A kind of automatic driving decision safety system and method

Abstract

The present invention provides an autonomous driving decision safety system and method, the system comprising a decision safety assessment subsystem and a decision safety response subsystem, the decision safety assessment subsystem comprising an input information safety assessment module, an input information failure warning module, a decision state safety assessment module and a decision state failure warning module connected in sequence, the decision safety response subsystem comprising an output information real-time recording module, an output information loss judgment and compensation module and a multiple safety response module connected in sequence, the decision state failure warning module in the decision safety assessment subsystem is connected to the multiple safety response modules in the decision safety response subsystem, and real-time supervision and response to decision safety or driving safety issues of autonomous driving vehicles are achieved based on vehicle safety assessment and vehicle safety response technologies, and the completeness of the execution logic or response measures of the running vehicle autonomous driving decision system under different environmental problems and environmental scenarios can be evaluated in real time, and various capabilities of the vehicle autonomous driving decision system can be evaluated.

Description

Technical Field

[0001] The present invention relates to the field of autonomous driving technology, and in particular to an autonomous driving decision-making safety system and method based on real-time safety assessment and emergency response technology. Background Art

[0002] As self-driving cars gradually enter people's daily lives in the future, the types of self-driving systems on the road will gradually become more numerous and complex. Although the promotion and application of self-driving technology have gradually become normalized, people's attention to the safety of different self-driving systems has remained high. Only safe self-driving vehicles can be accepted by consumers. The decision-making system in the self-driving system is the "brain" of the vehicle, and the completeness of its algorithm and execution logic is the key to determining the safety of the vehicle and its passengers. Therefore, it can be said to a certain extent that if the safety of the decision-making system can be guaranteed to the greatest extent, the overall safety of the vehicle will be greatly improved. In recent years, researchers in related fields have focused their research on safety on studying a safe and reliable decision-making system.

[0003] At present, each autonomous driving system R&D company or scientific research institution has different development strategies for the decision-making system, but they will invest the greatest R&D efforts to make unique innovations in the safety, stability, and efficiency of the decision-making system. Currently, the autonomous driving systems that have been widely used, including Tesla's FSD, Xiaopeng's NGP, and Weilai's NOP, do not open source their overall application solutions for the decision-making system to users. Therefore, it is still a big problem to generalize a decision-making safety system.

[0004] Today's safety assessment systems mainly use technologies such as adversarial vehicle simulation generation technology, FTPA analysis technology, and FTA analysis technology. These methods are all offline and require the vehicle's autonomous driving system to be placed in a virtual framework or scene to perform the collection and analysis of autonomous driving operation data. This often consumes a lot of testing time and is unable to perform status assessments on a real-time autonomous driving system. Some companies such as BMW and Audi have launched safety supervision algorithms for their own vehicle autonomous driving system decision systems, using the design pattern of a supervisory channel to increase the safety robustness of the overall system. However, this system that uses a single supervision assessment algorithm has certain limitations. It can only evaluate the decision system algorithm logic that it is familiar with, and the architecture is only applicable to its own company's autonomous driving system, and lacks generalization. Summary of the invention

[0005] In view of the problems existing in the above-mentioned existing safety assessment systems, such as the inability to perform status assessment on the autonomous driving system in real-time operation, the large amount of time consumed, the limitations and lack of generalization, the present invention provides an autonomous driving decision safety system, innovatively designs a safety protection system independent of the autonomous driving system, completes decision safety protection based on vehicle safety assessment and vehicle safety response technology, and can provide security for the autonomous driving system in all scenarios, especially in special or extreme scenarios. At the same time, it can also provide real-time problem assessment for the autonomous driving decision system of the running vehicle, point out the deficiencies in its algorithm design, and provide data support for the development and iteration of efficient and safe autonomous driving systems. The present invention also relates to an autonomous driving decision safety method.

