates the intelligent cockpit domain controller (ICC) and the intelligent driving domain controller (DDC). Under this architecture, when the DDC fails, the ICC typically takes over. However, existing redundancy solutions have significant shortcomings.
[0003] First, to ensure cost control, takeover systems typically only connect to a single type of sensor (such as a forward-facing camera), resulting in severely insufficient perception capabilities in adverse weather or complex scenarios, posing safety risks. Second, the slow failure detection, task switching, and data migration processes lead to an overall takeover latency often exceeding 500 milliseconds, failing to meet the real-time safety requirements of high-speed scenarios. Finally, the fixed allocation and isolation of computing resources in existing dual-domain controllers result in idle computing power for the smart cabin domain controllers under normal conditions, while during takeover, insufficient computing power may force a significant reduction in functional performance, leading to low resource utilization and high costs.
[0004] Therefore, there is an urgent need for an intelligent driving redundancy solution that can achieve rapid, seamless, and highly reliable takeover and efficiently utilize hardware resources. Summary of the Invention
[0005] In view of this, the present invention aims to provide a cabin-pilot fusion redundancy system and method based on dynamic resource scheduling, so as to solve the problems of weak perception capability, large response delay and low hardware resource utilization in the existing takeover system.
[0006] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides a cabin-pilot fusion redundancy system based on dynamic resource scheduling, comprising: Intelligent driving domain controller, used to run autonomous driving functions; The intelligent cockpit domain controller is communicatively connected to the intelligent driving domain controller. Multiple environmental sensing sensors; as well as, A smart sensor hub, connected to the plurality of environmental perception sensors, is used to receive raw data from the sensors and has a first data channel and a second data channel; the first data channel is used to transmit the raw data to the smart driving domain controller; the second data channel is used to transmit the feature data generated after preprocessing the raw data to the smart cockpit domain controller. A shared memory pool is provided, and the intelligent driving domain controller and the intelligent cockpit domain controller access the shared memory pool through a high-speed interconnection protocol. The intelligent driving domain controller is used to write the intermediate perception feature data generated during processing into the shared memory pool. The dynamic resource scheduling kernel is used to virtualize the computing resources of the intelligent driving domain controller and the intelligent cockpit domain controller into a unified resource pool, and when an abnormal operating status of the intelligent driving domain controller is detected, it triggers resource reallocation, dynamically scheduling the computing resources in the resource pool from the intelligent driving domain controller to the intelligent cockpit domain controller. Upon triggering the resource reallocation, the intelligent cockpit domain controller is configured to read the intermediate perception feature data from the shared memory pool and perform environmental perception and vehicle control tasks based on the feature data and the intermediate perception feature data.
[0007] Preferably, the system further includes a safety microcontroller; the safety microcontroller is used to monitor the operating status of the intelligent driving domain controller and arbitrate the consistency of data transmitted by the multiple environmental perception sensors through the first data channel and the second data channel; the dynamic resource scheduling kernel detects an abnormal operating status by receiving an abnormal status indication from the safety microcontroller.
[0008] Preferably, the intelligent driving domain controller, the intelligent cockpit domain controller, and the safety microcontroller are integrated on the same hardware substrate using advanced packaging technology and interconnected via the PCIe CXL protocol to form the shared memory pool.
[0009] Preferably, the dynamic resource scheduling kernel is configured to: pre-allocate a first proportion of computing resources to the intelligent cockpit domain controller when the intelligent driving domain controller is operating normally, in order to run monitoring tasks; when an abnormal operating state is detected and system takeover needs to be triggered, increase the computing resources allocated to the intelligent cockpit domain controller from the first proportion to a second proportion within a predetermined time, wherein the second proportion is greater than the first proportion.
[0010] Preferably, the monitoring task includes: running a lightweight perception model to process the feature data, and performing a consistency comparison between the processing result and the intermediate perception feature data read from the shared memory pool.
[0011] Preferably, the intelligent cockpit domain controller has a pre-installed lightweight world model, which is used to generate environmental state prediction data based on historical perception data when an interruption in communication with the intelligent driving domain controller is detected.
