Controller and vehicle

Abstract

The present application provides a controller and a vehicle. The controller includes a central processing unit and a microprocessing unit, wherein the central processing unit is used to receive a plurality of first environmental information sent by a plurality of first sensors, and generate a first control instruction at least according to the plurality of first environmental information, and control the chassis actuator to execute the first control instruction; the microprocessing unit is used to receive a plurality of second environmental information sent by a plurality of second sensors, and generate a second control instruction at least according to the plurality of second environmental information, and when the central processing unit is in a faulty state, the microprocessing unit is used to control the chassis backup actuator to execute the first control instruction or the second control instruction, thereby ensuring a high safety of the vehicle and a low material and development cost of the controller, thereby solving the problem in the prior art that it is difficult to simultaneously realize the control and redundant backup of the autonomous driving vehicle in the same controller.

Description

Technical Field

[0001] The present application relates to the field of autonomous driving, and more specifically, to a controller and a vehicle. Background Art

[0002] With the rapid development of automobile intelligence and the promotion of autonomous driving vehicle access standards by regional regulatory authorities, high-level autonomous driving functions are gradually entering the automotive original equipment market. The safety of autonomous driving vehicles has become an important part of product implementation. According to the definition of autonomous driving vehicles in SAEJ3016, high-level autonomous driving systems should support conditional or no driver takeover after the failure of the autonomous driving main controller. Therefore, this requires high-level autonomous driving systems to be able to take over control of the vehicle through a backup controller after the main controller fails.

[0003] In the prior art, when implementing the failure controllable function of a high-level autonomous driving system, it is usually implemented by combining an independent backup controller with an independent main controller, and the backup controller has independent sensors for collecting information, such as radar sensors, inertial measurement units (IMUs), etc. However, there are still the following problems in setting independent sensors for the main controller and the backup controller, and implementing control of the autonomous driving vehicle through the main controller and the backup controller:

[0004] 1. Due to communication bandwidth and real-time limitations, the main controller and backup controller of the autonomous driving vehicle can only control the autonomous driving vehicle based on the information collected by their respective sensors, which limits the performance of the perception algorithm;

[0005] 2. The output results of the main controller and the backup controller cannot be verified against each other, and the safe driving of the autonomous vehicle can only be ensured by setting limits on the chassis actuators. This solution can only correct the damage caused by excessive or insufficient control output values, and cannot correct failures such as trajectory tracking deviation and lane departure;

[0006] 3. The main controller and backup controller use independent sensors and independent controllers respectively, resulting in high controller material and development costs.

[0007] Therefore, there is an urgent need for a controller that can simultaneously achieve control and redundant backup of autonomous driving vehicles. Summary of the invention

[0008] The main purpose of this application is to provide a controller and a vehicle to solve the problem in the prior art that it is difficult to simultaneously achieve control and redundant backup of an autonomous driving vehicle in the same controller.

[0009] According to one aspect of an embodiment of the present invention, a controller is provided. A vehicle includes a controller, a chassis actuator and a chassis backup actuator. The controller is used to control the driving of the vehicle. The controller includes: a central processing unit, which is communicatively connected to a plurality of first sensors, and is used to receive a plurality of first environmental information sent by the plurality of first sensors, and generate a first control instruction at least based on the plurality of first environmental information, and control the chassis actuator to execute the first control instruction; a microprocessing unit, which is communicatively connected to a plurality of second sensors, and is used to receive a plurality of second environmental information sent by the plurality of second sensors, and generate a second control instruction at least based on the plurality of second environmental information, and when the central processing unit is in failure, the microprocessing unit is used to control the chassis backup actuator to execute the first control instruction or the second control instruction, wherein the first environmental information and the second environmental information are both environmental information of the vehicle in a predetermined area.

[0010] Optionally, the controller also includes: an exchange processing unit, which is communicatively connected to the third sensor, and is used to receive third environmental information sent by the third sensor, and send the third environmental information to the central processing unit and the microprocessing unit respectively, wherein the third environmental information is the environmental information of the vehicle within the predetermined area.

[0011] Optionally, the exchange processing unit is also used to: receive multiple second environment information sent by the microprocessing unit, and forward the multiple second environment information to the central processing unit; receive multiple first environment information sent by the central processing unit, and forward the multiple first environment information to the microprocessing unit.

[0012] Optionally, the central processing unit includes a first control module, and the microprocessing unit includes a second control module, which generates a first control instruction based on at least multiple first environmental information, including: the first control module generates the first control instruction based on multiple first environmental information, multiple second environmental information and the third environmental information; generates a second control instruction based on at least multiple second environmental information, including: the second control module generates the second control instruction based on multiple second environmental information and the third environmental information.

[0013] Optionally, the central processing unit also includes: a first verification module, used to receive the first control instruction sent by the first control module, and receive the second control instruction sent by the second control module, and verify the first control instruction and the second control instruction; a first diagnostic module, used to perform fault detection on the central processing unit; the microprocessor unit also includes: a second verification module, used to receive the third control instruction sent by the first control module, and receive the fourth control instruction sent by the second control module, and verify the third control instruction and the fourth control instruction, wherein the first control instruction and the third control instruction are the same control instruction, and the second control instruction and the fourth control instruction are the same control instruction; a second diagnostic module, used to perform fault detection on the microprocessor unit.

