An autonomous vehicle safety domain redundancy control system and safety evaluation method

Abstract

The application provides a kind of automatic driving car safety domain redundancy control system and safety evaluation method, the safety system aims at providing a kind of multistage fault-tolerant safety body system method containing four levels of safety domain, including level I safety domain vehicle safety perception subsystem, level II safety domain vehicle interconnection safety subsystem, level III safety domain automatic driving and manned driving switching system in emergency, level IV safety domain automatic power-off system and the method of switching between systems, and proposes the algorithm method for reliability evaluation of vehicle using this safety system method through traffic management command system, and the device for evaluating the reliability of vehicle using this safety system method.

Description

Technical Field

[0001] This invention belongs to the field of transportation safety technology, and in particular relates to a safety domain redundancy control system and safety assessment method for autonomous vehicles. Background Technology

[0002] With frequent traffic accidents involving autonomous vehicles, the safety performance of driverless technology has become a major public concern. Because personal safety is at stake, drivers and passengers are worried about the reliability and fault tolerance of autonomous driving, creating an urgent need to improve its safety and error tolerance levels.

[0003] With the advancement of artificial intelligence technology, a significant amount of research has been invested in the field of autonomous driving, currently divided into two technical routes: single-vehicle intelligence and intelligent connected vehicles. The single-vehicle intelligence route cannot predict all scenarios in advance and has significant safety hazards; the intelligent connected vehicle route lacks vehicle intelligence measures. Summary of the Invention

[0004] Purpose of the invention: Autonomous vehicles need to combine the advantages of single-vehicle intelligence and intelligent connected vehicle technologies to achieve technological complementarity, thereby reducing overall costs. Simultaneously, it is necessary to conduct reliability assessments on vehicles employing autonomous driving safety systems, requiring a reliability algorithm for annual inspection and labeling of vehicles using autonomous driving technology.

[0005] To address the aforementioned technical issues, this invention provides a multi-level fault-tolerant safety system for unmanned road vehicles, along with a reliability assessment algorithm and system device. The aim is to provide a safety system equipment method and to evaluate the reliability of vehicles using this safety system method, including simulation evaluation in experimental settings. Especially in the early stages of unmanned driving adoption, it is necessary to certify the redundancy level of unmanned driving systems. Furthermore, as unmanned driving gradually becomes commercialized and the number of unmanned vehicles in cities increases, this invention can simultaneously evaluate urban vehicle traffic safety according to the traffic control command center's evaluation algorithm and system device, and further optimize road traffic strategies.

[0006] This invention provides a redundancy control system for the safety domain of an autonomous vehicle, including a Level I safety domain vehicle safety perception subsystem, a Level II safety domain vehicle interconnection safety subsystem, a Level III safety domain emergency switching system for autonomous driving and human driving, and a Level IV safety domain automatic power-off system.

[0007] The Level I safety domain vehicle safety perception subsystem includes module A, module B, and module C; modules A, B, and C are connected in series.

[0008] Module A includes a collision avoidance ranging component, Module B includes a vehicle vision component, and Module C includes the first group of intelligent driving vehicle units.

[0009] Module A is used to measure the distance between the vehicle and surrounding objects and transmit the distance measurement information to Module B in real time. Module B identifies surrounding objects and transmits the object identification information to Module C. Module C determines whether the surrounding objects pose a safety risk to the vehicle's driving based on the information transmitted by Module B and transmits the information to Module G.

[0010] The Level II safety domain vehicle interconnection safety subsystem includes modules D, E, F, and G; modules D, E, and F are connected in parallel and then connected in series with module G.

[0011] The D module includes a vehicle status digital acquisition subsystem, which is used to collect vehicle speed, gear, tire pressure, temperature and humidity, vehicle length, width and height, engine temperature, and driving start and end points.

[0012] The E module includes a vehicle interconnection module for communicating with vehicles, roadside facilities, pedestrian mobile terminals, traffic management systems such as traffic lights, and satellite positioning systems (including but not limited to the BeiDou satellite positioning system and GPS positioning system).

[0013] The F module includes a traffic control command center interconnection module, used to acquire information, including high-definition dynamic maps of road traffic and information on traffic control caused by social events (such as temporary traffic control for marathon events, traffic control on important sections of roads for the college entrance examination, etc.).

