Vehicle control method, device, apparatus, and storage medium

Abstract

The present disclosure provides a vehicle control method, device, equipment and storage medium, relates to the technical field of vehicle driving safety, in particular to the technical field of safety redundancy, anomaly detection, vehicle control and the like, and can be applied to the scene of automatic driving, auxiliary driving, intelligent traffic and the like. The specific implementation scheme comprises the following steps: a first control system determines a first detection result of a vehicle according to sensing information of the vehicle, and controls the vehicle according to the first detection result; a second control system determines a second detection result of the vehicle according to the sensing information, and sends first indication information to a third control system according to the second detection result; the third control system is implemented in an electronic control unit of the vehicle; when the first control system is abnormal, the second control system controls the vehicle according to the second detection result; when the first control system and the second control system are both abnormal, the third control system controls the vehicle according to the first indication information. The present disclosure can improve the driving safety of the vehicle.

Description

Technical Field

[0001] This disclosure relates to the field of vehicle driving safety technology, specifically to the fields of safety redundancy, anomaly detection, and vehicle control, and can be applied to scenarios such as autonomous driving, assisted driving, and intelligent transportation. In particular, it relates to a vehicle control method, device, equipment, and storage medium. Background Technology

[0002] Implementing redundant control in the vehicle control system of autonomous or assisted driving vehicles can improve vehicle driving safety.

[0003] Currently, redundant control in vehicle control systems mainly includes: setting up a redundant control system for the basic vehicle control system. When the basic vehicle control system malfunctions, the redundant control system can take over control of the vehicle in a timely manner to prevent the vehicle from going out of control. Summary of the Invention

[0004] This disclosure provides a vehicle control method, apparatus, device, and storage medium that can enhance control assurance for vehicle driving and improve vehicle driving safety.

[0005] According to a first aspect of this disclosure, a vehicle control method is provided, the method comprising:

[0006] The first control system determines the first detection result of the vehicle based on the vehicle's perception information and controls the vehicle accordingly. The second control system determines the second detection result of the vehicle based on the perception information and sends a first instruction to the third control system based on the second detection result. The first instruction is related to the second detection result. The third control system is implemented in the vehicle's electronic control unit. When the first control system malfunctions, the second control system controls the vehicle based on the second detection result. When both the first and second control systems malfunction, the third control system controls the vehicle based on the first instruction.

[0007] According to a second aspect of this disclosure, a vehicle control device is provided, the device comprising: a first control unit, a second control unit, and a third control unit.

[0008] The first control unit is used to determine a first detection result of the vehicle based on the vehicle's perception information, and control the vehicle based on the first detection result. The second control unit is used to determine a second detection result of the vehicle based on the perception information, and send a first instruction message to the third control unit based on the second detection result; wherein the first instruction message is related to the second detection result; the third control unit is the vehicle's electronic control unit. The second control unit is also used to control the vehicle based on the second detection result when the first control unit malfunctions. The third control unit is used to control the vehicle based on the first instruction message when both the first and second control units malfunction.

[0009] According to a third aspect of this disclosure, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method as described in the first aspect.

[0010] According to a fourth aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions for causing a computer to perform the method described in the first aspect.

[0011] According to a fifth aspect of this disclosure, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the method according to the first aspect.

[0012] According to a sixth aspect of this disclosure, an autonomous driving system or driver assistance system is provided, which, when in operation, implements the method described in the first aspect.

[0013] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0014] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0015] Figure 1 A schematic flowchart of a vehicle control method provided in an embodiment of this disclosure;

[0016] Figure 2 This is another schematic flowchart of the vehicle control method provided in the embodiments of this disclosure;

[0017] Figure 3 Another schematic flowchart of the vehicle control method provided in this disclosure embodiment;

[0018] Figure 4 A schematic diagram of the composition of the vehicle control device provided in the embodiments of this disclosure;

[0019] Figure 5 A schematic block diagram of an example electronic device 500 that can be used to implement embodiments of the present disclosure is shown. Detailed Implementation

[0020] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0021] It should be understood that in the embodiments of this disclosure, the character " / " generally indicates that the preceding and following objects are in an "or" relationship. The terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated.

[0022] Implementing redundant control in the vehicle control system of autonomous or assisted driving vehicles can improve vehicle driving safety.

[0023] Currently, redundant control in vehicle control systems mainly includes: setting up a redundant control system for the basic vehicle control system. When the basic vehicle control system malfunctions, the redundant control system can take over control of the vehicle in a timely manner to prevent the vehicle from going out of control.

[0024] However, current redundancy control methods offer limited improvements in vehicle safety. For example, in some scenarios, both the basic vehicle control system and the redundant control system may malfunction, resulting in a failure to guarantee safe vehicle control. Therefore, to meet the needs of current and future autonomous driving, assisted driving, and intelligent transportation scenarios, the redundancy control methods of vehicle control systems still require further optimization.

[0025] Against this background, this disclosure provides a vehicle control method that, based on the vehicle's basic control system and redundant control system, utilizes the vehicle's own electronic control unit to provide an additional redundant control system, thereby achieving triple redundancy control of the vehicle. This enhances control assurance for vehicle driving and effectively improves vehicle driving safety.

[0026] For example, the entity executing this method can be a vehicle control system. The vehicle control system may include a first control system, a second control system, and a third control system. The first control system may be the vehicle's basic control system; the second control system may be the vehicle's first redundant control system; and the third control system may be the second redundant control system implemented using the vehicle's own electronic control unit. The first, second, and third control systems together achieve triple redundancy control of the vehicle.