[0014] Optionally, the vehicle further includes a first CAN transceiver and a second CAN transceiver, wherein the first CAN transceiver is communicatively connected to the first verification module and the second diagnostic module respectively, and the second CAN transceiver is communicatively connected to the second verification module and the first diagnostic module respectively, and after verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller is further used for: when both the first verification module and the second verification module pass the verification and neither the first diagnostic module nor the second diagnostic module detects a fault, the first verification module sends the first control instruction to the first CAN transceiver so that the first CAN transceiver forwards the first control instruction to the chassis actuator, and the first diagnostic module sends a first shutdown instruction to the second CAN transceiver so that the second CAN transceiver does not work.

[0015] Optionally, after verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller is also used to: when the first verification module fails the verification, the second verification module passes the verification, the first diagnostic module detects a fault and the second diagnostic module does not detect a fault, the second verification module sends the third control instruction to the second CAN transceiver so that the second CAN transceiver forwards the third control instruction to the chassis backup actuator, and the second diagnostic module sends the second shutdown instruction to the first CAN transceiver so that the first CAN transceiver does not work; when the first verification module fails the verification, the second verification module passes the verification, the first diagnostic module does not detect a fault and the second diagnostic module detects a fault, the first verification module sends the first control instruction to the first CAN transceiver so that the first CAN transceiver forwards the first control instruction to the chassis actuator, and the first diagnostic module sends the first shutdown instruction to the second CAN transceiver so that the second CAN transceiver does not work.

[0016] Optionally, after verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller is also used for: when both the first verification module and the second verification module fail to pass the verification, the first diagnostic module detects a fault and the second diagnostic module does not detect a fault, the second verification module sends the fourth control instruction to the second CAN transceiver so that the second CAN transceiver forwards the fourth control instruction to the chassis backup actuator, and the second diagnostic module sends the second shutdown instruction to the first CAN transceiver so that the first CAN transceiver does not work; when both the first verification module and the second verification module fail to pass the verification, the first diagnostic module does not detect a fault and the second diagnostic module detects a fault, the first verification module sends the first control instruction to the first CAN transceiver so that the first CAN transceiver forwards the first control instruction to the chassis actuator, and the first diagnostic module sends the first shutdown instruction to the second CAN transceiver so that the second CAN transceiver does not work.

[0017] Optionally, after verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller is also used for: when the first verification module passes the verification, the second verification module fails the verification, the first diagnostic module detects a fault and the second diagnostic module does not detect a fault, the second verification module sends the fourth control instruction to the second CAN transceiver so that the second CAN transceiver forwards the fourth control instruction to the chassis backup actuator, and the second diagnostic module sends the second shutdown instruction to the first CAN transceiver so that the first CAN transceiver does not work; when the first verification module passes the verification, the second verification module fails the verification, the first diagnostic module does not detect a fault and the second diagnostic module detects a fault, the first verification module sends the first control instruction to the first CAN transceiver so that the first CAN transceiver forwards the first control instruction to the chassis actuator, and the first diagnostic module sends the first shutdown instruction to the second CAN transceiver so that the second CAN transceiver does not work.

[0018] Optionally, after verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller is also used to: when the first verification module fails the verification, the second verification module passes the verification, the first diagnostic module detects a fault and the second diagnostic module detects a fault, the first CAN transceiver and the second CAN transceiver are both in the off state, and the vehicle performs an emergency stop.

[0019] Optionally, the central processing unit and the micro processing unit do not share the same power supply unit.

[0020] Optionally, the plurality of the first sensors include image acquisition devices and lidars, and the plurality of the second sensors include short-range millimeter-wave radars and GNSS and IMU fusion positioning.

[0021] Optionally, the switching processing unit communicates with the central processing unit and the micro processing unit respectively through an RGMII communication interface, and the third sensor is a long-range millimeter-wave radar.

[0022] Optionally, the first verification module and the second diagnostic module communicate with the first CAN transceiver via a CAN line, the second verification module and the first diagnostic module communicate with the second CAN transceiver via the CAN line, the first control module communicates with the second verification module via an SPI communication bus, the second control module communicates with the first verification module via the SPI communication bus, the first verification module communicates with the first diagnostic module via the SPI communication bus, the first diagnostic module communicates with the second diagnostic module via the SPI communication bus, and the second diagnostic module communicates with the second verification module via the SPI communication bus.

[0023] According to another aspect of an embodiment of the present invention, a vehicle is further provided, the vehicle comprising a controller, and the controller is any one of the controllers described above.

[0024] In an embodiment of the present invention, the controller includes a central processing unit and a microprocessing unit, wherein the central processing unit is connected to a plurality of first sensors for receiving a plurality of first environmental information sent by the plurality of first sensors, and generating a first control instruction at least according to the plurality of first environmental information, and controlling the chassis actuator to execute the first control instruction; the microprocessing unit is connected to a plurality of second sensors for receiving a plurality of second environmental information sent by the plurality of second sensors, and generating a second control instruction at least according to the plurality of second environmental information, and in the case where the central processing unit is in a fault, the microprocessing unit is used to control the chassis backup actuator to execute the first control instruction or the second control instruction. In the present application, the central processing unit (i.e., the main controller) generates a first control instruction at least according to the plurality of first environmental information to realize automatic driving control of the vehicle; and in the case where the central processing unit fails, the microprocessing unit (i.e., the backup controller) generates a second control instruction at least according to the plurality of second environmental information, and controls the chassis backup actuator to execute the first control instruction or the second control instruction. That is to say, in the event of a failure of the central processing unit, the microprocessing unit can take over the vehicle in an emergency, thereby achieving control and redundant backup of the vehicle in the same controller, which ensures higher vehicle safety and lower controller material and development costs, thereby solving the problem in the prior art that it is difficult to simultaneously achieve control and redundant backup of autonomous driving vehicles in the same controller. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings constituting part of the present application are used to provide a further understanding of the present application. The exemplary embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0026] Figure 1A schematic diagram of the structure of a controller according to an embodiment of the present application is shown;

[0027] Figure 2 A schematic structural diagram of a controller according to another embodiment of the present application is shown.

