Control apparatus and intelligent driving device

Abstract

A control apparatus and an intelligent driving device. The control apparatus comprises: a first computing unit group, a second computing unit group, and a control unit, wherein first and second interfaces of the first computing unit group are used for respectively communicating with a first group of sensors and a second group of sensors, which first and second groups of sensors are from a first-type sensor group; third and fourth interfaces of the second computing unit group are used for respectively communicating with the first group of sensors and the second group of sensors; the first to fourth interfaces are first-type interfaces; the first computing unit group and the second computing unit group communicate with each other by means of second-type interfaces, and the first computing unit group and the second computing unit group communicate with the control unit by means of third-type interfaces and fourth-type interfaces, respectively; and the first computing unit group and / or the second computing unit group generate / generates, on the basis of signals received from sensors, control information for controlling a vehicle. When no fault occurs in the control unit, the control unit sends control information. When the present solution is applied to the field of intelligent vehicles, the high reliability of an intelligent driving system can be achieved at a low cost.

Description

Control device and intelligent driving device TECHNICAL FIELD

[0001] The present application relates to the field of intelligent vehicles, and more particularly, to a control device and an intelligent driving device. BACKGROUND

[0002] An intelligent driving system of a vehicle includes three key parts of perception, planning and control, and the three parts cooperatively realize a complete system of intelligent decision and execution of the vehicle, thereby realizing automatic control of the vehicle. Failure or malfunction of any one of the perception, planning and control will affect the driving safety of the vehicle. With the development of intelligent driving functions of the vehicle, the intelligent driving level is continuously improved. In order to ensure the driving safety of the vehicle, the intelligent driving system of the vehicle needs to be redundantly designed to ensure the safety of the vehicle in the event of failure or malfunction of a device (such as a controller in the intelligent driving system). However, the current redundant architecture of the intelligent driving system has a high cost, and therefore a low-cost and high-reliability control scheme for intelligent driving is urgently needed to be developed.

[0003] SUMMARY

[0004] The present application provides a control device and an intelligent driving device, which can realize high reliability of an intelligent driving system of a vehicle at a low cost.

[0005] In a first aspect, a control device is provided, which is applied to an intelligent driving device, and includes a first computing unit group, a second computing unit group and a control unit; wherein a first interface of the first computing unit group is configured to communicate with a first group of sensors of a first group of sensors, and a second interface of the first computing unit group is configured to communicate with a second group of sensors of the first group of sensors; a third interface of the second computing unit group is configured to communicate with the first group of sensors, and a fourth interface of the second computing unit group is configured to communicate with the second group of sensors, and the first interface, the second interface, the third interface and the fourth interface belong to a first type of interface; the first computing unit group and the second computing unit group communicate through a second type of interface, the first computing unit group and the control unit communicate through a third type of interface, and the second computing unit group and the control unit communicate through a fourth type of interface; the first computing unit group and / or the second computing unit group generate control information according to the received signals of the sensors, and the control information is used to control the intelligent driving device; when the control unit does not fail, the control device sends the control information through the control unit.

[0006] In some implementations, the first computing unit group and the second computing unit group transmit at least one of the following via the second type of interface: intermediate data, information indicating the working state of the computing unit group, and indication information about the working state (whether there is a fault) of the control unit. The intermediate data can be intermediate results obtained by the computing unit group processing the sensor data. For example, the first computing unit group and the second computing unit group each process part of the sensor data, and after processing is completed, the respective processing results (e.g., intermediate data) are sent to the other party. The information indicating the working state of the computing unit group can be a heartbeat packet transmitted periodically. If one of the first computing unit group and the second computing unit group does not receive a heartbeat packet from the other party within a period of time (e.g., a period of time corresponding to two heartbeat packet transmission periods, or other period of time), it can be determined that the other party has failed. In an example, the first computing unit group and the second computing unit group both have the ability to send control information. The first computing unit group can send information indicating the working state of the control unit to the second computing unit group via the second type of interface, and the first computing unit group can receive information indicating the working state of the control unit from the second computing unit group via the second type of interface. In another example, only one of the first computing unit group and the second computing unit group has the ability to send control information. The computing unit group that has the ability to send control information can receive information indicating the working state of the control unit from the other party via the second type of interface.

[0007] In some implementations, the first computing unit group sends control information to the control unit via the third type of interface, or the first computing unit group can also receive information indicating the working state of the control unit via the third type of interface. In some implementations, the second computing unit group sends control information to the control unit via the fourth type of interface, or the second computing unit group can also receive information indicating the working state of the control unit via the fourth type of interface. Exemplarily, the aforementioned information indicating the working state of the control unit can be a heartbeat packet transmitted periodically.

[0008] In some implementations, the third type of interface and the fourth type of interface can be the same interface, or can be different interfaces. In addition, the second type of interface and the third type of interface (or the fourth type of interface) can both be the same interface (e.g., both Ethernet interfaces), or can be different interfaces.

[0009] In some implementations, the control device sends control information to the execution system (e.g., steering system, chassis control system, etc.) of the intelligent driving device, and when the execution system executes the control information, the control of the intelligent driving device can be realized.

[0010] In the technical solution, the first type of sensor groups are sequentially connected to the two computing unit groups, and the two computing unit groups are in communication with the control unit to transmit control information to the control unit. When a computing unit group fails, the other computing unit group and the control unit can still ensure the normal output of the control information. That is, the technical solution can ensure the reliability of the control device by using two computing unit groups and one control unit, and since only one control unit is used, the cost of the control device can be reduced.

[0011] It should be noted that the failure or abnormal working state of the control unit (or computing unit group) in the embodiments of the present application can include: failure of software loaded in the control unit (or computing unit group) and / or failure of hardware loaded in the control unit (or computing unit group). More specific failure types can include: power supply failure, clock failure, communication failure, or processing module failure of the control unit (or computing unit group). Among them, the power supply failure refers to the failure of the power supply module or power supply line, which causes the control unit (or computing unit group) to be unable to supply power, the communication failure refers to the failure of the software or hardware, which causes the control unit (or computing unit group) to be unable to communicate with the outside world, the clock failure refers to the inaccuracy or failure of the clock of the control unit (or computing unit group), which causes the clock synchronization to be unable to be realized, and the processing module failure refers to the failure of the software or hardware, which causes the processing module to be unable to process data.

[0012] In combination with the first aspect, in some implementations of the first aspect, the first computing unit group is powered by a first power supply module, the second computing unit group is powered by a second power supply module, and the control unit is powered by a third power supply module.

[0013] In the technical solution, the first computing unit group, the second computing unit group, and the control unit are respectively powered by different power supply modules. When one power supply module fails, the remaining two power supply modules can still ensure the normal power supply of the control unit and at least one computing unit group, thereby ensuring that the control device can normally output control information and helping to improve the reliability of the control device.

[0014] In the technical solution, the first computing unit group, the second computing unit group, and the control unit are respectively powered by different power supply modules. When one power supply module fails, the remaining two power supply modules can still ensure the normal power supply of the control unit and at least one computing unit group, thereby ensuring that the control device can normally output control information and helping to improve the reliability of the control device.

[0015] With reference to the second aspect, in some implementations of the second aspect, the first interface of the first computing unit group is configured to communicate with a first group of sensors of the first group of sensors, and the second interface of the first computing unit group is configured to communicate with a second group of sensors of the first group of sensors; the third interface of the second computing unit group is configured to communicate with the first group of sensors, and the fourth interface of the second computing unit group is configured to communicate with the second group of sensors, and the first interface, the second interface, the third interface and the fourth interface belong to the first type of interfaces; the first computing unit group and the second computing unit group communicate through the second type of interfaces, the first computing unit group and the control unit communicate through the third type of interfaces, and the second computing unit group and the control unit communicate through the fourth type of interfaces.

[0016] With reference to the first aspect or the second aspect, in some implementations of the first aspect or the second aspect, the first power supply module is powered through the first power supply line, the second power supply module is powered through the second power supply line, and the third power supply module is powered through the combination of the first power supply line and the second power supply line.

[0017] In the above technical solution, when one of the power supply lines fails, the remaining one power supply line can still supply power to the two power supply modules, thereby ensuring the normal power supply of the control unit and one computing unit group, so that the control device can still normally output control information, which helps to improve the reliability of the control device.

[0018] In the above technical solution, when one of the power supply lines fails, the remaining one power supply line can still supply power to the two power supply modules, thereby ensuring the normal power supply of the control unit and one computing unit group, so that the control device can still normally output control information, which helps to improve the reliability of the control device.

[0019] With reference to the first aspect or the second aspect, in some implementations of the first aspect or the second aspect, the first computing unit group receives state indication information from the second computing unit group through the second type of interfaces, and the state indication information indicates whether the working state of the control unit is normal; the first computing unit group receives first information from the control unit through the third type of interfaces, and the first information indicates the working state of the control unit; when the state indication information indicates that the working state of the control unit is abnormal, and the first information or the reception condition of the first information indicates that the working state of the control unit is abnormal, the first computing unit group determines that the control unit fails.