[0027] In the embodiments of this disclosure, the first control system and the second control system can be implemented locally in the vehicle or remotely connected to the vehicle. For example, the first control system and the second control system can be implemented locally in the vehicle's on-board chip, central control equipment, etc. Alternatively, the remote device can be a computer or server connected to the vehicle, or other devices with data processing capabilities; the implementation of the first control system and the second control system is not limited herein.

[0028] In some embodiments, the server can be a single server, or it can be a server cluster consisting of multiple servers. In some embodiments, the server cluster can also be a distributed cluster. This disclosure does not limit the specific implementation of the server.

[0029] The vehicle control method is illustrated below.

[0030] Figure 1 This is a schematic flowchart illustrating a vehicle control method provided in an embodiment of this disclosure. Figure 1 As shown, the method may include:

[0031] S101. The first control system determines the first detection result of the vehicle based on the vehicle's perception information, and controls the vehicle based on the first detection result.

[0032] For example, a vehicle can be equipped with various sensors, such as distance sensors, light sensors, and infrared sensors. The perceived information can include various sensor data collected by the vehicle's sensors, such as obstacle information and the distance between the vehicle and obstacles. There are no restrictions on the type and quantity of sensor data.

[0033] In some embodiments, the perceived information may also include map perceived information. For example, map perceived information may include: location information obtained based on a high-precision map or a local map, and lane detection information (such as lane width, orientation, number of lanes, etc.). This disclosure does not limit the perceived information.

[0034] The primary control system can be considered the vehicle's basic control system. Based on the vehicle's sensor information, the primary control system detects the surrounding driving environment and obtains initial detection results. For example, these initial detection results may include: whether there are obstacles around the vehicle, and the distance between the obstacles and the vehicle.

[0035] Based on the first detection result, the first control system can determine whether the first vehicle needs to decelerate, stop, accelerate, turn lights on or off, or turn windshield wipers on or off, and generate vehicle control information corresponding to the first detection result based on the determination result. After generating the vehicle control information corresponding to the first detection result, the first control system can execute the vehicle control information corresponding to the first detection result to control the vehicle. For example, if the determination result is that the first vehicle needs to stop, the vehicle control information corresponding to the first detection result can be to control the vehicle to stop. The first control system can control the vehicle to stop by executing the vehicle control information corresponding to the first detection result. For example, the first control system executing the vehicle control information corresponding to the first detection result can mean that the first control system sends corresponding control commands to the vehicle's mechanical control system (such as the brake control system, throttle control system, etc.) based on the vehicle control information corresponding to the first detection result.

[0036] In this embodiment of the disclosure, the vehicle control information corresponding to the first detection result can be referred to as the first control information.

[0037] S102, the second control system determines the second detection result of the vehicle based on the perception information, and sends the first instruction information to the third control system based on the second detection result; wherein, the first instruction information is related to the second detection result; the third control system is implemented in the vehicle's electronic control unit.

[0038] For example, in this embodiment of the disclosure, the second control system and the first control system can share sensing information. Alternatively, the second control system and the first control system can each acquire sensing information. It should be understood that the sensing information received by the second control system and the first control system is consistent.

[0039] Unlike the first control system, in this embodiment, the second control system can be considered as the vehicle's first redundant control system. Similar to the first control system, the second control system can also detect the vehicle's surrounding driving environment based on the vehicle's perception information; however, the result obtained by the second control system can be referred to as the second detection result. The second detection result is similar to the first detection result and will not be described further.

[0040] After obtaining the second detection result, the second control system can send a first instruction to the third control system based on the second detection result. The first instruction is related to the second detection result, and the third control system can obtain the second detection result or the vehicle control information corresponding to the second detection result based on the first instruction. In this embodiment, the vehicle control information corresponding to the second detection result can be referred to as the second control information.

[0041] The third control system is implemented in the vehicle's electronic control unit. Unlike the first and second control systems, in this embodiment, the third control system can be considered a second redundant control system for the vehicle.

[0042] S103. When the first control system malfunctions, the second control system controls the vehicle based on the second detection result.

[0043] As described above, the second control system can be considered the vehicle's first redundant control system. As the vehicle's first redundant control system, when the first control system malfunctions, the second control system can replace it and control the vehicle based on the second detection result. By replacing (or taking over) the first control system and controlling the vehicle based on the second detection result, the second control system adds a layer of control protection on top of the first control system, achieving dual redundancy control together with the first control system, thus improving vehicle driving safety.

[0044] The method by which the second control system controls the vehicle based on the second detection result can be similar to the method by which the first control system controls the vehicle based on the first detection result, and will not be repeated here. For example, the second control system can determine the vehicle control information corresponding to the second detection result based on the second detection result in order to control the vehicle.

[0045] S104. When both the first control system and the second control system malfunction, the third control system controls the vehicle according to the first instruction information.

[0046] As described above, the third control system can be considered a second redundant control system for the vehicle. As this second redundant control system, when both the first and second control systems malfunction, the third control system can replace them and control the vehicle based on the first indication information. Since the first indication information is related to the second detection result, the third control system can obtain the second detection result or the corresponding vehicle control information based on the first indication information. The third control system controlling the vehicle based on the first indication information may include: determining the vehicle control information corresponding to the second detection result based on the first indication information, and controlling the vehicle based on the corresponding vehicle control information.

