An automated driving control system and vehicle

Abstract

This invention relates to an autonomous driving control system and a vehicle. The autonomous driving control system includes an autonomous driving intelligent controller and a vehicle controller, which are communicatively connected. The system also includes a drive-by-wire controller and a safety redundancy controller. The drive-by-wire controller is communicatively connected to both the autonomous driving intelligent controller and the vehicle controller, and the safety redundancy controller is also communicatively connected to both. The drive-by-wire controller sends a braking command to the vehicle controller when it detects an anomaly in the autonomous driving intelligent controller, and the safety redundancy controller sends a braking command to the vehicle controller when it detects an anomaly in the drive-by-wire controller. Based on this invention, the autonomous driving control system can solve the vehicle safety problem caused by the lack of effective detection of anomalies in the autonomous driving intelligent controller in existing autonomous vehicles.

Description

Technical Field

[0001] This invention belongs to the field of fault diagnosis and decision-making for autonomous driving systems, and specifically relates to an autonomous driving control system and vehicle. Background Technology

[0002] In recent years, the development of autonomous driving systems has received increasing attention from research institutions, universities, and automotive companies, and vehicles equipped with these systems have gradually appeared on the streets. With the widespread application of autonomous vehicles, safety incidents involving them have also attracted widespread public attention. Therefore, ensuring the driving safety of autonomous vehicles to improve passenger safety and satisfaction has become a crucial challenge that must be overcome in the development of such vehicles.

[0003] Most existing autonomous vehicles achieve autonomous driving through the autonomous driving intelligent controller of the autonomous driving system. However, most existing autonomous vehicles lack detection of the autonomous driving intelligent controller, making it easy for safety issues to arise when the intelligent controller malfunctions. A small number of autonomous vehicles have a detection module built into the intelligent controller to detect whether the intelligent controller is malfunctioning. However, the built-in detection module cannot detect abnormal message delays when the intelligent controller sends messages outwards in a timely manner, so safety issues still exist in autonomous driving. In addition, existing autonomous vehicles also lack anomaly detection of the detection module. Therefore, existing autonomous vehicles lack effective detection of abnormal conditions of the intelligent controller and cannot effectively control the vehicle when the intelligent controller malfunctions, which in turn leads to vehicle safety accidents. Summary of the Invention

[0004] This invention provides an autonomous driving control system and vehicle to solve the vehicle safety problem caused by the lack of effective detection of abnormal conditions of the autonomous driving intelligent controller in existing autonomous driving vehicles.

[0005] To address the aforementioned technical problems, this invention provides an autonomous driving control system, including an autonomous driving intelligent controller and a vehicle controller, which are communicatively connected. The autonomous driving intelligent controller and the vehicle controller further include a drive-by-wire controller and a safety redundancy controller. The drive-by-wire controller is communicatively connected to both the autonomous driving intelligent controller and the vehicle controller, and the safety redundancy controller is also communicatively connected to both the drive-by-wire controller and the vehicle controller. The drive-by-wire controller sends a braking command to the vehicle controller when it detects an abnormality in the autonomous driving intelligent controller, and the safety redundancy controller sends a braking command to the vehicle controller when it detects an abnormality in the drive-by-wire controller.

[0006] The beneficial effects of the above technical solution are as follows: By setting up a drive-by-wire controller connected to the autonomous driving intelligent controller, it can detect whether the autonomous driving intelligent controller is malfunctioning. If an malfunction occurs, the drive-by-wire controller promptly sends a braking command to the vehicle controller, preventing driving safety issues caused by the malfunction of the autonomous driving intelligent controller, thereby improving the reliability of the autonomous driving control system and driving safety. In addition, a safety redundancy controller connected to the drive-by-wire controller is also set up to detect whether the drive-by-wire controller is malfunctioning. If an malfunction occurs, the safety redundancy controller promptly sends a braking command to the vehicle controller, preventing driving safety issues caused by the malfunction of the drive-by-wire controller. Through the two-level safety control system composed of the drive-by-wire controller and the safety redundancy controller, the vehicle can be effectively controlled when the autonomous driving intelligent controller malfunctions, further improving the reliability of the autonomous driving control system and driving safety.