[0028] The above drawings include the following reference numerals:

[0029] 100, controller; 200, central processing unit; 201, image acquisition device; 202, laser radar; 203, first perception module; 204, first positioning module; 205, prediction module; 206, first path planning module; 207, first control module; 208, first verification module; 209, first diagnosis module; 210, first CAN transceiver; 211, first sensor; 2011, camera information; 2021, laser radar information; 300, exchange processing unit; 301, third sensor; 3011, Long-range millimeter-wave radar information; 400, microprocessor unit; 401, short-range millimeter-wave radar; 402, GNSS and IMU fusion positioning; 403, second perception module; 404, second positioning module; 405, second path planning module; 406, second control module; 407, second diagnostic module; 408, second verification module; 409, second CAN transceiver; 410, second sensor; 4011, short-range millimeter-wave radar information; 4021, fusion information; 500, chassis actuator; 600, chassis backup actuator. DETAILED DESCRIPTION

[0030] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0031] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0032] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0033] As mentioned in the background technology, it is difficult to achieve control and redundant backup of an autonomous driving vehicle in the same controller in the prior art. In order to solve the above problem, in a typical implementation of the present application, a controller and a vehicle are provided.

[0034] According to an embodiment of the present application, a controller is provided. Figure 1 As shown, the vehicle includes a controller 100, a chassis actuator 500 and a chassis backup actuator 600, and the controller 100 is used to control the driving of the vehicle. The controller 100 includes a central processing unit 200 and a microprocessing unit 400. The central processing unit 200 is connected to a plurality of first sensors 211 for communication, and the central processing unit 200 is used to receive a plurality of first environmental information sent by the plurality of first sensors 211, and generate a first control instruction at least according to the plurality of first environmental information, and control the chassis actuator 500 to execute the first control instruction; the microprocessing unit 400 is connected to a plurality of second sensors 410 for communication, and the microprocessing unit 400 is used to receive a plurality of second environmental information sent by the plurality of second sensors 410, and generate a second control instruction at least according to the plurality of second environmental information. When the central processing unit 200 is in a fault, the microprocessing unit 400 is used to control the chassis backup actuator 600 to execute the first control instruction or the second control instruction, wherein the first environmental information and the second environmental information are both environmental information of the vehicle in a predetermined area.

[0035] The above-mentioned controller includes a central processing unit and a microprocessing unit, wherein the central processing unit is communicatively connected to multiple first sensors, and is used to receive multiple first environmental information sent by multiple first sensors, and generate a first control instruction at least based on the multiple first environmental information, and control the chassis actuator to execute the first control instruction; the microprocessing unit is communicatively connected to multiple second sensors, and is used to receive multiple second environmental information sent by multiple second sensors, and generate a second control instruction at least based on the multiple second environmental information. When the central processing unit is in a faulty state, the microprocessing unit is used to control the chassis backup actuator to execute the first control instruction or the second control instruction. In the present application, the central processing unit (i.e., the main controller) generates a first control instruction based on at least multiple first environmental information to achieve automatic driving control of the vehicle; and in the event of a failure of the central processing unit, the microprocessing unit (i.e., the backup controller) generates a second control instruction based on at least multiple second environmental information to control the chassis backup actuator to execute the first control instruction or the second control instruction. In other words, in the event of a failure of the central processing unit, the microprocessing unit achieves emergency takeover of the vehicle, thereby achieving control and redundant backup of the vehicle in the same controller, which ensures a higher safety of the vehicle and a lower material and development cost of the controller, thereby solving the problem in the prior art that it is difficult to simultaneously achieve control and redundant backup of an automatic driving vehicle in the same controller.

[0036] Specifically, in the above-mentioned embodiment, the types of the plurality of first sensors and the plurality of second sensors may be completely different. Of course, the types of the plurality of first sensors and the plurality of second sensors may also be partially the same.

[0037] In one embodiment of the present application, Figure 1 As shown, the controller 100 further includes an exchange processing unit 300, which is communicatively connected with the third sensor 301. The exchange processing unit 300 is used to receive the third environmental information sent by the third sensor 301, and send the third environmental information to the central processing unit 200 and the micro-processing unit 400, respectively, wherein the third environmental information is the environmental information of the vehicle in the predetermined area. In this embodiment, the exchange processing unit is communicatively connected with the third sensor, so that the exchange processing unit can obtain the third environmental information collected by the third sensor, and send it to the central processing unit and the micro-processing unit, respectively, which further ensures that the first control instruction generated by the central processing unit and the second control instruction generated by the micro-processing unit are relatively accurate.

