Intelligent driving control method, device and system

Abstract

An intelligent driving control method, device and system (100), the intelligent driving control method is applied to the intelligent driving control system (100), the intelligent driving control system (100) includes: main controller (11), first redundant controller (12) and second redundant controller (13), and the control method includes: determining the failure operable working group according to the state of main controller (11), first redundant controller (12) and second redundant controller (13), when one of main controller (11), first redundant controller (12) and second redundant controller (13) fails, the other two controllers constitute the failure operable working group, and are used to control the vehicle to execute intelligent driving operation.Make the vehicle also be able to realize intelligent driving operation when one of the controllers fails, and ensure a higher intelligent driving level, without the need for the driver to take over the driving operation.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of intelligent driving, in particular to an intelligent driving control method and device and an intelligent driving control system. BACKGROUND

[0002] Intelligent driving technology is the key to realizing intelligent driving of vehicles and is also the inevitable trend of future vehicle development. At present, the intelligent driving products on the market can only achieve intelligent driving level L2+, under which the driver still needs to monitor the driving environment and be ready to take over the driving operation at any time.

[0003] Higher-level intelligent driving scenarios almost do not require the driver to monitor the driving environment: for example, L3 level, conditional automation, under the condition of permission, the vehicle can complete all driving actions without the driver monitoring the driving environment at any time; L4 level, high automation, without the need for driver monitoring.

[0004] For high-level intelligent driving scenarios, once the control system fails, it can only be downgraded to a safe state and wait for the driver to take over.

[0005] It can be seen that supporting high-level intelligent driving scenarios puts higher safety and reliability requirements on the control system. SUMMARY

[0006] In order to meet the safety and reliability requirements of high-level intelligent driving scenarios, the present application provides an intelligent driving control method, device and system.

[0007] The first aspect of the present application provides an intelligent driving control method, which is applied to an intelligent driving control system, the intelligent driving control system comprising a main controller, a first redundant controller and a second redundant controller, the main controller and the first redundant controller forming a failure operation working group for outputting a vehicle control signal, the control method comprising: acquiring the states of the main controller, the first redundant controller and the second redundant controller; when one of the main controller and the first redundant controller is in a failure state and the second redundant controller is in a normal state, determining that the one of the main controller and the first redundant controller in the normal state and the second redundant controller form a failure operation working group.

[0008] Through the above setting, the control system can still ensure vehicle control through double controllers when one of the controllers fails, and the double controllers can effectively support L3-L4 level intelligent driving without the need for the driver to take over the driving operation, thereby meeting the safety and reliability requirements of high driving level scenarios.

[0009] In a possible implementation, the method further includes: when the main controller, the first redundant controller and the second redundant controller are all valid, causing the main controller and the first redundant controller to form the fail-operational working group, and causing the second redundant controller to enter the standby state.

[0010] Through the above setting, a higher intelligent driving level of the vehicle is achieved, and the power consumption of the second redundant controller is reduced.

[0011] In a possible implementation, the second redundant controller has a lower computing capability than the main controller or the first redundant controller.

[0012] Through the above setting, a higher intelligent driving level of the vehicle is achieved, and the cost of the control system is reduced.

[0013] In a possible implementation, the method further includes: causing the controller in the failure state to enter a repair mode.

[0014] Through the above setting, the failed controller is repaired in time and online, avoiding the situation that the vehicle cannot realize intelligent driving when two controllers fail and can only be parked under the control of a single controller, and further guaranteeing the intelligent driving level of the vehicle.

[0015] In a possible implementation, the main controller is connected with the first redundant controller and the second redundant controller respectively, and the first redundant controller is connected with the second redundant controller, for transmitting states of the main controller, the first redundant controller and the second redundant controller.

[0016] Through the above setting, communication and data interaction between the controllers are achieved, and thus when one of the controllers fails, the other two controllers can form the fail-operational working group in time to control the vehicle to perform intelligent driving operation, guaranteeing the intelligent driving level of the vehicle.

[0017] In a possible implementation, the states of the main controller, the first redundant controller and the second redundant controller are recorded in a controller state maintenance table, and the controller state maintenance table is stored in the main controller, the first redundant controller and the second redundant controller respectively.

[0018] Through the above setting, any controller can obtain the states of other controllers in time, and thus when one of the controllers fails, the other two controllers can form the fail-operational working group in time to control the vehicle to perform intelligent driving operation, guaranteeing the intelligent driving level of the vehicle.

[0019] In one possible implementation, when one controller fails and is unable to send a status, the other two controllers, which are connected to the failed controller, update the controller status maintenance table after both controllers have determined that the failed controller has failed.

[0020] In one possible implementation, once the main controller or the first redundant controller is successfully repaired, the successfully repaired controller replaces the failed second redundant controller in the workgroup, and the second redundant controller enters a standby state.

[0021] The above settings can further ensure the vehicle's intelligent driving level, so that the control system can still control the vehicle through the dual controllers when one controller fails. The dual controllers can effectively support L3 to L4 level intelligent driving without the need for the driver to take over driving operations, thus meeting the safety and reliability requirements of high driving level scenarios.

[0022] In one possible implementation, if two of the main controller, the first redundant controller, and the second redundant controller fail, the other controller will stop the vehicle.

[0023] By implementing the above settings, traffic accidents can be avoided in the event of failure of both controllers, thereby ensuring vehicle driving safety.

[0024] One possible implementation also includes sending the status of the failed controller to a remote maintenance system.

[0025] The above settings enable users and / or remote maintenance systems to obtain controller failure information in a timely manner, allowing failed intelligent driving controls to be repaired promptly, thereby further ensuring the vehicle's intelligent driving level.

[0026] One possible implementation also includes sending alert messages to the user.

[0027] In one possible implementation, in the event of failure of the main controller, the first redundant controller, or the second redundant controller, the status of the failed controller is submitted to the remote maintenance system, and an alert message is sent to the user.

[0028] In one possible implementation, in the event of failure of both the main controller, the first redundant controller, and the second redundant controller, the status of the failed controller is submitted to the remote maintenance system, and an alert message is sent to the user.

[0029] In one possible implementation, in the event of failure of the main controller, the first redundant controller, or the second redundant controller, the status of the failed controller is submitted to the remote maintenance system.

[0030] In a possible implementation, the driving control system further comprises a first vision sensor group, a detection sensor group and a second vision sensor group, wherein the main controller is connected with the first vision sensor group, the detection sensor group and the second vision sensor group; the first redundant controller is connected with the first vision camera sensor group and the detection sensor group; and the second redundant controller is connected with the detection sensor group and the second vision sensor group.

[0031] Through the above arrangement, in the case of failure of any controller, the data obtained by the sensors is not lost, and the vehicle can realize intelligent driving under the control of two controllers and ensure a high intelligent driving level.

[0032] In a second aspect, the application provides an intelligent driving control device applied to an intelligent driving control system, the intelligent driving control system comprising a main controller, a first redundant controller and a second redundant controller, the main controller and the first redundant controller forming a failure-operable working group for outputting a vehicle control signal, the control device comprising: an acquisition module configured to acquire states of the main controller, the first redundant controller and the second redundant controller; and a determination module configured to determine that one of the main controller and the first redundant controller in a normal state forms a failure-operable working group with the second redundant controller when one of the main controller, the first redundant controller and the second redundant controller is in a failure state and the second redundant controller is in a normal state.

[0033] In a possible implementation, the determination module is further configured to: when the main controller, the first redundant controller and the second redundant controller are all valid, make the main controller and the first redundant controller form a failure-operable working group, and make the second redundant controller enter a standby state.

[0034] In a possible implementation, the second redundant controller has a lower computing capability than the main controller or the first redundant controller.

[0035] In a possible implementation, the determination module is further configured to: make the controller in the failure state enter a repair mode.

[0036] In a possible implementation, the main controller is connected with the first redundant controller and the second redundant controller respectively, and the first redundant controller is connected with the second redundant controller, for transmitting the states of the main controller, the first redundant controller and the second redundant controller.

[0037] In a possible implementation, the states of the main controller, the first redundant controller and the second redundant controller are recorded in a controller state maintenance table, and the controller state maintenance table is stored in the main controller, the first redundant controller and the second redundant controller respectively.

[0038] In a possible implementation, when one of the controllers fails to send the state, and the other two controllers are connected to the failed controller respectively, after the other two controllers both determine that the failed controller fails, the other two controllers update the controller state maintenance table.

[0039] In a possible implementation, the determining module is further configured to: when one of the master controller or the first redundant controller is repaired successfully, determine that the repaired controller replaces the second redundant controller in the failed operable working group, and the second redundant controller enters the standby state.