[0006] The technical solution of the present invention is as follows:

[0007] An automatic driving decision safety system, characterized in that it comprises a decision safety assessment subsystem and a decision safety response subsystem, wherein the decision safety assessment subsystem comprises an input information safety assessment module, an input information failure warning module, a decision state safety assessment module and a decision state failure warning module connected in sequence, and the decision safety response subsystem comprises an output information real-time recording module, an output information distrust judgment and compensation module and a multiple safety response module connected in sequence, and the decision state failure warning module in the decision safety assessment subsystem is connected to the multiple safety response modules in the decision safety response subsystem,

[0008] The input information safety assessment module is used to perform safety assessment on the input information of the vehicle automatic driving decision system and generate assessment information; the input information failure warning module assesses the safety level of the vehicle input information according to the assessment information and a preset first threshold of the adaptive safety level; the decision state safety assessment module calculates the vehicle automatic driving decision system state assessment information according to the safety level of the vehicle input information, combined with the output information of the vehicle automatic driving decision system and the vehicle operation state obtained based on the vehicle automatic driving perception system; the decision system failure warning module divides the vehicle automatic driving decision system into different levels of dangerous state warning levels according to the vehicle automatic driving decision system state assessment information and a set second threshold of the adaptive safety level;

[0009] The output information real-time recording module is used to record the output information of the vehicle's automatic driving perception system in real time; the output information breach judgment and compensation module makes a breach judgment and compensates for the output information of the vehicle's automatic driving perception system based on the safety level of the vehicle's input information; the multiple safety response module performs the best action response based on the divided dangerous state warning level and the compensated output information of the vehicle's automatic driving perception system provided by the output information breach judgment and compensation module to provide safety protection for the automatic driving vehicle.

[0010] Preferably, the input information security assessment module includes an input information untrustworthy submodule, a human misoperation submodule and an input device hardware failure submodule, and the input information untrustworthy submodule is used to identify untrustworthy situations of different sensor information, including GPS information untrustworthy, laser radar information untrustworthy, camera information untrustworthy and millimeter wave radar information untrustworthy;

[0011] The personnel misoperation submodule is used to identify personnel misoperation situations, including mis-touching of vehicle control mechanisms and mis-touching of human-computer interaction mechanisms;

[0012] The input device hardware fault submodule is used to identify and determine the fault status of sensor hardware devices, including GPS fault, lidar fault, camera fault and millimeter wave radar fault.

[0013] Preferably, the decision state safety assessment module includes a decision system output information assessment submodule and a vehicle state assessment submodule. The decision system output information assessment submodule utilizes the collected vehicle automatic driving decision system output information to assess the real-time working condition of the vehicle automatic driving decision system through the state of the vehicle automatic driving decision system output information. The vehicle state assessment submodule is used to assess the safety of the automatic driving decision system, and calculates the vehicle automatic driving decision system state assessment information according to the safety level of the vehicle input information, combined with the output information of the vehicle automatic driving decision system and the vehicle operating state obtained based on the vehicle automatic driving perception system.

[0014] Preferably, the decision system output information evaluation submodule determines that the vehicle autonomous driving decision system hardware has failed when the vehicle autonomous driving decision system does not output normal information, and determines that the vehicle autonomous driving decision system software program is running lagging when the vehicle autonomous driving decision system outputs information at an insufficient frequency.

[0015] Preferably, the multiple safety response modules include a secondary decision-making submodule, an active degradation submodule, an emergency risk avoidance submodule and a safe stop submodule. The secondary decision-making submodule is used to perform a secondary decision operation when the vehicle's automatic driving is in a light safety level state to ensure the continued normal operation of the automatic driving system. The active degradation module is used to perform a safety level reduction operation when the vehicle's automatic driving is in a medium safety level state. The emergency risk avoidance module is used to perform an emergency risk avoidance operation when the vehicle's automatic driving is in a severe safety level state to avoid responsibility or protect the safety of passengers. The safe stop module is used to perform emergency stops, pullover parking, passenger takeover or specific function exit operations on vehicle equipment when the vehicle's automatic driving is in a specific danger level range.

[0016] Preferably, the output information dishonesty judgment and compensation module includes a historical information storage submodule, and the historical information storage submodule uses a Kalman filtering algorithm to compensate for the output information of the dishonest vehicle automatic driving perception system.

