A fault-tolerant autonomous driving computing platform

Abstract

The present invention discloses an automatic driving computing platform with fault tolerance function, including: an environment perception module for acquiring vehicle surrounding environment information; an information exchange module connected to the environment perception module for fusing the environment information; a decision module connected to the information exchange module for outputting a decision result according to the fused information; a voting unit connected to the decision module for voting on the decision result; and an execution unit connected to the voting unit for controlling the operation of the vehicle according to the voting result. The present invention enables the automatic driving vehicle to have computing fault tolerance through redundant decision modules and voting units, avoids problems such as unreasonable target arbitration and traffic accidents and safety hazards caused by decision errors due to a single computing module, and improves the safety and reliability of automatic driving technology.

Description

Technical Field

[0001] The present invention relates to the field of autonomous driving safety technology, and in particular to an autonomous driving computing platform with a fault-tolerant function. Background Art

[0002] Autonomous vehicles (Self-driving automobile) are cutting-edge technologies that rely on the combination of computer and artificial intelligence technology and complex hardware and software. Without human control, they mainly perceive the surrounding environment information of the road through the fusion of sensors, combine high-precision maps and high-precision positioning to achieve path planning, and control the movement of the vehicle after making decisions to complete complete, safe and effective driving.

[0003] In recent years, the technology of self-driving cars has made rapid progress, and it is gradually approaching practical application in the 21st century. During the process of vehicle self-driving, the perception and positioning information received by the sensor is particularly important in the behavior decision-making and control of the vehicle. However, at present, there are still many limitations in self-driving technology, such as incomplete consideration of target usage scenarios, resulting in the system's inability to accurately identify environmental factors; unreasonable function arbitration logic, resulting in system decision errors; insufficient actuator response capability, resulting in motion control deviation from expectations, etc., which makes it difficult to effectively meet the development needs of the widespread application of self-driving car technology. Summary of the invention

[0004] The purpose of the present invention is to provide an automatic driving computing platform with fault tolerance function to effectively ensure the driving safety of the vehicle.

[0005] To achieve the above object, the present invention provides the following solutions:

[0006] An autonomous driving computing platform with fault tolerance function, comprising:

[0007] Environmental perception module, used to obtain information about the vehicle's surroundings;

[0008] An information exchange module, connected to the environment perception module, for fusing the environment information;

[0009] A decision-making module, connected to the information exchange module, for outputting a decision result based on the fused information;

[0010] A voting unit, connected to the decision module, for voting on the decision result;

[0011] The execution unit is connected to the voting unit and is used to control the operation of the vehicle according to the voting result.

[0012] Optionally, the environmental perception module includes Beidou / GPS, a lidar, a binocular camera and a sensor group; the sensor group includes a GNSS sensor and an INS sensor.

[0013] Optionally, the decision module includes three computing units with the same structure; the computing units include:

[0014] A main decision subunit, connected to the information exchange module, for outputting a decision result based on the fused information;

[0015] The security management strategy is used to monitor the running time, running results, configuration parameters and running status of the main decision-making subunit.

[0016] Optionally, the main decision subunit includes:

[0017] A graphics processor, connected to the information exchange module, for extracting features from the fused information according to a built-in neural network algorithm;

[0018] A controller, used to collect monitoring information of vehicles and vehicle personnel;

[0019] The central core processor is connected to the graphics processor and the controller respectively, and is used to output a decision result according to the extracted features and the monitoring information.

[0020] Optionally, the voting unit includes three safety voting devices with the same structure.

[0021] Optionally, the autonomous driving computing platform further includes: three fault detection units, which are respectively connected to the computing unit and the safety voter for performing fault detection.

[0022] Optionally, the autonomous driving computing platform further includes: three status indication units, which are connected to the fault detection unit for displaying fault status.