[0040] In a possible implementation, the determining module is further configured to: in the case where two of the master controller, the first redundant controller and the second redundant controller fail, control the vehicle to stop by the other one of the controllers.

[0041] In a possible implementation, the determining module is further configured to: submit the state of the failed controller to a remote maintenance system.

[0042] In a possible implementation, the method further includes: sending warning information to a user.

[0043] In a possible implementation, in the case where one of the master controller, the first redundant controller or the second redundant controller fails, the state of the failed controller is submitted to a remote maintenance system, and warning information is sent to a user.

[0044] In a possible implementation, in the case where two of the master controller, the first redundant controller and the second redundant controller fail, the state of the failed controller is submitted to a remote maintenance system, and warning information is sent to a user.

[0045] In a possible implementation, in the case where one of the master controller, the first redundant controller or the second redundant controller fails, the state of the failed controller is submitted to a remote maintenance system.

[0046] In a possible implementation, the driving control system further includes a first visual sensor group, a detection sensor group and a second visual sensor group, wherein the master controller is connected to the first visual sensor group, the detection sensor group and the second visual sensor group; the first redundant controller is connected to the first visual sensor group and the detection sensor group; and the second redundant controller is connected to the detection sensor group and the second visual sensor group.

[0047] The intelligent driving control device provided by the second aspect of the application and any possible implementation thereof brings the same technical effects as the intelligent driving control method provided by the first aspect of the application and any possible implementation thereof. For the sake of brevity, the technical effects are not described again here.

[0048] In a third aspect of the present application, an intelligent driving control system is provided, comprising: a main controller, a first redundant controller, and a second redundant controller; the main controller is connected with a first vision sensor group and a second vision sensor group, acquires first vision sensor data from the first vision sensor group, and acquires second vision sensor data from the second vision sensor group; the first redundant controller is connected with the first vision sensor group, and acquires the first vision sensor data from the first vision sensor group; the second redundant controller is connected with the second vision sensor group, and acquires the second vision sensor data from the second vision sensor group; wherein the first vision sensor data comprises front view data, surround view data, and rear view data, and the second vision sensor data comprises front view data, side view data, and rear view data; the intelligent driving control system outputs a control signal based on data acquired by at least two of the main controller, the first redundant controller, and the second redundant controller.

[0049] In a possible implementation, the main controller, the first redundant controller, and the second redundant controller are all connected with a detection sensor group, and acquire detection sensor data from the detection sensor group.

[0050] In a possible implementation, the detection sensor data comprises ultrasonic radar detection data and millimeter wave radar detection data.

[0051] In a possible implementation, when the main controller, the first redundant controller, and the second redundant controller are all valid, the main controller and the first redundant controller form a failed but operable working group, and the second redundant controller is in a standby state.

[0052] In a possible implementation, the failed controller is in a repair state.

[0053] In a possible implementation, the second redundant controller has a lower computing capability than the main controller or the first redundant controller.

[0054] In a possible implementation, the main controller is connected with the first redundant controller and the second redundant controller respectively, and the first redundant controller is connected with the second redundant controller, for transmitting states of the main controller, the first redundant controller, and the second redundant controller.

[0055] In a possible implementation, the states of the main controller, the first redundant controller, and the second redundant controller are recorded in a controller state maintenance table, and the controller state maintenance table is stored in the main controller, the first redundant controller, and the second redundant controller respectively.

[0056] In a possible implementation, when one of the controllers fails to send the state, since the other two controllers are connected with the failed controller respectively, after the other two controllers both determine that the failed controller fails, the other two controllers update the controller state maintenance table.

[0057] In a possible implementation, when one of the main controller or the first redundant controller is repaired successfully, the controller repaired successfully replaces the second redundant controller in the failed operable working group, and the second redundant controller is in a standby state.

[0058] In a possible implementation, further comprising: in the case that two of the main controller, the first redundant controller and the second redundant controller fail, controlling the vehicle to stop by the other controller.

[0059] In a possible implementation, further comprising: submitting the state of the failed controller to a remote maintenance system.

[0060] In a possible implementation, sending alert information to a user.

[0061] The technical effects brought by the intelligent driving control device provided in the third aspect of the present application and any possible implementation thereof are the same as the technical effects brought by the intelligent driving control method provided in the first aspect of the present application and any possible implementation thereof. For the sake of brevity, the description is not repeated here.

[0062] The fourth aspect of the present application provides a vehicle, comprising the intelligent driving control system provided in the third aspect of the present application and any possible implementation thereof and / or the intelligent driving control device provided in the second aspect of the present application and any possible implementation thereof.

[0063] The fifth aspect of the present application provides a computing device, comprising: a bus; a communication interface connected with the bus; at least one processor connected with the bus; and at least one memory connected with the bus and storing program instructions, the program instructions causing the at least one processor to execute the intelligent driving control method provided in the first aspect of the present application and any possible implementation thereof when executed by the at least one processor.

[0064] The sixth aspect of the present application provides a computer readable storage medium, which stores program instructions, the program instructions causing a computer to execute the intelligent driving control method provided in the first aspect of the present application and any possible implementation thereof when executed by the computer.

[0065] These and other aspects of the present application will become more fully understood from the following (a) description of the embodiments, such as those described in the description. BRIEF DESCRIPTION OF DRAWINGS

[0066] The various features and the relationships between the various features of the present application will be further illustrated below with reference to the accompanying drawings. The drawings are all exemplary, some features are not shown in actual proportion, and some features in the drawings can omit the features that are conventional in the field to which the present application pertains and are not essential to the present application, or additional features that are not essential to the present application are shown, and the combination of the various features shown in the drawings is not intended to limit the present application. In addition, throughout the specification, the same reference signs refer to the same things. The specific drawings are as follows:

[0067] Figure 1A is a schematic diagram of a module of an intelligent driving control system with an intelligent driving level of L2+ and below;

[0068] Figure 1B is a schematic diagram of a module of an intelligent driving control system with an intelligent driving level of L4 to L5;

[0069] Figure 2A shows a schematic diagram of an intelligent driving control system provided by an embodiment of the present application;

[0070] Figure 2B shows a schematic diagram of an intelligent driving control system provided by another embodiment of the present application;

[0071] Figure 2C shows a schematic diagram of a module of a controller provided by an embodiment of the present application;

[0072] Figure 3A shows a schematic diagram of signal connection between a main controller, a first redundant controller and a second redundant controller and other control units (systems) of a vehicle provided by an embodiment of the present application;

[0073] Figure 3B shows a schematic diagram of signal connection between a main controller, a first redundant controller and a second redundant controller and other control units (systems) of a vehicle provided by another embodiment of the present application;

[0074] Figure 4A shows a schematic diagram of a structure of a camera with a double POC serializer interface;

[0075] Figure 4B shows a schematic diagram of a structure of a camera with a single POC serializer interface and a double interface adapter box connected to the camera with the single POC serializer interface;

[0076] Figure 5A shows a schematic diagram of a power supply structure of an intelligent driving control system provided by an embodiment of the present application;

[0077] Figure 5BA power supply structure schematic diagram of an intelligent driving control system provided by another embodiment of the application is shown.

[0078] Figure 6A A flow chart of an intelligent driving control method provided by an embodiment of the application is shown.

[0079] Figure 6B A flow chart of an intelligent driving control method provided by another embodiment of the application is shown.

[0080] Figure 7 A module schematic diagram of an intelligent driving control device provided by an embodiment of the application is shown.

[0081] Figure 8 A schematic diagram of a computing device provided by an embodiment of the application is shown. DETAILED DESCRIPTION

[0082] The words "first", "second", "third", and the like, as well as similar terms, used in the description and claims of this application merely denote different instances of similar objects, without necessarily implying a specific order or sequence. It is to be understood that the embodiments described herein can be carried out in other sequences than those specifically described, unless otherwise specifically stated herein.

[0083] In the following description, reference signs denoting steps, such as S10, S21, and the like, do not necessarily mean that the steps are carried out in the order shown, unless otherwise specifically stated herein. Steps can be carried out in another order, or simultaneously, as long as the intended function is achieved.

[0084] The term "comprising", used in the description and claims of this application, should not be interpreted as being restricted to the means listed thereafter; it does not exclude other elements or steps. It needs to be interpreted in a manner that it specifies the presence of stated features, integers, steps or components as referred to, but does not preclude the presence or addition of one or more other features, integers, steps, components or groups thereof. Thus, the expression "a device comprising means A and B" does not exclude the presence of other means than A and B.

