Methods, devices, equipment and storage media for redundancy control of autonomous driving

Abstract

This invention relates to the field of autonomous driving technology, and discloses an autonomous driving redundancy control method, apparatus, device, and storage medium. The method includes at least two control units and at least two execution components. The control units control the execution components according to an initial interaction mode. The method includes: when the main control unit in the control unit is in an abnormal operating state, the control unit switches the control mode of the execution components to a first interaction mode based on a first abnormality type of the main control unit; when at least one of the execution components is in an abnormal operating state, the execution component sends abnormal information to the control unit and executes a corresponding abnormality warning strategy; the control unit switches the control mode of the execution components to a second interaction mode based on a second abnormality type and abnormality level corresponding to the abnormal information. This invention improves driving safety when the autonomous driving system and chassis actuators malfunction.

Description

Technical Field

[0001] This invention relates to the field of autonomous driving technology, and in particular to an autonomous driving redundancy control method, apparatus, device, and storage medium. Background Technology

[0002] To ensure the driving safety of autonomous vehicles, the stability and redundancy of each actuator in the chassis need to be adequately guaranteed. When a failure occurs in the vehicle chassis actuators or any unit of the redundant autonomous driving system, the coordination between the autonomous driving system and the chassis actuators must reach a safe state to ensure passenger safety. However, existing methods struggle to guarantee vehicle safety when a single autonomous driving system controller fails, or when two autonomous driving system controllers fail, or when any of the chassis actuators fail. In short, existing autonomous driving redundancy control methods offer relatively low safety for vehicle driving control when the autonomous driving system and chassis actuators fail. Summary of the Invention

[0003] The main objective of this invention is to solve the technical problem that existing autonomous driving redundancy control methods have relatively low safety in vehicle driving control when the autonomous driving system and chassis actuators fail.

[0004] The first aspect of this invention provides an autonomous driving redundancy control method, including at least two control units and at least two execution components. The at least two control units control the at least two execution components according to an initial interaction mode. The autonomous driving redundancy control method includes: when the working state of the main control unit among the at least two control units is abnormal, the at least two control units switch the control mode of the at least two execution components from the initial interaction mode to a first interaction mode based on a first abnormality type of the main control unit; when the working state of at least one of the at least two execution components is abnormal, the at least two execution components send abnormal information to the at least two control units and execute a corresponding abnormality warning strategy; and the at least two control units switch the control mode of the at least two execution components from the initial interaction mode to a second interaction mode based on the abnormal information.

[0005] Optionally, in a first implementation of the first aspect of the present invention, at least two CAN buses are further included, and the at least two control units and the at least two execution components communicate through the at least two CAN buses. The first exception type includes a reception exception, and the initial interaction mode includes the communication mode of the initial CAN bus. The at least two control units, based on the first exception type of the main control unit, switch the control mode of the at least two execution components from the initial interaction mode to the first interaction mode, which includes: the main control unit in the at least two control units identifies a target CAN bus with a normal working state from the at least two CAN buses, and sends the identification information corresponding to the target CAN bus to the at least two execution components, thereby switching the communication mode of the at least two execution components from the initial CAN bus to the target CAN bus.

[0006] Optionally, in a second implementation of the first aspect of the present invention, the at least two control units further include a redundant control unit, the first exception type further includes an operational exception, and the initial interaction method further includes a response method to the main control unit; the at least two control units switching the control method of the at least two execution components from the initial interaction method to the first interaction method based on the first exception type of the main control unit includes: the redundant control unit in the at least two control units sending its own identification information to the at least two execution components, wherein when the at least two execution components receive the identification information of the redundant control unit within a preset first frame number, the response method of the at least two execution components is switched from the main control unit to the redundant control unit; when the at least two execution components do not receive the identification information of the redundant control unit within a preset second frame number, the response method of the at least two execution components is switched from the main control unit to the redundant control unit after the preset second frame number.