[0014] The G module includes the second group of intelligent driving vehicle units, which comprehensively analyzes the relevant information obtained by the D, E and F modules to determine whether there are safety issues in vehicle operation. The G module and the C module exchange information with each other to achieve comprehensive analysis of various information from the vehicle and other road objects, as well as the vehicle and other road equipment (roadside facilities, pedestrian mobile terminals, traffic lights, etc.).

[0015] The Level III safety domain emergency automatic driving and manual driving switching system includes the H module. When both the Level I safety domain vehicle safety perception subsystem and the Level II safety domain vehicle interconnection safety subsystem report fault codes, the vehicle automatically uses the vehicle power control system to perform an emergency parking.

[0016] The Level IV safety domain automatic power-off system includes module I, which is used to automatically enter the energy shutdown state when the vehicle is out of control in a scenario where the safety domain fails. For electric vehicles, this means the power supply is automatically shut off, and for gasoline vehicles, it means the fuel line is shut off.

[0017] The system performs the following steps:

[0018] Step 1: Module A transmits the ranging information to Module B in real time;

[0019] Step 2: Based on the ranging information, module B uses visual recognition to determine the location information of relevant objects (such as other vehicles and road obstacles) on the road around the vehicle, and then transmits the determination information to module C.

[0020] Step 3: Module C determines whether there is a safety risk to the vehicle from relevant objects on the road around the vehicle based on the information transmitted by Module B, and then transmits the information to Module G.

[0021] Step 4: Module D transmits all digital information of the vehicle to Module G. All digital information of the vehicle includes driving speed, vehicle weight, instrument panel monitoring data, temperature and humidity, starting and ending positions, and the length, width and height of the vehicle.

[0022] Step 5: The E module provides the G module with information on vehicle-to-vehicle communication, vehicle-to-roadside facilities, vehicle-to-traffic lights, and vehicle-to-satellite communication. At the same time, the G module also feeds back the vehicle's driving information to the E module, and the E module feeds back the information to other vehicles or facilities.

[0023] Step 6: Module F provides a dynamic high-precision map of road traffic to Module G, and at the same time supplements the dynamic high-precision map information of road traffic by collecting information from Module G;

[0024] Step 7: The G module issues a driving command to the vehicle and controls the vehicle's power control system to drive normally.

[0025] Step 8: If module G provides self-test information to the vehicle safety perception subsystem in the Level I safety domain, and the self-test information indicates a fault in the vehicle interconnection safety subsystem in the Level II safety domain, module G sends fault information to module C; at the same time, module C will also send the self-test information of the vehicle safety perception subsystem in the Level I safety domain back to module G.

[0026] Step 9: Module C takes over the vehicle power control system based on the fault information of the Level II safety domain vehicle interconnection safety subsystem fed back by Module G, and the Level I safety domain vehicle safety perception subsystem directly controls the vehicle's driving actions.

[0027] Step 10: If module G receives fault information from module C regarding the vehicle safety perception subsystem in the Level I safety domain, it will no longer use the vehicle safety perception subsystem in the Level I safety domain as the basis for decision-making, but will instead use the vehicle interconnection safety subsystem in the Level II safety domain as the basis for decision-making to complete the automatic driving of the vehicle.

[0028] Step 11: The G module provides real-time feedback to the H module on the status of the Level I safety domain vehicle safety perception subsystem and the Level II safety domain vehicle interconnection safety subsystem. When a fault code is provided for the Level I safety domain vehicle safety perception subsystem and the Level II safety domain vehicle interconnection safety subsystem, a reminder to switch from autonomous driving to driverless driving is generated. If the vehicle detects a loss of system control and fails to switch from driverless to driverless driving, the vehicle automatically switches its energy source.

[0029] Step 12: The automatic power-off signal is fed back to the H module through the I module. The H module provides a voice prompt: "A fault has occurred in the two-level autonomous driving system. Automatic power cut-off is performed to prevent the system fault from causing brake failure and subsequent traffic accidents." At this time, the vehicle will exhibit autonomous parking behavior. If the switch is not completed, the vehicle will remain in a parked state. The I module will slowly pop out from the steering wheel position. The I module includes a steering wheel controller. The driver can activate the one-button switch function between autonomous driving and manual driving on the I module to enable manual driving of the vehicle.