[0085] The phrase "one embodiment" or "an embodiment" appearing in the present description means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. The appearances of the phrase "in one embodiment" or "in an embodiment" in various places in the specification are not necessarily all referring to the same embodiment, but can refer to different embodiments. Furthermore, the particular features, structures, or characteristics can be combined in any suitable manner in one or more embodiments.

[0086] Explanation of the terms involved in the present application:

[0087] Laser radar (Lidar), which works as follows: using the light pulses emitted by the laser and using the receiver to receive the light pulses reflected from the target, by calculating the propagation time of the light pulses from the laser to be reflected back to the receiver, combining the propagation speed of light and the parameters of the laser radar, the distance between the target and the vehicle, the direction of the target, the height of the target, the speed of the target, the attitude of the target and the shape of the target, etc. are obtained.

[0088] Millimeter wave radar (RADAR), which works as follows: using high-frequency circuit to generate electromagnetic waves of a certain modulation frequency, and using the antenna to send electromagnetic waves and receive electromagnetic waves reflected from the target, combining the parameters of the millimeter wave radar to calculate the distance between the target and the vehicle, the speed of the target and the direction of the target, etc.

[0089] Ultrasonic sensor (USS), also known as ultrasonic radar, which works as follows: using the ultrasonic wave transmitter to emit ultrasonic wave signals, and starting timing at the same time as the emission of ultrasonic waves, the ultrasonic waves propagate through the air, and when encountering obstacles in the propagation path, they will be immediately reflected back, and the ultrasonic wave receiver stops timing when receiving the reflected ultrasonic waves. According to the time recorded by the ultrasonic wave propagation speed from emission to reflection, the distance between the ultrasonic wave emission point and the obstacle is obtained.

[0090] Global navigation satellite system (GNSS), which can provide users with three-dimensional coordinate information, speed information and time information at any place on the earth's surface or near space. At present, there are four global navigation satellite systems in the world, including: China's BeiDou satellite navigation system (BDS), the United States' global positioning system (GPS), the European Union's Galileo satellite navigation system (Galileo) and Russia's GLONASS satellite navigation system (GLONASS).

[0091] Inertial measurement unit (IMU), which works by using gyroscopes, accelerometers and other inertial sensors and electronic computers to measure the acceleration of the carrier relative to the ground in real time to determine the position of the carrier and the parameters of the earth's gravity field.

[0092] Electronic control unit (ECU), also known as "driving computer", which is usually composed of microprocessors, memories, input / output interfaces, analog-to-digital converters and integrated circuits, and its working principle is to operate and process the data obtained by various sensors and output control signals to control the controlled object to perform corresponding driving operations.

[0093] Advanced Driver Assistance Systems (ADAS), which works by using sensors (millimeter wave radar, laser radar, single / dual camera and global navigation satellite system) installed on the vehicle to obtain data of targets in the surrounding environment during vehicle driving, and processes the data to output driving operation instructions, thereby making the driver aware of potential dangers in advance and increasing the comfort and safety of vehicle driving.

[0094] Power over Coax (POC) is a technology that transmits signals and superimposes power based on coaxial cables, that is, signals and power supply are combined together and transmitted on a coaxial cable.

[0095] Body control module (BCM), also known as "body computer", is used to control the electronic devices of the vehicle body (such as power windows, power mirrors, air conditioning, headlights, turn signals, anti-theft locking system, central locking and defrosting device, etc.) to perform corresponding operations. The body control module can be connected to other ECUs through a bus.

[0096] Electronic Stability Program (ESP) is a general term for systems or programs that prevent vehicles from losing control when they reach dynamic limits, which works by processing and calculating the data obtained by sensors (such as steering sensors, wheel sensors, side slip sensors, lateral acceleration sensors and steering wheel throttle and brake pedal sensors) and comparing the calculated results with pre-set values. When the calculated result exceeds or approaches the pre-set value, control the various execution systems (such as electronic brake distribution system, anti-lock braking system, tracking control system and vehicle dynamics control system) to maintain the dynamic balance of the vehicle.

[0097] Electric Power Steering (EPS) can include sensors (such as torque sensors, angle sensors, and speed sensors), steering assist mechanisms (such as motors, clutches, and reduction transmission mechanisms), and ECUs. When the driver turns the steering wheel, the torque sensor and the angle sensor generate corresponding voltage signals according to the input torque and the steering angle, and the speed sensor detects the speed signal. The ECU generates control instructions to control the motor operation according to the voltage signal and the speed signal, helping the driver to perform steering operations.

[0098] Ibooster (IBS) can include a boost motor, a boost transmission mechanism, a push rod mechanism, a stroke sensor, a master cylinder, and a controller. When the driver steps on the brake pedal, the push rod mechanism generates displacement, the stroke sensor detects the displacement of the push rod and sends the displacement signal of the push rod to the controller, and the controller calculates the torque that the motor should generate according to the displacement signal. The boost transmission mechanism converts the torque into a servo braking force, which acts together with the push rod force generated by the input of the pedal to achieve braking through the liquid pressure in the master cylinder.

[0099] In-Vehicle Infotainment (IVI) is a system that provides information and entertainment functions for drivers and passengers. It can provide multimedia playback, navigation, Bluetooth / Wi-Fi connection, mapping (e.g., directly mapping the phone screen to the car screen), human-vehicle interaction (e.g., touch screen, key function, voice interaction, gesture recognition, and face recognition), vehicle information display and control, intelligent driving, and social functions.

[0100] Vehicle Control Unit (VCU) is used to collect motor status, battery status, accelerator pedal signal, brake pedal signal, and sensor signal, analyze the driver's intention, and output corresponding control instructions to control the execution of corresponding operations by the lower-level controllers. Vehicle Control Unit can be used to control normal driving, braking energy feedback, energy management of the whole vehicle engine and battery, fault diagnosis and processing, and vehicle state monitoring, etc., to ensure that the vehicle works normally and stably in a good power, high economy and reliability state.

[0101] Telematics box (T-box) can provide remote communication interface for vehicles through 4G / 5G remote wireless communication, global navigation satellite system and inertial measurement system and CAN communication, etc., and provide services such as driving data collection, driving track recording, vehicle fault monitoring, vehicle remote query and control (opening and closing lock, air conditioning control, window control, transmitter torque limitation and engine start-stop), driving behavior analysis and 4G / 5G wireless hot spot sharing, etc.

[0102] Micro Control Unit (MCU) is a chip-level computer that integrates memory, counter, interface and CPU into a single chip for different application scenarios.

[0103] Camera Serial Interface-2 (CSI-2) is an interface specification developed by Mobile Industry Processor Interface (MIPI).

[0104] Controller Area Network (CAN) is a technology for data transmission between various ECUs in vehicles to realize communication between various ECUs in vehicles, and the maximum data transmission rate is 1 Mbps.

[0105] Controller Area Network-Flexible Data-Rate (CAN FD) has flexible data rate, which can support larger data transmission rate compared with Controller Area Network, and the maximum data transmission rate is 5 Mbps, which supports transmission of longer byte data, and the longest byte data is 64 bytes.

[0106] In the field of intelligent driving, in order to show the ability of vehicle action and reaction, intelligent driving level can be divided into the following types:

[0107] Level L1: The vehicle can realize the function of driving assistance of controlling steering wheel turning or controlling vehicle speed through ADAS platform, but the driver needs to monitor the driving environment and be ready to take over the driving operation at any time.

[0108] Level L2: The vehicle can realize the function of driving assistance of simultaneously controlling steering wheel turning and controlling vehicle speed through ADAS platform, but the driver needs to monitor the driving environment and be ready to take over the driving operation at any time.

[0109] Level L2+: Level L2+ is an upgrade of Level L2. Under suitable conditions, the vehicle can perform all driving operations through the ADAS platform, but the driver still needs to monitor the driving environment and be ready to take over driving operations at any time.

[0110] Level 3: The vehicle can perform all driving operations and can alert the driver. Under suitable conditions, driver monitoring of the driving environment is not required, but the driver needs to take over driving operations to handle situations that the artificial intelligence may not be able to handle.

[0111] Level L4: The vehicle can perform all driving operations, and in certain scenarios, no driver is required in the vehicle.

[0112] Level L5: The vehicle can perform all driving operations, and no driver is required in the vehicle in any scenario.

[0113] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. In case of any inconsistency, the meaning set forth in this specification or derived from the content described herein shall prevail. Furthermore, the terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit the scope of this application.

[0114] It should be noted that in this application, "vehicle" can include one or more different types of means of transport, and can also include one or more different types of transport vehicles or movable objects that operate or move on land (e.g., highways, roads, railways, etc.), water (e.g., waterways, rivers, oceans, etc.), or in space. For example, a vehicle can include automobiles, bicycles, motorcycles, trains, subways, airplanes, ships, aircraft, and / or other types of means of transport or movable objects.