[0012] Secondly, this invention provides a cabin-riding fusion redundancy method based on dynamic resource scheduling, applied to the system described above, the method comprising: The intelligent sensor hub transmits raw data from the environmental perception sensor to the intelligent driving domain controller via the first data channel, and transmits preprocessed feature data to the intelligent cockpit domain controller via the second data channel. The raw data is processed by the intelligent driving domain controller, and the intermediate perception feature data generated by the processing is written into the shared memory pool; The computing resources of the intelligent driving domain controller and the intelligent cockpit domain controller are virtualized into a resource pool for management through the dynamic resource scheduling kernel. Monitor the operating status of the intelligent driving domain controller; When an abnormal operating status is detected, resource reallocation is triggered, and the computing resources in the resource pool are dynamically scheduled from the intelligent driving domain controller to the intelligent cockpit domain controller. After resource reallocation, the intelligent cockpit domain controller reads the intermediate perception feature data from the shared memory pool and performs environmental perception and vehicle control tasks based on the feature data and the intermediate perception feature data.
[0013] Preferably, before detecting an abnormal operating status, the method further includes: pre-allocating a first proportion of computing resources to the intelligent cockpit domain controller; controlling the intelligent cockpit domain controller to run a monitoring task using the first proportion of computing resources, the monitoring task including: processing the feature data, and performing a consistency comparison between the processing result and the intermediate sensing feature data read from the shared memory pool.
[0014] Preferably, monitoring the operating status of the intelligent driving domain controller includes receiving an abnormal status indication from a safety microcontroller, which is used to monitor the operating status of the intelligent driving domain controller and arbitrate the consistency of sensor data.
[0015] Preferably, the method further includes: when a communication interruption is detected between the intelligent cockpit domain controller and the intelligent driving domain controller, controlling the intelligent cockpit domain controller to start a preset lightweight world model; generating environmental state prediction data for a future period based on historical perception data through the lightweight world model; and executing vehicle control decisions based on the environmental state prediction data.
[0016] The beneficial effects of this invention are: Achieving highly reliable and real-time safe takeover: By constructing a dual-path heterogeneous redundant access for raw and feature data through an intelligent sensor hub, the dependence on a single sensor link is fundamentally resolved. This ensures that the takeover system still possesses reliable multi-dimensional environmental perception capabilities even when the intelligent driving domain control or any data channel fails. Combined with a "feature relay" mechanism implemented through a shared memory pool and millisecond-level resource switching by a dynamic resource scheduling kernel, the overall system takeover latency is reduced from hundreds of milliseconds in existing solutions to less than 100 milliseconds, meeting the real-time requirements for safe takeover in high-speed scenarios for advanced autonomous driving.
[0017] This significantly improves hardware resource utilization and optimizes system costs: By pooling computing resources for intelligent driving and intelligent cabin domain control through virtualization technology and dynamically scheduling them based on operational status, it breaks down the barrier of fixed computing power allocation in traditional solutions. It achieves a flexible resource utilization mode of "normal low-power monitoring and instant expansion in case of failure," providing complete backup computing power without the need for additional redundant computing chips. This significantly reduces system hardware material costs while improving resource utilization efficiency.
[0018] This solution significantly enhances the overall robustness and functional safety of the system: by introducing an independent safety microcontroller for hardware-level deterministic monitoring and combining it with intelligent fault monitoring strategies at the software layer, a multi-layered, cross-dimensional system health status arbitration system is constructed. Furthermore, a lightweight world model prediction and compensation mechanism designed to address extreme scenarios such as communication interruptions provides ultimate safety assurance for the system. These designs work together to enable the system to readily handle various abnormal conditions, ranging from gradual performance degradation to complete failure and even communication interruptions, significantly expanding the system's safe operating boundaries and meeting the high-level requirements of automotive functional safety. Attached Figure Description
[0019] Figure 1 A schematic diagram of a cabin-riding fusion redundancy system based on dynamic resource scheduling is provided in an embodiment of the present invention; Detailed Implementation The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0020] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the stated features. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.
[0021] In the description of this application, the term "for example" is used to mean "used as an example, illustration, or description." Any embodiment described as "for example" in this application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use the invention. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that the invention can be made without using these specific details. In other instances, well-known structures and processes will not be described in detail to avoid obscuring the description of the invention with unnecessary detail. Therefore, the invention is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed in this application.