[0007] Furthermore, in order to better improve the reliability of the autonomous driving control system, the present invention provides an autonomous driving control system, which also includes the safety redundancy controller for controlling the connected braking module and sending braking commands to the braking module when an abnormality is detected in the vehicle controller.

[0008] Furthermore, in order to accurately and comprehensively detect whether the autonomous driving intelligent controller or the drive-by-wire controller is abnormal, the present invention provides an autonomous driving control system, which also includes at least one of two situations: the sent command timeout and the sent command CRC check failure.

[0009] Furthermore, in order to ensure that the vehicle can drive normally when the autonomous driving intelligent controller is functioning properly, the present invention provides an autonomous driving control system, which also includes the drive-by-wire controller for controlling the steering module. When the autonomous driving intelligent controller is functioning properly, the drive-by-wire controller is used to forward steering commands from the autonomous driving intelligent controller to the steering module, and to forward drive commands or braking commands from the autonomous driving intelligent controller to the vehicle controller.

[0010] Furthermore, in order to more accurately and comprehensively detect whether the autonomous driving intelligent controller or drive-by-wire controller is abnormal, the present invention provides an autonomous driving control system, which also includes abnormalities including sudden changes in steering commands or drive commands.

[0011] Furthermore, in order to better improve the reliability of communication between controllers, the present invention provides an autonomous driving control system, which also includes CAN communication as the communication method between the drive-by-wire controller, the autonomous driving intelligent controller, and the vehicle controller.

[0012] Furthermore, in order to better improve the reliability of communication between controllers, the present invention provides an autonomous driving control system, which also includes CAN communication between the safety redundancy controller, the drive-by-wire controller, and the vehicle controller.

[0013] The present invention also provides a vehicle, including a steering module, a drive module, and a braking module. The vehicle further includes the aforementioned automatic driving control system. The automatic driving control system is connected to the steering module, the drive module, and the braking module respectively. The automatic driving control system is used to send corresponding steering commands, drive commands, and braking commands to the steering module, the drive module, and the braking module. The steering module is used to perform steering after receiving a steering command. The drive module is used to perform drive after receiving a drive command. The braking module is used to perform braking after receiving a braking command. Attached Figure Description

[0014] Figure 1 This is a block diagram of the autonomous driving control system of the present invention;

[0015] Figure 2 This is the control logic diagram of the drive-by-wire controller of the present invention;

[0016] Figure 3(a) is the first control logic diagram of the safety redundancy controller of the present invention;

[0017] Figure 3(b) is the second control logic diagram of the safety redundancy controller of the present invention. Detailed Implementation

[0018] The basic concept of this invention is as follows: By setting up a drive-by-wire controller connected to the autonomous driving intelligent controller, it can detect whether the autonomous driving intelligent controller is malfunctioning. If an malfunction occurs, the drive-by-wire controller promptly sends a braking command to the vehicle controller. In addition, a safety redundancy controller connected to the drive-by-wire controller is also set up to detect whether the drive-by-wire controller is malfunctioning. If an malfunction occurs, the safety redundancy controller promptly sends a braking command to the vehicle controller. Through the two-level safety control consisting of the drive-by-wire controller and the safety redundancy controller, the vehicle can be effectively controlled when the autonomous driving intelligent controller malfunctions, thereby improving the reliability of the autonomous driving control system and driving safety.

[0019] To make the objectives, technical solutions, and technical effects of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0020] Example of an automated driving control system:

[0021] Figure 1 This is a block diagram of the autonomous driving control system of the present invention; Figure 2Figure 3(a) is the control logic diagram of the drive-by-wire controller of the present invention; Figure 3(b) is the first control logic diagram of the safety redundancy controller of the present invention.