[0038] In another embodiment of the present application, Figure 1As shown, the switching processing unit 300 is also used to: receive the plurality of second environment information sent by the microprocessing unit 400, and forward the plurality of second environment information to the central processing unit 200; receive the plurality of first environment information sent by the central processing unit 200, and forward the plurality of first environment information to the microprocessing unit 400. That is to say, the switching processing unit realizes the mutual transmission of sensor data (i.e., the plurality of first environment information and the plurality of second environment information) between the central processing unit and the microprocessing unit, thereby solving the problem that the main controller (i.e., the central processing unit) and the backup controller (i.e., the microprocessing unit) can only collect the sensor data of each communication due to the communication bandwidth and real-time limitation between PCB boards. Subsequently, the central processing unit can also use the plurality of first environment information, the plurality of second environment information, and the third environment information as the data input of the perception algorithm to generate the first control instruction, further ensuring that the generated first control instruction is relatively accurate, further ensuring that the vehicle can be controlled more accurately, and further ensuring that the safety of the autonomous driving vehicle is higher.

[0039] In another embodiment of the present application, Figure 2 As shown, the central processing unit 200 includes a first control module 207, and the microprocessing unit 400 includes a second control module 406. The first control instruction is generated at least according to the plurality of the first environmental information, including: the first control module 207 generates the first control instruction according to the plurality of the first environmental information, the plurality of the second environmental information and the third environmental information; the second control instruction is generated at least according to the plurality of the second environmental information, including: the second control module 406 generates the second control instruction according to the plurality of the second environmental information and the third environmental information. In this embodiment, the first control module generates the first control instruction according to the plurality of the first environmental information, the plurality of the second environmental information and the third environmental information, so that the first control instruction obtained is more accurate, and the subsequent central processing unit can control the automatic driving vehicle more accurately according to the first control instruction, and the second control module generates the second control instruction according to the plurality of the second environmental information and the third environmental information, so that when the central processing unit is in a fault, the microprocessing unit can also control the vehicle to perform emergency parking according to the second control instruction, realize emergency takeover of the vehicle, and ensure the high safety of the vehicle.

[0040] In actual application, the second control module may also generate a second control instruction according to a plurality of first environment information, a plurality of second environment information and a third environment information.

[0041] In order to avoid the harm to the vehicle caused by unexpected control or control function failure, in another embodiment of the present application, Figure 2As shown, the central processing unit 200 further includes a first verification module 208 and a first diagnostic module 209, wherein the first verification module 208 is used to receive the first control instruction sent by the first control module 207, and receive the second control instruction sent by the second control module 406, and verify the first control instruction and the second control instruction; the first diagnostic module 209 is used to perform fault detection on the central processing unit 200; the microprocessor unit 400 further includes a second verification module 408 and a second diagnostic module 407, the second verification module 408 is used to receive the third control instruction sent by the first control module 207, and receive the fourth control instruction sent by the second control module 406, and verify the third control instruction and the fourth control instruction, wherein the first control instruction and the third control instruction are the same control instruction, and the second control instruction and the fourth control instruction are the same control instruction; the second diagnostic module 407 is used to perform fault detection on the microprocessor unit 400.

[0042] Specifically, the first diagnostic module can also perform fault detection on the microprocessing unit, and the second diagnostic module can also perform fault detection on the central processing unit.

[0043] Specifically, Figure 2 As shown, the central processing unit 200 also includes a first perception module 203, a first positioning module 204, a prediction module 205, and a first path planning module 206. The central processing unit 200 is the core implementation unit for realizing automatic driving functions such as city cruising and highway cruising. Among them, the first perception module 203 and the first positioning module can acquire perception information and locate the vehicle according to the camera information 2011, the laser radar information 2021, the long-range millimeter wave radar information 3011, the short-range millimeter wave radar information 4011 and the fusion information 4021. The prediction module 205 can predict other objects in the predetermined area where the vehicle is located, and the first path planning module 206 can realize the planning of the vehicle's driving path. The micro-processing unit 400 also includes a second perception module 403, a second positioning module 404, and a second path planning module 405. The micro-processing unit realizes the control and takeover of the vehicle after the central processing unit fails. Among them, the second perception module 403 and the second positioning module 404 can acquire perception information and locate the vehicle based on the long-range millimeter-wave radar information 3011, the short-range millimeter-wave radar information 4011 and the fusion information 4021, and the second path planning module 405 can also plan the vehicle's driving path.

[0044] In one embodiment of the present application, Figure 2As shown, the vehicle further includes a first CAN transceiver 210 and a second CAN transceiver 409, wherein the first CAN transceiver 210 is respectively connected to the first verification module 208 and the second diagnostic module 407 for communication, and the second CAN transceiver 409 is respectively connected to the second verification module 408 and the first diagnostic module 209 for communication, and after verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller 100 is further used to: in the first When the verification module 208 and the second verification module 408 are both verified and the first diagnostic module 209 and the second diagnostic module 407 are both not detected with a fault, the first verification module 208 sends the first control instruction to the first CAN transceiver 210, so that the first CAN transceiver 210 forwards the first control instruction to the chassis actuator 500, and the first diagnostic module 209 sends the first shutdown instruction to the second CAN transceiver 409, so that the second CAN transceiver 409 does not work. In this embodiment, the first verification module of the central processing unit and the second verification module of the microprocessor unit are mutually verified, thereby solving the problem in the prior art that the output processing results of the main controller (i.e., the central processing unit of the present application) and the backup controller (i.e., the microprocessor unit of the present application) cannot be mutually verified, and the safety of the vehicle can only be ensured by setting a limit value in the chassis actuator.