[0020] Exemplarily, the state indication information and the aforementioned indication information about the working state of the control unit can be the same information.

[0021] In some implementations, the first information or the reception condition of the first information indicates that the working state of the control unit is abnormal, which can include: if the first information is the indication information and the indication information indicates that the control unit fails (i.e., the control unit actively reports an error to the first computing unit group), it can be considered that the first information indicates that the working state of the control unit is abnormal; if the first information is the heartbeat packet transmitted periodically, and the first computing unit group does not receive the first information within a certain time length (such as a time length corresponding to two heartbeat packet transmission periods, or other time lengths), it can be considered that the reception condition of the first information indicates that the working state of the control unit is abnormal.

[0022] In some implementations, when the first computing unit group determines that the control unit fails, the control device sends the control information through the first computing unit group.

[0023] In the above technical solutions, the first computing unit group determines whether the control unit fails through two ways of the state indication information and the first information (or the reception condition of the first information), which helps to improve the reliability of the determination result of the working state of the control unit, thereby improving the reliability of the control device, reducing the probability of the first computing unit group and the control unit sending the control information at the same time, and helping to ensure the safety of the intelligent driving equipment.

[0024] In combination with the first aspect or the second aspect, in some implementations of the first aspect or the second aspect, the first computing unit group and the control unit also communicate through a fifth type of interface, and the third type of interface and the fifth type of interface are both used to transmit information related to the working state of the control unit.

[0025] In the present implementation, the first computing unit group and the second computing unit group can not transmit information indicating the working state of the computing unit group and the indication information about the working state of the control unit.

[0026] In some implementations, the first computing unit group and the control unit can also transmit the control information through the fifth type of interface.

[0027] It should be noted that the third type of interface and the fifth type of interface are different interfaces, for example, the third type of interface is an Ethernet interface, and the fifth type of interface is a CAN-FD interface; for another example, the third type of interface is an uncoordinated random access and transmission (URAT) interface, and the fifth type of interface is a serial peripheral interface (SPI).

[0028] In the technical solution, two different types of communication channels exist between the first computing unit group and the control unit, so that the first computing unit group can determine whether the control unit fails through the information transmitted by the two communication channels, thereby improving the reliability of the control device.

[0029] In some implementations of the first aspect or the second aspect, the first computing unit group receives second information from the control unit through the third type of interface, and receives third information from the control unit through the fifth type of interface, the second information and the third information both indicating the working state of the control unit; when the second information or the receiving condition of the second information indicates that the working state of the control unit is abnormal, and the third information or the receiving condition of the third information indicates that the working state of the control unit is abnormal, the first computing unit group determines that the control unit fails.

[0030] In some implementations, when the first computing unit group determines that the control unit fails, the control device sends control information through the first computing unit group.

[0031] In the technical solution, when the information transmitted by the two communication channels both indicates that the working state of the control unit is abnormal, the first computing unit group determines that the control unit fails, which can reduce the probability of false judgment of the control unit failure, thereby improving the reliability of the control device, reducing the probability of simultaneous sending of control information by the first computing unit group and the control unit, and helping to ensure the safety of the intelligent driving equipment.

[0032] In some implementations of the first aspect or the second aspect, the first computing unit group and the second computing unit group also communicate through a sixth type of interface, and the second type of interface and the sixth type of interface are both used to transmit information related to the working state of the second computing unit group.

[0033] In the implementation, the first computing unit group and the second computing unit group can transmit information indicating the working state of the computing unit group through the second type of interface and the sixth type of interface; or the first computing unit group and the second computing unit group can also transmit intermediate data through the second type of interface and the sixth type of interface.

[0034] In some implementations, the second type of interface and the sixth type of interface are different interfaces, for example, the second type of interface is an Ethernet interface, and the sixth type of interface is a peripheral component interconnect express (PCIe).

[0035] In the technical solution, two different types of communication channels exist between the first computing unit group and the second computing unit group. Thus, one of the first computing unit group and the second computing unit group can determine whether the other one fails through information transmitted in the two communication channels, thereby helping to improve the reliability of the control device. That is, the first computing unit group and / or the second computing unit group has the ability to simultaneously determine whether the control unit and the other computing unit group fail. Thus, when any two components of the first computing unit group, the second computing unit group and the control unit fail, the remaining one component that does not fail has the ability to determine that the other two components fail, and the control device can output control information through the component that does not fail, thereby further improving the reliability of the control device.

[0036] With reference to the first aspect or the second aspect, in some implementations of the first aspect or the second aspect, the first computing unit group receives fourth information from the second computing unit group through the second type of interface, and receives fifth information from the control unit through the sixth type of interface. The fourth information and the fifth information both indicate the working state of the second computing unit. When the fourth information or the reception condition of the fourth information indicates that the working state of the second computing unit group is abnormal, and the fifth information or the reception condition of the fifth information indicates that the working state of the second computing unit group is abnormal, the first computing unit group determines that the second computing unit group fails.

[0037] In some implementations, when the first computing unit group determines that the second computing unit group and the control unit both fail, the control device sends control information through the first computing unit group.

[0038] In the technical solution, when the second computing unit group and the control unit both fail in the control device, the first computing unit group has the ability to make a more reliable determination and then send control information, thereby helping to ensure the reliability of the control device and improve the safety of the intelligent driving equipment.

[0039] With reference to the first aspect or the second aspect, in some implementations of the first aspect or the second aspect, the second computing unit group and the control unit also communicate through a ninth type of interface. The fourth type of interface and the ninth type of interface are both used to transmit information related to the working state of the control unit.

[0040] In some implementations, the second computing unit group determines that the control unit fails when the sixth information or the reception condition of the sixth information indicates that the working state of the control unit is abnormal, and the seventh information or the reception condition of the seventh information indicates that the working state of the control unit is abnormal.

[0041] In some implementations, the control device sends the control information through the second computing unit group when the second computing unit group determines that the control unit fails.

[0042] In the above technical solution, the control device includes three channels for sending the control information, i.e., a channel for sending the control information through the control unit, a channel for sending the control information through the first computing unit group, and a channel for sending the control information through the second computing unit group. When a single-point failure (e.g., a failure of one of the control unit, the first computing unit group, and the second computing unit group) or a double-point failure (e.g., a failure of two of the control unit, the first computing unit group, and the second computing unit group) occurs in the control device, the control information can be normally sent, which helps to ensure the reliability of the control device and thus improves the safety of the intelligent driving equipment.

[0043] In some implementations, the control device sends the control information through the second computing unit group when the second computing unit group determines that the control unit fails.

[0044] In some implementations, when the first computing unit group, the second computing unit group, and the control unit all have the capability of sending the control information, the control information is sent by the control unit when the control unit does not fail; when the control unit fails and the first computing unit group and the second computing unit group do not fail, the computing unit group that sends the control information can be determined according to the priority between the first computing unit group and the second computing unit group, e.g., the first computing unit group has a higher priority, and thus the control information is sent by the first computing unit group.

[0045] In the above technical solution, the control device can still normally send the control information when the control unit fails, which helps to ensure the reliability of the control device and thus improves the safety of the intelligent driving equipment.

[0046] In some implementations, the first computing unit group generates the first control information according to the signals of the sensors received, the second computing unit group generates the second control information according to the signals of the sensors received, and the control information is associated with the first control information or the second control information.

[0047] In some implementations, the control information associated with the first control information or the second control information can include any of the following: the control information is the same as the first control information or the second control information, for example, the control unit transmits the first control information or the second control information; or the control information is the same as the content (i.e., the vehicle control instruction) included in the first control information or the second control information, but the format of the information is different due to the use of different transmission protocols.

[0048] With reference to the first aspect or the second aspect, in some implementations of the first aspect or the second aspect, when the control unit fails, the device transmits the first control information through the first computing unit group; or the device transmits the second control information through the second computing unit group.

[0049] With reference to the first aspect or the second aspect, in some implementations of the first aspect or the second aspect, the first computing unit group and the second computing unit group further include a seventh type of interface, and the seventh type of interface is used for communication with sensors in the second type of sensor group.

[0050] With reference to the first aspect or the second aspect, in some implementations of the first aspect or the second aspect, the device further includes a network forwarding unit, and the second type of sensor group respectively communicates with the first computing unit group and the second computing unit group through a seventh type of interface of the network forwarding unit.

[0051] In some implementations, the network forwarding unit is also powered by the third power supply module.

[0052] In the above technical solution, the second type of sensor group accesses the first computing unit group and the second computing unit group through the network forwarding unit, and the second type of sensor group and the first type of sensor group will not fail together, which helps to improve the reliability of the control information output by the control device.