[0022] This embodiment provides an autonomous driving control system. This autonomous driving control system operates when the vehicle is in a driverless state. For example... Figure 1 As shown, the autonomous driving control system includes an autonomous driving intelligent controller, a vehicle controller (i.e., a VCU new energy controller), a drive-by-wire controller, and a safety redundancy controller. The drive-by-wire controller, a chassis drive-by-wire unit (DBW), is the communication module between the autonomous driving intelligent controller and the vehicle's CAN bus. The vehicle controller (VCU) is a control unit in pure electric vehicles used to implement functions such as drive torque control, optimized braking energy control, vehicle energy management, CAN network maintenance and management, fault diagnosis and handling, and vehicle status monitoring. The autonomous driving intelligent controller and the vehicle controller communicate with each other; the drive-by-wire controller communicates with both the autonomous driving intelligent controller and the vehicle controller; and the safety redundancy controller communicates with both the drive-by-wire controller and the vehicle controller. Specifically, the drive-by-wire controller communicates with both the autonomous driving intelligent controller and the vehicle controller via CAN communication, and the safety redundancy controller communicates with both the drive-by-wire controller and the vehicle controller via CAN communication.

[0023] In this embodiment, the autonomous driving intelligent controller is used to generate CAN messages to enable autonomous driving of the vehicle. The CAN messages include steering commands, driving commands, and braking commands.

[0024] In this embodiment, the drive-by-wire controller is used to receive CAN messages from the autonomous driving intelligent controller and detect whether the autonomous driving intelligent controller is malfunctioning.

[0025] In this embodiment, the drive-by-wire controller sends a braking command CAN message to the vehicle controller when it detects an anomaly in the autonomous driving intelligent controller. Anomalies in the autonomous driving intelligent controller include three scenarios: command timeout, logically inconsistent steering / drive commands, and CRC checksum failures. If the autonomous driving intelligent controller exhibits at least one of these scenarios, it indicates an anomaly. The anomalies in the control commands issued by the autonomous driving intelligent controller include, but are not limited to, the scenarios shown in Table 1.

[0026] Table 1 Definition of Abnormal Status of Control Commands

[0027] Serial Number Abnormal state of control commands issued by the intelligent controller of the autonomous driving system 1 Drive control signal timeout 100ms (or according to calibration value) 2 Braking control signal timeout 100ms (or according to calibration value) 3 Steering control signal timeout 100ms (or according to calibration value) 4 Drive control signal CRC check fault 5 Braking control signal CRC check fault 6 Steering control signal CRC check fault 7 The drive control signal does not exhibit logical jumps. 8 The steering control signal does not change logically.

[0028] Among them, the illogical jump in the sent steering / drive commands refers to a sudden change in the sent steering and / or drive commands. Specifically, during driving, normal steering commands generally exhibit a linear relationship, that is, the corresponding steering angle changes linearly. For example, under normal circumstances, the steering angle gradually increases from 10°, 15°, and 20°. If the steering angle suddenly changes from 10° to 50° during the increase, it can be determined that the steering command has a sudden change. Similarly, normal drive commands generally exhibit a linear relationship, that is, the corresponding torque also changes linearly. For example, under normal circumstances, the torque gradually increases from 20 N·m, 30 N·m, and 40 N·m. If the torque suddenly changes from 20 N·m to 100 N·m during the increase, it can be determined that the drive command has a sudden change.

[0029] In this embodiment, in order to ensure that the vehicle can drive normally when the autonomous driving intelligent controller is working properly, the drive-by-wire controller is also used to control the steering module. When the autonomous driving intelligent controller is working properly, the drive-by-wire controller forwards the steering command from the autonomous driving intelligent controller to the steering module, and forwards the drive command or braking command from the autonomous driving intelligent controller to the vehicle controller.

[0030] In this embodiment, the working process of the drive-by-wire controller is as follows:

[0031] like Figure 2 As shown, when the vehicle is in operation, the DBW drive-by-wire controller first determines whether the vehicle is in autonomous driving mode. If it is confirmed to be in autonomous driving mode, it checks whether the autonomous driving intelligent controller is abnormal. If it is determined that the control command issued by the autonomous driving intelligent controller is in a normal state, the control command will be issued normally. If it is determined that the control command issued by the autonomous driving intelligent controller is in an abnormal state, the safety protection function is triggered to intercept the abnormal control command issued by the autonomous driving intelligent controller and control the vehicle to safely decelerate and stop.

[0032] In this embodiment, the safety redundancy controller is used to receive CAN messages from the drive-by-wire controller and detect whether the drive-by-wire controller is abnormal. The CAN messages include steering commands, driving commands, and braking commands.