[0045] Specifically, the first verification module passes the verification that the first control instruction and the second control instruction are the same instruction; the second verification module passes the verification that the third control instruction and the fourth control instruction are the same instruction. For example, the first control instruction is that the vehicle turns left, and the second control instruction is also that the vehicle turns left.

[0046] Specifically, the first control module generates a first control instruction according to a plurality of first environmental information, a plurality of second environmental information and a third environmental information, the first control module sends the first control instruction to the first verification module, and at the same time sends the first control instruction (also known as the third control instruction) to the second verification module. The second control module generates a second control instruction according to a plurality of second environmental information and the third environmental information, the second control module also sends the second control instruction to the first verification module, and the second control module sends the second control instruction (also known as the fourth control instruction) to the second verification module. In this way, the first verification module can mutually verify the first control instruction and the second control instruction, and the second verification module can mutually verify the third control instruction and the fourth control instruction (also known as the fourth control instruction).

[0047] In order to avoid the single point failure of a single controller (i.e., a central processing unit and a microprocessor unit), which results in the inability to control the vehicle automatically, and to solve the problem in the prior art that the safety of the vehicle must be ensured by setting a limit value on the chassis actuator, in another embodiment of the present application, Figure 2 As shown, after verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller 100 is further used for: when the first verification module 208 fails to verify, the second verification module 408 passes, the first diagnostic module 209 detects a fault and the second diagnostic module 407 does not detect a fault, the second verification module 408 sends the third control instruction to the second CAN transceiver 409, so that the second CAN transceiver 409 forwards the third control instruction to the chassis backup actuator 600, and the second diagnostic module 407 sends a second shutdown instruction to the chassis backup actuator 600. The first CAN transceiver 210 is configured to prevent the first CAN transceiver 210 from working; when the first verification module 208 fails the verification, the second verification module 408 passes the verification, the first diagnostic module 209 does not detect a fault, and the second diagnostic module 407 detects a fault, the first verification module 208 sends the first control instruction to the first CAN transceiver 210, so that the first CAN transceiver 210 forwards the first control instruction to the chassis actuator 500, and the first diagnostic module 209 sends the first shutdown instruction to the second CAN transceiver 409, so that the second CAN transceiver 409 does not work.

[0048] In another embodiment of the present application, Figure 2As shown, after verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller 100 is also used for: when the first verification module 208 and the second verification module 408 both fail to pass the verification, the first diagnostic module 209 detects a fault and the second diagnostic module 407 does not detect a fault, the second verification module 408 sends the fourth control instruction to the second CAN transceiver 409, so that the second CAN transceiver 409 forwards the fourth control instruction to the chassis backup actuator 600, and the second diagnostic module 407 sends a second shutdown instruction to the second CAN transceiver 409. The first CAN transceiver 210 is used to make the first CAN transceiver 210 not work; when the first verification module 208 and the second verification module 408 are both failed, the first diagnostic module 209 does not detect a fault, and the second diagnostic module 407 detects a fault, the first verification module 208 sends the first control instruction to the first CAN transceiver 210, so that the first CAN transceiver 210 forwards the first control instruction to the chassis actuator 500, and the first diagnostic module 209 sends the first shutdown instruction to the second CAN transceiver 409, so that the second CAN transceiver 409 does not work. In this embodiment, the first control instruction and the second control instruction of the vehicle are double-checked by the first verification module and the second verification module, so as to avoid the problem that a single controller makes it difficult to control the vehicle automatically, and at the same time, there is no need to set control restrictions on the chassis actuator to avoid the damage caused by the abnormality of the vehicle's control instruction to the vehicle, thereby enriching the operation mode of the vehicle and ensuring a good user experience.

[0049] In order to further ensure that the vehicle can be controlled more safely and avoid the difficulty in controlling the vehicle automatically due to failure of a single controller, in another embodiment of the present application, Figure 2As shown, after verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller 100 is also used for: when the first verification module 208 passes the verification, the second verification module 408 fails the verification, the first diagnostic module 209 detects a fault and the second diagnostic module 407 does not detect a fault, the second verification module 408 sends the fourth control instruction to the second CAN transceiver 409, so that the second CAN transceiver 409 forwards the fourth control instruction to the chassis backup actuator 600, and the second diagnostic module 407 sends a second shutdown instruction to the first CAN transceiver 409. The first CAN transceiver 210 is configured to prevent the first CAN transceiver 210 from working; when the first verification module 208 passes the verification, the second verification module 408 fails the verification, the first diagnostic module 209 does not detect a fault and the second diagnostic module 407 detects a fault, the first verification module 208 sends the first control instruction to the first CAN transceiver 210, so that the first CAN transceiver 210 forwards the first control instruction to the chassis actuator 500, and the first diagnostic module 209 sends the first shutdown instruction to the second CAN transceiver 409, so that the second CAN transceiver 409 does not work.