[0047] The way the third control system controls the vehicle based on the vehicle control information corresponding to the second detection result can also refer to the way the first control system controls the vehicle based on the first detection result, and will not be described again.

[0048] The third control system replaces the first and second control systems and controls the vehicle according to the first instruction information. It can add another layer of control protection on the basis of the first and second control systems, and together with the first and second control systems, it can achieve triple redundancy control, further improving the driving safety of the vehicle.

[0049] Understandably, in this embodiment, the first control system has a higher priority in controlling the vehicle based on the first detection result than the second control system has a higher priority in controlling the vehicle based on the second detection result. When the first control system malfunctions, the second control system can control the vehicle based on the second detection result. The second control system's priority in controlling the vehicle based on the second detection result is also higher than the third control system's priority in controlling the vehicle based on the first instruction information. When both the first and second control systems malfunction, the third control system can control the vehicle based on the first instruction information.

[0050] As described above, in this embodiment, the first control system can determine the first detection result of the vehicle based on the vehicle's perception information and control the vehicle accordingly. The second control system can determine the second detection result of the vehicle based on the perception information and send a first instruction to the third control system based on the second detection result. The first instruction is related to the second detection result. The third control system is implemented in the vehicle's electronic control unit. When the first control system malfunctions, the second control system controls the vehicle based on the second detection result, achieving two redundant control methods for the vehicle. When both the first and second control systems malfunction, the third control system controls the vehicle based on the first instruction, achieving triple redundant control. By implementing triple redundant control, the vehicle control system gains two additional layers of control protection on top of the first control system, effectively improving vehicle driving safety.

[0051] In addition, by implementing the third control system in the vehicle's electronic control unit, the embodiments of this disclosure can make reasonable use of the resources provided by the vehicle itself to achieve triple redundancy control, which not only reduces the difficulty of implementing triple redundancy control, but also saves the implementation cost of triple redundancy control.

[0052] In some embodiments, the step of the second control system sending the first instruction information to the third control system according to the second detection result in S102 may include: the second control system determining the vehicle control information corresponding to the second detection result based on the second detection result; the second control system sending the first instruction information to the third control system based on the vehicle control information corresponding to the second detection result; the first instruction information including the vehicle control information corresponding to the second detection result.

[0053] Accordingly, the step in S104 above where the third control system controls the vehicle according to the first instruction information may include: the third control system executing the vehicle control information corresponding to the second detection result to control the vehicle.

[0054] For example, in this embodiment, when the second control system sends the first instruction information to the third control system, it can determine the vehicle control information corresponding to the second detection result based on the second detection result, and send the vehicle control information corresponding to the second detection result as the aforementioned first instruction information to the third control system. After receiving the vehicle control information corresponding to the second detection result, if both the first and second control systems are abnormal, the third control system can execute the vehicle control information corresponding to the second detection result to control the vehicle.

[0055] The method by which the second control system determines the vehicle control information corresponding to the second detection result based on the second detection result can refer to the method by which the first control system determines the vehicle control information corresponding to the first detection result based on the first detection result in the aforementioned embodiment; the method by which the third control system executes the vehicle control information corresponding to the second detection result can refer to the method by which the first control system executes the vehicle control information corresponding to the first detection result in the aforementioned embodiment, and will not be described again here.

[0056] In this embodiment, the second control system determines the vehicle control information corresponding to the second detection result based on the second detection result, and sends the first instruction information to the third control system based on the vehicle control information corresponding to the second detection result. The third control system executes the vehicle control information corresponding to the second detection result to control the vehicle. This allows the calculation process of the vehicle control information (i.e., the vehicle control information corresponding to the second detection result) that the third control system needs to execute to be implemented in the second control system, thus minimizing the consumption of computing power of the third control system. Since the third control system is implemented in the vehicle's electronic control unit, this embodiment can achieve triple redundancy control of the vehicle with minimal consumption of computing power of the vehicle's electronic control unit.

[0057] In other embodiments, the first indication information described in S102 above may also include the second detection result.

[0058] Accordingly, the step in S104 above where the third control system controls the vehicle according to the first instruction information may include: the third control system determining the vehicle control information corresponding to the second detection result based on the second detection result; and the third control system executing the vehicle control information corresponding to the second detection result to control the vehicle.

[0059] For example, in this embodiment, when the second control system sends the first instruction information to the third control system, it can directly send the second detection result as the first instruction information to the third control system. After receiving the second detection result, if both the first and second control systems are abnormal, the third control system can first determine the vehicle control information corresponding to the second detection result based on the second detection result, and then execute the vehicle control information corresponding to the second detection result to control the vehicle. Alternatively, the third control system can also determine the vehicle control information corresponding to the second detection result in advance before both the first and second control systems are abnormal; and directly execute the vehicle control information corresponding to the second detection result to control the vehicle when both the first and second control systems are abnormal, without limitation.

[0060] The method by which the third control system determines the vehicle control information corresponding to the second detection result based on the second detection result can refer to the method by which the first control system determines the vehicle control information corresponding to the first detection result based on the first detection result in the aforementioned embodiment; the method by which the third control system executes the vehicle control information corresponding to the second detection result can refer to the method by which the first control system executes the vehicle control information corresponding to the first detection result in the aforementioned embodiment, and will not be described again here.