[0030] This invention also provides a method for safety assessment of autonomous vehicles, specifically including:

[0031] The reliability R of the vehicle safety perception subsystem in the Level I safety domain Ⅰ for:

[0032] R Ⅰ =R1*R2*R3 (1)

[0033] Where R1 represents the reliability of module A, R2 represents the reliability of module B, and R3 represents the reliability of module C;

[0034] Reliability R of the Level II safety domain vehicle interconnection safety subsystem Ⅱ for:

[0035] R Ⅱ =(1-(1-R4)*(1-R5)*(1-R6))*R7 (2)

[0036] Where R4 represents the reliability of module D, R5 represents the reliability of module E, R6 represents the reliability of module F, and R7 represents the reliability of module G.

[0037] Reliability R of the automated driving and manned driving switching system in emergency situations in the Level III safety domain Ⅲ for:

[0038] R Ⅲ =R8 (3)

[0039] R8 represents the reliability of module H;

[0040] Reliability R of Level IV safety domain automatic power-off system Ⅳ for:

[0041] R Ⅳ =R9 (4)

[0042] R9 represents the reliability of the I module;

[0043] The vehicle reliability Z is:

[0044] Z = 1 - (1 - R) Ⅰ )*(1-R Ⅱ )*(1-R Ⅲ )*(1-R Ⅳ (5).

[0045] The method described in this invention also includes: a safety assessment and annual inspection method, specifically including: after the vehicle leaves the factory, the vehicle is transported by a transportation vehicle to a vehicle annual inspection test site registered with the traffic management department; the traffic command and control center outputs the judgment result to the testing device at the testing site; the vehicle is tested for reliability level of the vehicle equipped with the aforementioned autonomous driving vehicle safety domain redundancy control system during each annual inspection in accordance with the annual inspection requirements of the traffic management department, and a reliability star rating label is affixed.

[0046] When a vehicle's reliability Z ≥ 99.99999%, it is rated as a 7-star safety vehicle.

[0047] When a vehicle's reliability Z ≥ 99.9999%, it is rated as a 6-star safety vehicle.

[0048] When a vehicle's reliability Z ≥ 99.999%, it is rated as a 5-star safety vehicle.

[0049] If the vehicle reliability Z < 99.999%, the annual inspection is deemed unqualified, and it is recommended to repair or replace the system hardware and software.

[0050] The method of the present invention further includes: being able to prominently mark the reliability level of a vehicle using the aforementioned autonomous driving vehicle safety domain redundancy control system by means of vehicle stickers or roof display lights, so as to achieve the purpose of reminder.

[0051] The present invention has the following beneficial effects:

[0052] (1) Enhancing the safety level of autonomous driving through the integration of vehicle networking systems: Current autonomous driving single-vehicle intelligence and intelligent connected vehicle networking modes both have security vulnerabilities, one important reason being insufficient security redundancy. This invention provides multiple layers of safety protection for vehicle operation through five layers of security safeguards.

[0053] (2) Forming a reliability assessment device system for unmanned driving: As unmanned vehicles are tested and commercialized in urban environments, and unmanned vehicles are mixed with ordinary manned vehicles, it is necessary to assess the overall safety level of urban transportation in urban environments.

[0054] (4) Improve the safety level of autonomous driving: By setting up multiple protection mechanisms, building test environments and operation evaluation environments, conduct a full-process and full-network evaluation of the safety of autonomous vehicles entering urban driving. On the one hand, establish a market access mechanism for autonomous vehicles, and on the other hand, provide more applications for transportation based on traffic control and command centers, including unified dispatch of autonomous vehicles through traffic control and command centers, building an autonomous ride-hailing platform, and providing vehicle management for each autonomous vehicle (emergency rescue, maintenance reminders and appointments, insurance reminders and accident reporting services, and other rich applications). Attached Figure Description

[0055] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments, and the advantages of the present invention in the above and / or other aspects will become clearer.

[0056] Figure 1 This is a diagram of the four-level safety domain redundancy control system for autonomous electric vehicles according to the present invention.