[0050] In one embodiment of the present application, Figure 2 As shown, after verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller 100 is also used for: when the first verification module 208 fails to verify, the second verification module 408 passes, the first diagnostic module 209 detects a fault, and the second diagnostic module 407 detects a fault, the first CAN transceiver 210 and the second CAN transceiver 409 are both in a closed state, and the vehicle performs an emergency stop. In this embodiment, when the first diagnostic module and the second diagnostic module both detect a fault, the first CAN transceiver and the second CAN transceiver are controlled to be in a closed state, so as to control the vehicle to perform an emergency stop, which further ensures that the vehicle is relatively safe and further avoids damage to the vehicle.

[0051] In a specific embodiment of the present application, when the first diagnostic module detects a fault and the second diagnostic module detects a fault, both the first CAN transceiver and the second CAN transceiver are in a closed state, and the vehicle performs an emergency stop.

[0052] In order to ensure the independence of the functions of the central processing unit and to avoid power supply problems causing the central processing unit and the micro-processing unit to fail at the same time, in an embodiment of the present application, the central processing unit and the micro-processing unit do not share the same power supply unit.

[0053] In another embodiment of the present application, Figure 1 As shown, the plurality of first sensors 211 include an image acquisition device 201 and a laser radar 202 , and the plurality of second sensors 410 include a short-range millimeter-wave radar 401 and a GNSS and IMU fusion positioning system 402 .

[0054] Specifically, the image acquisition device may be a camera. Of course, the image acquisition device may also be a camera head, and the image acquisition device is not limited in the present application.

[0055] Specifically, the above-mentioned GNSS and IMU fusion positioning is specifically a combination of Global Navigation Satellite System (GNSS) and Inertial Measurement Unit (IMU) sensor fusion.

[0056] In actual application, Figure 1 As shown, the image acquisition device 201 is connected to the central processing unit 200 through the LVDS transmission bus, and the laser radar 202 is connected to the central processing unit 200 through the Ethernet bus. The central processing unit 200 can directly obtain multiple first environmental information of the vehicle in the predetermined area collected by the image acquisition device 201 and the laser radar 202.

[0057] Specifically, Figure 1 As shown, the short-range millimeter-wave radar 401 is connected to the microprocessing unit 400 through the CAN bus, and the GNSS and IMU fusion positioning 402 is connected to the microprocessing unit 400 through the CAN bus. For the microprocessing unit, after receiving the multiple second environmental information collected by the MCU receiving the short-range millimeter-wave radar 401 and the GNSS and IMU fusion positioning 402, the microprocessing unit 400 can forward the multiple second environmental information to the exchange processing unit 300, so that the exchange processing unit 300 forwards the multiple second environmental information to the central processing unit 200, so that the central processing unit can perform information fusion according to the multiple first environmental information, the multiple second environmental information and the third environmental information, and generate a more accurate first control instruction.

[0058] In order to enable the exchange processing unit to more efficiently transmit data between the central processing unit and the micro processing unit, in another embodiment of the present application, Figure 1As shown, the switching processing unit 300 communicates with the central processing unit 200 and the microprocessing unit 400 respectively through an RGMII (Reduced Gigabit Media Independent Interface, RGMII for short) communication interface, and the third sensor 301 is a long-range millimeter wave radar.

[0059] Specifically, Figure 1 As shown, the long-range millimeter-wave radar is connected to the switching processing unit 300 through the Ethernet bus. For the switching processing unit 300, it can send the third environmental information of the vehicle in the predetermined area collected by the long-range millimeter-wave radar to the central processing unit 200 and the micro-processing unit 400. For the micro-processing unit 400, after receiving the third environmental information, it can generate a second control instruction according to the plurality of second environmental information and the third environmental information, so as to meet the situation that when the central processing unit 200 is in a fault state, the micro-processing unit can realize the degraded control of the vehicle and realize the emergency parking of the vehicle, thereby further ensuring the driving safety of the vehicle.

[0060] In one embodiment of the present application, the first verification module and the second diagnostic module communicate with the first CAN transceiver through a CAN line, the second verification module and the first diagnostic module communicate with the second CAN transceiver through the CAN line, the first control module communicates with the second verification module through an SPI (Serial Peripheral Interface, SPI for short) communication bus, the second control module communicates with the first verification module through the SPI communication bus, the first verification module communicates with the first diagnostic module through the SPI communication bus, the first diagnostic module communicates with the second diagnostic module through the SPI communication bus, and the second diagnostic module communicates with the second verification module through the SPI communication bus, thereby ensuring that communication is more efficient.

[0061] In a typical embodiment of the present application, a vehicle is further provided, the vehicle comprising a controller, and the controller is any one of the above-mentioned controllers.

[0062] The above-mentioned vehicle includes any of the above-mentioned controllers, and the above-mentioned controller includes a central processing unit and a microprocessing unit, wherein the central processing unit is connected to multiple first sensors for receiving multiple first environmental information sent by multiple first sensors, and generating a first control instruction at least according to the multiple first environmental information, and controlling the chassis actuator to execute the first control instruction; the microprocessing unit is connected to multiple second sensors for receiving multiple second environmental information sent by multiple second sensors, and generating a second control instruction at least according to the multiple second environmental information, and in the case where the central processing unit is in a fault, the microprocessing unit is used to control the chassis backup actuator to execute the first control instruction or the second control instruction. In the present application, the central processing unit (i.e., the main controller) generates the first control instruction at least according to the multiple first environmental information to realize the automatic driving control of the vehicle; and in the case where the central processing unit fails, the microprocessing unit (i.e., the backup controller) generates the second control instruction at least according to the multiple second environmental information, and controls the chassis backup actuator to execute the first control instruction or the second control instruction. That is to say, in the event of a failure of the central processing unit, the microprocessing unit can take over the vehicle in an emergency, thereby achieving control and redundant backup of the vehicle in the same controller, which ensures higher vehicle safety and lower controller material and development costs, thereby solving the problem in the prior art that it is difficult to simultaneously achieve control and redundant backup of autonomous driving vehicles in the same controller.