[0061] In this embodiment, the first indication information includes the second detection result. The third control system determines the vehicle control information corresponding to the second detection result based on the second detection result and executes the corresponding vehicle control information. This allows the calculation process of the vehicle control information to be executed by the third control system (i.e., the vehicle control information corresponding to the second detection result) to be implemented within the third control system. The third control system is implemented in the vehicle's electronic control unit and is a relatively independent system from the second control system. By implementing the calculation process of the vehicle control information to be executed by the third control system within the third control system itself, this embodiment avoids errors in the calculation of the vehicle control information to be executed by the third control system due to malfunctions in the second control system, thereby improving the accuracy of the vehicle's triple redundancy control.

[0062] In some embodiments, the method further includes: a second control system determining a first expected driving state of the vehicle based on a second detection result; when the actual driving state of the vehicle does not match the first expected driving state, the second control system determining that the first control system is abnormal; a third control system determining a second expected driving state of the vehicle based on a first indication; when the actual driving state of the vehicle does not match the second expected driving state, the third control system determining that both the first control system and the second control system are abnormal.

[0063] For example, Figure 2 This is another schematic flowchart illustrating the vehicle control method provided in an embodiment of this disclosure. Figure 2 As shown, the method may include:

[0064] S201. The first control system determines the first detection result of the vehicle based on the vehicle's perception information, and controls the vehicle based on the first detection result.

[0065] S201 can be referred to in S101, and will not be repeated here.

[0066] S202, the second control system determines the second detection result of the vehicle based on the perception information, and sends the first instruction information to the third control system based on the second detection result; wherein, the first instruction information is related to the second detection result; the third control system is implemented in the vehicle's electronic control unit.

[0067] S202 can be referred to in S102, and will not be repeated here.

[0068] S203. The second control system determines the first expected driving state of the vehicle based on the second detection result.

[0069] For example, S203 may include: the second control system determining vehicle control information corresponding to the second detection result based on the second detection result, and determining the first expected driving state of the vehicle based on the vehicle control information corresponding to the second detection result. For example, the second control system may determine what driving state the vehicle should be in after assuming the execution of the vehicle control information corresponding to the second detection result, and this driving state is the first expected driving state. For example, taking the vehicle control information corresponding to the second detection result as parking as an example, the second control system may determine that the vehicle should be in a stopped state after assuming the execution of the vehicle control information corresponding to the second detection result, and the first expected driving state is the stopped state.

[0070] S204. When the actual driving state of the vehicle does not match the first expected driving state, the second control system determines that the first control system is malfunctioning.

[0071] For example, taking the first expected driving state as a stopped state as an example, the discrepancy between the actual driving state of the vehicle and the first expected driving state means that the actual driving state of the vehicle is not a stopped state, such as still driving.

[0072] In this embodiment of the disclosure, when the first control system is operating normally, after the first control system controls the vehicle according to the first detection result, the actual driving state of the vehicle should be consistent with the first expected driving state. If the actual driving state of the vehicle does not match the first expected driving state, it indicates that the first control system is malfunctioning.

[0073] For example, if the first control system is functioning normally and the first detection result is "impending collision," then the first control system should stop the vehicle. At this point, the second detection result should also be "impending collision." Based on the second detection result, the second control system should determine the vehicle's first expected driving state as a stopped state, consistent with the vehicle's actual driving state.

[0074] When the first control system malfunctions, it may be unable to stop the vehicle. In this case, the second detection result is "impending collision." Based on this result, the second control system determines that the vehicle's first expected driving state should be a stopped state, which is inconsistent with the vehicle's actual driving state. Therefore, the second control system can determine that the first control system is malfunctioning and needs to execute S205 as described below.

[0075] S205. When the first control system malfunctions, the second control system controls the vehicle based on the second detection result.

[0076] S205 can be referred to in S103, and will not be repeated here.

[0077] S206. The third control system determines the second expected driving state of the vehicle based on the first instruction information.

[0078] For example, S206 may include: the third control system determining vehicle control information corresponding to the second detection result based on the first indication information (as described in the foregoing embodiments, the first indication information may include the second detection result or the vehicle control information corresponding to the second detection result), and determining the second expected driving state of the vehicle based on the vehicle control information corresponding to the second detection result. For example, similar to the second control system, the third control system may also determine what driving state the vehicle should be in after assuming the execution of the vehicle control information corresponding to the second detection result; this driving state is the second expected driving state. For example, taking deceleration as an example, the third control system may determine that after assuming the execution of the vehicle control information corresponding to the second detection result, the vehicle should be in a deceleration state (or the driving speed should decrease), then the second expected driving state is a deceleration state or a state where the driving speed decreases.

[0079] S207. When the actual driving state of the vehicle does not match the second expected driving state, the third control system determines that both the first control system and the second control system are abnormal.

[0080] For example, taking the second expected driving state as a deceleration state as an example, the discrepancy between the vehicle's actual driving state and the second expected driving state means that the vehicle's actual driving state is not a deceleration state, such as still accelerating or the driving speed not decreasing.

[0081] In this embodiment, when the first control system operates normally, after controlling the vehicle based on the first detection result, the actual driving state of the vehicle should be consistent with the second expected driving state. When the first control system malfunctions but the second control system operates normally, after controlling the vehicle based on the first detection result, the actual driving state of the vehicle should also be consistent with the second expected driving state. If the actual driving state of the vehicle does not match the second expected driving state, it indicates that both the first and second control systems are malfunctioning.

[0082] For example, if the first control system is functioning normally and the first detection result is "a zebra crossing ahead", then the first control system should control the vehicle to decelerate. At this time, the second detection result should also be "a zebra crossing ahead". Based on the second detection result, the second control system should determine the vehicle's first expected driving state as a deceleration state, which is consistent with the vehicle's actual driving state.