[0057] Figure 2 This is a system diagram for reliability evaluation of the four-level safety domain redundancy control system for autonomous electric vehicles according to the present invention. Detailed Implementation

[0058] like Figure 1 , Figure 2 As shown, the present invention provides a safety domain redundancy control system and safety assessment method for autonomous vehicles.

[0059] It includes a Level I safety domain vehicle safety perception subsystem, a Level II safety domain vehicle interconnection safety subsystem, a Level III safety domain emergency switching system between autonomous driving and manned driving, and a Level IV safety domain automatic power-off system.

[0060] The Level I safety domain vehicle safety perception subsystem includes module A, module B, and module C; modules A, B, and C are connected in series.

[0061] Module A includes a collision avoidance ranging component, Module B includes a vehicle vision component, and Module C includes the first group of intelligent driving vehicle units.

[0062] Module A is used to measure the distance between the vehicle and surrounding objects and transmit the distance measurement information to Module B in real time. Module B identifies surrounding objects and transmits the object identification information to Module C. Module C determines whether the surrounding objects pose a safety risk to the vehicle's driving based on the information transmitted by Module B and transmits the information to Module G.

[0063] The Level II safety domain vehicle interconnection safety subsystem includes modules D, E, F, and G; modules D, E, and F are connected in parallel and then connected in series with module G.

[0064] The D module includes a vehicle status digital acquisition subsystem, which is used to collect vehicle speed, gear, tire pressure, temperature and humidity, vehicle length, width and height, engine temperature, and driving start and end points.

[0065] The E module includes a vehicle interconnection module for communicating with vehicles, roadside facilities, pedestrian mobile terminals, traffic management systems such as traffic lights, and satellite positioning systems (including but not limited to the BeiDou satellite positioning system and GPS positioning system).

[0066] The F module includes a traffic control command center interconnection module, used to acquire information, including high-definition dynamic maps of road traffic and information on traffic control caused by social events (such as temporary traffic control for marathon events, traffic control on important sections of roads for the college entrance examination, etc.).

[0067] The G module includes the second group of intelligent driving vehicle units, which comprehensively analyzes the relevant information obtained by the D, E and F modules to determine whether there are safety issues in vehicle operation. The G module and the C module exchange information with each other to achieve comprehensive analysis of various information from the vehicle and other road objects, as well as the vehicle and other road equipment (roadside facilities, pedestrian mobile terminals, traffic lights, etc.).

[0068] The Level III safety domain emergency automatic driving and manual driving switching system includes the H module. When both the Level I safety domain vehicle safety perception subsystem and the Level II safety domain vehicle interconnection safety subsystem report fault codes, the vehicle automatically uses the vehicle power control system to perform an emergency parking.

[0069] The Level IV safety domain automatic power-off system includes module I, which is used to automatically enter the energy shutdown state when the vehicle is out of control in a scenario where the safety domain fails. For electric vehicles, this means the power supply is automatically shut off, and for gasoline vehicles, it means the fuel line is shut off.

[0070] The system performs the following steps:

[0071] Step 1: The vehicle's A module ranging device transmits the ranging information to the vehicle's vision recognition system (B module) in real time;

[0072] Step 2: Module B combines the information from Module A and uses visual recognition to comprehensively determine the location of vehicles and other objects around the road traffic vehicle. Module B then transmits the determination information to the first intelligent driving vehicle unit (Module C).

[0073] Step 3: After the C module performs the information judgment, it transmits the information to the second group of intelligent driving vehicle units (G module);

[0074] Step 4: The D module transmits all digital information of the vehicle to the G module (including driving speed, vehicle weight, instrument panel monitoring data, temperature and humidity, starting and ending positions, and vehicle length, width and height information);

[0075] Step 5: The E module provides the G module with various information regarding vehicle-to-vehicle communication, vehicle-to-roadside facilities, vehicle-to-traffic lights, and vehicle-to-satellite communication. Simultaneously, the G module also feeds back vehicle driving information to the E module, which in turn feeds it back to other vehicles or facilities.