[0115] In the field of intelligent driving, such as Figure 1A As shown, an intelligent driving control system at level L2+ and below may include: a single controller 02 connected to sensor 010. The sensor may include: a camera 011, a millimeter-wave radar 012, and an ultrasonic radar 013. In some embodiments, the sensor may further include: a lidar 014. Figure 1AIn the illustrated embodiment, the sensors include a camera 011, a millimeter wave radar 012, an ultrasonic radar 013, and a laser radar 014. However, the present application is not limited thereto, and different types of sensors can be configured according to the use scenario. The data obtained by the sensors 010 are subjected to perception processing, fusion processing, positioning processing, and control processing, and the control instructions of the vehicle are output, thereby assisting the driver to perform a series of driving operations. When the controller 020 fails, the vehicle cannot drive by itself and can only be taken over by the driver.

[0116] As shown in Figure 1B , an intelligent driving control system example with an intelligent driving level of level L4 to level L5 includes a main controller 021 and a redundant controller 022. The main controller 021 and the redundant controller 022 are respectively connected with the sensors 010. The sensors can include a camera 011, a millimeter wave radar 012, and an ultrasonic radar 013. In some embodiments, the sensors can also include a laser radar 014. In Figure 1B In the illustrated embodiment, the sensors include a camera 011, a millimeter wave radar 012, an ultrasonic radar 013, and a laser radar 014. However, the present application is not limited thereto, and different types of sensors can be configured according to the use scenario. In the case where neither the main controller 021 nor the redundant controller 022 fails, the main controller 021 controls the vehicle to perform intelligent driving operation, and the redundant controller 022 is in standby state. The main controller 021 subjects the data obtained by the sensors to perception processing, fusion processing, positioning processing, and control processing, and outputs the control instructions of the vehicle, thereby controlling the vehicle to perform intelligent driving operation. After the main controller 021 fails, the redundant controller 022 switches from the standby state to the running state and controls the vehicle to park at an appropriate position. When the main controller 021 fails, the vehicle is downgraded to L2+, which can be parking under the control of the redundant controller 022 and cannot continue the L4-L5 level intelligent driving operation.

[0117] In order to enable the vehicle to achieve intelligent driving in the case where any controller fails, and to ensure that the vehicle has an intelligent driving level of level L4 to level L5, embodiments of the present application provide an intelligent driving control method, an intelligent driving control device, and an intelligent driving control system.

[0118] Embodiment one: intelligent driving control system

[0119] Figure 2A An intelligent driving control system 100 provided by an embodiment of the present application is shown, as shown in Figure 2A The intelligent driving control system 100 includes a main controller 11, a first redundant controller 12, and a second redundant controller 13.

[0120] In some embodiments, the intelligent driving control system 100 can also include a plurality of sensors connected with the main controller 11, the first redundant controller 12, and the second redundant controller 13. For example, vision sensors and probing sensors, such as Figure 2BAs shown, the visual sensor can include one or more cameras 22, the detection sensor includes one or more millimeter wave radars 21, one or more ultrasonic radars 24, and optionally one or more laser radars 23. In one possible implementation, the plurality of visual sensors can be divided into two visual sensor groups, wherein the first visual sensor group includes one or more front-view cameras, one or more surround-view cameras, and one or more rear-view cameras; the second visual sensor group includes one or more front-view cameras, one or more side-view cameras, and one or more rear-view cameras. The front-view cameras in the first visual sensor group and the second visual sensor group can be the same or different. For example, the front-view cameras can include long-range, medium-range, and short-range cameras. In one possible implementation, the front-view cameras in the first visual sensor group can include long-range and short-range cameras, and the front-view cameras in the second visual sensor group can include medium-range cameras; in another possible implementation, the front-view cameras in the first visual sensor group and the second visual sensor group are the same and include long-range, medium-range, and short-range cameras. Similarly, the rear-view cameras in the first visual sensor group and the second visual sensor group can be the same or different. The main controller is connected to the first visual sensor group and the second visual sensor group, obtains first visual sensor data from the first visual sensor group, and obtains second visual sensor data from the second visual sensor group; the first redundant controller is connected to the first visual sensor group and obtains the first visual sensor data from the first visual sensor group; the second redundant controller is connected to the second visual sensor group and obtains the second visual sensor data from the second visual sensor group; wherein the first visual sensor data includes front-view data, surround-view data, and rear-view data, and the second visual sensor data includes front-view data, side-view data, and rear-view data; the intelligent driving control system outputs a control signal based on the data obtained by at least two of the main controller, the first redundant controller, and the second redundant controller. In this way, although the first redundant controller and the second redundant controller obtain less visual data than the main controller, the visual data obtained by any two controllers in a working group includes front-view data, side-view data, surround-view data, and rear-view data. It can be understood that if the front-view cameras in the first visual sensor group and the front-view cameras in the second visual sensor group are the same, the front-view data in the first visual sensor data and the front-view data in the second visual sensor data are the same, otherwise, the front-view data in the first visual sensor data and the front-view data in the second visual sensor data are different. If the rear-view cameras in the first visual sensor group and the rear-view cameras in the second visual sensor group are the same, the rear-view data in the first visual sensor data and the rear-view data in the second visual sensor data are the same, otherwise, the rear-view data in the first visual sensor data and the rear-view data in the second visual sensor data are different.

[0121] In some embodiments, the sensors can further include a detection sensor. The detection sensor can be connected to the main controller, the first redundant controller and the second redundant controller respectively, and the main controller, the first redundant controller and the second redundant controller obtain detection sensor data from the detection sensor group. In some embodiments, the detection sensor data includes ultrasonic radar detection data and millimeter wave radar detection data. Optionally, laser radar detection data can also be included. In Figure 2B In the example shown, the detection sensor can include a millimeter wave radar 21, a camera 22, a laser radar 23 and an ultrasonic radar 24. The present application does not limit this, and different types of sensors can be configured according to the use scenario.

[0122] In some embodiments, as Figure 2B As shown, the intelligent driving control system can further include an ECU 32 of a vehicle chassis, a positioning and inertial measurement unit 25, and other ECUs 31 and a T-box 41 of the vehicle connected to the controller through the central gateway 50. The positioning and inertial measurement unit 25 can include a global navigation satellite positioning device and an inertial measurement device. The positioning and inertial measurement unit 25 can be connected to the satellite positioning system (BDS, GPS, GNS or GLONASS) 71 through the antenna 61 according to the type of global navigation satellite positioning device it is equipped with, and interact with the controller to perform time synchronization signal interaction, to perform local time service and vehicle positioning calculation of the vehicle, etc.

[0123] The main controller 11, the first redundant controller 12 and the second redundant controller can process and calculate the data obtained through the sensors (millimeter wave radar 21, camera 22, laser radar 23 and ultrasonic radar 24), the positioning and inertial measurement unit 25, the central gateway, generate control instructions of the vehicle in combination with the states of the chassis ECU 32 and other ECUs, and further control the vehicle to perform corresponding intelligent driving operations.

[0124] In some embodiments, the main controller 11, the first redundant controller 12 and the second redundant controller 13 are all controllers with strong computing power; or the main controller is a controller with strong computing power, the first redundant controller is a controller with medium or strong computing power, and the second redundant controller can be a controller with medium or weak computing power. As in the foregoing implementation manner, the first redundant controller and the second redundant controller process less visual data than the main controller, and accordingly, the computing power can be relatively lower than that of the main controller, thereby reducing the cost of the intelligent control system.

[0125] Figure 2C A module schematic diagram of the controller provided by the embodiments of the present application is shown. As Figure 2C shown,Figure 2A and Figure 2B Each of the main controller 11, the first redundant controller 12 and the second redundant controller 13 shown can include a computing unit 101, an MCU 102 and an interface module 103.

[0126] The computing unit 101 can process and calculate the data obtained by sensors and the like, and generate control instructions according to the driving needs of the user. The computing unit 101 can include a system on chip (SOC) 1011 and a memory 1012. The SOC 1011 can include a plurality of functional modules, such as an image processing module for image processing, such as a GPU (graphics processing unit), a general computing module for general computing, such as a CPU, an AI computing module for artificial intelligence computing, such as an NPU (neural-network process units), an interface module for connecting with other devices (e.g., the MCU 102), and an internal memory, etc. The memory 1012 can store application software (e.g., perception application software, fusion application software, positioning application software, and centralized control application software, etc.) and other data for performing intelligent driving operations. When the computing unit 101 is running, the SOC 1011 can execute computer execution instructions in the memory 1012 to perform perception processing, fusion processing, positioning processing, and planning processing on the data obtained by sensors such as cameras, lidar, millimeter wave radar, etc., and output corresponding control instructions to control the vehicle to perform intelligent driving operations.