[0017] An automatic driving decision-making safety method, characterized by comprising the following steps:

[0018] Input information security assessment step: Conduct security assessment on the input information of the vehicle's autonomous driving decision system and generate assessment information;

[0019] Input information failure warning step: evaluating the safety level of vehicle input information according to the generated evaluation information and a preset adaptive safety level first threshold;

[0020] Decision status safety assessment step: according to the safety level of the vehicle input information, combined with the output information of the vehicle automatic driving decision system and the vehicle operation status obtained based on the vehicle automatic driving perception system, the vehicle automatic driving decision system status assessment information is calculated;

[0021] Decision system failure warning step: dividing the vehicle automatic driving decision system into different levels of dangerous state warning levels according to the vehicle automatic driving decision system state evaluation information and the set adaptive safety level second threshold;

[0022] Output information real-time recording step: real-time recording of the output information of the vehicle's autonomous driving perception system;

[0023] Output information breach judgment and compensation step: based on the safety level of the vehicle input information, the output information of the vehicle's autonomous driving perception system is judged to be breached and compensated;

[0024] Multiple safety response steps: Based on the divided dangerous state warning level, the output information of the vehicle's autonomous driving perception system after compensation provided by the output information loss judgment and compensation step is combined to make the best action response to provide safety protection for the autonomous driving vehicle.

[0025] Preferably, the decision state safety assessment step also determines whether the software and hardware of the vehicle's automatic driving decision system fails based on the state of the vehicle's automatic driving decision system output information. When the vehicle's automatic driving decision system does not output normal information, it is determined that the vehicle's automatic driving decision system hardware fails. When the vehicle's automatic driving decision system outputs information at an insufficient frequency, it is determined that the vehicle's automatic driving decision system software program is running lagging.

[0026] Preferably, the action responses in the multiple safety response steps include executing secondary decision-making operations, safety level reduction operations, emergency risk avoidance operations, and emergency stopping, pulling over, occupant takeover or specific function exit operations of vehicle equipment to avoid responsibility or protect the personal safety of occupants.

[0027] The beneficial effects of the present invention are:

[0028] The present invention provides an automatic driving decision safety system and method, including a decision safety assessment subsystem and a decision safety response subsystem. The decision safety assessment subsystem includes an input information safety assessment module, an input information failure warning module, a decision state safety assessment module and a decision state failure warning module. The decision safety response subsystem includes an output information real-time recording module, an output information loss judgment and compensation module and a multiple safety response module. The modules work together to evaluate the completeness of the execution logic or response measures of the vehicle automatic driving decision system under different environmental problems and environmental scenarios through the input information safety assessment module, the input information failure warning module, the decision state safety assessment module and the decision state failure warning module, and evaluate the various capabilities of the vehicle automatic driving decision system; when problems are found, safety protection is performed through the output information real-time recording module, the output information loss judgment and compensation module and the multiple safety response module, and the deficiencies in the algorithm design of the vehicle automatic driving decision system are pointed out, so as to provide data support for the development and iteration of efficient and safe automatic driving systems, and enhance the development and iteration efficiency of advanced automatic driving decision systems.

[0029] Existing vehicle autonomous driving systems are composed of three parts: a vehicle autonomous driving perception system, a vehicle autonomous driving decision-making system and a vehicle autonomous driving control system. Among them, the vehicle autonomous driving perception system is used to perceive the real-time environmental information of the vehicle, and output the perceived non-dishonest information to the vehicle autonomous driving decision-making system for processing. The output information of the vehicle autonomous driving decision-making system is transmitted to the vehicle autonomous driving control system for control.

[0030] The present invention innovatively designs a safety protection system that is independent of the autonomous driving system. Based on vehicle safety assessment and vehicle safety response technology, it realizes real-time supervision and response to decision-making safety or driving safety issues of autonomous driving vehicles. It can provide protection for the safety of autonomous driving systems in all scenarios, especially in special or extreme scenarios. During operation, it can not only provide maximum safety protection for autonomous driving vehicles, but also provide a basis for the improvement of future autonomous driving decision-making systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a structural schematic diagram of the automatic driving decision-making safety system of the present invention.

[0032] Figure 2 It is a structural diagram of the input information security assessment module of the present invention.

[0033] Figure 3 It is a structural diagram of the decision-making state security assessment module of the present invention.

[0034] Figure 4 It is a schematic diagram of the preferred structure of the multiple security response module of the present invention.

[0035] Figure 5 It is a flow chart of the automatic driving decision-making safety method of the present invention. DETAILED DESCRIPTION

[0036] The present invention will be described below in conjunction with the accompanying drawings.