[0033] In this embodiment, the safety redundancy controller sends a CAN message including braking commands to the vehicle controller when it detects an anomaly in the drive-by-wire controller. The anomaly in the drive-by-wire controller includes two scenarios: command timeout and CRC check failure. If at least one of these two scenarios occurs, it indicates that the drive-by-wire controller is malfunctioning.

[0034] In this embodiment, to further improve the reliability of the autonomous driving control system, the safety redundancy controller is also used to control the connected braking module. The safety redundancy controller also detects whether the vehicle controller is malfunctioning. When a malfunction is detected, it sends a CAN message containing braking commands to the braking module. Vehicle controller malfunctions include two scenarios: command timeout and CRC check failure. If at least one of these two scenarios occurs, it indicates that the vehicle controller is malfunctioning.

[0035] In this embodiment, the operation of the safety redundancy controller is as follows:

[0036] As shown in Figure 3(a), when the vehicle is in operation, the safety redundancy controller first determines whether it is in autonomous driving mode. If it is confirmed to be in autonomous driving mode, it checks whether the DBW drive-by-wire controller has issued a control command within 150ms. If it is determined that the DBW drive-by-wire controller has issued a control command normally within 150ms and the control command verification is normal, the safety redundancy controller is in monitoring mode and continuously monitors the timeout status of the autonomous driving system control command. If it is determined that the DBW drive-by-wire controller has not issued a control command within 150ms, the safety protection function is triggered, and the safety redundancy controller issues a control command to control the vehicle to safely decelerate and stop.

[0037] As shown in Figure 3(b), when the vehicle is in operation, the safety redundancy controller monitors whether the VCU new energy controller sends a status message within 150ms and whether the status message is verified to be normal. When it is determined that the VCU new energy controller sends a status message within 150ms and the status message is verified to be normal, the safety redundancy controller is in monitoring mode and continuously monitors the timeout status of the VCU new energy controller status message. When it is determined that the VCU new energy controller does not send a status message within 150ms, the safety protection function is triggered, and the safety redundancy controller sends a control command to the braking module to control the vehicle to safely decelerate and stop.

[0038] In this embodiment, the vehicle controller is used to receive CAN messages from the drive-by-wire controller or the safety redundancy controller, and to control the drive module or the braking module to realize the driving or braking of the vehicle.

[0039] In this embodiment, the operation process of the autonomous driving control system is as follows:

[0040] The DBW drive-by-wire controller receives drive, braking, and steering control CAN messages from the autonomous driving intelligent controller. When the drive, braking, and steering control CAN messages are in an abnormal state such as timeout or verification failure, it sends a braking command to the vehicle controller to bring the autonomous vehicle to a safe stop. When the drive, braking, and steering control CAN messages are in a normal state, the DBW drive-by-wire controller sends the CAN messages from the autonomous driving system intelligent controller to the vehicle execution layer (vehicle controller or steering module) to keep the vehicle in a safe autonomous driving operation state.

[0041] The safety redundancy controller receives drive, braking, and steering control CAN messages from the DBW drive-by-wire controller. When the drive, braking, and steering control CAN messages are in an abnormal state such as timeout or verification failure, it sends a braking command to the vehicle controller to stop the autonomous vehicle safely. When the drive, braking, and steering control CAN messages are in a normal state, the safety redundancy controller is in a monitoring state and does not send control CAN message commands.

[0042] The safety redundancy controller also receives status CAN messages from the VCU new energy controller (i.e., the vehicle controller). When the status CAN message of the VCU new energy controller is in an abnormal state of loss, it directly sends a braking control CAN message to the braking module to bring the autonomous vehicle to a safe stop.