[0022] Example 1 Figure 1 This is a schematic diagram of a cabin-riding fusion redundancy system based on dynamic resource scheduling, provided as an embodiment of the present invention. Figure 1 As shown, this embodiment of the invention provides a cockpit-driving fusion redundancy system based on dynamic resource scheduling, including: an intelligent driving domain controller, an intelligent cockpit domain controller, multiple environmental perception sensors, an intelligent sensor hub, a shared memory pool, and a dynamic resource scheduling kernel.
[0023] Intelligent driving domain controllers (Intelligent driving SoCs, such as NVIDIA Orin) are used to run autonomous driving functions.
[0024] The intelligent cockpit domain controller (intelligent cockpit SoC, such as Qualcomm SA8295) is communicatively connected to the intelligent driving domain controller.
[0025] Multiple environmental sensing sensors, including cameras, millimeter-wave radar, lidar, etc.
[0026] A smart sensor hub, connected to the plurality of environmental perception sensors, is used to receive raw data from the sensors and has a first data channel and a second data channel; the first data channel is used to transmit the raw data to the smart driving domain controller; the second data channel is used to transmit the feature data generated after preprocessing the raw data to the smart cockpit domain controller.
[0027] This intelligent sensor hub features dual independent output capabilities. It directly connects to various environmental sensing sensors such as cameras, millimeter-wave radar, and lidar. Internally, the hub can integrate an image signal processor (ISP), a programmable logic array (such as an FPGA), or a dedicated neural network processing unit.
[0028] The first data channel serves as the main processing channel, directly connecting the raw data streams from the sensors (such as RAW images and ADC sampled point clouds) to the intelligent driving domain controller via a high-bandwidth, low-latency serial link (e.g., FPD-Link III, MIPI CSI-2). This channel provides a lossless or low-loss data source for the deep fusion algorithms of the intelligent driving domain controller.
[0029] The second data channel, serving as a redundancy / feature channel, preprocesses the raw data within the hub. This includes tasks such as noise reduction and correction of images, clustering of radar point clouds, or running a lightweight convolutional neural network for preliminary target detection and feature extraction. The resulting structured feature data (e.g., target lists, feature vectors) or compressed low-level feature maps are then transmitted to the smart cabin domain controller via a reliable bus such as Time-Sensitive Networking (TSN) Ethernet. Under normal circumstances, this channel serves as a monitoring source; during takeover, it becomes one of the core sensing inputs.
[0030] A shared memory pool is provided, with the intelligent driving domain controller and the intelligent cockpit domain controller connected via a high-speed interconnect protocol supporting cache coherency (such as PCIe 5.0 with CXL). System software (such as the Hypervisor or system firmware) can configure and map a globally shared physical memory region. The intelligent driving domain controller has read and write permissions to this region, while the intelligent cockpit domain controller is normally granted read-only permissions. This shared memory pool is typically organized as a ring buffer with timestamps and cyclic redundancy checks. The intelligent driving domain controller sequentially writes processed "intermediate perception feature data" (e.g., feature maps extracted from the backbone network, target attribute lists, etc.) and marks the write completion status. The system software can verify the validity of the data to ensure that the intelligent cockpit domain controller reads the latest and valid data snapshot.
[0031] The dynamic resource scheduling kernel, typically implemented based on a Type-1 Hypervisor, is primarily responsible for resource abstraction and intelligent scheduling. It mainly virtualizes the computing resources of the intelligent driving domain controller and the intelligent cockpit domain controller into a unified resource pool. When an abnormal operating state of the intelligent driving domain controller is detected, it triggers resource reallocation, dynamically scheduling computing resources from the intelligent driving domain controller to the intelligent cockpit domain controller. Upon triggering the resource reallocation, the intelligent cockpit domain controller is configured to read the intermediate perception feature data from the shared memory pool and perform environmental perception and vehicle control tasks based on the feature data and the intermediate perception feature data.
[0032] Preferably, the dynamic resource scheduling kernel is configured to: pre-allocate a first proportion of computing resources to the intelligent cockpit domain controller when the intelligent driving domain controller is operating normally, to maintain the intelligent cockpit domain controller's monitoring tasks; when an abnormal operating state is detected requiring system takeover, increase the computing resources allocated to the intelligent cockpit domain controller from the first proportion to a second proportion within a predetermined time, where the second proportion is greater than the first proportion. For example, when the intelligent driving domain controller is operating normally, 10% of the computing resources are pre-allocated to the intelligent cockpit domain controller, while the intelligent driving domain controller exclusively uses 90% of the computing resources. When an abnormal operating state is detected requiring system takeover, the computing resources of the intelligent cockpit domain controller are increased to 80%.