[0053] With reference to the first aspect or the second aspect, in some implementations of the first aspect or the second aspect, the seventh type of interface is an Ethernet interface.

[0054] With reference to the first aspect or the second aspect, in some implementations of the first aspect or the second aspect, the first computing unit group and the second computing unit group further include an eighth type of interface, and the eighth type of interface is used for communication with sensors in the third type of sensor group.

[0055] In the technical solution, the third sensor group is connected to the first and second calculation unit groups, and the third sensor group and the first sensor group will not cause common cause failure, which helps to improve the reliability of the control information output by the control device. In addition, when the first, second and third sensor groups are all connected to the control device, the possibility of common cause failure among the sensors is low, and in the case of single point failure of the control unit, the first and second calculation unit groups and the network forwarding unit, the lost sensor signals can be minimized, which helps to ensure the reliability of the control information output by the control device, thereby improving the safety of the intelligent driving equipment.

[0056] With reference to the first aspect or the second aspect, in some implementations of the first aspect or the second aspect, the control unit communicates with the sensors in the third sensor group through an eighth interface.

[0057] In the technical solution, the third sensor group is connected to the control unit through the eighth interface, so that when the first and second calculation unit groups fail, the control unit can control the intelligent driving equipment to drive to a safe position according to the signals of the sensors in the third sensor group, thereby improving the safety of the intelligent driving equipment.

[0058] With reference to the first aspect or the second aspect, in some implementations of the first aspect or the second aspect, the eighth interface is a controller area network-flexible data (CAN-FD) interface.

[0059] With reference to the first aspect or the second aspect, in some implementations of the first aspect or the second aspect, the device further comprises a first access unit and a second access unit, the first group of sensors respectively communicate with the first and second calculation unit groups through a first interface of the first access unit, and the second group of sensors respectively communicate with the first and second calculation unit groups through a first interface of the second access unit.

[0060] In some implementations, the first access unit is powered by a first power supply module, and the second access unit is powered by a second power supply module.

[0061] With reference to the first aspect or the second aspect, in some implementations of the first aspect or the second aspect, the first interface is a mobile industry processor interface (MIPI).

[0062] With reference to the first aspect or the second aspect, in some implementations of the first aspect or the second aspect, the first group of sensors includes at least one camera disposed on a first side of the intelligent driving device, and the second group of sensors includes at least one camera disposed on a second side of the intelligent driving device.

[0063] In a third aspect, a control system is provided, which includes the apparatus of any possible implementation of the first aspect or the second aspect, and the first group of sensors.

[0064] With reference to the third aspect, in some implementations of the third aspect, the system further includes the second group of sensors and / or the third group of sensors.

[0065] In a fourth aspect, a control method is provided, which is performed by a control apparatus including a first group of computing units, a second group of computing units, and a control unit; wherein a first interface of the first group of computing units is configured to communicate with a first group of sensors of a first group of sensors, and a second interface of the first group of computing units is configured to communicate with a second group of sensors of the first group of sensors; a third interface of the second group of computing units is configured to communicate with the first group of sensors, and a fourth interface of the second group of computing units is configured to communicate with the second group of sensors, the first interface, the second interface, the third interface, and the fourth interface belong to a first type of interfaces; the first group of computing units and the second group of computing units communicate with each other through a second type of interfaces, the first group of computing units and the control unit communicate with each other through a third type of interfaces, and the second group of computing units and the control unit communicate with each other through a fourth type of interfaces; the method includes:

[0066] when none of the first group of computing units, the second group of computing units, and the control unit fails, sending, by the control unit, first control information, the first control information being used for controlling the intelligent driving device, and the first control information being generated by the first group of computing units or the second group of computing units according to signals received by the sensors;

[0067] when the second group of computing units fails, and none of the first group of computing units and the control unit fails, sending, by the control unit, second control information, the second control information being used for controlling the intelligent driving device, and the second control information being generated by the first group of computing units according to signals received by the sensors;

[0068] when the first group of computing units fails, and none of the second group of computing units and the control unit fails, sending, by the control unit, third control information, the third control information being used for controlling the intelligent driving device, and the third control information being generated by the second group of computing units according to signals received by the sensors;

[0069] In a case where the control unit fails and neither the first computing unit group nor the second computing unit group fails, the fourth control information is sent by the first computing unit group, the fourth control information is used for controlling the intelligent driving device, and the fourth control information is generated by the first computing unit group according to the received sensor signal.

[0070] In a case where the control unit and the first computing unit group fail and the second computing unit group does not fail, the fifth control information is sent by the second computing unit group, the fifth control information is used for controlling the intelligent driving device, and the fifth control information is generated by the first computing unit group according to the received sensor signal.

[0071] With reference to the fourth aspect, in some implementations of the fourth aspect, the method further includes: the first computing unit group receives state indication information from the second computing unit group and first information from the control unit, the state indication information indicates whether the working state of the control unit is normal, and the first information indicates the working state of the control unit; the fourth control information is sent by the first computing unit group, including: in a case where the first computing unit group determines that the state indication information indicates that the working state of the control unit is abnormal and the first information or the reception of the first information indicates that the working state of the control unit is abnormal, the first computing unit group determines that the control unit fails and sends the fourth control information.

[0072] With reference to the fourth aspect, in some implementations of the fourth aspect, the method further includes: the first computing unit group receives second information from the control unit through a first communication channel and receives third information from the control unit through a second communication channel, the second information and the third information both indicate the working state of the control unit; the fourth control information is sent by the first computing unit group, including: in a case where the second information or the reception of the second information indicates that the working state of the control unit is abnormal and the third information or the reception of the third information indicates that the working state of the control unit is abnormal, the first computing unit group determines that the control unit fails and sends the fourth control information.

[0073] In some implementations, the first communication channel is a communication channel between the third type interface of the first computing unit group and the third type interface of the control unit, and the second communication channel is a communication channel between the fifth type interface of the first computing unit group and the fifth type interface of the control unit.

[0074] In some implementations of the fourth aspect, the method further comprises: receiving, by the first computing unit group, fourth information from the second computing unit group via a third communication channel, and receiving, by the first computing unit group, fifth information from the control unit via a fourth communication channel, wherein the fourth information and the fifth information both indicate the working state of the second computing unit group; and determining, by the first computing unit group, that the second computing unit group has failed, when the fourth information or the reception of the fourth information indicates that the working state of the second computing unit group is abnormal, and the fifth information or the reception of the fifth information indicates that the working state of the second computing unit group is abnormal.

[0075] In some implementations, the third communication channel is a communication channel between the second-type interface of the first computing unit group and the second-type interface of the second computing unit group, and the fourth communication channel is a communication channel between the sixth-type interface of the first computing unit group and the sixth-type interface of the second computing unit group.

[0076] In some implementations of the fourth aspect, the method of determining that the first computing unit group has failed by the second computing unit group can refer to the description in the above implementation, and will not be described here.

[0077] In some implementations of the fourth aspect, the method further comprises: receiving, by the second computing unit group, sixth information from the control unit via a fifth communication channel, and receiving, by the second computing unit group, seventh information from the control unit via a sixth communication channel, wherein the sixth information and the seventh information both indicate the working state of the control unit; determining, by the second computing unit group, that the control unit has failed, when the sixth information or the reception of the sixth information indicates that the working state of the control unit is abnormal, and the seventh information or the reception of the seventh information indicates that the working state of the control unit is abnormal; and sending, by the second computing unit group, fifth control information, comprising: sending the fifth control information when the second computing unit group determines that the first computing unit group has failed.

[0078] In some implementations, the fifth communication channel is a communication channel between the fourth-type interface of the second computing unit group and the fourth-type interface of the control unit, and the sixth communication channel is a communication channel between the ninth-type interface of the second computing unit group and the ninth-type interface of the control unit.

[0079] In some implementations of the fourth aspect, the method is performed by the control device in any possible implementation of the first aspect or the second aspect, or the method is performed by the control system in any possible implementation of the third aspect.

[0080] In the fifth aspect, a control device is provided, which comprises a processor configured to execute a computer program stored in a memory, so that the device performs the method in any possible implementation of the fifth aspect.

[0081] With reference to the fifth aspect, in some implementations of the fifth aspect, the control device further includes a memory.

[0082] The sixth aspect provides a controller, which includes the device in any possible implementation of the first aspect, the second aspect or the fifth aspect. In actual implementation, the controller can be a domain controller, or can also be a vehicle-mounted central computer.

[0083] The seventh aspect provides an intelligent driving device, which includes the device in any possible implementation of the first aspect, the second aspect or the fifth aspect, or the intelligent driving device includes the system in any possible implementation of the third aspect, or the intelligent driving device includes the controller in any possible implementation of the sixth aspect.