[0037] In order to solve the shortcomings of the existing safety assessment system, the present invention proposes an automatic driving decision-making safety system, the structure of which is as follows: Figure 1As shown, it includes a decision safety assessment subsystem and a decision safety response subsystem. The decision safety assessment subsystem provides problem assessment for the vehicle automatic driving decision system, points out the deficiencies in its algorithm design, and provides data support for the development and iteration of efficient and safe automatic driving systems. It includes an input information safety assessment module, an input information failure warning module, a decision state safety assessment module, and a decision state failure warning module connected in sequence. The decision safety response subsystem includes an output information real-time recording module, an output information loss judgment and compensation module, and a multiple safety response module connected in sequence. The decision state failure warning module in the decision safety assessment subsystem is connected to the multiple safety response modules in the decision safety response subsystem. Among them, since the input information of the vehicle automatic driving decision system has a great influence on the decision safety, the evaluation of the vehicle automatic driving decision system capability also needs to consider its processing capabilities of the perception data output by the vehicle perception system and positioning data in a loss of trust state. Therefore, the input information safety assessment module is used to perform a safety assessment on the input information of the vehicle automatic driving decision system, and to perform input information loss detection, personnel misoperation detection, input device hardware failure detection, and other evaluations.

[0038] It should be noted that the vehicle's autonomous driving system consists of three parts: the vehicle's autonomous driving perception system, the vehicle's autonomous driving decision-making system and the vehicle's autonomous driving control system. Among them, the vehicle's autonomous driving perception system is used to perceive the real-time environmental information of the vehicle, and output the perceived non-dishonest information to the vehicle's autonomous driving decision-making system for processing. The output information of the vehicle's autonomous driving decision-making system is transmitted to the vehicle's autonomous driving control system for control.

[0039] Specifically, the structure of the input information security assessment module is as follows: Figure 2As shown, it includes an input information distrust submodule, a personnel misoperation submodule and an input device hardware failure submodule. The input information distrust submodule includes GPS information distrust, LiDAR information distrust, camera information distrust and millimeter wave radar information distrust. The distrust of different sensor information is identified by adopting a sensor data model-based method combined with a historical data-driven judgment method. In addition, the vehicle's global perception system can be used to further identify problems with input information and improve the ability to judge distrust. The personnel misoperation submodule includes mis-touching of vehicle control mechanisms and mis-touching of human-computer interaction mechanisms. For example, by judging whether the accelerator pedal is mis-touched, the steering wheel is mis-touched, etc. Misoperation, etc., to identify human misoperation; the input device hardware failure submodule includes GPS failure, lidar failure, camera failure and millimeter wave radar failure, which uses the fault judgment information of the sensor for identification, and combines the method driven by special scenario data to judge the fault status of the sensor hardware device; after conducting a safety assessment on the input information of the vehicle's automatic driving decision-making system, the evaluation information is generated and output to the input information failure warning module. The input information failure warning module evaluates the safety level of the vehicle's input information based on the evaluation information and the pre-set first threshold of the adaptive safety level, and outputs it to the decision-making state safety assessment module for further use.

[0040] The structure of the decision-making state security assessment module is as follows: Figure 3As shown, it includes a decision system output information evaluation submodule and a vehicle state evaluation submodule. The decision system output information evaluation submodule collects the output information of the vehicle's automatic driving decision system, and judges the real-time working status of the decision system through reverse reasoning of the state of the vehicle's automatic driving decision system output information. When the vehicle's automatic driving decision system does not have normal information output, it is determined that the vehicle's automatic driving decision system hardware has failed. When the vehicle's automatic driving decision system outputs information at an insufficient frequency, it is determined that the vehicle's automatic driving decision system software program is running lagging. The vehicle state evaluation submodule can be adapted to a global perception system including intelligent tire equipment. During the automatic driving process, the comprehensive safety assessment index of the automatic driving vehicle is obtained through operations such as safe calculation of the friction coefficient of the vehicle's driving road, safe calculation of road roughness, calculation of potential energy field, calculation of trajectory hazard, matching calculation of environmental state dangerous accident set, and calculation of reachable set intersection. At the same time, the vehicle's autonomous driving decision system status evaluation information can be calculated based on the safety level of the vehicle's input information (i.e., the perception information breach level) in combination with the output information of the vehicle's autonomous driving decision system and the vehicle's operating status obtained based on the vehicle's autonomous driving perception system, that is, the tolerance for receiving inaccurate perception information in special scenarios, so as to further evaluate the safety of the autonomous driving decision system; the evaluation information of the decision system output information evaluation submodule and the vehicle status evaluation submodule are then integrated to obtain comprehensive evaluation information or a comprehensive evaluation index, and the evaluation results will be provided to the decision system failure warning module, which can divide the vehicle's autonomous driving decision system into different levels of dangerous status warning levels based on the vehicle's autonomous driving decision system status evaluation information and the set second threshold of the adaptive safety level, and output them to multiple safety response modules.