[0076] Step 6: The traffic control command center access module F provides low-latency dynamic high-precision maps to module G, and at the same time supplements the city's dynamic high-definition map information by collecting information from module G;

[0077] Step 7: The G module issues driving instructions to the road vehicle and controls the road vehicle's power transportation system to drive normally;

[0078] Step 8: When module G provides self-test information to system I, and the self-test information indicates that system II has a fault, it transmits the fault information to module C; at the same time, module C will also transmit the self-test information of system I to module G.

[0079] Step 9: Module C takes over the vehicle power control system based on the II system fault information fed back by Module G, and System I directly controls the vehicle's driving actions;

[0080] Step 10: When module G receives system I fault information from module C, it will no longer use system I as the basis for decision-making, but will use system II as the basis for decision-making to complete the vehicle's operation.

[0081] Step 11: The G module provides real-time feedback to the H module on the status of the Level I safety domain vehicle safety perception subsystem and the Level II safety domain vehicle interconnection safety subsystem. When a fault code is provided for the Level I safety domain vehicle safety perception subsystem and the Level II safety domain vehicle interconnection safety subsystem, a reminder is generated to switch from autonomous driving to driverless driving. If the vehicle detects a loss of system control and fails to switch from driverless to driverless driving, the vehicle automatically switches its energy source.

[0082] Step 12: The automatic parking signal is fed back to the H module through the I module. The H module provides a voice prompt: "A malfunction has occurred in the two-level autonomous driving system. Automatic parking will be performed." At this time, it will appear as an autonomous parking action. If the switch is not completed, the vehicle will remain in a parked state. The I module, which contains the steering wheel controller, slowly pops out from the steering wheel position. The driver can activate the one-button switch function between automatic and manual driving on the I module to enable manual driving of the vehicle.

[0083] This invention also provides a method for safety assessment of autonomous vehicles, specifically including:

[0084] The reliability R of the vehicle safety perception subsystem in the Level I safety domain Ⅰ for:

[0085] R Ⅰ =R1*R2*R3 (1)

[0086] Where R1 represents the reliability of module A, R2 represents the reliability of module B, and R3 represents the reliability of module C;

[0087] Reliability R of the Level II safety domain vehicle interconnection safety subsystem Ⅱ for:

[0088] R Ⅱ =(1-(1-R4)*(1-R5)*(1-R6))*R7 (2)

[0089] Where R4 represents the reliability of module D, R5 represents the reliability of module E, R6 represents the reliability of module F, and R7 represents the reliability of module G.

[0090] Reliability R of the automated driving and manned driving switching system in emergency situations in the Level III safety domain Ⅲ for:

[0091] R Ⅲ =R8 (3)

[0092] R8 represents the reliability of module H;

[0093] Reliability R of Level IV safety domain automatic power-off system Ⅳ for:

[0094] R Ⅳ =R9 (4)

[0095] R9 represents the reliability of the I module;

[0096] The vehicle reliability Z is:

[0097] Z = 1 - (1 - R) Ⅰ )*(1-R Ⅱ )*(1-RⅢ )*(1-R Ⅳ (5).

[0098] The method described in this invention also includes: a safety assessment and annual inspection method, specifically including: after the vehicle leaves the factory, the vehicle is transported by a transportation vehicle to a vehicle annual inspection test site registered with the traffic management department; the traffic command and control center outputs the judgment result to the testing device at the testing site; the vehicle is tested for reliability level of the vehicle equipped with the aforementioned autonomous driving vehicle safety domain redundancy control system during each annual inspection in accordance with the annual inspection requirements of the traffic management department, and a reliability star rating label is affixed.

[0099] When a vehicle's reliability Z ≥ 99.99999%, it is rated as a 7-star safety vehicle.

[0100] When a vehicle's reliability Z ≥ 99.9999%, it is rated as a 6-star safety vehicle.

[0101] When a vehicle's reliability Z ≥ 99.999%, it is rated as a 5-star safety vehicle.

[0102] If the vehicle reliability Z < 99.999%, the annual inspection is deemed unqualified, and it is recommended to repair or replace the system hardware and software.

[0103] The method of the present invention further includes: being able to prominently mark the reliability level of a vehicle using the aforementioned autonomous driving vehicle safety domain redundancy control system by means of vehicle stickers or roof display lights, so as to achieve the purpose of reminder.