[0084] With reference to the seventh aspect, in some implementations of the seventh aspect, the intelligent driving device is a vehicle.

[0085] The eighth aspect provides a computer program product, which includes computer program codes. When the computer program codes are run on a computer or a processor, the computer or the processor executes the method in any possible implementation of the fourth aspect.

[0086] It should be noted that the computer program codes can be stored in a storage medium in whole or in part, and the storage medium can be packaged together with the processor or packaged separately from the processor.

[0087] The ninth aspect provides a computer readable medium, which stores instructions. When the instructions are executed by a processor, the processor implements the method in any possible implementation of the fourth aspect.

[0088] The tenth aspect provides a chip system, which includes a circuit for executing the method in any possible implementation of the fourth aspect.

[0089] The beneficial effects not described in the third aspect to the tenth aspect can be referred to the description in the first aspect or the second aspect, and will not be described here. BRIEF DESCRIPTION OF DRAWINGS

[0090] FIG. 1 is a functional schematic block diagram of a vehicle according to an embodiment of the present application;

[0091] FIG. 2 is a schematic block diagram of a control device according to an embodiment of the present application;

[0092] FIG. 3 is another schematic block diagram of a control device according to an embodiment of the present application;

[0093] FIG. 4 is a schematic diagram of control device fault handling according to an embodiment of the present application;

[0094] FIG. 5 is another schematic block diagram of a control device according to an embodiment of the present application;

[0095] FIG. 6 is another schematic diagram of control device fault handling according to an embodiment of the present application;

[0096] FIG. 7 is another schematic block diagram of a control device according to an embodiment of the present application;

[0097] FIG. 8 is a schematic block diagram of a power supply architecture of a control device according to an embodiment of the present application;

[0098] FIG. 9 is another schematic block diagram of a control device according to an embodiment of the present application. DETAILED DESCRIPTION

[0099] The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings.

[0100] FIG. 1 is a functional block diagram of a vehicle according to an embodiment of the present application. As shown in FIG. 1, the vehicle 100 can include a perception system 120 and a computing platform 150, wherein the perception system 120 can include several sensors for sensing information of the environment around the vehicle 100. For example, the perception system 120 can include a positioning system, which can be a global positioning system (GPS), a Beidou system, or other positioning systems. For another example, the perception system 120 can also include one or more of an inertial measurement unit (IMU), a laser radar, a millimeter wave radar, an ultrasonic radar, and a camera.

[0101] Some or all of the functionality of the vehicle 100 can be controlled by the computing platform 150. The computing platform 150 can include processors 151-15n, which are circuits that have the capability to process signals. In one implementation, the processors can be circuits that have the capability to read and execute instructions, such as a central processing unit (CPU), a microprocessor, a graphics processing unit (GPU) (which can be understood as a type of microprocessor), a digital signal processor (DSP), or the like. In another implementation, the processors can be circuits that implement functionality through fixed or reconfigurable logic, such as an application-specific integrated circuit (ASIC) or a programmable logic device (PLD) such as a field programmable gate array (FPGA). In reconfigurable hardware circuits, the processors load configuration documents to implement the configuration of the hardware circuits, which can be understood as the processors loading instructions to implement the functionality of some or all of the units described above. Additionally, the processors can be hardware circuits designed for artificial intelligence, which can be understood as a type of ASIC, such as a neural network processing unit (NPU), a tensor processing unit (TPU), a deep learning processing unit (DPU), or the like. Additionally, the computing platform 150 can include a memory that stores instructions that can be called by some or all of the processors 151-15n to implement corresponding functionality.

[0102] The computing platform 150 can include at least one of an advanced driving domain controller (ADC), or a mobile data center (MDC); a vehicle domain controller (VDC); and a cockpit domain controller (CDC). The ADC or MDC is used to implement intelligent driving related perception, decision and control functions, and in actual implementation, the ADC or MDC can also be other names, such as a special equipment system (SAS), an intelligent driving server ICAS2, an ADAS super core, etc. The VDC is used to implement vehicle control functions, and the VDC can be regarded as an integration of a power domain, a chassis domain and a body domain, and in actual implementation, the VDC can also be other names, such as a body controller (BDC), a vehicle control server ICAS1, a body super core (BSC), etc. The CDC is used to implement cockpit intelligent functions such as human-computer interaction, and in actual implementation, the CDC can also be other names, such as a media graphics unit (MGU), an intelligent cockpit server ICAS3, a cockpit super core (CSC), etc. The ICAS is an in-car application server (ICAS). Alternatively, the computing platform 150 can also be a central computing platform, for example, can include a vehicle central computer (VCC).

[0103] Exemplarily, taking the MDC as an example, the computing platform 150 can control the operation of the intelligent driving system. The intelligent driving system can include an advanced driving assistant system (ADAS) and an autonomous driving system (ADS). The intelligent driving system uses various sensors on the vehicle (including but not limited to laser radar, millimeter wave radar, camera, ultrasonic sensor, global positioning system, inertial measurement unit) to obtain information from the surroundings of the vehicle, and analyzes and processes the obtained information, to realize functions such as obstacle perception, target recognition, vehicle positioning, path planning, driver monitoring / reminding, etc., thereby improving the safety, automation level and comfort of vehicle driving.

[0104] At different automatic driving levels (L0-L5), the intelligent driving system can realize different levels of automatic driving assistance based on artificial intelligence algorithms and information obtained by multiple sensors. The above-mentioned automatic driving levels (L0-L5) are based on the classification standard of Society of Automotive Engineers (SAE). Among them, L0 level is non-automation; L1 level is driving assistance; L2 level is partial automation; L3 level is conditional automation; L4 level is high automation; L5 level is complete automation. The tasks of monitoring the road conditions and reacting from L1 to L3 levels are completed by the driver and the system together, and the driver needs to take over the dynamic driving task. L4 and L5 levels can let the driver completely change into the role of a passenger. At present, the functions that can be realized by ADAS mainly include but are not limited to: adaptive cruise, automatic emergency braking, automatic parking, blind spot monitoring, front intersection traffic warning / braking, rear intersection traffic warning / braking, front vehicle collision warning, lane departure warning, lane keeping assistance, rear vehicle collision warning, traffic sign recognition, traffic congestion assistance, highway assistance, etc. It should be understood that the above-mentioned various functions can have specific modes at different automatic driving levels (L0-L5), and the higher the automatic driving level, the more intelligent the corresponding mode.

[0105] As described above, as the intelligent driving level of a vehicle is continuously improved, in order to ensure the driving safety of the vehicle, the intelligent driving system of the vehicle needs to be redundantly designed to ensure the safety of the vehicle in the event of a failure or malfunction. The current intelligent driving system generally adopts a dual-controller redundancy architecture, divides multiple sensors in the vehicle into at least two groups according to regions, and connects the at least two groups of sensors to two controllers respectively, so that when a controller fails, the vehicle can be controlled to drive to a safe place by the other controller. However, when a controller fails, the information of the sensors connected to the controller cannot be transmitted to the other controller, so that the reliability of the vehicle control information output by the other controller is insufficient. In addition, the dual-controller redundancy architecture is divided into two types: one is that each controller is implemented by a system-on-a-chip (SoC), that is, the sensors are connected to the SoC, and the SoC directly outputs vehicle control information to control the vehicle; the other is that each controller is implemented by a combination of an SoC and a micro controller unit (MCU), that is, the sensors are connected to the SoC, and the SoC generates vehicle control information according to the signals of the sensors, and the MCU controls the vehicle according to the vehicle control information from the SoC. For the foregoing dual-controller redundancy architecture, in the former, the functional safety of the SoC cannot reach the functional safety level required by a high intelligent driving level (such as L3 and above), and in the latter, the use of two MCUs results in a high cost of the intelligent driving system. It should be noted that the functional safety involved in the present application can be understood as avoiding unreasonable risks caused by electronic and electrical system failure behaviors, and the ultimate goal is to prevent personnel casualties or property losses caused by electronic and electrical system failures. The functional safety level is represented by the automotive safety integration level (ASIL), which can be divided into four levels: A, B, C, and D. Among them, the D level is the highest level, and the requirement for functional safety is the highest, that is, the electronic and electrical system needs to have high reliability and failure prevention capability to prevent failures from causing serious harm or threatening life.

[0106] In view of this, the embodiment of the present application provides a control device which can realize high reliability of the intelligent driving system of the vehicle at a lower cost.

[0107] For ease of understanding, the control device provided by the embodiment of the present application is described in detail below in combination with FIGS. 2-8.