[0033] Through dynamic resource scheduling, "elastic reservation" and "millisecond-level rapid expansion" of computing resources are achieved. Under normal circumstances, monitoring is maintained with minimal overhead, and all redundant computing power is released instantly in the event of failure. While ensuring seamless takeover performance, this greatly improves the average utilization efficiency of hardware resources and avoids the waste caused by fixed resource allocation.
[0034] When performing monitoring tasks, the intelligent cockpit domain controller includes: running a lightweight perception model to process the feature data, and comparing the processing result with the intermediate perception feature data read from the shared memory pool. By processing the feature data through a lightweight model and cross-validating it with the high-precision intermediate results of the main system, data anomalies or algorithm deviations can be detected early and with low overhead, creating conditions for preventive warnings or smooth switching.
[0035] It should be understood that the lightweight perception model running on the intelligent cockpit domain controller is not a separately designed small model. It is the complete autonomous driving perception model that routinely runs on the intelligent driving domain controller. This model is typically a deep, multimodal fusion neural network, such as a Transformer architecture based on BEV (bird's-eye view) (e.g., BEVFormer), or a complex camera-LiDAR fusion network. Its characteristics include high accuracy and comprehensive functionality, capable of fine-grained object detection, segmentation, tracking, and semantic understanding, but it also requires enormous computing resources (consuming significant NPU computing power and memory) and runs on an intelligent driving SoC (e.g., Orin). The lightweight perception model running on the intelligent cockpit domain controller, however, is derived from the complete autonomous driving perception model that routinely runs on the intelligent driving domain controller through model compression and knowledge transfer techniques (especially knowledge distillation).
[0036] Training Phase (Distillation): During the offline training phase, the "full model" from the intelligent driving domain control system is used as the teacher model, and a small network architecture (such as a simplified convolutional neural network or a miniature Transformer) is used as the student model. By allowing the "student model" to learn and imitate the output of the "teacher model" on a large amount of training data (not only the final result, but also the feature distribution or attention relationship of the intermediate layers), the knowledge of the "teacher model" is "distilled" into the "student model".
[0037] Inference Phase (Deployment and Operation): After training, the resulting "student model" is the lightweight perception model. Its model size and computational complexity can be reduced to less than 30% of the full model, with accuracy loss controlled within a very small range (e.g., <2%). This model is deployed on the intelligent cockpit domain controller.
[0038] Under normal circumstances, it takes the aforementioned "feature data" as input, runs monitoring tasks, and generates rapid, preliminary perception results.
[0039] After takeover: It uses intermediate features obtained from the shared memory pool as input to continue high-confidence environmental perception. Its lightweight nature ensures that it can still run in real time and meet the performance requirements after takeover, even with the relatively limited computing power of the smart cabin SoC.
[0040] Preferably, the intelligent cockpit domain controller is pre-installed with a lightweight world model. This lightweight world model is used to generate environmental state prediction data based on historical perception data when a communication interruption with the intelligent driving domain controller is detected. This preferred approach provides the system with the "ultimate" safety capability to cope with the extreme edge scenario of complete communication interruption. By using short-term trajectory prediction based on historical data, the system can still make reasonable and conservative decisions even after becoming an "information island," greatly expanding the system's safe operating boundaries.
[0041] The "lightweight world model" deployed in the vehicle's intelligent cockpit domain control is a version obtained by compressing and optimizing the "full world model" using model compression techniques (such as pruning, quantization, and distillation). The "full world model" refers to a complex generative world model trained on a massive trajectory dataset. It may be based on a diffusion model, variational autoencoder, or recurrent neural network, capable of generating multiple probabilistic trajectories for scene evolution within the next few seconds, conditioned on historical states. The full model has numerous parameters and high prediction accuracy, but it has a large computational load and is typically used for offline simulation or cloud training. The lightweight world model sacrifices some prediction diversity and long-term accuracy in exchange for operability on the vehicle's embedded platform. Its core capability is to perform short-term (e.g., 3-5 seconds in the future) real-time probabilistic trajectory extrapolation.