[0127] The MCU 102 can be used to monitor the state of the controller, for example, to monitor the voltage, temperature, and whether the controller is failed or malfunctioning; can also be used to power on and off control and reset control of the controller; and to connect with the ECU of the vehicle chassis and other control units of the vehicle, so that the corresponding ECU performs various operations. The MCU 102 can include a processor, a memory, a communication interface, and the like. The communication interface can be connected with the SOC of the current controller, the MCU of other controllers, and the ECU of the vehicle chassis, and the like, for data exchange with the SOC of the controller, the MCU of other controllers, and the ECU of the vehicle chassis, and the like, for example, to obtain state data of the SOC of the current controller, state data of the MCU and / or SOC of other controllers, and state data of the ECU of the vehicle chassis. The processor can process and calculate the state data obtained through the communication interface to generate corresponding control instructions. In some embodiments, the processor can establish a controller state table based on the obtained state data, for example, as shown in Table 1, a state table recorded for each controller, used to record the states of the main controller, the first redundant controller, and the second redundant controller, for example, after system startup, each controller is normal, and the state record is as shown in Table 1. The processor determines a failure operational working group according to the controller state table, and in the example shown in Table 1, the main controller and the first redundant controller form the failure operational working group, and the second redundant controller is in standby state. It should be noted that this is only an example and is not limited thereto. In some embodiments, the controller state table is stored in the memory. The memory can include a read-only memory and a random access memory, and provide instructions and data to the processor. Part of the processor can also include a non-volatile random access memory. For example, the processor can also store device type information.

[0128] When the MCU is running, the processor can execute computer execution instructions in the memory, for example, when the main controller fails, the MCU of the main controller can trigger a repair mode to perform re-powering, resetting, or repairing, and the like; the MCUs of the first redundant controller and the second redundant controller can update their own controller state tables according to the obtained state of the main controller, and make the first redundant controller and the second redundant controller form a failure operational working group, and optionally, the MCU of the first redundant controller can send warning information to the user through IVI. When the main controller and the first redundant controller both fail, the MCUs of the main controller and the first redundant controller can trigger a repair mode to perform re-powering, resetting, or repairing, and the like; the MCU of the second redundant controller can update its own controller state table according to the obtained state of the main controller, send warning information to the user through IVI, and make the second redundant controller enter a safe state, so that the second redundant controller controls the vehicle to stop.

[0129] Table 1

[0130]

[0131] The interface module 103 can provide an in-vehicle Ethernet interface, a video serial-to-parallel transceiver interface, a CAN interface and / or a CAN FD interface for connecting to sensor interfaces, vehicle chassis controller interfaces and gateway interfaces, thereby enabling data interaction between the controller and other control units or modules of the vehicle.

[0132] Figure 3A A schematic diagram showing the connections between the main controller 11, the first redundant controller 12, and the second redundant controller 13, as well as with other control units (systems) of the vehicle, is provided. Figure 3A As shown, the main controller 11 can be connected to the first redundant controller 12 and the second redundant controller 13 via vehicle Ethernet signals. The first redundant controller 12 and the second redundant controller 13 can also be connected via vehicle Ethernet signals. The main controller 11, the first redundant controller 12, and the second redundant controller 13 can be connected to other modules in the vehicle, such as the VCU, BCM, IVI, and / or T-box, via a vehicle gateway. The first redundant controller 12 and the second redundant controller 13 are connected to the vehicle gateway via CAN or CAN FD signals. The vehicle gateway can be connected to other modules in the vehicle, such as the VCU, BCM, IVI, and / or T-box, via vehicle Ethernet signals. The VCU can be connected to ESP, EPS, and / or IBS via vehicle Ethernet signals.

[0133] The sensors may include both detection sensors and vision sensors. For example, the sensors may include one or more of millimeter-wave radar 21, camera 22, lidar 23, and ultrasonic radar 24. Figure 3A and 3B In the example shown, the sensors include: millimeter-wave radar 21, camera 22, lidar 23, and ultrasonic radar 24, but this application is not limited to this; the sensors may also include: millimeter-wave radar 21, camera 22, and ultrasonic radar 24. Figure 3A and 3BIn the shown example, according to the type of the sensor, the sensors can be divided into the sensors of region A, the sensors of region B, the sensors of region C and the sensors of region D. The sensors of region A can be the camera 22, including: the front-view camera 221, the surround-view camera 222 and the rear-view camera 223, i.e. the first visual sensor group; the sensors of region B can be the ultrasonic radar 24 and the millimeter-wave radar 21, including: the front ultrasonic radar 241 and the front millimeter-wave radar 211, the four-corner ultrasonic radar 242 and the four-corner millimeter-wave radar 212 and the rear ultrasonic radar 243 and the rear millimeter-wave radar 213, i.e. the ultrasonic radar and millimeter-wave radar sensor group; the sensors of region C can be the laser radar 23, including: the front laser radar 231, the side laser radar 232 and the rear laser radar 233, i.e. the laser radar sensor group; and the sensors of region D can be the camera, including: the front-view camera 224, the side-view camera 225 and the rear-view camera 226, i.e. the second visual sensor group. It should be noted that the laser radar of region C can also not be deployed, and accordingly the second sensor gateway can also not be deployed. It should be noted that the region here includes sub-regions at different positions on the vehicle, and the region here is mainly divided according to the type or combination of the covered positions of the deployed sensors.

[0134] The main controller 11 can be signal-connected with the camera 22 of region A, the ultrasonic radar 24 and the millimeter-wave radar 21 of region B, the laser radar 23 of region C and the camera 22 of region D respectively; the first redundant controller 12 can be signal-connected with the camera 22 of region A, the ultrasonic radar 24 and the millimeter-wave radar 21 of region B and the laser radar 23 of region C respectively; and the second redundant controller 13 can be signal-connected with the ultrasonic radar 24 and the millimeter-wave radar 21 of region B, the laser radar 23 of region C and the camera 22 of region D respectively.

[0135] In some embodiments, the ultrasonic radar 24 and the millimeter wave radar 21 in region B can signal to the main controller 11, the first redundant controller 12 and the second redundant controller 13 through the first sensor gateway 2401 respectively. The ultrasonic radar 24 and the millimeter wave radar 21 can be signal connected with the first sensor gateway 2401 through CAN, CAN FD and / or vehicle Ethernet. The main controller 11, the first redundant controller 12 and the second redundant controller 13 can be signal connected with the first sensor gateway 2401 through vehicle Ethernet. The laser radar 23 in region C can signal to the main controller 11, the first redundant controller 12 and the second redundant controller 13 through the second sensor gateway 2301 respectively. The laser radar 23 can be signal connected with the second sensor gateway 2301 through CAN, CAN FD and / or vehicle Ethernet. The main controller 11, the first redundant controller 12 and the second redundant controller 13 can be signal connected with the second sensor gateway 2301 through vehicle Ethernet. The camera 22 in region A can be connected with the main controller 11 and the first redundant controller 12 through POC serializer interface respectively; the camera 22 in region D can be connected with the main controller 11 and the second redundant controller 13 through POC serializer interface respectively.

[0136] Figure 3B The signal connection diagram between the main controller 11, the first redundant controller 12 and the second redundant controller 13 and other control units (systems) of the vehicle is shown. The main controller 11, the first redundant controller 12 and the second redundant controller 13 are signal connected with the vehicle through the vehicle Ethernet. Figure 3A Different from the above, the sensors in region D can include: the forward-looking camera 224 and the side-looking camera 227, i.e. the second visual sensor group; the computing capability of the main controller 11 is greater than or equal to the first redundant controller 12 which is greater than the second redundant controller 13. In the case that the main controller 11 and the first redundant controller 12 both fail, the second redundant controller 13 is connected with the sensors in region B, region C and region D (the forward-looking camera 224 and the side-looking camera 227) to control the vehicle to stop. It is explained here that a certain region herein includes sub-regions in different positions on the vehicle, and the regions herein are mainly divided according to the types of the sensors arranged.