[0108] Fig. 2 shows a schematic block diagram of a control device according to an embodiment of the present application. As shown in Fig. 2, the control device comprises a first computing unit group, a second computing unit group and a control unit. The first interface of the first computing unit group is configured to communicate with a first group of sensors of the first sensor group, and the second interface of the first computing unit group is configured to communicate with a second group of sensors of the first sensor group. The third interface of the second computing unit group is configured to communicate with the first group of sensors, and the fourth interface of the second computing unit group is configured to communicate with the second group of sensors. The first interface, the second interface, the third interface and the fourth interface belong to the first type of interface. The first computing unit group and the second computing unit group communicate with each other through the second type of interface, the first computing unit group and the control unit communicate with each other through the third type of interface, and the second computing unit group and the control unit communicate with each other through the fourth type of interface. The first computing unit group and / or the second computing unit group generate control information according to the signals received by the sensors, and the control information is used to control the intelligent driving device. When the control unit does not fail, the control device sends the control information through the control unit.

[0109] For example, the first computing unit group and the second computing unit group can each comprise at least one SoC, and the control unit can be an MCU. The control device can be any one of the MDC or the VCC in the foregoing embodiments, or the control device can also be a single board arranged in the MDC or the VCC. In addition, the control device can also be another device having the function of a domain controller such as the MDC, or the control device can also be another device having the function of a central computing platform such as the VCC. In some implementations, the control device can be a VDC or a CDC, or can be a device having or integrating the function of a VDC and / or a CDC.

[0110] In some implementations, the device further comprises a first access unit and a second access unit. The first group of sensors respectively communicates with the first computing unit group and the second computing unit group through the first type of interface of the first access unit, and the second group of sensors respectively communicates with the first computing unit group and the second computing unit group through the first type of interface of the second access unit. For example, the first type of interface is an MIPI interface.

[0111] In some implementations, the first computing unit group generates first control information according to the signals received by the sensors, and the second computing unit group generates second control information according to the signals received by the sensors. The control information is associated with the first control information or the second control information.

[0112] Exemplarily, the control information associated with the first control information or the second control information can include any of the following: the control information is the same as the first control information or the second control information, for example, the control unit transmits the first control information or the second control information; or the control information is obtained by protocol conversion on the first control information or the second control information, that is, the control information is the same as the content included in the first control information or the second control information, but the formats of the information can be different due to the use of different transmission protocols.

[0113] In some implementations, when the control unit fails, the device transmits the control information through the first computing unit group or the second computing unit group. More specifically, when the control unit fails, the control device transmits the first control information through the first computing unit group; or the control device transmits the second control information through the second computing unit group.

[0114] In some implementations, the first computing unit group and the second computing unit group further include a seventh type of interface for communicating with sensors in the second type of sensor group; and the first computing unit group and the second computing unit group further include an eighth type of interface for communicating with sensors in the third type of sensor group.

[0115] More specifically, the control device further includes a network forwarding unit, and the second type of sensor group respectively communicates with the first computing unit group and the second computing unit group through the seventh type of interface of the network forwarding unit. In addition, the control unit can also communicate with the sensors in the third type of sensor group through the eighth type of interface. Exemplarily, the seventh type of interface is an Ethernet interface, and the eighth type of interface is a CAN-FD interface.

[0116] It can be understood that the communication between the certain type of sensor group and the first computing unit group and the second computing unit group (or the control unit) involved in the embodiments of the present application can include direct communication between the certain type of sensor group and the first computing unit group and the second computing unit group (or the control unit), for example, the third type of sensor group directly communicates with the first computing unit group, the second computing unit group or the control unit through CAN-FD, without the need for a third party unit to analyze or forward related information. Alternatively, the communication between the certain type of sensor group and the first computing unit group and the second computing unit group can also include communication between the certain type of sensor group and the first computing unit group and the second computing unit group via a third party unit, for example, the first type of sensor group communicates with the first computing unit group and the second computing unit group via the first access unit and / or the second access unit; and for example, the second type of sensor group communicates with the first computing unit group and the second computing unit group via the network forwarding unit. Among them, the third party unit can process the information transmitted between the certain type of sensor group and the first computing unit group and the second computing unit group, or the third party unit can only transmit the information.

[0117] For the convenience of understanding the communication relationship between the control device and the first type sensor group, the second type sensor group and the third type sensor group provided by the embodiments of the present application, the following will be described in detail in combination with FIG. 3.

[0118] FIG. 3 shows a schematic block diagram of the control device provided by the embodiments of the present application. As shown in FIG. 3, the control device includes a computing unit group 1 (an example of the first computing unit group), a computing unit group 2 (an example of the second computing unit group) and a control unit. The sensors of the vehicle are divided into four groups, i.e., an A type sensor group 1 (an example of the first group of sensors in the first type sensor group), an A type sensor group 2 (an example of the second group of sensors in the first type sensor group), a B type sensor group (an example of the second type sensor group) and a C type sensor group (an example of the third type sensor group), and the four groups of sensors are respectively connected to the control device. More specifically:

[0119] The A type sensor group 1 is connected to the computing unit group 1 through an access unit 1, the A type sensor group 1 and the access unit 1 are connected through a power over coax (POC) cable, and the access unit 1 and the computing unit group 1 communicate through a MIPI interface; the A type sensor group 2 is connected to the computing unit group 2 through an access unit 2, the A type sensor group 2 and the access unit 2 are connected through a POC cable, and the access unit 2 and the computing unit group 2 communicate through a MIPI interface. In addition, the A type sensor group 1 is connected to the computing unit group 2 through the access unit 1, and the A type sensor group 1 communicates with the computing unit group 2 through the MIPI interface of the access unit 1; the A type sensor group 2 is connected to the computing unit group 1 through the access unit 2, and the A type sensor group 2 communicates with the computing unit group 1 through the MIPI interface of the access unit 2. The access unit 1 and the access unit 2 can be respectively regarded as an example of the first access unit and the second access unit. In some implementations, the A type sensor group (including the A type sensor group 1 and / or the A type sensor group 2) can include a camera, a time of fly (TOF) sensor and the like, which can communicate with the computing unit group through a MIPI interface, wherein the TOF sensor refers to a sensor for measuring the distance and / or depth of an object by using the TOF principle, which can include an infrared light sensor. In addition, the communication protocols between any two sensors in the A type sensor group and the access unit (such as the access unit 1 or the access unit 2) can be the same or different. For example, the access unit is a deserializer, and any two sensors can use different serializer-deserializer protocols to communicate with the access unit, or any two sensors can also use the same serializer-deserializer protocol to communicate with the access unit.

[0120] The B-type sensor group is connected to the computing unit group 1, the computing unit group 2 and the control unit through the network forwarding unit. The B-type sensor group communicates with the network forwarding unit through an Ethernet interface. The network forwarding unit sends the signals of the sensors in the B-type sensor group to the computing unit group 1 and the computing unit group 2 through the Ethernet interface. The network forwarding unit can be a local area network switch (LSW) or other units with Ethernet forwarding function. The B-type sensor group can include a light detection and ranging (LIDAR), a four-dimensional radio detection and ranging (4D RADAR) or other sensors that can communicate with the computing unit group through the Ethernet interface.

[0121] The C-type sensor group communicates with the computing unit group 1 and the computing unit group 2 through the CAN-FD interface and sends the perceived information to the computing unit group 1 and the computing unit group 2, respectively. In addition, the C-type sensor group can also communicate with the control unit through the CAN-FD interface and send the perceived information to the control unit. The C-type sensor group can include a three-dimensional radio detection and ranging (3D RADAR), an ultrasonic radar, a global navigation satellite system (GNSS), an IMU or other sensors that can communicate with the computing unit group through the CAN-FD interface.

[0122] It can be understood that when the computing unit group 1, the computing unit group 2, the access unit 1, the access unit 2 and the network forwarding unit in the control device are all normal, the A-type sensor group 1, the A-type sensor group 2, the B-type sensor group and the C-type sensor group can all access the computing unit group 1 and the computing unit group 2. When the access unit 1 fails, all the sensors except the A-type sensor group 1 can access the computing unit group 1 and the computing unit group 2. When the access unit 2 fails, all the sensors except the A-type sensor group 2 can access the computing unit group 1 and the computing unit group 2. When the network forwarding unit fails, all the sensors except the B-type sensor group can access the computing unit group 1 and the computing unit group 2. That is, in the architecture shown in FIG. 3, the connection mode between the components makes the loss of sensor signals less when a single point failure (i.e., a component or a part fails) occurs in the control device, thereby ensuring that the generated vehicle control information is highly reliable and improving the functional safety of the control device.

[0123] In some implementations, for the control device shown in FIG. 2, the first computing unit group receives, through the second type of interface, state indication information from the second computing unit group, the state indication information indicating whether the working state of the control unit is normal; the first computing unit group receives, through the third type of interface, first information from the control unit, the first information indicating the working state of the control unit; when the state indication information indicates that the working state of the control unit is abnormal and the first information or the reception condition of the first information indicates that the working state of the control unit is abnormal, the first computing unit group determines that the control unit has a fault. Further, when the first computing unit group determines that the control unit has a fault, the control information (such as the aforementioned first control information) can be sent.