[0042] By employing advanced machine learning techniques such as knowledge distillation and model compression, the capabilities of the "full model" are transferred to a "lightweight model" that is suitable for vehicle-side resource constraints. This design ensures that the backup system (intelligent cockpit domain control) can still inherit the core intelligence (perception and prediction) of the main system (intelligent driving domain control) under limited hardware resources, thereby achieving a smooth downgrade and seamless connection from the high-performance main system to the high-efficiency backup system.
[0043] Preferably, the system further includes a security microcontroller; the security microcontroller is used to monitor the operating status of the intelligent driving domain controller and arbitrate the consistency of data transmitted by the multiple environmental perception sensors through the first data channel and the second data channel; when the operating status of the intelligent driving domain controller is abnormal, it sends an abnormal status indication to the dynamic resource scheduling kernel.
[0044] A safety microcontroller is a standalone hardware component that meets functional safety level (ASIL-D) requirements. Its key role is to perform deterministic monitoring and logic arbitration. Monitor the hardware heartbeat signal of the intelligent driving SoC (a most basic survival status signal).
[0045] Arbitration of dual-path data consistency: Here, "arbitration consistency" refers to a logical comparison at the functional safety level of the two data streams to determine the critical safety status or data validity reflected by the two streams, rather than a direct comparison of the heterogeneous original bitstreams. Specifically, this may include: a. Event trigger consistency: Monitor whether the processing results of the two data streams trigger the same key safety event flags (such as "forward collision warning" or "emergency braking request") within a preset time window.
[0046] b. Metadata verification: Verify whether the timestamps attached to the two data streams are synchronized, or whether the data validity flags are both normal.
[0047] c. Simplified semantic cross-validation: When simplified semantic information is available (such as the Boolean state "there is an obstacle directly in front" parsed from one source of data), it is compared with the basic security state derived from another source of data.
[0048] Its output is a simple, highly reliable abnormal state indication signal, which is sent directly to the dynamic resource scheduling kernel.
[0049] By introducing an independent safety microcontroller as a dedicated hardware safety monitoring unit, highly reliable hardware-level fault detection is provided. Its arbitration of dual-channel data "consistency" refers to verifying at the functional safety level whether the key logical states reflected by the two data channels (such as high-risk event triggering, data validity flags) conflict, thereby providing the system with deterministic anomaly triggering signals and significantly improving the reliability of takeover decisions.
[0050] The intelligent driving domain controller, intelligent cockpit domain controller, and safety microcontroller are integrated onto the same hardware substrate using advanced 2.5D / 3D packaging technology. They are integrated within the same packaging substrate via a silicon interposer, achieving ultra-short-distance (<1cm) interconnection. This advanced packaging enables ultra-short-distance chip interconnection, and combined with the memory pooling capabilities of the CXL protocol, it constructs a low-latency, high-bandwidth shared memory physical foundation. This provides crucial hardware support for subsequent sub-millisecond-level data context switching and is the core of reducing overall takeover latency.
[0051] Example 2 This invention provides a cabin-riding fusion redundancy method based on dynamic resource scheduling, applied to the system provided in Embodiment 1. The method includes: The intelligent sensor hub transmits raw data from the environmental perception sensor to the intelligent driving domain controller via the first data channel, and transmits preprocessed feature data to the intelligent cockpit domain controller via the second data channel. The raw data is processed by the intelligent driving domain controller, and the intermediate perception feature data generated by the processing is written into the shared memory pool; The computing resources of the intelligent driving domain controller and the intelligent cockpit domain controller are virtualized into a resource pool for management through the dynamic resource scheduling kernel. Monitor the operating status of the intelligent driving domain controller; When an abnormal operating status is detected, resource reallocation is triggered, and the computing resources in the resource pool are dynamically scheduled from the intelligent driving domain controller to the intelligent cockpit domain controller. After resource reallocation, the intelligent cockpit domain controller reads the intermediate perception feature data from the shared memory pool and performs environmental perception and vehicle control tasks based on the feature data and the intermediate perception feature data.
[0052] Specifically, this method can perform dynamic resource scheduling through the following workflow.
[0053] Routine operation and monitoring phase: Sensor data is distributed in two channels via a hub.
[0054] The intelligent driving domain controller processes raw data, outputs vehicle control commands, and continuously writes intermediate features into a shared memory pool.
[0055] The dynamic resource scheduling kernel pre-allocates a small portion of computing power (such as 10% of the NPU) to the smart cabin domain controller.