[0041] The decision-making safety response subsystem includes an output information real-time recording module, an output information loss judgment and compensation module, and a multiple safety response module, which are connected in sequence. The output information real-time recording module will record the information perceived by the vehicle perception system, that is, the output information of the vehicle's automatic driving perception system in real time. In addition, since the vehicle perception system sometimes loses information in the process of perceiving environmental information, such as errors in obstacle labels perceived by visual perception on rainy days, or information loss, the output information loss judgment and compensation module will judge whether the above-mentioned perceived environmental information has lost trust based on the safety level of the vehicle's input information. If it is judged that the perceived environmental information has indeed lost trust, the Kalman filtering algorithm is used to compensate for the lost environmental information to obtain accurate environmental information, and the compensated accurate environmental information is output to the multiple safety response modules.

[0042] The multiple safety response modules will take different safety response measures to ensure the safety of passengers and vehicles according to the warning level and request of the dangerous state of the vehicle autonomous driving decision system provided by the decision system failure warning module, and the accurate surrounding environment information of the current autonomous driving vehicle provided by the output information loss judgment and compensation module. The structure of the decision safety response subsystem is as follows: Figure 4 As shown, it includes a secondary decision-making submodule, an active degradation submodule, an emergency avoidance submodule and a safe stop submodule. The secondary decision-making submodule executes a secondary decision based on the global perception system or a secondary decision operation selected by the occupant when the vehicle's automatic driving is in a light safety level state to ensure the continued normal operation of the automatic driving system; the active degradation module executes an operation of reducing the safety level or reducing the aggressiveness of automatic driving when the vehicle's automatic driving is in a medium safety level state; the emergency avoidance module executes an emergency avoidance operation to avoid responsibility or protect the safety of the occupants when the vehicle's automatic driving is in a severe safety level state; the safe stop module requires emergency stopping, pulling over, occupant takeover or specific function exit of the vehicle equipment when the vehicle's automatic driving is in a specific danger level range, such as when the vehicle is about to collide with pedestrians in front or is about to drive onto an abnormal road.

[0043] It should be noted that the decision safety response subsystem and the decision safety assessment subsystem always run simultaneously. During the safety response process, the decision safety assessment subsystem continuously monitors the vehicle status and can adjust or change the safety response strategy at any time to ensure the maximum degree of autonomous driving safety protection function.

[0044] The present invention also relates to an automatic driving decision-making safety method, which corresponds to the above-mentioned automatic driving decision-making safety system and can be understood as an implementation method of the above-mentioned automatic driving decision-making safety system. The method includes an input information security assessment step, an input information failure warning step, a decision state security assessment step, a decision system failure warning step, an output information real-time recording step, an output information loss judgment and compensation step, and multiple safety response steps, such as Figure 5 As shown,

[0045] An input information security assessment step is to conduct a security assessment on the input information of the vehicle's autonomous driving decision system and generate assessment information;

[0046] an input information failure warning step, evaluating the safety level of the vehicle input information according to the generated evaluation information and a preset adaptive safety level first threshold;

[0047] A decision state safety assessment step, which calculates vehicle autonomous driving decision system state assessment information based on the safety level of vehicle input information, combined with the output information of the vehicle autonomous driving decision system and the vehicle operating state obtained based on the vehicle autonomous driving perception system;

[0048] A decision system failure warning step, dividing the vehicle automatic driving decision system into different levels of dangerous state warning levels according to the vehicle automatic driving decision system state evaluation information and the set adaptive safety level second threshold;

[0049] The step of recording output information in real time is to record the output information of the vehicle's automatic driving perception system in real time;

[0050] An output information breach judgment and compensation step, which judges and compensates for the breach of trust of the output information of the vehicle's automatic driving perception system based on the safety level of the vehicle's input information;

[0051] Multiple safety response steps, based on the divided dangerous state warning level, combined with the output information loss judgment and compensation step provided by the compensated vehicle autonomous driving perception system output information, make the best action response to provide safety protection for the autonomous driving vehicle.