[0083] If the first control system malfunctions but the second control system functions normally, the first control system may be unable to control the vehicle's deceleration. If the second detection result is "a zebra crossing ahead," the second control system can control the vehicle to decelerate based on this result. For the third control system, the second expected driving state determined by the third control system should be a deceleration state, consistent with the vehicle's actual driving state.

[0084] When both the first and second control systems malfunction, the first control system may fail to control the vehicle's deceleration. The second control system may also fail to control the vehicle's deceleration. In this case, the second detection result is "zebra crossing ahead." Based on the vehicle control information corresponding to the second detection result, the third control system determines that the vehicle's second expected driving state should be a deceleration state, which is inconsistent with the vehicle's actual driving state. Therefore, the third control system can determine that both the first and second control systems are malfunctioning and needs to execute step S208 below.

[0085] S208. When both the first control system and the second control system malfunction, the third control system controls the vehicle according to the first instruction information.

[0086] S208 can be referred to in S104, and will not be repeated here.

[0087] In this embodiment, the second control system can determine the first expected driving state of the vehicle based on the second detection result, and determine whether the first control system is malfunctioning based on the first expected driving state; the third control system can determine the second expected driving state of the vehicle based on the first indication information, and determine whether both the first and second control systems are malfunctioning based on the second expected driving state. That is, the second and third control systems can determine whether to activate their own redundant control based on their respective determined expected driving states of the vehicle. For the second and third control systems, each redundant control system determines whether to activate its own redundant control based on its own subjective calculation results, which can better ensure the effective activation of redundant control and further improve vehicle driving safety.

[0088] In some embodiments, the first control system may also send a second instruction to the third control system based on the first detection result; the second instruction is related to the first detection result; the third control system may combine the second instruction to determine whether both the first control system and the second control system are malfunctioning, and to control the vehicle.

[0089] For example, Figure 3 This is yet another schematic flowchart illustrating the vehicle control method provided in this embodiment of the disclosure. Figure 3 As shown, the method may include:

[0090] S301. The first control system determines the first detection result of the vehicle based on the vehicle's perception information, and controls the vehicle based on the first detection result.

[0091] S301 can be referred to in S101, and will not be repeated here.

[0092] S302. The first control system sends a second instruction to the third control system based on the first detection result; the second instruction is related to the first detection result.

[0093] The method by which the first control system sends the second instruction information to the third control system based on the first detection result can be similar to the method in the foregoing embodiments where the second control system sends the first instruction information to the third control system based on the second detection result. For example, the first instruction information may include the first detection result, or it may include vehicle control information corresponding to the first detection result. Further details will not be elaborated here.

[0094] S303, the second control system determines the second detection result of the vehicle based on the perception information, and sends the first instruction information to the third control system based on the second detection result; wherein, the first instruction information is related to the second detection result; the third control system is implemented in the vehicle's electronic control unit.

[0095] S303 can be referred to in S102, and will not be repeated here.

[0096] S304. The second control system determines the first expected driving state of the vehicle based on the second detection result.

[0097] S304 can be referred to in S203, and will not be repeated here.

[0098] S305. When the actual driving state of the vehicle does not match the first expected driving state, the second control system determines that the first control system is malfunctioning.

[0099] S305 can be referred to in S204, and will not be repeated here.

[0100] S306. When the first control system malfunctions, the second control system controls the vehicle based on the second detection result.

[0101] S306 can be referred to in S103, and will not be repeated here.

[0102] S307, the third control system determines the second expected driving state of the vehicle based on the first instruction information and the second instruction information.

[0103] That is, the step of the third control system in the foregoing embodiments determining the second expected driving state of the vehicle based on the first instruction information may include: the third control system determining the second expected driving state of the vehicle based on the first instruction information and the second instruction information.

[0104] Understandably, there are two possibilities when comparing the first and second instruction information. First, the vehicle control information corresponding to the first instruction information (such as the second control information mentioned above) is the same as the vehicle control information corresponding to the second instruction information (such as the first control information mentioned above); second, the vehicle control information corresponding to the first instruction information is different from the vehicle control information corresponding to the second instruction information.

[0105] When the vehicle control information corresponding to the first instruction information is the same as the vehicle control information corresponding to the second instruction information, S307 may include: the third control system uses either the first instruction information or the second instruction information as the target instruction information, and determines the second expected driving state of the vehicle based on the target instruction information.

[0106] When the vehicle control information corresponding to the first indication information is different from the vehicle control information corresponding to the second indication information, S307 may include: the third control system determines the vehicle control information with higher control priority from the first indication information and the second indication information according to the control priorities corresponding to the vehicle control information corresponding to the first indication information and the second indication information, and determines the second expected driving state of the vehicle according to the target indication information. For example, assuming that the vehicle control information corresponding to the first indication information is to stop, and the vehicle control information corresponding to the second indication information is to decelerate, for vehicle control, the control priority of "stopping" is higher than the control priority of "decelerating" (that is, the vehicle can be controlled to stop first), then the target indication information can be the first indication information.

[0107] The method by which the third control system determines the second expected driving state can be referred to in the aforementioned embodiments and will not be repeated here.

[0108] S308. When the actual driving state of the vehicle does not match the second expected driving state, the third control system determines that both the first control system and the second control system are abnormal.

[0109] S308 can be referred to in S207, and will not be repeated here.