[0137] In some possible implementations, the sensors included in the second visual sensor group can be further simplified, and the simplified sensors are included in the first visual sensor group accordingly. For example, the second visual sensor group can include the forward-looking camera 224 and the side-looking camera 227, and the first visual sensor group can include the front camera 221 and the side camera 222. Figure 3BIn the example shown, the side front view camera 227 in region D can be put into region A, and region D only includes front view cameras. Accordingly, the first redundant controller 12 and the main controller 11 are both connected with a first vision sensor group, for example, the sensors in region A, and the first vision sensor group includes the front view camera 221, the surround view camera 222, the rear view camera 223, the side view camera 225, and the side front view camera 227. The second redundant controller 13 and the main controller 11 are both connected with a second vision sensor group, for example, the sensors in region D, and the second vision sensor group includes the front view camera. The connection mode of the probe sensor group is the same as that of the vision sensor group. Figure 3A Or 3B. In this implementation, if the main controller 11 and the first redundant controller 12 fail, the second redundant controller 13 can still meet the requirement of controlling the current lane parking although the sensor data obtained by the second redundant controller 13 is less.

[0138] It should be noted that the above are only examples and are not limited thereto.

[0139] As shown in Figure 3A and Figure 3B As shown, since the cameras 22 in region A and region D need to be connected with two controllers respectively, the cameras need to have a dual-POC serializer interface, or the cameras with a single-POC serializer interface can be connected with two controllers through a dual-interface adapter box 26.

[0140] Figure 4A A structure diagram of the camera 22 with a dual-POC serializer interface 2208 is shown. As shown in Figure 4A The camera 22 with a dual-POC serializer interface can include a camera internal power supply module 2201, a combined power supply module 2202, a camera sensor 2203, and a dual-interface serializer 2204. One end of the camera sensor 2203 can be connected with one end of the dual-interface serializer 2204 through a CSI-2 interface 2210. One end of the camera internal power supply module 2201 can be connected with one end of the combined power supply module 2202. The other end of the dual-interface serializer 2204 and the other end of the combined power supply module 2202 can be connected with the controller through a dual-POC serializer interface 2208, thereby realizing signal transmission and power connection with the controller.

[0141] Figure 4B A structure diagram of the camera 22 with a single-POC serializer interface 2209 and the dual-interface adapter box 26 connected to the camera 22 with a single-POC serializer interface 2209 is shown. As shown in Figure 4BAs shown, the camera 22 with the single POC serializer interface 2209 can include a camera internal power module 2205, a single interface plus serializer 2206, and a camera sensor 2207. The camera sensor 2207 can be connected to the single interface plus serializer 2206 through a CSI-2 interface 2210. The single interface plus serializer 2206 and the camera internal power module 2205 can be connected to the double interface adapter box 26 through the single POC serializer interface. The double interface adapter box 26 can include a first plus serializer 261, a second plus serializer 262, a deserializer 263, and a combiner power module 264. One end of the first plus serializer 261 and the second plus serializer 262 is connected to the controller through the double POC serializer interface 2208, respectively, and the other end of the first plus serializer 261 and the second plus serializer 262 is connected to the deserializer 263. One end of the combiner power module 264 is connected to the double POC serializer interface 2208, respectively, and the other end of the combiner power module 264 is used to be connected to the single POC serializer interface 2209, thereby realizing the signal transmission and power connection between the camera 22 with the single POC serializer interface 2209 and the controller.

[0142] According to the different types of sensors, the power supply modes are also different. In some embodiments, the camera does not have a power stabilizing module, and needs to be powered by the vehicle-mounted power supply through the power stabilizing module of the controller; the ultrasonic radar, the millimeter wave radar, and the laser radar have a power stabilizing module, and can be powered by the vehicle-mounted power supply. In some embodiments, the ultrasonic radar, the millimeter wave radar, and the laser radar can also be powered by the vehicle-mounted power supply through the power stabilizing module. In order not to affect the power supply of any sensor when any controller fails, the embodiments of the present application provide a method for supplying power to an intelligent driving control system, as shown in Figure 5A and Figure 5B

[0143] Figure 5A The power supply structure schematic diagram of the intelligent driving control system provided by the embodiments of the present application is shown. The first redundant controller 12, the main controller 11, and the second redundant controller 13 can be powered by the vehicle-mounted power supply bus A, the vehicle-mounted power supply bus B, and the vehicle-mounted power supply bus C, respectively. The ultrasonic radar 24 and the millimeter wave radar 21 in the region B and the laser radar 23 in the region C can be powered by the vehicle-mounted power supply bus A and the vehicle-mounted power supply bus B, respectively.

[0144] ​The camera 22 in region A can be powered by the main controller power stabilizing module 11A of the main controller 11 and the first redundant controller power stabilizing module 12A of the first redundant controller 12. The camera 22 in region D can be powered by the main controller power stabilizing module 11A of the main controller 11 and the second redundant controller power stabilizing module 13A of the second redundant controller 13. The stabilizing power module is a power supply device for providing stable AC or DC power to a load device. In some embodiments, the stabilizing power module can be integrated in the controller. For the sake of clarity, Figure 5A Only the first redundant controller 12, the main controller 11, the first redundant controller power stabilizing module 12A of the first redundant controller 12, the main controller power stabilizing module 11A of the main controller 11, and the second redundant controller power stabilizing module 13A of the second redundant controller 13 are shown.

[0145] Figure 5B A power supply structure schematic diagram of the intelligent driving control system provided by another embodiment of the present application is shown. As Figure 5A The sensors in region D can include a front-view camera 224 and a side front-view camera 227, i.e., a second camera sensor group. The remaining power supply modes are the same as those of Figure 5A The power supply structure of the intelligent driving control system is shown.

[0146] Embodiment two, intelligent driving control method

[0147] Figure 6A A flowchart of an intelligent driving control method provided by an embodiment of the present application is shown. In some embodiments, the intelligent driving control method provided by an embodiment of the present application can be implemented by executing computer execution instructions in a memory by a processor of an MCU. As Figure 6A As shown, the control method of the intelligent driving control system provided by an embodiment of the present application can include the following steps:

[0148] Step S1: Obtain the states of the main controller, the first redundant controller, and the second redundant controller.

[0149] The intelligent driving control system can include a main controller, a first redundant controller, and a second redundant controller, each of which is connected to the other two controllers, for obtaining the states of the other controllers. After the intelligent driving control system is powered on and initialized, the MCU can determine that the main controller and the first redundant controller form a failure-operable working group for outputting vehicle control signals, and determine that the second redundant controller enters a standby state.

[0150] In some embodiments, the driving control system further comprises a first vision sensor group, a detection sensor group and a second vision sensor group, wherein the main controller is connected with the first vision sensor group, the detection sensor group and the second vision sensor group; the first redundant controller is connected with the first vision sensor group and the detection sensor group; and the second redundant controller is connected with the detection sensor group and the second vision sensor group.

[0151] In some embodiments, the main controller has higher computing capability than the first and second redundant controllers.

[0152] Step S2: When one of the main controller and the first redundant controller is in a failure state and the second redundant controller is in a normal state, the one in the normal state forms a failure operational work group with the second redundant controller.

[0153] In some embodiments, each controller can acquire the state of other controllers through a heartbeat mechanism. The MCU of each controller can send its own state information to other controllers at a preset time interval, and each controller updates its own controller state table according to the state information provided by other controllers. When a controller fails to acquire the state information of other controllers or acquires the state information of a failed controller, the MCU determines that the controller is failed and updates the controller state table. Alternatively, the MCU of each controller can detect the state of other controllers at a preset time interval. When the state of a controller is not detected or the controller is detected to be failed, the MCU determines that the controller is failed and updates the controller state table.

[0154] In some embodiments, each controller can also acquire the state of other controllers through an alarm light. In some failure cases, a controller can determine a failed controller by sending an alarm message to other controllers and update the controller state table. In the case that a controller fails to send an alarm message due to failure, the MCU can acquire the state of other controllers through a combination of the heartbeat mechanism and the alarm light, and then update the controller state table and determine the failure operational work group.

[0155] In some embodiments, when one of the main controller, the first redundant controller and the second redundant controller fails but has not been detected by the other active controller to fail and self-repairs successfully, step S2 can not be performed, and the failed operational working group composed of the main controller and the first redundant controller continues to perform intelligent driving control and outputs vehicle control signals, and the second redundant controller remains in standby state. In some embodiments, when one of the main controller and the first redundant controller is in a failed state and the second redundant controller is in a normal state, the other one of the main controller and the first redundant controller is upgraded to a new main controller and forms a failed operational working group with the second redundant controller; on this basis, when one of the new main controller and the second redundant controller fails, the only active controller controls the vehicle to stop as a new main controller.

[0156] In some embodiments, when one of the main controller and the first redundant controller is in a failed state and the second redundant controller fails, the only active controller controls the vehicle to stop as a new main controller.