[0124] For the above scheme, there can be only one communication channel for transmitting the state indication information between the first computing unit group and the second computing unit group, and there can be only one communication channel for transmitting the first information between the first computing unit group and the control unit. At this time, the communication relationship between the components in the control device can be as shown in FIG. 3. The computing unit group 1 and the computing unit group 2 communicate through a communication channel a, the computing unit group 1 and the control unit communicate through a communication channel b, and the computing unit group 2 and the control unit communicate through a communication channel c. The aforementioned state indication information and the first information can be transmitted through the communication channel a and the communication channel b respectively, that is, the communication channel a and the communication channel b can be respectively regarded as examples of the communication channel between the second type of interfaces, the communication channel between the third type of interfaces. That is, the computing unit group 2 can send the monitoring result of the working state of the control unit to the computing unit group 1 through the communication channel a. In addition, the computing unit group 1 and the computing unit group 2 can also transmit intermediate data and other information through the communication channel a; or the computing unit group 2 can also send indication information of its own fault to the computing unit group 1 through the communication channel a. The computing unit group and the control unit can transmit a heartbeat packet through the communication channel b (or the communication channel c), which is used to determine whether the working state of the control unit or the computing unit group is abnormal; or the computing unit group sends the vehicle control information (such as the aforementioned control information) to the control unit through the communication channel b (or the communication channel c); or the control unit can also send indication information of its own fault to the computing unit through the communication channel.

[0125] Exemplarily, the communication channel a can be any one of a communication channel between Ethernet interfaces, a communication channel between PCIe interfaces, or a communication channel between serializer-deserializer (SerDes) interfaces; the communication channel b (or the communication channel c) can include any one of a communication channel between CAN-FD interfaces, a communication channel between URAT interfaces, a communication channel between SPIs, a communication channel between Ethernet interfaces.

[0126] Further, the first computing unit group has arbitration capability, and can arbitrate whether the control unit fails according to the state indication information and the first information. More specifically, taking the first computing unit group as the computing unit group 1 shown in FIG. 3 and the second computing unit group as the computing unit group 2 shown in FIG. 3 as examples, as shown in FIG. 3, the computing unit group 1 includes a regulation and control module a, which is configured to generate control information a (an example of the first control information) according to signals of the sensors, the control information a being used to control at least one of a steering mechanism, a power assistance mechanism, and a brake mechanism of the vehicle; the computing unit group 2 includes a regulation and control module b, which is configured to generate control information b (an example of the second control information) according to signals of the sensors, the control information b being used to control at least one of the steering mechanism, the power assistance mechanism, and the brake mechanism of the vehicle. In addition, the computing unit group 1 further includes an arbitration module a, and the computing unit group 2 further includes a monitoring module, the arbitration module a and the monitoring module having the capability of monitoring the working state of the control unit. When the arbitration module a determines that the control unit fails (for example, according to the first information or the receiving state of the first information), and the arbitration module a receives the state indication information from the monitoring module indicating that the control unit fails, the arbitration module a determines that the control unit fails, and then the computing unit group 1 is controlled to send the control information a, as shown specifically in (a) of FIG. 4.

[0127] Further, the control unit shown in Fig. 3 comprises an arbitration module b. The arbitration module b is capable of monitoring the working states of the computing unit group 1 and the computing unit group 2, for example, to monitor whether the computing unit group 1 and the computing unit group 2 are faulty. When the control unit is not faulty, the control device sends the vehicle control information (i.e., the vehicle control channel 1) through the control unit. More specifically, when the computing unit group 1, the computing unit group 2 and the control unit are not faulty, the arbitration module b arbitrates the control unit to send the control information a from the computing unit group 1 or the control information b from the computing unit group 2. When the arbitration module b determines that the computing unit group 1 or the computing unit group 2 is faulty, the arbitration module b executes the control information from the computing unit which is not faulty. For example, as shown in (b) of Fig. 4, when the computing unit group 2 is faulty, the arbitration module b arbitrates the control unit to send the control information a from the computing unit group 1; for another example, as shown in (c) of Fig. 4, when the computing unit group 1 is faulty, the arbitration module b arbitrates the control unit to send the control information b from the computing unit group 2. Further, the arbitration module b is also capable of monitoring its own working state, and when the arbitration module b determines that it is faulty, it can control itself to enter a silent state, i.e., no longer send the vehicle control information.

[0128] In some implementations, for the control device shown in Fig. 2, the first computing unit group and the control unit also communicate through a fifth type of interface, and the third type of interface and the fifth type of interface are both used to transmit information related to the working state of the control unit. Further, the first computing unit group receives second information from the control unit through the third type of interface, and receives third information from the control unit through the fifth type of interface, and the second information and the third information both indicate the working state of the control unit; when the second information or the reception condition of the second information indicates that the working state of the control unit is abnormal, and the third information or the reception condition of the third information indicates that the working state of the control unit is abnormal, the first computing unit group determines that the control unit is faulty. Further, when the first computing unit group determines that the control unit is faulty, it can send the control information.

[0129] More specifically, for the above scheme, the first and second computing unit groups can not transmit state indication information and / or related information of the working state of the computing unit groups (such as heartbeat packets), and the second computing unit group can not set a monitoring module and / or an arbitration module. At this time, the communication relationship between the components in the control device can be as shown in FIG. 5. Among them, the computing unit group 1 and the control unit respectively communicate through the communication channel b' and the communication channel b", and the second information and the third information can be transmitted through the communication channel b' and the communication channel b" respectively, that is, the communication channel b' and the communication channel b" can be respectively regarded as an example of the communication channel between the third type of interface, the communication channel between the fifth type of interface. In addition, the computing unit group 1 can send vehicle control information (such as control information a) to the control unit through the communication channel b' and / or the communication channel b", and the control unit can also monitor the working state of the computing unit group 1 through the communication channel b' and / or the communication channel b". The computing unit group 2 can send control information to the control unit through the communication channel c, and the computing unit group 2 no longer monitors the working state of the control unit, but the control unit can monitor the working state of the computing unit group 2 through the communication channel c. Further, when the second information indicates that the control unit fails or the arbitration module a does not receive the second information within a certain time length (such as a time length corresponding to n heartbeat packet transmission periods, n is greater than 1), and the third information indicates that the control unit fails or the arbitration module a does not receive the third information within a certain time length (such as a time length corresponding to n heartbeat packet transmission periods, n is greater than 1), and both the third information determines that the control unit fails, the arbitration module a determines that the control unit fails, and then the control computing unit group 1 sends the control information a, as shown in (a) of FIG. 6.

[0130] In addition, the control unit shown in FIG. 5 includes an arbitration module b, the functions and actions of which can be referred to the description of the corresponding part of FIG. 3, which will not be repeated here. In the case where the control unit does not fail, but the computing unit group 1 or the computing unit group 2 fails, the transmission path of the control information in the control device is as shown in (b) and (c) of FIG. 6.

[0131] It should be noted that the communication channel b' and the communication channel b" are different types of communication channels, that is, the communication protocols used by the two are different, for example, the communication channel b' is an Ethernet channel, and the communication channel b" is any one of a CAN-FD channel, a URAT channel, and a SPI channel.

[0132] In some implementations, on the basis of the architecture shown in FIG. 5, the first computing unit group and the second computing unit group also communicate through a sixth type of interface, and the second type of interface and the sixth type of interface are both used to transmit information related to the working state of the second computing unit group. Further, the first computing unit group receives fourth information from the second computing unit group through the second type of interface, and the first computing unit group receives fifth information from the control unit through the sixth type of interface, and the fourth information and the fifth information both indicate the working state of the second computing unit; when the fourth information or the reception condition of the fourth information indicates that the working state of the second computing unit group is abnormal, and the fifth information or the reception condition of the fifth information indicates that the working state of the second computing unit group is abnormal, the first computing unit group determines that the second computing unit group has failed.