[0023] According to the specific embodiments provided by the present invention, the present invention discloses the following technical effects:

[0024] The present invention enables the autonomous driving car to have computational fault tolerance through redundant decision modules and voting units, avoiding the problems of unreasonable target arbitration, traffic accidents and safety hazards caused by decision errors caused by a single computing module. Therefore, compared with the existing technical means, the autonomous driving computing platform provided by the present invention greatly ensures the technical difficulties of autonomous driving cars failing due to decision errors, effectively improves the safety and reliability of autonomous driving cars, meets the existing development needs and greatly improves the efficiency of road traffic safety, thereby providing the public with a convenient, efficient, green and safe travel environment, and has broad application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0026] Figure 1 A schematic diagram of the structure of an autonomous driving computing platform with fault tolerance provided by the present invention;

[0027] Figure 2 A schematic diagram of the structure of a computing unit provided by the present invention;

[0028] Figure 3 A schematic diagram of the structure of the safety voting device provided by the present invention;

[0029] Figure 4 This is a structural schematic diagram of the status indicating unit provided by the present invention. DETAILED DESCRIPTION

[0030] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0031] The purpose of the present invention is to provide an automatic driving computing platform with fault tolerance function to effectively ensure the driving safety of the vehicle.

[0032] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0033] like Figure 1As shown, the autonomous driving computing platform with fault tolerance function provided by the present invention includes: an environment perception module, an information exchange module, a decision module, a voting unit and an execution unit.

[0034] The environment perception module is used to obtain the vehicle's surrounding environment information. The environment perception module includes Beidou / GPS, LiDAR, binocular camera and sensor group; the sensor group includes GNSS sensor and INS sensor. Beidou / GPS provides autonomous vehicles with three-dimensional navigation and positioning capabilities with global coverage, all-day, all-weather and continuity; the laser radar can rotate at a stable angular velocity relative to the vehicle as the vehicle moves, continuously emit lasers to the surroundings and detect surrounding objects, record reflection point information, and thus obtain all-round environmental information around the driverless car; the binocular camera can obtain the surrounding environmental information closest to that obtained by the human eye. It directly measures the distance to the scene in front (the range covered by the image) by calculating the parallax of the two images, and can effectively and stably provide the ability to perceive the surrounding environment; sensor group; the sensor group includes GNSS sensors and INS sensors, and the GNSS and INS data are processed by appropriate methods so that the data acquisition frequency can still maintain a high update frequency as the speed and driving distance increase, ensuring that the vehicle can have a stable, reliable and real-time location information. The environmental perception module can also use each sensor together according to the advantages and disadvantages of different sensors, with complementary functions, mutual backup and mutual assistance, and data fusion capabilities.

[0035] The information exchange module establishes communication with the environment perception module and the decision-making module through a high-speed internal bus and a high-speed external bus respectively, and can fuse the environment, location and other data collected by the environment perception module and send them to the decision-making module at high speed and synchronously.

[0036] The decision module is connected to the information exchange module and is used to output a decision result based on the fused information. The decision module includes three computing units with the same structure, namely, computing unit A, computing unit B and computing unit C. Figure 2 As shown, the computing unit includes: a main decision-making subunit and a safety management strategy. The main decision-making subunit is connected to the information exchange module to output the decision result according to the fused information. The safety management strategy includes error monitoring and avoidance, information security strategy, system performance monitoring and corrective execution safety secondary, warning and degradation strategy, and external processor. The purpose of setting the safety management strategy is to avoid interference from the external environment, threaten the driving safety of the vehicle, and defend against system crashes, information leakage and other problems caused by the intrusion of the automatic driving system. At the same time, it can also monitor the running time, running results, configuration parameters, and running status of each main decision-making subunit.

[0037] The main decision-making subunit includes a high-performance central core processor, a high-performance graphics processor and a controller.

[0038] As an image processor, the high-performance graphics processor (model NVIDIA DRIVE AGX Pegasus) has digital image processing capabilities. It can perform compound calculations based on autonomous driving algorithms and vehicle sensors and body-related information, and can realize the synchronous operation of various sensors for functions such as lane keeping, adaptive cruise control, and target detection, and then send the calculated data to the high-performance central core processor and controller. The central core processor (model NVIDIA DRIVE Orin) provides computing power support for autonomous driving functions, confidence views, digital clusters, and AI cockpits. The controller (model Wangao Technology V84xx@200MHz) can collect data such as digital instrument panels, vehicle information systems, and driver and passenger monitoring. The high-performance central core processor integrates the features extracted by the high-performance graphics processor and the vehicle data generated by the controller, and has efficient logic synthesis functions. It realizes autonomous driving path planning, behavior planning, trajectory planning and other decisions based on the perception results.