[0157] In some embodiments, the intelligent driving control method further comprises: when the main controller, the first redundant controller and the second redundant controller are all active, causing the main controller and the first redundant controller to form a failed operational working group and causing the second redundant controller to enter a standby state.

[0158] In some embodiments, the intelligent driving control method further comprises: in the case where two of the main controller, the first redundant controller and the second redundant controller fail, controlling the vehicle to stop by the other controller.

[0159] In some embodiments, when one controller fails and fails to repair, and one of the two controllers forming the failed operational working group also fails but has not been detected by the other controller to fail and self-repairs successfully, the intelligent driving operation without degradation can be continued, and the vehicle is not controlled to stop.

[0160] In some embodiments, the intelligent driving control method can further comprise: causing the controller in a failed state to enter a repair mode.

[0161] In some embodiments, the intelligent driving control method can further comprise: when one of the main controller or the first redundant controller repairs successfully, the controller that repairs successfully replaces the second redundant controller in the failed operational working group, and the second redundant controller enters a standby state.

[0162] In some embodiments, the intelligent driving control method further comprises: submitting the state of the failed controller to a remote maintenance system.

[0163] In some embodiments, the intelligent driving control method can further include sending alert information to a user. For example, when one of the main controller, the first redundant controller and the second redundant controller fails, the status of the failed controller is submitted to a remote maintenance system, and alert information can be optionally sent to the user. When two of the main controller, the first redundant controller and the second redundant controller fail, the status of the failed controllers is submitted to the remote maintenance system and alert information is sent to the user.

[0164] Figure 6B A flowchart of an intelligent driving control method provided by another embodiment of the application is shown. The control method of the intelligent driving control system provided by another embodiment of the application can include the following steps:

[0165] After the intelligent driving control system is powered on and initialized, step S10 is performed: the main controller and the first redundant controller form a fail operational working group, and the second redundant controller is in a standby state.

[0166] The fail operational working group is used to control the vehicle to perform driving operations, and can ensure that the vehicle performs intelligent driving operations and guarantees the intelligent driving level even if any of the main controller and the first redundant controller fails.

[0167] The controller in the standby state is in a low-power consumption mode, and its micro control unit MCU can monitor the state of the controller. Its computing unit 101 (see Figure 2C ) is in a sleep state and does not work. In the standby state, the micro control unit MCU monitors the operating state of the controller itself and other controllers (such as monitoring the operating state of the main controller, the first redundant controller and the second redundant controller), the voltage of the controller itself and the temperature of the controller itself, etc. When the micro control unit MCU detects that another controller fails, the MCU controls the computing unit (see Figure 2C ) to switch from the sleep state to the working state, and forms a fail operational working group with the controller that does not fail to control the vehicle to perform intelligent driving operations.

[0168] In some embodiments, any two of the main controller, the first redundant controller and the second redundant controller can also form a fail operational working group, for example, the main controller and the second redundant controller form a fail operational working group, and the remaining one is in a standby state, which is not limited by the application.

[0169] In some embodiments, the main controller, the first redundant controller and the second redundant controller can be the same controller or different controllers. That is, the main controller, the first redundant controller and the second redundant controller are all controllers with strong computing power, or the main controller is a controller with strong computing power, the first redundant controller is a controller with medium or strong computing power, and the second redundant controller can be a controller with medium or weak computing power.

[0170] In the case of failure of the main controller, step S21 is performed: the first redundant controller and the second redundant controller form a failure operable working group.

[0171] The main controller, the first redundant controller and the second redundant controller can be connected to each other respectively for sending or obtaining the state and data of the other controllers. In the case of failure of the main controller, it can send a signal to the other controllers, and the first redundant controller and the second redundant controller form a failure operable working group according to the signal. When the main controller fails to send a signal to the other controllers due to failure, the other controllers can obtain the state of the main controller through the MCU of the main controller, and then adjust the type of the controller in the failure operable working group.

[0172] Step S31: the main controller enters an online self-repair mode.

[0173] In some embodiments, the signal of failure of the main controller can also be sent to the user, for example, informing the user of the failure of the controller through IVI, or / and submitting the state of the failed controller to a remote maintenance system. In the case of failure of the online self-repair of the main controller, the main controller can be repaired through the remote maintenance system or offline manually.

[0174] Step S41: it is judged whether the self-repair of the main controller is successful, and when the self-repair of the main controller is successful, step S10 is performed; when the self-repair of the main controller fails, step S21 is performed.

[0175] In the case of failure of the first redundant controller, step S22 is performed: the main controller and the second redundant controller form a failure operable working group.

[0176] Step S32: the first redundant controller enters an online self-repair mode.

[0177] In some embodiments, the user can also be informed of the failure of the first redundant controller, for example, by IVI, or / and the status of the failed controller can be submitted to a remote maintenance system. In the case of a failure of the first redundant controller in online self-repair, the first redundant controller can be repaired by the remote maintenance system or offline manually. Step S42: determining whether the self-repair of the first redundant controller is successful, and if so, performing step S10; if not, performing step S22.

[0178] In the case of a failure of the second redundant controller, step S23 is performed: the main controller and the first redundant controller form a failed operable working group.

[0179] Step S33: the second redundant controller enters an online self-repair mode.

[0180] In some embodiments, the user can also be informed of the failure of the second redundant controller, for example, by IVI, or / and the status of the failed controller can be submitted to a remote maintenance system. In the case of a failure of the second redundant controller in online self-repair, the second redundant controller can be repaired by the remote maintenance system or offline manually.

[0181] Step S41: determining whether the self-repair of the second redundant controller is successful, and if so, performing step S10; if not, performing step S23.

[0182] In some embodiments, in the case of a failure of the main controller, the first redundant controller or the second redundant controller, the failed controller enters a self-repair mode, the status of the failed controller is submitted to a remote maintenance system, and warning information is sent to the user.

[0183] In a possible implementation, in the case of a failure of the main controller, the first redundant controller or the second redundant controller, the failed controller enters a self-repair mode, and the status of the failed controller is submitted to a remote maintenance system.

[0184] In the case of a failure of any two of the main controller, the first redundant controller and the second redundant controller, step S50 is performed: the only normal controller enters a safe mode and controls the vehicle to park at an appropriate location.

[0185] In some embodiments, in the case of a failure of any two of the main controller, the first redundant controller and the second redundant controller, the user can also be informed of the failure.

[0186] Embodiment three, intelligent driving control device

[0187] Figure 7 A module schematic diagram of the intelligent driving control device provided by the embodiment of the application is shown. As shown in the figure, Figure 7 The intelligent driving control device provided by the embodiment of the application is applied to an intelligent driving control system, and the intelligent driving control system comprises a main controller, a first redundant controller and a second redundant controller. The main controller and the first redundant controller constitute a working group for outputting a vehicle control signal. The control device comprises: an acquisition module 1000, configured to acquire the states of the main controller, the first redundant controller and the second redundant controller; and a determination module 2000, configured to determine that one of the main controller and the first redundant controller in a normal state and the second redundant controller constitute a failure-operable working group when one of the main controller, the first redundant controller and the second redundant controller is in a failure state and the second redundant controller is in a normal state.

[0188] In some embodiments, the determination module is further configured to: when the main controller, the first redundant controller and the second redundant controller are all valid, make the main controller and the first redundant controller constitute the failure-operable working group, and make the second redundant controller enter a standby state.

[0189] In some embodiments, the second redundant controller has a lower computing capability than the main controller or the first redundant controller.

[0190] In some embodiments, the determination module is further configured to: make the controller in the failure state enter a repair mode.

[0191] In some embodiments, the main controller is connected with the first redundant controller and the second redundant controller respectively, and the first redundant controller is connected with the second redundant controller, for transmitting the states of the main controller, the first redundant controller and the second redundant controller.

[0192] In some embodiments, the states of the main controller, the first redundant controller and the second redundant controller are recorded in a controller state maintenance table, and the controller state maintenance table is stored in the main controller, the first redundant controller and the second redundant controller respectively.

[0193] In some embodiments, when one of the controllers fails to send a state due to failure, since the other two controllers are connected with the failed controller respectively, after the other two controllers both determine that the failed controller is failed, the other two controllers update the controller state maintenance table.

[0194] In some embodiments, the determination module is further configured to: when one of the main controller or the first redundant controller is successfully repaired, determine that the successfully repaired controller replaces the second redundant controller in the failure-operable working group, and the second redundant controller enters a standby state.

[0195] In some embodiments, the determining module is further configured to: in the case that two of the main controller, the first redundant controller and the second redundant controller fail, control the vehicle to stop by the other one.

[0196] In some embodiments, the determining module is further configured to: submit the status of the failed controller to a remote maintenance system.