[0133] The communication relationship between the components in the more specific control device can be as shown in FIG. 7. Among them, between the computing unit group 1 and the computing unit group 2, between the computing unit group 1 and the control unit, and between the computing unit group 2 and the control unit, there are at least two communication channels, and the two communication channels each correspond to a type of interface, and each communication channel can be used to transmit information indicating the working state of the computing unit group and / or the control unit. It can be understood that the two communication channels between any two components are different communication channels, for example, communication channel a1 is a PCIe channel, then communication channel a2 is an Ethernet channel or a SerDes channel; communication channel b1 is an Ethernet channel, and communication channel b2 is any one of a CAN-FD channel, a URAT channel, and a SPI channel; communication channel c1 is an Ethernet channel, and communication channel c2 is any one of a CAN-FD channel, a URAT channel, and a SPI channel. In addition, the computing unit group 2 is provided with an arbitration module c, so that the computing unit group 2 has the ability to arbitrate whether the computing unit group 1 and the control unit have failed. For the architecture shown in FIG. 7, the computing unit group 1, the computing unit group 2, and the control unit all have the ability to send control information, and in the case that any two of the computing unit group 1, the computing unit group 2, and the control unit fail, the remaining one component that has not failed can determine that the other two have failed according to relevant information (such as the reception condition of the heartbeat packet), and then can send control information to ensure that the control device works normally. The specific implementation of the computing unit group 2 determining that the computing unit group 1 and / or the control unit has failed can refer to the method of the first computing unit group determining that the second computing unit group and the control unit have failed, which will not be described here. In actual implementation, the priority between the vehicle control channel 2 and the vehicle control channel 3 can be set in advance to prevent conflict between the control information sent by the vehicle control channel 2 and the vehicle control channel 3 in the case that the control unit fails. For example, the priority of the vehicle control channel 2 can be set to be higher than the priority of the vehicle control channel 3, so that when the control unit fails, the control device sends vehicle control information through the computing unit group 1 (i.e., the vehicle control channel 2).

[0134] In some implementations, the first group of computing units is powered by a first power supply module, the second group of computing units is powered by a second power supply module, and the control unit is powered by a third power supply module. The first power supply module is powered by a first power supply line, the second power supply module is powered by a second power supply line, and the third power supply module is powered by the first power supply line and the second power supply line in combination.

[0135] In some implementations, the first access unit is powered by a first power supply module, the second access unit is powered by a second power supply module, and the network forwarding unit is powered by a third module, so as to simplify the layout of wires in the control device.

[0136] For ease of understanding, the power supply architecture of the control device provided by the embodiments of the present application is described below in combination with FIG. 8. As shown in FIG. 8, the first group of computing units and the first access unit are powered by a low-voltage bus A power supply module, the second group of computing units and the second access unit are powered by a low-voltage bus B power supply module, and the network forwarding unit and the control unit are powered by a low-voltage bus A / B combined power supply module. The low-voltage bus A power supply module is connected to the power supply system through a low-voltage bus A, the low-voltage bus B power supply module is connected to the power supply system through a low-voltage bus B, and the low-voltage bus A / B combined power supply module is powered by the low-voltage bus A and the low-voltage bus B in combination. The low-voltage bus A can be regarded as an example of the first power supply line, the low-voltage bus B can be regarded as an example of the second power supply line, the low-voltage bus A power supply module can be regarded as an example of the first power supply module, the low-voltage bus B power supply module can be regarded as an example of the second power supply module, and the low-voltage bus A / B combined power supply module can be regarded as an example of the third power supply module.

[0137] It can be understood that when a single bus or a single power supply module fails, the remaining one group of computing units and the control unit can still work normally, and other sensors except one group of A-type sensors (group 1 or group 2 of A-type sensors) can still access the normally working group of computing units, which helps to ensure less loss of sensor signals and helps to ensure that the generated vehicle control information is highly reliable, thereby improving the functional safety of the control device.

[0138] The architecture of the control device and the communication relationship between the components are described above in combination with FIG. 2 to FIG. 8. Based on the foregoing control device, the embodiment of the present application further provides a control method, which can include: when the first computing unit group, the second computing unit group and the control unit are all normal, sending, by the control unit, first control information, the first control information being used for controlling the vehicle and being generated by the first computing unit group or the second computing unit group according to the signals received by the sensors; when the second computing unit group is faulty, and the first computing unit group and the control unit are both normal, sending, by the control unit, second control information, the second control information being used for controlling the vehicle and being generated by the first computing unit group according to the signals received by the sensors; when the first computing unit group is faulty, and the second computing unit group and the control unit are both normal, sending, by the control unit, third control information, the third control information being used for controlling the vehicle and being generated by the second computing unit group according to the signals received by the sensors; when the control unit is faulty, and the first computing unit group and the second computing unit group are both normal, sending, by the first computing unit group, fourth control information, the fourth control information being used for controlling the vehicle and being generated by the first computing unit group according to the signals received by the sensors; or when the control unit and the first computing unit group are faulty, and the second computing unit group is normal, sending, by the second computing unit group, fifth control information, the fifth control information being used for controlling the vehicle and being generated by the first computing unit group according to the signals received by the sensors.

[0139] Exemplarily, the first control information, the second control information, the third control information, the fourth control information and the fifth control information can be some examples of the control information in the foregoing embodiments.

[0140] In some implementations, the method further includes: the first computing unit group receiving state indication information from the second computing unit group and first information from the control unit, wherein the state indication information indicates whether the working state of the control unit is normal, and the first information indicates the working state of the control unit; and sending, by the first computing unit group, the fourth control information, including: when the first computing unit group determines that the state indication information indicates that the working state of the control unit is abnormal, and the first information or the receiving condition of the first information indicates that the working state of the control unit is abnormal, the first computing unit group determines that the control unit is faulty, and sends the fourth control information.

[0141] In some implementations, the method further comprises: the first computing unit group receiving second information from the control unit through a first communication channel, the first computing unit group receiving third information from the control unit through a second communication channel, the second information and the third information both indicating the working state of the control unit; and the first computing unit group sending fourth control information, comprising: when the second information or the receiving condition of the second information indicates that the working state of the control unit is abnormal, and the third information or the receiving condition of the third information indicates that the working state of the control unit is abnormal, the first computing unit group determines that the control unit has a fault, and sends the fourth control information.

[0142] In some implementations, the first communication channel is a communication channel between the third type interface of the first computing unit group and the third type interface of the control unit, for example, the communication channel b' in the foregoing embodiments; and the second communication channel is a communication channel between the fifth type interface of the first computing unit group and the fifth type interface of the control unit, for example, the communication channel b" in the foregoing embodiments.

[0143] In some implementations, the method further comprises: the first computing unit group receiving fourth information from the second computing unit group through a third communication channel, the first computing unit group receiving fifth information from the control unit through a fourth communication channel, the fourth information and the fifth information both indicating the working state of the second computing unit group; and when the fourth information or the receiving condition of the fourth information indicates that the working state of the second computing unit group is abnormal, and the fifth information or the receiving condition of the fifth information indicates that the working state of the second computing unit group is abnormal, the first computing unit group determines that the second computing unit group has a fault.

[0144] In some implementations, the third communication channel is a communication channel between the second type interface of the first computing unit group and the second type interface of the second computing unit group, for example, the communication channel a1 in the foregoing embodiments; and the fourth communication channel is a communication channel between the sixth type interface of the first computing unit group and the sixth type interface of the second computing unit group, for example, the communication channel a2 in the foregoing embodiments.

[0145] The specific implementation in which the second computing unit group determines that the first computing unit group has a fault can refer to the description in the foregoing embodiments, which will not be described herein again.

[0146] In some embodiments, the method further comprises: receiving, by the second computing unit group, sixth information from the control unit via a fifth communication channel, receiving, by the second computing unit group, seventh information from the control unit via a sixth communication channel, the sixth information and the seventh information both indicating the working state of the control unit; determining, by the second computing unit group, that the control unit is faulty when the sixth information or the reception condition of the sixth information indicates that the working state of the control unit is abnormal, and the seventh information or the reception condition of the seventh information indicates that the working state of the control unit is abnormal; and sending, by the second computing unit group, fifth control information, comprising: sending the fifth control information when the second computing unit group determines that the first computing unit group is faulty.

[0147] In some embodiments, the fifth communication channel is a communication channel between a fourth type interface of the second computing unit group and a fourth type interface of the control unit, for example, the communication channel c1 in the foregoing embodiments; and the sixth communication channel is a communication channel between a ninth type interface of the second computing unit group and a ninth type interface of the control unit, for example, the communication channel c2 in the foregoing embodiments.

[0148] For the parts of the method not described in detail, reference can be made to the description in the foregoing embodiments, which will not be described herein again.

[0149] In various embodiments of the present application, the terms and / or descriptions of various embodiments are consistent and can be referred to each other if there is no special description and logical conflict, and the technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationship.

[0150] FIG. 9 is another schematic block diagram of a control device provided by an embodiment of the present application. The control device 2100 shown in FIG. 9 can include a processor 2110, a transceiver 2120, and a memory 2130. The processor 2110, the transceiver 2120, and the memory 2130 are connected through an internal connection path. The memory 2130 is configured to store instructions, and the processor 2110 is configured to execute the instructions stored in the memory 2130 to implement the control method in the foregoing embodiments. Optionally, the memory 2130 can be coupled to the processor 2110 through an interface, or the memory 2130 can be integrated with the processor 2110.

[0151] It should be noted that the transceiver 2120 can include but is not limited to a transceiving device such as an input / output interface to realize the communication between the device 2100 and other devices or communication networks.