[0007] Optionally, in a third implementation of the first aspect of the present invention, the first exception type further includes a request exception, and the initial interaction method further includes a response method to any one of the at least two control units, the initial interaction method including an initial CAN bus communication method; before the at least two control units switch the control method of the at least two execution components from the initial interaction method to the first interaction method based on the first exception type of the main control unit, the method further includes: if the difference between the braking request values ​​sent between any one control unit and the main control unit exceeds a preset first numerical range, or the steering request value exceeds a preset second numerical range, then the first exception type is determined to be a request exception; the at least two control units switching the control method of the at least two execution components from the initial interaction method to the first interaction method based on the first exception type of the main control unit includes: the main control unit among the at least two control units sending its own identification information to the at least two execution components, and switching the response method of the at least two execution components from any one control unit to the main control unit.

[0008] Optionally, in the fourth implementation of the first aspect of the present invention, each of the at least two execution components includes at least a braking unit, the braking unit including a main braking unit and a redundant braking unit; the step of sending abnormal information to the at least two control units and executing a corresponding abnormal warning strategy when at least one of the at least two execution components is in an abnormal working state includes: when the working state of the main braking unit or the redundant braking unit in the at least two execution components is in a failed working state, the main braking unit or the redundant braking unit in a normal working state sends abnormal information to the at least two control units, and responds to the control commands sent by the at least two control units using the main braking unit or the redundant braking unit in a normal working state.

[0009] Optionally, in a fifth implementation of the first aspect of the present invention, each of the at least two execution components includes at least a steering unit, the steering unit including a main steering unit and a redundant steering unit, the main steering unit being connected to the main CAN bus, and the redundant steering unit being connected to the redundant CAN bus; the step of sending abnormal information to the at least two control units and executing a corresponding abnormal warning strategy when at least one of the at least two execution components is in an abnormal working state includes: when the main steering unit in the at least two execution components is in a failed working state, the redundant steering unit sends abnormal information to the at least two control units through the redundant CAN bus and provides a preset first proportion of steering assistance; when the redundant steering unit in the at least two execution components is in a failed working state, the main steering unit sends abnormal information to the at least two control units through the main CAN bus and provides a preset first proportion of steering assistance.

[0010] When the operating state of the main steering unit or the redundant steering unit in the at least two execution components is in a safety degraded state, the main steering unit and the redundant steering unit respectively send abnormal information to the at least two control units through the main CAN bus and the redundant CAN bus, and respectively provide a preset second ratio of steering assistance.

[0011] Optionally, in a sixth implementation of the first aspect of the present invention, the at least two execution components include a driving unit; the step of sending abnormal information to the at least two control units and executing a corresponding abnormal warning strategy when at least one of the at least two execution components is in an abnormal working state includes: when the working state of the driving unit in the at least two execution components is faulty, the driving unit sends abnormal information to the at least two control units and performs security degradation processing.

[0012] Optionally, in a seventh implementation of the first aspect of the present invention, the at least two control units switching the control mode of the at least two execution components from the initial interaction mode to the second interaction mode based on the abnormal information includes: the at least two control units determining a corresponding second abnormality type and abnormality level based on the abnormal information, wherein the second abnormality type includes brake failure, steering failure, steering safety degradation, and drive failure, and the abnormality level includes a first abnormality level, a second abnormality level, and a third abnormality level; matching a second interaction mode corresponding to the warning level based on the combination of the second abnormality type and the abnormality level, and switching the control mode of the at least two execution components from the initial interaction mode to the second interaction mode corresponding to the warning level.

[0013] A second aspect of the present invention provides an autonomous driving redundancy control device, comprising at least two control units and at least two execution components, wherein the at least two control units control the at least two execution components according to an initial interaction mode. The autonomous driving redundancy control device comprises: a first interaction module, configured to, when the working state of the main control unit among the at least two control units is abnormal, switch the control mode of the at least two execution components from the initial interaction mode to a first interaction mode based on a first abnormality type of the main control unit; a warning module, configured to, when the working state of at least one of the at least two execution components is abnormal, send abnormal information to the at least two control units and execute a corresponding abnormality warning strategy; and a second interaction module, configured to, based on the abnormal information, switch the control mode of the at least two execution components from the initial interaction mode to a second interaction mode.