[0110] S309. When both the first control system and the second control system malfunction, the third control system controls the vehicle according to the first instruction information and the second instruction information.

[0111] For example, S309 is related to S307, in which the third control system can determine target indication information with higher control priority and determine a second expected driving state based on the target indication information. S309 may include: when both the first control system and the second control system malfunction, the third control system controls the vehicle based on the target indication information. It is understood that the target indication information is one of the first indication information and the second indication information.

[0112] In this embodiment, the first control system sends a second instruction to the third control system based on the first detection result. The third control system determines the second expected driving state of the vehicle based on the first and second instruction information. When both the first and second control systems malfunction, the third control system controls the vehicle based on the first and second instruction information. This allows the third control system to jointly determine the second expected driving state and control the vehicle based on the first detection result of the first control system and the second detection result of the second control system. In some implementation scenarios, the second control system may malfunction (e.g., the second detection result is incorrect, and / or the vehicle control information corresponding to the second detection result is incorrect), but the first control system is correct (e.g., the first detection result and the vehicle control information corresponding to the first detection result are correct). To address this, this embodiment allows the third control system to jointly determine the second expected driving state and control the vehicle based on the first detection result of the first control system and the second detection result of the second control system. This avoids vehicle control malfunctions caused by errors in the second control system, further improving the accuracy of triple redundancy control and vehicle driving safety.

[0113] In some embodiments, the method further includes: a third control system determining a third expected driving state of the vehicle based on the perception information; and when the actual driving state of the vehicle does not match the third expected driving state, the third control system controlling the vehicle based on the perception information.

[0114] As described in the preceding embodiments, the first control system has a higher priority in controlling the vehicle based on the first detection result than the second control system has a higher priority in controlling the vehicle based on the second detection result. When the first control system malfunctions, the second control system can control the vehicle based on the second detection result. The second control system's priority in controlling the vehicle based on the second detection result is also higher than the third control system's priority in controlling the vehicle based on the first instruction information. When both the first and second control systems malfunction, the third control system can control the vehicle based on the first instruction information.

[0115] In this embodiment, the priority of the third control system in controlling the vehicle based on perception information can be higher than the priority of the first control system in controlling the vehicle based on the first detection result. In the logic of the third control system controlling the vehicle based on perception information, the control conditions of the third control system can be set to conditions applicable to emergency situations, such as: obstacles being too close (e.g., less than a certain distance threshold), or a pedestrian being suddenly detected. When these conditions applicable to emergency situations are not met, the method can control the vehicle according to the triple redundancy control method described in the previous embodiment. When these conditions applicable to emergency situations are met, the third control system can directly control the vehicle based on perception information. For example, when a pedestrian suddenly appears in front of the vehicle, the third control system can determine the third expected driving state of the vehicle as a stopped state based on perception information; when the actual driving state of the vehicle does not match the third expected driving state, the third control system can directly control the vehicle to stop based on perception information.

[0116] In other words, in this embodiment, regardless of whether the first control system and the second control system malfunction, the third control system can determine the third expected driving state of the vehicle based on the perception information; and when the actual driving state of the vehicle does not match the third expected driving state, it controls the vehicle based on the perception information.

[0117] In this embodiment, the third control system determines the third expected driving state of the vehicle based on the perception information, and controls the vehicle based on the perception information when the actual driving state of the vehicle does not match the third expected driving state. This allows the third control system to control the vehicle directly based on the perception information without relying on the first and second control systems in some emergency situations, providing a deeper level of safety for vehicle driving and further improving vehicle driving safety.

[0118] For example, in scenarios where the detection results of the first and second control systems are inaccurate, this embodiment can still ensure vehicle driving safety through the third control system.

[0119] In some embodiments, the electronic control unit mentioned above includes one or more of the following: a microcontroller unit (MCU) and a microprocessor unit (MPU).

[0120] For example, an MCU can be a single-chip microcomputer or a microcontroller.

[0121] In the vehicle's electronic control unit, MCU and MPU have more available computing power. By selecting electronic control units such as MCU and MPU to implement the third control system, the operation status of the third control system can be better guaranteed.

[0122] Optionally, in this embodiment of the disclosure, the electronic control unit used to implement the third control system may include one or more. When there are multiple electronic control units used to implement the third control system, the third control system may also be implemented as a distributed system on the multiple electronic control units, distributing the required computing power among the multiple electronic control units to reduce the processing pressure on the electronic control units.

[0123] In some embodiments, the step of the second control system sending the first instruction information to the third control system may include: the second control system sending the first instruction information to the third control system according to a target frequency; wherein the target frequency is a dynamic value.

[0124] In one implementation, the target frequency can be a manually set value that can be dynamically adjusted as needed. For example, the capabilities of electronic control units in different vehicles may vary, and different target frequencies can be applied based on the capabilities of the electronic control unit, such as 10 Hz or 100 Hz.

[0125] In another implementation, the vehicle control system can also automatically adjust the target frequency as needed. For example, when the first control system is functioning normally, the target frequency can be adjusted to a lower value; when the first control system malfunctions, the target frequency can be adjusted to a higher value.

[0126] For example, for some purely electric vehicles, when the battery is sufficiently charged, the target frequency can be adjusted to a higher value; when the battery is low, the target frequency can be adjusted to a lower value. This disclosure does not limit the dynamic adjustment method of the target frequency.

[0127] In this embodiment, the second control system sends the first instruction information to the third control system according to the dynamically adjustable target frequency, which enables the triple redundancy control mechanism to better adapt to the vehicle environment according to actual needs.