[0052] Preferably, the decision state safety assessment step also determines whether the software and hardware of the vehicle's autonomous driving decision system fails based on the state of the vehicle's autonomous driving decision system output information. When the vehicle's autonomous driving decision system does not have normal input information output, it is determined that the vehicle's autonomous driving decision system hardware has failed. When the vehicle's autonomous driving decision system outputs information at an insufficient frequency, it is determined that the vehicle's autonomous driving decision system software program is running lagging.

[0053] Preferably, the action responses in the multiple safety response steps include executing secondary decision operations, safety level reduction operations, emergency risk avoidance operations, and emergency stops, pullovers, occupant takeovers, or specific function exits of vehicle equipment to avoid responsibility or protect the personal safety of occupants.

[0054] The present invention provides an objective and scientific autonomous driving decision-making safety system and method, innovatively designs a safety protection system independent of the autonomous driving system, and realizes real-time supervision and response to decision-making safety or driving safety issues of autonomous driving vehicles based on vehicle safety assessment and vehicle safety response technology. It can provide protection for the safety of autonomous driving systems in all scenarios, especially in special or extreme scenarios. It can also evaluate the completeness of the execution logic or response measures of the vehicle's autonomous driving decision-making system under different environmental problems and environmental scenarios, evaluate the various capabilities of the vehicle's autonomous driving decision-making system, and provide safety protection when problems are found. At the same time, it points out the deficiencies in the algorithm design of the vehicle's autonomous driving decision-making system, provides data support for the development and iteration of efficient and safe autonomous driving systems, and enhances the development and iteration efficiency of advanced autonomous driving decision-making systems.

[0055] It should be noted that the above-described specific implementations can enable those skilled in the art to more fully understand the invention, but do not limit the invention in any way. Therefore, although this specification has described the invention in detail with reference to the drawings and embodiments, those skilled in the art should understand that the invention can still be modified or replaced by equivalents. In short, all technical solutions and improvements that do not deviate from the spirit and scope of the invention should be included in the protection scope of the patent for the invention.

Claims

1. An automatic driving decision safety system, characterized in that: It includes a decision security assessment subsystem and a decision security response subsystem. The decision security assessment subsystem includes an input information security assessment module, an input information failure warning module, a decision state security assessment module and a decision state failure warning module connected in sequence. The decision security response subsystem includes an output information real-time recording module, an output information dishonesty judgment and compensation module and a multiple security response module connected in sequence. The decision state failure warning module in the decision security assessment subsystem is connected to the multiple security response modules in the decision security response subsystem. The input information safety assessment module is used to perform safety assessment on the input information of the vehicle automatic driving decision system and generate assessment information; the input information failure warning module assesses the safety level of the vehicle input information according to the assessment information and a preset adaptive safety level first threshold; The decision state safety assessment module calculates the vehicle automatic driving decision system state assessment information according to the safety level of the vehicle input information, combined with the output information of the vehicle automatic driving decision system and the vehicle operation state obtained based on the vehicle automatic driving perception system; the decision system failure warning module divides the vehicle automatic driving decision system into different levels of dangerous state warning levels according to the vehicle automatic driving decision system state assessment information and the set adaptive safety level second threshold; The output information real-time recording module is used to record the output information of the vehicle's automatic driving perception system in real time; the output information breach judgment and compensation module makes a breach judgment and compensates for the output information of the vehicle's automatic driving perception system based on the safety level of the vehicle's input information; the multiple safety response module performs the best action response based on the divided dangerous state warning level and the compensated output information of the vehicle's automatic driving perception system provided by the output information breach judgment and compensation module to provide safety protection for the automatic driving vehicle.

2. The automatic driving decision safety system according to claim 1, characterized in that: The input information security assessment module includes an input information untrustworthiness submodule, a human misoperation submodule, and an input device hardware failure submodule. The input information untrustworthiness submodule is used to identify untrustworthiness of different sensor information, including GPS information untrustworthiness, laser radar information untrustworthiness, camera information untrustworthiness, and millimeter wave radar information untrustworthiness; The personnel misoperation submodule is used to identify personnel misoperation situations, including mis-touching of vehicle control mechanisms and mis-touching of human-computer interaction mechanisms; The input device hardware fault submodule is used to identify and determine the fault status of sensor hardware devices, including GPS fault, lidar fault, camera fault and millimeter wave radar fault.