[0043] The autonomous driving control system based on this embodiment includes a drive-by-wire controller connected to the autonomous driving intelligent controller to detect any abnormalities in the intelligent controller. If an abnormality is detected, the drive-by-wire controller promptly sends a braking command to the vehicle controller to prevent driving safety issues caused by the intelligent controller's malfunction, thereby improving the reliability and driving safety of the autonomous driving control system. Additionally, a safety redundancy controller connected to the drive-by-wire controller is also included to detect any abnormalities in the drive-by-wire controller. If an abnormality is detected, the safety redundancy controller promptly sends a braking command to the vehicle controller to prevent driving safety issues caused by the drive-by-wire controller's malfunction. This two-tiered safety control system, consisting of the drive-by-wire controller and the safety redundancy controller, effectively controls the vehicle when the intelligent controller malfunctions, further improving the reliability and driving safety of the autonomous driving control system. Furthermore, the safety redundancy controller can also brake the vehicle to a stop when the vehicle controller malfunctions. The monitoring of the vehicle controller's status CAN messages by the safety redundancy controller constitutes a three-tiered safety protection decision-making system for the autonomous vehicle, making vehicle operation safer and resolving and eliminating problems such as loss of control and collisions that endanger passenger safety due to autonomous driving system crashes or poor stability during autonomous driving. The autonomous driving control system in this embodiment includes, but is not limited to, safety protection for the operation of autonomous vehicles.

[0044] Vehicle Example:

[0045] This embodiment provides a vehicle. The vehicle in this embodiment is an autonomous driving vehicle. The vehicle in this embodiment includes a steering module, a drive module, a braking module, and an autonomous driving control system.

[0046] In this embodiment, the autonomous driving control system is connected to the steering module, drive module, and braking module, respectively. The autonomous driving control system sends corresponding steering commands, drive commands, and braking commands to the steering module, drive module, and braking module. The specific details of the autonomous driving control system have already been described in the embodiments of the autonomous driving control system and will not be repeated here.

[0047] A steering module is used to receive steering commands and then implement steering. A steering module, for example, is a steering controller. There must be at least one steering module.

[0048] The driver module is used to receive driver instructions and implement the driver. The driver module is, for example, a driver controller.

[0049] A braking module is used to receive braking commands and implement braking; a braking module is, for example, a brake controller. There must be at least one braking module.

[0050] The vehicle based on this embodiment can solve the vehicle safety problem caused by the lack of effective detection of abnormal conditions of the autonomous driving intelligent controller in existing autonomous driving vehicles.

Claims

1. An autonomous driving control system, comprising an autonomous driving intelligent controller and a vehicle controller, wherein the autonomous driving intelligent controller and the vehicle controller are communicatively connected, characterized in that, The autonomous driving control system further includes a drive-by-wire controller and a safety redundancy controller. The drive-by-wire controller is communicatively connected to both the autonomous driving intelligent controller and the vehicle controller. The safety redundancy controller is also communicatively connected to both the drive-by-wire controller and the vehicle controller. The drive-by-wire controller is used to send braking commands to the vehicle controller when an abnormality is detected in the autonomous driving intelligent controller, and is also used to control the connection to the steering module. When the autonomous driving intelligent controller is functioning normally, the drive-by-wire controller is used to forward steering commands from the autonomous driving intelligent controller to the steering module, and to forward drive commands or braking commands from the autonomous driving intelligent controller to the vehicle controller. The safety redundancy controller is used to send braking commands to the vehicle controller when an abnormality is detected in the drive-by-wire controller, and is also used to control the connection to the braking module, sending braking commands to the braking module when an abnormality is detected in the vehicle controller.

2. The automatic driving control system according to claim 1, characterized in that, An anomaly refers to at least one of two situations: a timeout in the sent command or a CRC check failure in the sent command.

3. The automatic driving control system according to claim 1, characterized in that, Anomalies also include cases where steering or drive commands change abruptly.

4. The automatic driving control system according to claim 1, characterized in that, The communication method between the drive-by-wire controller, the autonomous driving intelligent controller, and the vehicle controller is CAN communication.

5. The automatic driving control system according to claim 1, characterized in that, The communication method between the safety redundancy controller, the drive-by-wire controller, and the vehicle controller is CAN communication.

6. A vehicle comprising a steering module, a drive module, and a braking module, characterized in that, The vehicle further includes an automatic driving control system according to any one of claims 1-5, wherein the automatic driving control system is connected to the steering module, the drive module and the braking module respectively, and the automatic driving control system is used to send corresponding steering commands, drive commands and braking commands to the steering module, the drive module and the braking module. The steering module is used to perform steering after receiving the steering command, the drive module is used to perform drive after receiving the drive command and the braking module is used to perform braking after receiving the braking command.

Images