[0152] The memory 2130 can be volatile memory and / or nonvolatile memory. The nonvolatile memory can be read-only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), electrically EPROM (EEPROM), or flash memory, for example. The volatile memory can be random access memory (RAM), for example. The RAM can be used as external cache memory, for example. By way of example and not limitation, RAM includes forms of memory such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0153] The transceiver 2120 uses a transceiving device such as, but not limited to, a transceiver to enable communication between the device 2100 and other devices or communication networks to receive / send data / information for implementing the methods in the above-described embodiments.

[0154] Embodiments of the present application also provide a controller, which includes the control device in the above-described embodiments. Exemplarily, the controller can be a domain controller, or can also be a vehicle-mounted central computer.

[0155] Embodiments of the present application also provide an intelligent driving device, which includes the control device in the above-described embodiments, or the intelligent driving device can also include the controller in the above-described embodiments.

[0156] The intelligent driving device related to the embodiments of the present application can include a road vehicle, a water vehicle, an air vehicle, an industrial device, an agricultural device, or an entertainment device, etc. For example, the intelligent driving device can be a vehicle, which is a general concept of a vehicle, and can be a vehicle (such as a commercial vehicle, a passenger vehicle, a motorcycle, a flying vehicle, a train, etc.), an industrial vehicle (such as a forklift, a trailer, a tractor, etc.), an engineering vehicle (such as an excavator, a bulldozer, a crane, etc.), an agricultural device (such as a mower, a harvester, etc.), an entertainment device, a toy vehicle, etc. The embodiments of the present application do not specifically limit the type of the vehicle.

[0157] In some implementations, the intelligent driving device includes the vehicle 100 shown in FIG. 1.

[0158] The embodiments of the present application also provide a computer program product, which includes computer program codes, and when the computer program codes are run on a computer, the computer is caused to implement the method in the above embodiments of the present application.

[0159] The embodiments of the present application also provide a computer readable storage medium, which stores computer instructions, and when the computer instructions are run on a computer, the computer is caused to implement the method in the above embodiments of the present application.

[0160] The embodiments of the present application also provide a chip, which includes a circuit for executing the method in the above embodiments of the present application.

[0161] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0162] In the description of the embodiments of the present application, unless otherwise specified, " / " represents the meaning of or, for example, A / B can represent A or B; "and / or" herein is a description of the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B can represent: A alone, A and B exist at the same time, and B alone. In the present application, "at least one" means one or more, and "multiple" means two or more. "At least one of the following" or similar expressions means any combination of these items, including any combination of single item or multiple items. For example, at least one of a, b, or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, and c can be single or multiple.

[0163] The prefix words such as "first", "second" are used in the embodiments of the present application only for the purpose of distinguishing different described objects, and have no limitation to the position, order, priority, quantity or content of the described objects. The use of the prefix words such as ordinal numbers in the embodiments of the present application has no limitation to the described objects, and the statement of the described objects should refer to the description in the claims or embodiments, and should not be construed as superfluous limitation.

[0164] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described above are only schematic, and the division of the units is only a logical function division, and there can be another division manner in actual implementation, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, device or unit, and can be electrical, mechanical or other forms.

[0165] In various embodiments of the present application, the terms and / or descriptions between various embodiments are consistent and can be mutually referred to if there is no special description and logical conflict, and the technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationship.

[0166] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0167] In addition, each functional unit in various embodiments of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit.

[0168] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto, and any skilled person in the art can easily think of changes or replacements within the technical range disclosed in the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A control device characterized by comprising: The device is applied to an intelligent driving equipment, and comprises a first computing unit group, a second computing unit group and a control unit. A first interface of the first computing unit group is configured to communicate with a first group of sensors of a first sensor group, and a second interface of the first computing unit group is configured to communicate with a second group of sensors of the first sensor group. A third interface of the second computing unit group is configured to communicate with the first group of sensors, and a fourth interface of the second computing unit group is configured to communicate with the second group of sensors, wherein the first interface, the second interface, the third interface and the fourth interface belong to a first type of interface. The first computing unit group and the second computing unit group communicate with each other through a second type of interface, the first computing unit group and the control unit communicate with each other through a third type of interface, and the second computing unit group and the control unit communicate with each other through a fourth type of interface. The first computing unit group and / or the second computing unit group generate control information according to received signals of sensors, and the control information is used to control the intelligent driving equipment. When the control unit does not fail, the device sends the control information through the control unit.

2. The apparatus of claim 1, wherein, The first computing unit group is powered by a first power supply module, the second computing unit group is powered by a second power supply module, and the control unit is powered by a third power supply module.

3. The apparatus of claim 2, wherein, The first power supply module is powered by a first power supply line, the second power supply module is powered by a second power supply line, and the third power supply module is powered by a combination of the first power supply line and the second power supply line.

4. The apparatus of any one of claims 1 to 3, wherein, The first computing unit group receives state indication information from the second computing unit group through the second type of interface, and the state indication information indicates whether the working state of the control unit is normal. The first computing unit group receives first information from the control unit through the third type of interface, and the first information indicates the working state of the control unit. When the state indication information indicates that the working state of the control unit is abnormal, and the first information or the reception condition of the first information indicates that the working state of the control unit is abnormal, the first computing unit determines that the control unit fails.

5. The apparatus of any one of claims 1 to 3, wherein, The first computing unit group and the control unit also communicate with each other through a fifth type of interface, and the third type of interface and the fifth type of interface are both used to transmit information related to the working state of the control unit.

6. The apparatus of claim 5, wherein, The first computing unit group receives second information from the control unit through the third type of interface, and the first computing unit group receives third information from the control unit through the fifth type of interface, wherein the second information and the third information both indicate the working state of the control unit. When the second information or the reception condition of the second information indicates that the working state of the control unit is abnormal, and the third information or the reception condition of the third information indicates that the working state of the control unit is abnormal, the first computing unit determines that the control unit fails.

7. The apparatus of claim 5 or 6, wherein, The first computing unit group and the second computing unit group also communicate through a sixth type interface, the second type interface and the sixth type interface are both used for transmitting information related to working states between the second computing unit group.

8. The apparatus of claim 7, wherein, The first computing unit group receives fourth information from the second computing unit group through the second type interface, and receives fifth information from the control unit through the sixth type interface, the fourth information and the fifth information both indicate working states of the second computing unit group. When the fourth information or the receiving condition of the fourth information indicates that the working state of the second computing unit group is abnormal, and the fifth information or the receiving condition of the fifth information indicates that the working state of the second computing unit group is abnormal, the first computing unit group determines that the second computing unit group fails.

9. The apparatus of any one of claims 1 to 8, wherein, The method further comprises: When the control unit fails, the device transmits the control information through the first computing unit group or the second computing unit group.

10. The apparatus of any one of claims 1 to 9, wherein, The first computing unit group generates first control information according to signals of the received sensors, and the second computing unit group generates second control information according to signals of the received sensors; the control information is associated with the first control information or the second control information.

11. The apparatus of claim 10, wherein, When the control unit fails, the device transmits the first control information through the first computing unit group, or the device transmits the second control information through the second computing unit group.

12. The apparatus of any one of claims 1-11, wherein, The first computing unit group and the second computing unit group further comprise a seventh type interface, the seventh type interface is used for communicating with sensors in a second type sensor group.

13. The apparatus of claim 12, wherein, The device further comprises a network forwarding unit, the second type sensor group respectively communicates with the first computing unit group and the second computing unit group through the seventh type interface of the network forwarding unit.

14. The apparatus of claim 12 or 13, wherein, The seventh type interface is an Ethernet interface.

15. The apparatus of any one of claims 1 to 14, wherein, The first computing unit group and the second computing unit group further comprise an eighth type interface, the eighth type interface is used for communicating with sensors in a third type sensor group.

16. The apparatus of claim 15, wherein, The control unit communicates with the sensors in the third type sensor group through the eighth type interface.

17. The apparatus of claim 15 or 16, wherein, The eighth type interface is a controller area network-flexible data interface.

18. The apparatus of any one of claims 1-17, wherein, The device further comprises a first access unit and a second access unit, the first group of sensors respectively communicate with the first computing unit group and the second computing unit group through the first type interface of the first access unit, and the second group of sensors respectively communicate with the first computing unit group and the second computing unit group through the first type interface of the second access unit.

19. The apparatus of any one of claims 1-18, wherein, The first type interface is a mobile industry processor interface.

20. The apparatus of any one of claims 1-19, wherein, The first group of sensors comprises at least one camera device arranged on a first side of the intelligent driving equipment, and the second group of sensors comprises at least one camera device arranged on a second side of the intelligent driving equipment.

21. A controller characterized by, The device comprises any one of claims 1 to 20.

22. An intelligent driving device, comprising: The device comprises any one of claims 1 to 20, or the controller of claim 21.

Images