3. The automatic driving decision safety system according to claim 1, characterized in that: The decision state safety assessment module includes a decision system output information assessment submodule and a vehicle state assessment submodule. The decision system output information assessment submodule utilizes the collected vehicle automatic driving decision system output information to assess the real-time working status of the vehicle automatic driving decision system through the state of the vehicle automatic driving decision system output information. The vehicle state assessment submodule is used to assess the safety of the automatic driving decision system, and calculates the vehicle automatic driving decision system state assessment information according to the safety level of the vehicle input information, combined with the output information of the vehicle automatic driving decision system and the vehicle operating state obtained based on the vehicle automatic driving perception system.

4. The automatic driving decision safety system according to claim 3, characterized in that: The decision system output information evaluation submodule determines that the vehicle automatic driving decision system hardware has failed when the vehicle automatic driving decision system does not have normal information output, and determines that the vehicle automatic driving decision system software program is running lagging when the vehicle automatic driving decision system outputs information at an insufficient frequency.

5. The automatic driving decision safety system according to claim 1, characterized in that: The multiple safety response module includes a secondary decision-making submodule, an active degradation submodule, an emergency avoidance submodule and a safe stop submodule. The secondary decision-making submodule is used to perform secondary decision operations when the vehicle's automatic driving is in a light safety level state to ensure the continued normal operation of the automatic driving system. The active degradation module is used to perform safety level reduction operations when the vehicle's automatic driving is in a medium safety level state. The emergency avoidance module is used to perform emergency avoidance operations when the vehicle's automatic driving is in a severe safety level state to avoid responsibility or protect the safety of passengers. The safe stop module is used to perform emergency stops, pullover parking, passenger takeover or specific function exit operations on vehicle equipment when the vehicle's automatic driving is in a specific danger level range.

6. The automatic driving decision safety system according to claim 1, characterized in that: The output information dishonesty judgment and compensation module includes a historical information storage submodule, and the historical information storage submodule uses a Kalman filtering algorithm to compensate for the output information of the vehicle automatic driving perception system that has lost trust.

7. A method for safe autonomous driving decision making, characterized in that: The following steps are involved: Input information security assessment step: Conduct security assessment on the input information of the vehicle's autonomous driving decision system and generate assessment information; Input information failure warning step: evaluating the safety level of vehicle input information according to the generated evaluation information and a preset adaptive safety level first threshold; Decision status safety assessment step: according to the safety level of the vehicle input information, combined with the output information of the vehicle automatic driving decision system and the vehicle operation status obtained based on the vehicle automatic driving perception system, the vehicle automatic driving decision system status assessment information is calculated; Decision system failure warning step: dividing the vehicle automatic driving decision system into different levels of dangerous state warning levels according to the vehicle automatic driving decision system state evaluation information and the set adaptive safety level second threshold; Output information real-time recording step: real-time recording of the output information of the vehicle's autonomous driving perception system; Output information breach judgment and compensation step: based on the safety level of the vehicle input information, the output information of the vehicle's autonomous driving perception system is judged to be breached and compensated; Multiple safety response steps: Based on the divided dangerous state warning level, the output information of the vehicle's autonomous driving perception system after compensation provided by the output information loss judgment and compensation step is combined to make the best action response to provide safety protection for the autonomous driving vehicle.

8. The autonomous driving decision-making safety method according to claim 7, characterized in that: The decision state safety assessment step also determines whether the software and hardware of the vehicle's automatic driving decision system are faulty based on the state of the vehicle's automatic driving decision system output information. When the vehicle's automatic driving decision system does not output normal information, it is determined that the vehicle's automatic driving decision system hardware is faulty. When the vehicle's automatic driving decision system outputs information at an insufficient frequency, it is determined that the vehicle's automatic driving decision system software program is running lagging.

9. The autonomous driving decision-making safety method according to claim 7, characterized in that: The action responses in the multiple safety response steps include executing secondary decision-making operations, safety level reduction operations, emergency risk avoidance operations, and emergency stopping, pulling over, occupant takeover, or specific function exit operations of vehicle equipment to avoid responsibility or protect the personal safety of occupants.

Images