[0128] It should be noted that the names of the first control system, second control system, and third control system mentioned in the embodiments of this disclosure are merely functional definitions. In other embodiments, the control system may also be referred to as a computing node. For example, the first control system may be called the main computing node, the second control system may be called the redundant computing node, and the third control system may be called the MCU node or MPU node, etc. This disclosure does not limit these names.

[0129] Alternatively, in some embodiments, the aforementioned third control system can also be implemented by adding a chip or other computing-capable device or software (such as an x86 computing system) to the vehicle, and this is not limited thereto.

[0130] In an exemplary embodiment, this disclosure also provides a vehicle control device that can be used to implement the vehicle control method as described in the foregoing embodiments. Figure 4 This is a schematic diagram illustrating the composition of a vehicle control device provided in an embodiment of this disclosure. Figure 4 As shown, the device may include: a first control unit 401, a second control unit 402, and a third control unit 403.

[0131] The first control unit 401 is used to determine the first detection result of the vehicle based on the vehicle's perception information, and to control the vehicle based on the first detection result.

[0132] The second control unit 402 is used to determine the second detection result of the vehicle based on the perception information, and send the first instruction information to the third control unit 403 based on the second detection result; wherein the first instruction information is related to the second detection result; the third control unit 403 is the vehicle's electronic control unit.

[0133] The second control unit 402 is also used to control the vehicle based on the second detection result when the first control unit 401 malfunctions.

[0134] The third control unit 403 is used to control the vehicle according to the first instruction information when both the first control unit 401 and the second control unit 402 are malfunctioning.

[0135] For example, the first control unit 401 may be the first control system described above, the second control unit 402 may be the second control system described above, and the third control unit 403 may be the third control system described above.

[0136] Optionally, the second control unit 402 is specifically used to determine the vehicle control information corresponding to the second detection result based on the second detection result, and send the first instruction information to the third control unit 403 based on the vehicle control information corresponding to the second detection result; the first instruction information includes the vehicle control information corresponding to the second detection result.

[0137] The third control unit 403 is specifically used to execute the vehicle control information corresponding to the second detection result in order to control the vehicle.

[0138] Optionally, the first indication information includes the second detection result; the third control unit 403 is specifically used to determine the vehicle control information corresponding to the second detection result based on the second detection result, and execute the vehicle control information corresponding to the second detection result to control the vehicle.

[0139] Optionally, the second control unit 402 is further configured to determine the first expected driving state of the vehicle based on the second detection result; and to determine that the first control unit 401 is malfunctioning when the actual driving state of the vehicle does not match the first expected driving state.

[0140] The third control unit 403 is also configured to determine the second expected driving state of the vehicle based on the first instruction information; and, when the actual driving state of the vehicle does not match the second expected driving state, to determine that both the first control unit 401 and the second control unit 402 are in abnormal control.

[0141] Optionally, the first control unit 401 is further configured to send second instruction information to the third control unit 403 based on the first detection result; the second instruction information is related to the first detection result.

[0142] The third control unit 403 is specifically configured to determine the second expected driving state of the vehicle based on the first instruction information and the second instruction information; and to control the vehicle based on the first instruction information and the second instruction information.

[0143] Optionally, the third control unit 403 is further configured to determine a third expected driving state of the vehicle based on the perception information; and to control the vehicle based on the perception information when the actual driving state of the vehicle does not match the third expected driving state.

[0144] Optionally, the electronic control unit includes one or more of the following: a microcontroller or a microprocessor.

[0145] Optionally, the second control unit 402 is specifically used to send first instruction information to the third control unit 403 according to the target frequency; wherein the target frequency is a dynamic value.

[0146] The acquisition, storage, and application of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0147] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, a computer program product, and a vehicle control system. The vehicle control system may be an autonomous driving system or a driver assistance system.

[0148] In an exemplary embodiment, an electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method described in the above embodiments. The electronic device may be the computer or server described above.

[0149] In an exemplary embodiment, the readable storage medium may be a non-transitory computer-readable storage medium storing computer instructions for causing a computer to perform the method described in the above embodiments.

[0150] In an exemplary embodiment, the computer program product includes a computer program that, when executed by a processor, implements the method described in the above embodiments.

[0151] In an exemplary embodiment, the autonomous driving system or driver assistance system implements the method described in the above embodiments during operation.

[0152] Figure 5 A schematic block diagram of an example electronic device 500 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0153] like Figure 5 As shown, the electronic device 500 includes a computing unit 501, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 502 or a computer program loaded from a storage unit 508 into a random access memory (RAM) 503. The RAM 503 may also store various programs and data required for the operation of the device 500. The computing unit 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0154] Multiple components in electronic device 500 are connected to I / O interface 505, including: input unit 506, such as keyboard, mouse, etc.; output unit 507, such as various types of monitors, speakers, etc.; storage unit 508, such as disk, optical disk, etc.; and communication unit 509, such as network card, modem, wireless transceiver, etc. Communication unit 509 allows electronic device 500 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0155] The computing unit 501 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 501 performs the various methods and processes described above, such as vehicle control methods. For example, in some embodiments, the vehicle control method may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 508. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 500 via ROM 502 and / or communication unit 509. When the computer program is loaded into RAM 503 and executed by the computing unit 501, one or more steps of the vehicle control method described above may be performed. Alternatively, in other embodiments, the computing unit 501 may be configured to perform the vehicle control method by any other suitable means (e.g., by means of firmware).