[0104] This invention provides a redundancy control system for the safety domain of autonomous vehicles and a safety assessment method. Many methods and approaches exist for implementing this technical solution; the above description is merely a preferred embodiment of the invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications should also be considered within the scope of protection of this invention. All components not explicitly stated in this embodiment can be implemented using existing technologies.

Claims

1. A safety domain redundancy control system for autonomous vehicles, characterized in that, This includes a Level I safety domain vehicle safety perception subsystem, a Level II safety domain vehicle interconnection safety subsystem, a Level III safety domain emergency automatic driving and manual driving switching system, and a Level IV safety domain automatic power-off system; The Level I safety domain vehicle safety perception subsystem includes module A, module B, and module C; modules A, B, and C are connected in series. Module A includes a collision avoidance ranging component, which includes an infrared sensor; Module B includes a vehicle vision sensor; and Module C includes the first group of intelligent driving vehicle units. Module A is used to measure the distance between the vehicle and surrounding objects and transmit the distance measurement information to Module B in real time. Module B combines the distance and the vehicle's driving status to identify surrounding objects that may affect vehicle safety and transmits the object identification results to Module C. Module C integrates the vehicle distance information, object identification results, and vehicle driving status information to comprehensively judge the impact on vehicle safety. The Level II safety domain vehicle interconnection safety subsystem includes modules D, E, F, and G; modules D, E, and F are connected in parallel and then connected in series with module G. The D module includes a vehicle status digital acquisition subsystem, which is used to collect vehicle speed, gear, tire pressure, temperature and humidity, vehicle length, width and height, engine temperature, and driving start and end points. The E module includes a vehicle-to-vehicle interconnection module, used for communicating with vehicles, roadside facilities, pedestrian mobile phone terminal IoT sensors, traffic management systems such as traffic lights, and satellite positioning systems; The F module is the access terminal for the road traffic command center, used to obtain traffic control information, including high-definition dynamic maps of road traffic and information on traffic control caused by social events. The G module includes a second group of intelligent driving vehicle units, which are used to comprehensively analyze the information obtained by the D, E and F modules to determine whether there are safety issues in vehicle operation. The G module and the C module exchange information with each other to achieve comprehensive analysis of various types of information from the vehicle and other road objects, as well as from the vehicle and other road equipment.

2. The system according to claim 1, characterized in that, The Level III safety domain emergency switching system for automatic and human driving includes an H module. When both the Level I safety domain vehicle safety perception subsystem and the Level II safety domain vehicle interconnection safety subsystem report fault codes, the vehicle automatically prompts a switch to human driving mode. The steering wheel automatically extends from the front control panel and prompts a switch to human driving mode. If there is no response, the vehicle enters automatic parking mode to avoid driving risks caused by vehicle system failure.

3. The system according to claim 2, characterized in that, The Level IV safety domain automatic power-off system includes module I, which is used to automatically enter the energy shutdown state when the vehicle is out of control in a scenario where the safety domain fails. For electric vehicles, this means the power supply is automatically shut off, and for gasoline vehicles, it means the fuel line is shut off.