[0063] From the above description, it can be seen that the above embodiments of the present application achieve the following technical effects:

[0064] 1) The controller of the present application includes a central processing unit and a microprocessing unit, wherein the central processing unit is connected to multiple first sensors for receiving multiple first environmental information sent by multiple first sensors, and generating a first control instruction at least according to the multiple first environmental information, and controlling the chassis actuator to execute the first control instruction; the microprocessing unit is connected to multiple second sensors for receiving multiple second environmental information sent by multiple second sensors, and generating a second control instruction at least according to the multiple second environmental information, and in the case of a failure of the central processing unit, the microprocessing unit is used to control the chassis backup actuator to execute the first control instruction or the second control instruction. In the present application, the central processing unit (i.e., the main controller) generates the first control instruction at least according to the multiple first environmental information to realize the automatic driving control of the vehicle; and in the case of a failure of the central processing unit, the microprocessing unit (i.e., the backup controller) generates the second control instruction at least according to the multiple second environmental information, and controls the chassis backup actuator to execute the first control instruction or the second control instruction. That is to say, in the event of a failure of the central processing unit, the microprocessing unit can take over the vehicle in an emergency, thereby achieving control and redundant backup of the vehicle in the same controller, which ensures higher vehicle safety and lower controller material and development costs, thereby solving the problem in the prior art that it is difficult to simultaneously achieve control and redundant backup of autonomous driving vehicles in the same controller.

[0065] 2) The vehicle of the present application includes any of the above-mentioned controllers, and the above-mentioned controller includes a central processing unit and a microprocessing unit, wherein the central processing unit is connected to multiple first sensors for communication, and is used to receive multiple first environmental information sent by multiple first sensors, and at least generate a first control instruction based on multiple first environmental information, and control the chassis actuator to execute the first control instruction; the microprocessing unit is connected to multiple second sensors for communication, and is used to receive multiple second environmental information sent by multiple second sensors, and at least generate a second control instruction based on multiple second environmental information, and control the chassis backup actuator to execute the second control instruction. In the case of a failure of the central processing unit, the microprocessing unit is used to control the chassis backup actuator to execute the first control instruction or the second control instruction. In the present application, the central processing unit (i.e., the main controller) generates the first control instruction based on at least multiple first environmental information to realize automatic driving control of the vehicle; and in the case of a failure of the central processing unit, the microprocessing unit (i.e., the backup controller) generates the second control instruction based on at least multiple second environmental information, and controls the chassis backup actuator to execute the first control instruction or the second control instruction. That is to say, in the event of a failure of the central processing unit, the microprocessing unit can take over the vehicle in an emergency, thereby achieving control and redundant backup of the vehicle in the same controller, which ensures higher vehicle safety and lower controller material and development costs, thereby solving the problem in the prior art that it is difficult to simultaneously achieve control and redundant backup of autonomous driving vehicles in the same controller.

[0066] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A controller, characterized in that: The vehicle includes a controller, a chassis actuator and a chassis backup actuator, wherein the controller is used to control the driving of the vehicle, and the controller includes: a central processing unit, connected to the plurality of first sensors for communication, the central processing unit being used to receive a plurality of first environmental information sent by the plurality of first sensors, and generating a first control instruction at least according to the plurality of first environmental information, and controlling the chassis actuator to execute the first control instruction; a microprocessing unit, which is communicatively connected to the plurality of second sensors, and is used to receive a plurality of second environmental information sent by the plurality of second sensors, and to generate a second control instruction at least according to the plurality of second environmental information, and in the event that the central processing unit fails, the microprocessing unit is used to control the chassis backup actuator to execute the first control instruction or the second control instruction, Wherein, the first environmental information and the second environmental information are both environmental information of the vehicle in a predetermined area; The central processing unit includes a first control module, and the microprocessing unit includes a second control module, and generates a first control instruction at least according to the plurality of the first environmental information, including: the first control module generates the first control instruction according to the plurality of the first environmental information, the plurality of the second environmental information and the third environmental information; and generates a second control instruction at least according to the plurality of the second environmental information, including: the second control module generates the second control instruction according to the plurality of the second environmental information and the third environmental information, and the third environmental information is the environmental information of the vehicle in the predetermined area; The central processing unit further includes: a first verification module, configured to receive the first control instruction sent by the first control module, and receive the second control instruction sent by the second control module, and verify the first control instruction and the second control instruction; a first diagnosis module, configured to perform fault detection on the central processing unit; The microprocessor unit also includes: a second verification module, used to receive a third control instruction sent by the first control module, and to receive a fourth control instruction sent by the second control module, and to verify the third control instruction and the fourth control instruction, wherein the first control instruction and the third control instruction are the same control instruction, and the second control instruction and the fourth control instruction are the same control instruction; and a second diagnostic module, used to perform fault detection on the microprocessor unit.