[0156] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0157] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0158] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0159] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0160] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0161] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0162] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0163] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A vehicle control method, the method comprising: The first control system determines the first detection result of the vehicle based on the vehicle's perception information, and controls the vehicle based on the first detection result; The second control system determines a second detection result of the vehicle based on the perceived information, and sends a first instruction to the third control system based on the second detection result; wherein the first instruction is related to the second detection result; the third control system is implemented in the vehicle's electronic control unit; The first control system sends a second indication message to the third control system based on the first detection result; the second indication message is related to the first detection result. The second control system determines the first expected driving state of the vehicle based on the second detection result, and determines whether the first control system is malfunctioning based on the first expected driving state. When the first control system malfunctions, the second control system controls the vehicle based on the second detection result; The third control system determines the second expected driving state of the vehicle based on the first indication information and the second indication information, and determines whether the first control system and the second control system are both abnormal based on the second expected driving state. When both the first control system and the second control system malfunction, the third control system controls the vehicle according to the first instruction information and the second instruction information.

2. The method according to claim 1, wherein the second control system sends first indication information to the third control system based on the second detection result, comprising: The second control system determines the vehicle control information corresponding to the second detection result based on the second detection result; The second control system sends a first instruction to the third control system based on the vehicle control information corresponding to the second detection result; The first indication information includes the vehicle control information corresponding to the second detection result; The third control system controls the vehicle according to the first instruction information, including: The third control system executes the vehicle control information corresponding to the second detection result to control the vehicle.

3. The method according to claim 1, wherein the first indication information includes the second detection result; The third control system controls the vehicle according to the first instruction information, including: The third control system determines the vehicle control information corresponding to the second detection result based on the second detection result; The third control system executes the vehicle control information corresponding to the second detection result to control the vehicle.

4. The method according to any one of claims 1-3, further comprising: When the actual driving state of the vehicle does not match the first expected driving state, the second control system determines that the first control system is malfunctioning. When the actual driving state of the vehicle does not match the second expected driving state, the third control system determines that both the first control system and the second control system are malfunctioning.

5. The method according to any one of claims 1-3, further comprising: The third control system determines the third expected driving state of the vehicle based on the perceived information. When the actual driving state of the vehicle does not match the third expected driving state, the third control system controls the vehicle based on the perception information.

6. The method according to any one of claims 1-3, wherein the electronic control unit comprises one or more of the following: a microcontroller unit, a microprocessor.

7. The method according to any one of claims 1-3, wherein the second control system sends first instruction information to the third control system, comprising: The second control system sends a first instruction to the third control system according to the target frequency; wherein the target frequency is a dynamic value.

8. A vehicle control device, the device comprising: First control unit, second control unit, and third control unit; The first control unit is configured to determine a first detection result of the vehicle based on the vehicle's perception information, and control the vehicle based on the first detection result; The second control unit is configured to determine a second detection result of the vehicle based on the perceived information, and send a first instruction information to the third control unit based on the second detection result; wherein the first instruction information is related to the second detection result; the third control unit is the vehicle's electronic control unit; The first control unit is further configured to send second indication information to the third control unit based on the first detection result; the second indication information is related to the first detection result. The second control unit is further configured to determine a first expected driving state of the vehicle based on the second detection result, determine whether the first control unit is abnormally controlled based on the first expected driving state, and control the vehicle based on the second detection result when the first control unit is abnormally controlled. The third control unit is configured to determine the second expected driving state of the vehicle based on the first indication information and the second indication information, and to determine whether both the first control unit and the second control unit are in abnormal control based on the second expected driving state, and to control the vehicle based on the first indication information and the second indication information when both the first control unit and the second control unit are in abnormal control.

9. The apparatus according to claim 8, wherein the second control unit is specifically configured to determine vehicle control information corresponding to the second detection result based on the second detection result, and send first instruction information to the third control unit based on the vehicle control information corresponding to the second detection result; the first instruction information includes the vehicle control information corresponding to the second detection result; The third control unit is specifically used to execute the vehicle control information corresponding to the second detection result in order to control the vehicle.

10. The apparatus according to claim 8, wherein the first indication information includes the second detection result; The third control unit is specifically used to determine the vehicle control information corresponding to the second detection result based on the second detection result, and execute the vehicle control information corresponding to the second detection result to control the vehicle.

11. The apparatus according to any one of claims 8-10, wherein the second control unit is further configured to determine that the first control unit is malfunctioning when the actual driving state of the vehicle does not match the first expected driving state; The third control unit is further configured to determine that both the first control unit and the second control unit are malfunctioning when the actual driving state of the vehicle does not match the second expected driving state.

12. The apparatus according to any one of claims 8-10, wherein the third control unit is further configured to determine a third expected driving state of the vehicle based on the sensing information; and to control the vehicle based on the sensing information when the actual driving state of the vehicle does not match the third expected driving state.

13. The device according to any one of claims 8-10, wherein the electronic control unit comprises one or more of the following: a microcontroller unit, a microprocessor.

14. The apparatus according to any one of claims 8-10, wherein the second control unit is specifically configured to send first indication information to the third control unit according to a target frequency; wherein, The target frequency is a dynamic value.

15. An electronic device comprising: At least one processor; And a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1-7.

16. A non-transitory computer-readable storage medium storing computer instructions for causing a computer to perform the method according to any one of claims 1-7.

17. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1-7.

18. An autonomous driving system, wherein the autonomous driving system, when running, implements the method according to any one of claims 1-7.

Images