[0056] Under this computing power, the intelligent cabin domain controller runs monitoring tasks: loading a lightweight perception model to process the feature data received from the second channel, obtaining a simplified environmental perception result (result A). Simultaneously, it asynchronously reads the latest intermediate feature data (or its derived advanced results) written by the intelligent driving domain controller from the shared memory pool (result B). Result A and result B are then compared for consistency. Differences exceeding a threshold are recorded as potential anomalies.
[0057] The dynamic resource scheduling kernel can integrate a software fault monitoring and arbitration module. This module not only receives hardware instructions from the security MCU, but also runs a multi-level fault judgment algorithm. It comprehensively analyzes multi-dimensional indicators such as the intelligent driving domain controller's hardware heartbeat, computing load, task execution cycle, output confidence, and consistency comparison results of the above monitoring tasks to form an intelligent and comprehensive judgment on the health status of the intelligent driving domain controller, and can identify complex faults such as performance degradation.
[0058] Anomaly monitoring and triggering phase: Triggering condition 1 (hardware monitoring): The security microcontroller detects the loss of the intelligent driving domain control heartbeat, or determines that there is a serious security logic inconsistency between the two data streams, and then sends an abnormal status indication signal to the dynamic resource scheduling kernel.
[0059] Triggering condition 2 (software intelligent monitoring): The fault monitoring module within the dynamic resource scheduling kernel, based on a multi-index judgment algorithm, determines whether the intelligent driving domain control is malfunctioning or its performance is seriously substandard.
[0060] If any trigger condition is met, the system will determine that it needs to take over.
[0061] Dynamic scheduling and rapid takeover phase: Resource reallocation: The dynamic resource scheduling kernel executes the scheduling protocol within a very short time (<50ms): a) significantly increases the NPU computing power quota available to the smart cabin domain controller from the monitoring level (e.g., 10%) to the takeover level (e.g., 80%); b) through the Hypervisor and memory controller, switches the smart cabin domain controller's access permissions to specific areas in the shared memory pool from "read-only" to "read-write".
[0062] "Feature relay" perception recovery: The intelligent cockpit domain controller immediately loads its full-featured lightweight perception model. This model does not start processing from the raw data, but directly reads the last valid and complete intermediate feature tensor written in the shared memory pool before the intelligent driving domain controller failed. Using this as a starting point, it continues to execute subsequent network forward propagation, instantly outputting a complete environmental perception result. This approach skips the most time-consuming low-level feature extraction stage, achieving extremely fast response in the first processing cycle after takeover.
[0063] Extreme scenario compensation phase: If, during the takeover process, the system detects a complete interruption of the communication link with the intelligent driving domain controller, the final safety barrier will be activated.
[0064] The intelligent cabin domain control system initiates a pre-configured lightweight world model (such as one based on a recurrent neural network or a diffusion model). This model uses locally cached historical perception feature sequences as conditions to iteratively predict the probability distribution of multiple possible trajectories of traffic participants within the next few seconds.
[0065] Based on this "probabilistic future scenario," the planning and control module executes the most conservative safety strategy (such as smoothly decelerating to a stop) to ensure vehicle safety.
[0066] While embodiments or examples of this disclosure have been described with reference to the accompanying drawings, it should be understood that the methods, systems, and devices described above are merely exemplary embodiments or examples, and the scope of the invention is not limited by these embodiments or examples, but only by the granted claims and their equivalents. Various elements in the embodiments or examples may be omitted or replaced by their equivalents. Furthermore, the steps may be performed in a different order than that described in this disclosure. Further, various elements in the embodiments or examples may be combined in various ways. Importantly, as the technology evolves, many elements described herein can be replaced by equivalents that appear after this disclosure.