[0039] The security management strategy is equipped with an external processor (model AT32F437@288MHz), which has a higher priority on the security side of the computing unit, avoiding external environmental interference that threatens vehicle driving safety, and defending against system crashes and information leakage caused by intrusions into the autonomous driving system. At the same time, it can also effectively monitor the running time, running results, configuration parameters, and running status of each main decision-making unit.

[0040] The main calculation process and purpose of the calculation unit is to plan an ideal local path without collision based on the local environment information and its own state information during the driving process of the intelligent vehicle. It mainly detects obstacles, tracks the movement trajectory of obstacles, and calculates the next possible position, and finally draws an obstacle map that includes existing collision risks and potential collision risks.

[0041] The computing unit combines the vehicle's surrounding environment information and the predicted movement trajectories of other objects (which can be predicted by a prediction method based on physical laws, a prediction method based on motion behavior, or a prediction method based on motion interaction), and plans and makes decisions on the vehicle's movement trajectory and speed; the specific decisions are suitable for realizing specific control of the vehicle, including VCU torque output control, EPS steering angle control, eBooster service brake control, and EPB parking brake control.

[0042] The voting unit is connected to the decision module and is used to vote on the decision result. The voting unit includes three safety voting devices with the same structure.

[0043] The safety voter is generally composed of timing circuits and gate circuits. The data collected by the environmental perception module is processed by calculation units A, B, and C respectively to obtain decision results a, b, and c. The decision results generated by the calculation units are synchronously transmitted to the three safety voters via the triple I / O bus. Figure 3 Only one of the three safety voters is shown, namely the voter that processes the decision result (a, b). It is composed of a timing circuit composed of CP1-CP4, a gate circuit composed of X1-X8, a shift register R and a corresponding bus interface.

[0044] like Figure 3 As shown, the output signals a and b of the calculation unit A and the calculation unit B are compared. The voter is driven by four pulse signals CP1-CP4. When a and b are both high levels, when the CP1 pulse arrives, the gate circuit X4 outputs a pulse signal and X7 outputs a pulse signal. When the CP2 pulse arrives, the gate circuit X4 does not output a pulse signal. When the CP3 pulse arrives, the gate circuit X5 outputs a pulse signal and X8 outputs a pulse signal. When the CP4 pulse arrives, the gate circuit X6 does not output a pulse signal. When a and b are both low levels, when CP1 arrives, the gate circuit X4 does not output a pulse signal, X6 outputs a pulse signal and X8 outputs a pulse signal. When CP2 arrives, the gate circuit X4 does not output a pulse signal, X3 outputs a pulse signal and X7 outputs a pulse signal. When CP3 arrives, the gate circuit X5 does not output a pulse signal. When CP4 arrives, the gate circuit X6 outputs a pulse signal and X8 outputs a pulse signal. When a is high and b is low, under the joint action of CP1 and CP2, gate circuit X7 continuously outputs two pulse signals. When a is low and b is high, under the joint action of CP3 and CP4, gate circuit X8 continuously outputs two pulse signals. The output pulses of gate circuits X7 and X8 act on the bidirectional shift register R, and R is set to the 10 state in advance. When the output signals a and b of the two hosts are pulse sequences and the two are consistent, the calculation unit A and the calculation unit B make a successful decision, the shift register shifts left and right, and outputs a pulse sequence, and the output gate X has a correct output. In this way, the autonomous driving computing platform can output the control signal to the execution unit, and the execution unit can control the operation of the vehicle according to the control signal.