[0197] In some embodiments, the method further comprises: sending an alert message to a user.

[0198] In some embodiments, in the case that the main controller, the first redundant controller or the second redundant controller fails, the status of the failed controller is submitted to a remote maintenance system and an alert message is sent to a user.

[0199] In some embodiments, in the case that two of the main controller, the first redundant controller and the second redundant controller fail, the status of the failed controller is submitted to a remote maintenance system and an alert message is sent to a user.

[0200] In some embodiments, in the case that the main controller, the first redundant controller or the second redundant controller fails, the status of the failed controller is submitted to a remote maintenance system.

[0201] In some embodiments, the driving control system further comprises a first visual sensor group, a detection sensor group and a second visual sensor group, wherein the main controller is connected with the first visual sensor group, the detection sensor group and the second visual sensor group; the first redundant controller is connected with the first visual sensor group and the detection sensor group; and the second redundant controller is connected with the detection sensor group and the second visual sensor group.

[0202] Embodiment four, vehicle

[0203] Embodiment four of the present application provides a vehicle, comprising the intelligent driving control system provided in embodiment one of the present application and / or the intelligent driving control device provided in embodiment three of the present application.

[0204] Embodiment five, computing device

[0205] Figure 8 is a structural schematic diagram of a computing device 1500 provided in embodiments of the present application. The computing device 1500 comprises a processor 1510, a memory 1520, a communication interface 1530 and a bus 1540.

[0206] It should be understood that, Figure 8 The communication interface 1530 in the computing device 1500 shown can be used for communication between other devices.

[0207] The processor 1510 can be connected with the memory 1520. The memory 1520 can be used to store the program code and data. Therefore, the memory 1520 can be a storage unit inside the processor 1510, can be an external storage unit independent of the processor 1510, or can be a component including the storage unit inside the processor 1510 and the external storage unit independent of the processor 1510.

[0208] Optionally, the computing device 1500 can further include a bus 1540. The memory 1520 and the communication interface 1530 can be connected with the processor 1510 through the bus 1540. The bus 1540 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus 1540 can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, Figure 8 Only one line is used in the figure to represent the bus, but it does not mean that there is only one bus or only one type of bus.

[0209] It should be understood that, in the embodiments of the present application, the processor 1510 can be a central processing unit (CPU). The processor can also be other general-purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs) or other programmable logic devices, discrete gates or transistor logic, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. Alternatively, the processor 1510 uses one or more integrated circuits to execute related programs to implement the technical solutions provided by the embodiments of the present application.

[0210] The memory 1520 can include read-only memory and random access memory, and provide instructions and data for the processor 1510. A part of the processor 1510 can also include a non-volatile random access memory. For example, the processor 1510 can also store device type information.

[0211] When the computing device 1500 is running, the processor 1510 executes computer-executed instructions in the memory 1520 to perform the operation steps of the intelligent driving control method provided by the embodiments of the present application.

[0212] It should be understood that the computing device 1500 according to the embodiments of the present application can correspond to the execution of the respective subjects in the methods according to the embodiments of the present application, and the above-mentioned and other operations and / or functions of the respective modules in the computing device 1500 are respectively for the implementation of the respective processes of the methods of the embodiments, and for the sake of brevity, will not be repeated here.

[0213] Those skilled in the art can clearly understand that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0214] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working processes of the above-mentioned system, device and unit can refer to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0215] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, device or unit, and can be electrical, mechanical or other forms.

[0216] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., they can be located in one place, or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiments.

[0217] In addition, the respective functional units in the embodiments of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit.

[0218] If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the parts that make contributions to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0219] Embodiment six, computer readable storage medium

[0220] The embodiments of the present application also provide a computer readable storage medium, which stores a computer program. The program is executed by a processor to perform an intelligent driving control method. The method includes at least one of the schemes described in the above embodiments.

[0221] The computer storage medium of the embodiments of the present application can adopt any combination of one or more computer readable media. The computer readable medium can be a computer readable signal medium or a computer readable storage medium. The computer readable storage medium may, for example, be, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination of the above. More specific examples (non-exhaustive list) of the computer readable storage medium include: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, the computer readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device or apparatus.

[0222] A computer readable signal medium can include a propagated data signal with computer executable code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal can take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium can be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate or transport programming code.

[0223] Program code embodied on a computer readable medium can be transmitted using any appropriate medium, including but not limited to wireless, wire line, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0224] Computer program code for carrying out operations for aspects of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0225] It is to be understood that the above description is intended to be illustrative and not restrictive. Many other embodiments will be apparent to those of skill in the art upon reading the above description. The scope of the application should, therefore, be determined not with reference to the above description, but should instead be determined with reference to the appended claims, along with their full scope of equivalents.

Claims

1. An intelligent driving control method, characterized in that, The intelligent driving control method is applied in an intelligent driving control system, which includes: a first vision sensor group, a detection sensor group, a second vision sensor group, an on-board gateway, a main controller, a first redundant controller, and a second redundant controller. The main controller is connected to the on-board gateway, the first vision sensor group, the detection sensor group, and the second vision sensor group. The first redundant controller is connected to the on-board gateway, the first vision sensor group, and the detection sensor group. The second redundant controller is connected to the on-board gateway, the detection sensor group, and the second vision sensor group. The main controller and the first redundant controller form a failure operation working group for outputting vehicle control signals. The control method includes: Obtain the status of the main controller, the first redundant controller, and the second redundant controller; When one of the main controller and the first redundant controller is in a failed state and the second redundant controller is in a normal state, it is determined that the one of the main controller and the first redundant controller in a normal state forms a failed but operable working group with the second redundant controller. When the main controller, the first redundant controller, and the second redundant controller are all effective, the main controller and the first redundant controller form a fail-safe working group, and the second redundant controller enters a standby state.

2. The control method according to claim 1, characterized in that, Also includes: This puts the controller in a faulty state into repair mode.

3. The control method according to claim 1 or 2, characterized in that, Once either the main controller or the first redundant controller is successfully repaired, the successfully repaired controller replaces the second redundant controller in the failed workgroup, and the second redundant controller enters a standby state.

4. The control method according to claim 1 or 2, characterized in that, Also includes: In the event of failure of two of the main controller, the first redundant controller, and the second redundant controller, the other controller will be used to stop the vehicle.

5. The control method according to claim 1 or 2, characterized in that, Also includes: The status of the failed controller is submitted to the remote maintenance system.

6. The control method according to claim 4, characterized in that, Also includes: Send alert messages to users.

7. The control method according to claim 1 or 2, characterized in that, The main controller has higher computing power than the first redundant controller and the second redundant controller.

8. An intelligent driving control device, characterized in that, The intelligent driving control device is applied in an intelligent driving control system, which includes: a first vision sensor group, a detection sensor group, a second vision sensor group, an on-board gateway, a main controller, a first redundant controller, and a second redundant controller. The main controller is connected to the on-board gateway, the first vision sensor group, the detection sensor group, and the second vision sensor group. The first redundant controller is connected to the on-board gateway, the first vision sensor group, and the detection sensor group. The second redundant controller is connected to the on-board gateway, the detection sensor group, and the second vision sensor group. The main controller and the first redundant controller form a failover-operable working group for outputting vehicle control signals. The control device includes: An acquisition module is used to acquire the status of the main controller, the first redundant controller, and the second redundant controller; The determining module is configured to determine, when one of the main controller and the first redundant controller is in a failed state and the second redundant controller is in a normal state, to form a failed workgroup with the second redundant controller; the determining module is further configured to: when the main controller, the first redundant controller and the second redundant controller are all effective, to form a failed workgroup with the main controller and the first redundant controller, and to put the second redundant controller into a standby state.

9. The control device according to claim 8, characterized in that, The determining module is also used to: put the controller in a failed state into repair mode.

10. The control device according to claim 8 or 9, characterized in that, The determining module is further configured to: when one of the main controller or the first redundant controller is successfully repaired, determine that the successfully repaired controller replaces the second redundant controller in the failed workgroup, and the second redundant controller enters a standby state.

11. The control device according to claim 8 or 9, characterized in that, The determining module is also used to: in the event of failure of two of the main controller, the first redundant controller and the second redundant controller, cause the other controller to control the vehicle to stop.

12. The control device according to claim 8 or 9, characterized in that, The determination module is also used to: submit the status of the failed controller to the remote maintenance system.

13. The control device according to claim 11, characterized in that, Also includes: Send alert messages to users.

14. The control device according to claim 8 or 9, characterized in that, The main controller has higher computing power than the first redundant controller and the second redundant controller.

Images