4. The system according to claim 3, characterized in that, The system performs the following steps: Step 1: Module A transmits the ranging information to Module B in real time; Step 2: Based on the ranging information, module B uses visual recognition to determine the location information of relevant objects on the road around the vehicle and then transmits the determination information to module C. Step 3: Module C determines whether there is a safety risk to the vehicle from relevant objects on the road around the vehicle based on the information transmitted by Module B, and then transmits the information to Module G. Step 4: Module D transmits all digital information of the vehicle to Module G. All digital information of the vehicle includes driving speed, vehicle weight, instrument panel monitoring data, temperature and humidity, starting and ending positions, and the length, width and height of the vehicle. Step 5: The E module provides the G module with information on vehicle-to-vehicle communication, vehicle-to-roadside facilities, vehicle-to-traffic lights, and vehicle-to-satellite communication. At the same time, the G module also feeds back the vehicle's driving information to the E module, and the E module feeds back the information to other vehicles or facilities. Step 6: Module F provides a dynamic high-precision map of road traffic to Module G, and at the same time supplements the dynamic high-precision map information of road traffic by collecting information from Module G; Step 7: The G module issues a driving command to the vehicle and controls the vehicle's power control system to drive normally. Step 8: If module G provides self-test information to the vehicle safety perception subsystem in the Level I safety domain, and the self-test information indicates a fault in the vehicle interconnection safety subsystem in the Level II safety domain, module G sends fault information to module C; at the same time, module C will also send the self-test information of the vehicle safety perception subsystem in the Level I safety domain back to module G. Step 9: Module C takes over the vehicle power control system based on the fault information of the Level II safety domain vehicle interconnection safety subsystem fed back by Module G, and the Level I safety domain vehicle safety perception subsystem directly controls the vehicle's driving actions. Step 10: If module G receives fault information from module C regarding the vehicle safety perception subsystem in the Level I safety domain, it will no longer use the vehicle safety perception subsystem in the Level I safety domain as the basis for decision-making, but will instead use the vehicle interconnection safety subsystem in the Level II safety domain as the basis for decision-making to complete the automatic driving of the vehicle. Step 11: The G module provides real-time feedback to the H module on the status of the Level I safety domain vehicle safety perception subsystem and the Level II safety domain vehicle interconnection safety subsystem. When a fault code is provided for the Level I safety domain vehicle safety perception subsystem and the Level II safety domain vehicle interconnection safety subsystem, a reminder is generated to switch from autonomous driving to manned driving. If the vehicle detects a loss of system control and fails to switch from unmanned driving to manned driving, the vehicle automatically switches its energy source. Step 12: The automatic power-off signal is fed back to the H module through the I module. The H module provides a voice prompt: "The two-level autonomous driving system has malfunctioned and is automatically cutting off power." At this time, it manifests as autonomous parking behavior. If the switch is not completed, the vehicle will remain in a parked state. The I module slowly pops out from the steering wheel position. The I module includes a steering wheel controller. The driver can activate the one-button switch function between autonomous driving and manual driving on the I module to enable manual driving of the vehicle.

5. A method for safety assessment of autonomous vehicles based on the system described in any one of claims 1 to 4, characterized in that, Specifically, it includes: Reliability R of a vehicle safety perception subsystem in a safety domain of level I Ⅰ is: R Ⅰ = R1*R2*R3 (1), Where R1 represents the reliability of module A, R2 represents the reliability of module B, and R3 represents the reliability of module C. The reliability data comes from third-party testing and certification data of the product. Reliability R of a safety subsystem for vehicle interconnection in a security domain of level II Ⅱ is: R Ⅱ =(1-(1-R4)*(1-R5)*(1-R6)*R7(2) Where R4 represents the reliability of module D, R5 represents the reliability of module E, R6 represents the reliability of module F, and R7 represents the reliability of module G. Reliability R of the automated driving and manned driving switching system in emergency situations in the Level III safety domain Ⅲ for: R Ⅲ =R8 (3), R8 represents the reliability of module H; Reliability R of Level IV safety domain automatic power-off system Ⅳ for: R Ⅳ =R9 (4), R9 represents the reliability of the I module; The vehicle reliability Z is: Z=1-(1- R Ⅰ )*(1- R Ⅱ )*(1- R Ⅲ )*(1- R Ⅳ ) (5)。 6. The method according to claim 5, characterized in that, Also includes: The safety assessment and annual inspection method specifically includes: after a vehicle leaves the factory, it is transported by a means of transport to a vehicle annual inspection test site registered with the traffic management department. The traffic command and control center system outputs the judgment result to the test terminal of the test site. According to the annual inspection requirements of the traffic management department, the vehicle reliability level of the vehicle equipped with the system described in any one of claims 1 to 2 is tested during each annual inspection, and a reliability star rating label is affixed. When a vehicle's reliability Z ≥ 99.99999%, it is rated as a 7-star safety vehicle. When a vehicle's reliability Z ≥ 99.9999%, it is rated as a 6-star safety vehicle. When a vehicle's reliability Z ≥ 99.999%, it is rated as a 5-star safety vehicle. If the vehicle reliability Z < 99.999%, the annual inspection is deemed unqualified, and it is recommended to repair or upgrade the system.

7. The method according to claim 6, characterized in that, The reliability level of a vehicle using the autonomous vehicle safety domain redundancy control system as described in claim 1 can be clearly marked by vehicle stickers or roof-mounted indicator lights to serve as a reminder.

Images