2. The controller according to claim 1, characterized in that: The controller further comprises: The exchange processing unit is communicatively connected with the third sensor, and is used for receiving the third environment information sent by the third sensor, and sending the third environment information to the central processing unit and the micro processing unit respectively.

3. The controller according to claim 2, characterized in that: The switching processing unit is also used for: receiving a plurality of the second environment information sent by the micro-processing unit, and forwarding the plurality of the second environment information to the central processing unit; Receive the plurality of first environment information sent by the central processing unit, and forward the plurality of first environment information to the micro processing unit.

4. The controller according to claim 3, characterized in that: The vehicle further includes a first CAN transceiver and a second CAN transceiver, wherein the first CAN transceiver is communicatively connected to the first verification module and the second diagnostic module respectively, and the second CAN transceiver is communicatively connected to the second verification module and the first diagnostic module respectively, After verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller is further used for: When both the first verification module and the second verification module pass the verification and neither the first diagnostic module nor the second diagnostic module detects a fault, the first verification module sends the first control instruction to the first CAN transceiver so that the first CAN transceiver forwards the first control instruction to the chassis actuator, and the first diagnostic module sends the first shutdown instruction to the second CAN transceiver so that the second CAN transceiver does not work.

5. The controller according to claim 4, characterized in that: After verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller is further used for: In the case where the first verification module fails verification, the second verification module passes verification, the first diagnostic module detects a fault and the second diagnostic module does not detect a fault, the second verification module sends the third control instruction to the second CAN transceiver so that the second CAN transceiver forwards the third control instruction to the chassis backup actuator, and the second diagnostic module sends a second shutdown instruction to the first CAN transceiver so that the first CAN transceiver does not work; When the first verification module fails the verification, the second verification module passes the verification, the first diagnostic module does not detect a fault, and the second diagnostic module detects a fault, the first verification module sends the first control instruction to the first CAN transceiver so that the first CAN transceiver forwards the first control instruction to the chassis actuator, and the first diagnostic module sends the first shutdown instruction to the second CAN transceiver so that the second CAN transceiver does not work.

6. The controller according to claim 4, characterized in that: After verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller is further used for: When both the first verification module and the second verification module fail to pass the verification, the first diagnostic module detects a fault and the second diagnostic module does not detect a fault, the second verification module sends the fourth control instruction to the second CAN transceiver so that the second CAN transceiver forwards the fourth control instruction to the chassis backup actuator, and the second diagnostic module sends a second shutdown instruction to the first CAN transceiver so that the first CAN transceiver does not work; When both the first verification module and the second verification module fail verification, the first diagnostic module does not detect a fault, and the second diagnostic module detects a fault, the first verification module sends the first control instruction to the first CAN transceiver so that the first CAN transceiver forwards the first control instruction to the chassis actuator, and the first diagnostic module sends the first shutdown instruction to the second CAN transceiver so that the second CAN transceiver does not work.

7. The controller according to claim 4, characterized in that: After verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller is further used for: When the first verification module passes verification, the second verification module fails verification, the first diagnostic module detects a fault and the second diagnostic module does not detect a fault, the second verification module sends the fourth control instruction to the second CAN transceiver so that the second CAN transceiver forwards the fourth control instruction to the chassis backup actuator, and the second diagnostic module sends a second shutdown instruction to the first CAN transceiver so that the first CAN transceiver does not work; When the first verification module passes the verification, the second verification module fails the verification, the first diagnostic module does not detect a fault and the second diagnostic module detects a fault, the first verification module sends the first control instruction to the first CAN transceiver so that the first CAN transceiver forwards the first control instruction to the chassis actuator, and the first diagnostic module sends the first shutdown instruction to the second CAN transceiver so that the second CAN transceiver does not work.

8. The controller according to claim 4, characterized in that: After verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller is further used for: When the first verification module fails the verification, the second verification module passes the verification, the first diagnostic module detects a fault, and the second diagnostic module detects a fault, the first CAN transceiver and the second CAN transceiver are both in the off state and the vehicle performs an emergency stop.

9. The controller according to any one of claims 1 to 8, characterized in that: The central processing unit and the micro processing unit do not share the same power supply unit.

10. The controller according to any one of claims 1 to 8, characterized in that: The plurality of the first sensors include image acquisition devices and laser radars, and the plurality of the second sensors include short-range millimeter-wave radars and GNSS and IMU fusion positioning.

11. The controller according to any one of claims 2 to 8, characterized in that: The switching processing unit communicates with the central processing unit and the micro processing unit respectively through the RGMII communication interface, and the third sensor is a long-range millimeter wave radar.

12. The controller according to any one of claims 4 to 8, characterized in that: The first verification module and the second diagnostic module communicate with the first CAN transceiver via a CAN line, the second verification module and the first diagnostic module communicate with the second CAN transceiver via the CAN line, the first control module communicates with the second verification module via an SPI communication bus, the second control module communicates with the first verification module via the SPI communication bus, the first verification module communicates with the first diagnostic module via the SPI communication bus, the first diagnostic module communicates with the second diagnostic module via the SPI communication bus, and the second diagnostic module communicates with the second verification module via the SPI communication bus.

13. A vehicle, characterized in that: The vehicle comprises a controller, and the controller is a controller as described in any one of claims 1 to 12.

Images