[0014] Optionally, in a first implementation of the second aspect of the present invention, at least two CAN buses are further included, the at least two control units and the at least two execution components communicate through the at least two CAN buses, the first exception type includes a reception exception, and the initial interaction mode includes the communication mode of the initial CAN bus; the first interaction module includes a reception exception handling unit, configured to: the main control unit among the at least two control units identify a target CAN bus with a normal working state from the at least two CAN buses, and send the identification information corresponding to the target CAN bus to the at least two execution components, and switch the communication mode of the at least two execution components from the initial CAN bus to the target CAN bus.

[0015] Optionally, in a second implementation of the second aspect of the present invention, the at least two control units further include a redundant control unit, the first exception type further includes a runtime exception, and the initial interaction method further includes a response method to the main control unit; the first interaction module further includes a runtime exception handling unit, configured to: send its own identification information to the at least two execution components, wherein when the at least two execution components receive the identification information of the redundant control unit within a preset first frame number, the response method to the at least two execution components is switched from the main control unit to the redundant control unit; when the at least two execution components do not receive the identification information of the redundant control unit within a preset second frame number, the response method to the at least two execution components is switched from the main control unit to the redundant control unit after the preset second frame number.

[0016] Optionally, in a third implementation of the second aspect of the present invention, the first exception type further includes a request exception, and the initial interaction method further includes a response method to any one of the at least two control units, the initial interaction method including an initial CAN bus communication method; the first interaction module further includes: a request exception determination unit, configured to: determine the first exception type as a request exception if the difference between the braking request value sent between any one of the control units and the main control unit exceeds a preset first numerical range, or the steering request value exceeds a preset second numerical range; and a request exception processing unit, configured to: send its own identification information to the at least two execution components, and switch the response method to the at least two execution components from any one control unit to the main control unit.

[0017] Optionally, in a fourth implementation of the second aspect of the present invention, each of the at least two execution components includes at least a braking unit, the braking unit including a main braking unit and a redundant braking unit; the warning module includes a braking warning unit, configured to: when the main braking unit or the redundant braking unit in the at least two execution components is in a failed state, the main braking unit or the redundant braking unit in a normal state sends abnormal information to the at least two control units, and responds to the control commands sent by the at least two control units using the main braking unit or the redundant braking unit in a normal state.

[0018] Optionally, in a fifth implementation of the second aspect of the present invention, each of the at least two execution components includes at least a steering unit, the steering unit including a main steering unit and a redundant steering unit, the main steering unit being connected to the main CAN bus, and the redundant steering unit being connected to the redundant CAN bus; the warning module further includes a steering warning unit, configured to: when the main steering unit in the at least two execution components is in a failed state, the redundant steering unit sends an abnormality message to the at least two control units via the redundant CAN bus and provides a preset first proportion of steering assistance; when the redundant steering unit in the at least two execution components is in a failed state, the main steering unit sends an abnormality message to the at least two control units via the main CAN bus and provides a preset first proportion of steering assistance; when the main steering unit or the redundant steering unit in the at least two execution components is in a safety degradation state, the main steering unit and the redundant steering unit respectively send abnormality messages to the at least two control units via the main CAN bus and the redundant CAN bus, and respectively provide a preset second proportion of steering assistance.

[0019] Optionally, in a sixth implementation of the second aspect of the present invention, the at least two execution components include a driving unit; the early warning module further includes a driving early warning unit, used to: when the working state of the driving unit in the at least two execution components is faulty, the driving unit sends abnormal information to the at least two control units and performs security degradation processing.