Claims
1. A cabin-pilot fusion redundancy system based on dynamic resource scheduling, characterized in that, include: Intelligent driving domain controller, used to run autonomous driving functions; The intelligent cockpit domain controller is communicatively connected to the intelligent driving domain controller. Multiple environmental sensing sensors; as well as, The intelligent sensor hub is connected to the plurality of environmental sensing sensors to receive raw data from the sensors and has a first data channel and a second data channel. The first data channel is used to transmit the raw data to the intelligent driving domain controller; the second data channel is used to transmit the feature data generated after preprocessing the raw data to the intelligent cockpit domain controller. A shared memory pool is provided, and the intelligent driving domain controller and the intelligent cockpit domain controller access the shared memory pool through a high-speed interconnection protocol. The intelligent driving domain controller is used to write the intermediate perception feature data generated during processing into the shared memory pool. The dynamic resource scheduling kernel is used to virtualize the computing resources of the intelligent driving domain controller and the intelligent cockpit domain controller into a unified resource pool, and when an abnormal operating status of the intelligent driving domain controller is detected, it triggers resource reallocation, dynamically scheduling the computing resources in the resource pool from the intelligent driving domain controller to the intelligent cockpit domain controller. Upon triggering the resource reallocation, the intelligent cockpit domain controller is configured to read the intermediate perception feature data from the shared memory pool and perform environmental perception and vehicle control tasks based on the feature data and the intermediate perception feature data.
2. The system according to claim 1, characterized in that, It also includes a safety microcontroller, which is used to monitor the operating status of the intelligent driving domain controller and arbitrate the consistency of the data transmitted by the multiple environmental perception sensors through the first data channel and the second data channel; The dynamic resource scheduling kernel detects an abnormal operating state, including receiving an abnormal state indication from the security microcontroller.
3. The system according to claim 2, characterized in that, The intelligent driving domain controller, the intelligent cockpit domain controller, and the safety microcontroller are integrated on the same hardware substrate using advanced packaging technology and interconnected via the PCIe CXL protocol to form the shared memory pool.
4. The system according to claim 1, characterized in that, The dynamic resource scheduling kernel is configured as follows: When the intelligent driving domain controller is operating normally, a first proportion of computing resources is pre-allocated to the intelligent cockpit domain controller to run monitoring tasks; When an abnormal operating status is detected that requires system takeover, the computing resources allocated to the intelligent cockpit domain controller will be increased from the first proportion to the second proportion within a predetermined time, where the second proportion is greater than the first proportion.
5. The system according to claim 4, characterized in that, The monitoring task includes: running a lightweight perception model to process the feature data, and comparing the processing result with the intermediate perception feature data read from the shared memory pool.
6. The system according to claim 1, characterized in that, The intelligent cockpit domain controller is pre-installed with a lightweight world model, which is used to generate environmental state prediction data based on historical perception data when an interruption in communication with the intelligent driving domain controller is detected.
7. A cabin-riding fusion redundancy method based on dynamic resource scheduling, applied to the system as described in any one of claims 1-6, characterized in that, The method includes: The intelligent sensor hub transmits raw data from the environmental perception sensor to the intelligent driving domain controller via the first data channel, and transmits preprocessed feature data to the intelligent cockpit domain controller via the second data channel. The raw data is processed by the intelligent driving domain controller, and the intermediate perception feature data generated by the processing is written into the shared memory pool; The computing resources of the intelligent driving domain controller and the intelligent cockpit domain controller are virtualized into a resource pool for management through the dynamic resource scheduling kernel. Monitor the operating status of the intelligent driving domain controller; When an abnormal operating status is detected, resource reallocation is triggered, and the computing resources in the resource pool are dynamically scheduled from the intelligent driving domain controller to the intelligent cockpit domain controller. After resource reallocation, the intelligent cockpit domain controller reads the intermediate perception feature data from the shared memory pool and performs environmental perception and vehicle control tasks based on the feature data and the intermediate perception feature data.
8. The method according to claim 7, characterized in that, Before detecting any abnormal operating status, the method further includes: A first proportion of computing resources is pre-allocated to the intelligent cockpit domain controller; The intelligent cockpit domain controller is controlled to run a monitoring task using the first proportion of computing resources. The monitoring task includes: processing the feature data and comparing the processing result with the intermediate sensing feature data read from the shared memory pool.
9. The method according to claim 7, characterized in that, The monitoring of the operating status of the intelligent driving domain controller includes receiving an abnormal status indication from a safety microcontroller, which is used to monitor the operating status of the intelligent driving domain controller and arbitrate the consistency of sensor data.
10. The method according to claim 7, characterized in that, The method further includes: When a communication interruption is detected between the intelligent cockpit domain controller and the intelligent driving domain controller, the intelligent cockpit domain controller is controlled to start a preset lightweight world model. Based on historical perception data, environmental state prediction data for a future period of time is generated through the lightweight world model. Vehicle control decisions are made based on the environmental state prediction data.