[0045] like Figure 3 As shown in the figure, when calculation unit A and calculation unit B are inconsistent, the shift register R is pushed twice in one direction, the state becomes 00, and its output becomes a steady-state signal of 0. Therefore, when a single failure occurs in calculation unit A or calculation unit B, the output of the safety voter becomes a steady-state output, thus achieving the safety of the voter.

[0046] The same applies to (a, c) safety voting devices and (b, c) safety voting devices.

[0047] like Figure 4 The device shown is a schematic diagram of the internal structure of the fault indication unit of the computing platform of the present invention. Each fault monitoring and indication unit shown is respectively connected to the triple I / O bus and the fault-tolerant voting unit, and is composed of at least one fault detection unit and one status indication module, and has the ability to monitor and indicate the current status of the computing unit and whether a fault occurs.

[0048] The autonomous driving computing platform also includes: three fault detection units, which are respectively connected to the computing unit and the safety voter for performing fault detection.

[0049] The autonomous driving computing platform also includes: three status indication units, which are connected to the fault detection unit and are used to display the fault status.

[0050] like Figure 4 As shown, after the decision processing of computing unit A, computing unit B, and computing unit C, decision results a, decision result b, and decision result c are obtained as the output of the calculation results. If the three votes are consistent, it is considered that the decision results a, decision result b, and decision result c generated by computing unit A, computing unit B, and computing unit C are all correct decisions, and the fault-tolerant voter selects one of the voting results as the execution output. If any one of computing unit A, computing unit B, and computing unit C fails, the fault-tolerant voter uses the decision results of the two computing units that have not failed as the execution output, and the computing unit system with the failure can perform trial fault repairs such as restarting according to its own logic. If normal decision-making is restored after a series of trial repairs, the computing platform resumes normal operation. If the fault still exists after the trial repair, the fault-tolerant voter uses the decision results of the two computing units that have not failed as the execution output, so that the vehicle can continue to maintain a stable driving state without any impact. The computing unit with a fault can be shielded and isolated, and operations such as fault status indication and maintenance can be performed.

[0051] The present invention adopts three computing units and a voting unit to form a decision output architecture, whose reliability and security are higher than a single hardware unit, thereby improving the safety and reliability of autonomous driving technology.

[0052] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0053] The principles and implementation methods of the present invention are described in this article using specific examples. The description of the above embodiments is only used to help understand the method and core idea of ​​the present invention. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. An autonomous driving computing platform with fault tolerance, characterized in that: include: Environmental perception module, used to obtain information about the vehicle's surroundings; An information exchange module, connected to the environment perception module, for fusing the environment information; A decision-making module, connected to the information exchange module, for outputting a decision result based on the fused information; A voting unit, connected to the decision module, for voting on the decision result; an execution unit, connected to the voting unit, and used to control the operation of the vehicle according to the voting result; The decision module includes three computing units with the same structure; the computing units include: A main decision subunit, connected to the information exchange module, for outputting a decision result based on the fused information; A security management strategy for monitoring the running time, running results, configuration parameters and running status of the main decision subunit; The main decision subunit comprises: A graphics processor, connected to the information exchange module, for extracting features from the fused information according to a built-in neural network algorithm; A controller, used to collect monitoring information of vehicles and vehicle personnel; The central core processor is connected to the graphics processor and the controller respectively, and is used to output a decision result according to the extracted features and the monitoring information.

2. The fault-tolerant autonomous driving computing platform according to claim 1, characterized in that: The environmental perception module includes Beidou / GPS, laser radar, binocular camera and sensor group; the sensor group includes GNSS sensor and INS sensor.

3. The fault-tolerant autonomous driving computing platform according to claim 1, characterized in that: The voting unit includes three safety voting devices with the same structure.

4. The fault-tolerant autonomous driving computing platform according to claim 3, characterized in that: The autonomous driving computing platform also includes: three fault detection units, which are respectively connected to the computing unit and the safety voter for performing fault detection.

5. The fault-tolerant autonomous driving computing platform according to claim 4, characterized in that: The autonomous driving computing platform also includes: three status indication units, which are connected to the fault detection unit and are used to display the fault status.

Images