[0020] Optionally, in a seventh implementation of the second aspect of the present invention, the second interaction module includes: a control anomaly determination unit, used by the at least two control units to determine a corresponding second anomaly type and anomaly level based on the anomaly information, wherein the second anomaly type includes brake failure, steering failure, steering safety degradation, and drive failure, and the anomaly level includes a first anomaly level, a second anomaly level, and a third anomaly level; and an interaction switching unit, used to match a second interaction mode corresponding to the warning level based on the combination of the second anomaly type and the anomaly level, and to switch the control mode of the at least two execution components from the initial interaction mode to the second interaction mode corresponding to the warning level.

[0021] A third aspect of the present invention provides an autonomous driving redundancy control device, comprising: a memory and at least one processor, wherein the memory stores instructions; the at least one processor invokes the instructions in the memory to cause the autonomous driving redundancy control device to execute the above-described autonomous driving redundancy control method.

[0022] A fourth aspect of the present invention provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the above-described autonomous driving redundancy control method.

[0023] The technical solution provided by this invention includes a method comprising at least two control units and at least two execution components. The control units control the execution components according to an initial interaction mode. The method includes: when the main control unit in the control unit is in an abnormal operating state, the control unit switches the control mode of the execution components to a first interaction mode based on a first abnormality type of the main control unit; when at least one of the execution components is in an abnormal operating state, the execution component sends abnormal information to the control unit and executes a corresponding abnormality warning strategy; the control unit switches the control mode of the execution components to a second interaction mode based on a second abnormality type and abnormality level corresponding to the abnormal information. This invention improves driving safety when the autonomous driving system and chassis actuators malfunction. Attached Figure Description

[0024] Figure 1 This is a schematic diagram of the first embodiment of the autonomous driving redundancy control method in this invention;

[0025] Figure 2 This is a schematic diagram of one embodiment of the autonomous driving redundancy control device in this invention;

[0026] Figure 3 This is a schematic diagram of another embodiment of the autonomous driving redundancy control device in this invention;

[0027] Figure 4 This is a schematic diagram of one embodiment of the autonomous driving redundancy control device in this invention. Detailed Implementation

[0028] This invention provides an autonomous driving redundancy control method, apparatus, device, and storage medium. The method includes at least two control units and at least two execution components. The control units control the execution components according to an initial interaction mode. The method includes: when the main control unit in the control unit is in an abnormal operating state, the control unit switches the control mode of the execution components to a first interaction mode based on a first abnormality type of the main control unit; when at least one of the execution components is in an abnormal operating state, the execution component sends abnormal information to the control unit and executes a corresponding abnormality warning strategy; the control unit switches the control mode of the execution components to a second interaction mode based on a second abnormality type and abnormality level corresponding to the abnormal information. This invention improves driving safety when the autonomous driving system and chassis actuators malfunction.

[0029] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” or “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] For ease of understanding, the specific process of the embodiments of the present invention is described below. Please refer to [link / reference]. Figure 1 The first embodiment of the autonomous driving redundancy control method in this invention includes:

[0031] 101. When the working state of the main control unit in the at least two control units is abnormal, the at least two control units switch the control mode of the at least two execution components from the initial interaction mode to the first interaction mode based on the first abnormality type of the main control unit.

[0032] It is understood that the executing entity of this invention can be an autonomous driving redundancy control device, a terminal, or a server; no specific limitation is made here. This autonomous driving redundancy control method is applied to a redundant autonomous driving system, including at least two control units and at least two execution components. The at least two control units control the at least two execution components according to an initial interaction method. Therefore, this embodiment uses the redundant autonomous driving system as the executing entity for description.

[0033] In this embodiment, the control unit is the main unit (ADU) of the automated driving control system. In a redundant automated driving system, there are at least two control units, at least one of which serves as the main control unit and at least one as the redundant control unit (the following description uses a combination of one main control unit and one redundant control unit). An execution component consists of related units such as a steering system, a braking system, and a drive system. A redundant automated driving system includes at least two execution components, at least one of which is a main execution component and one is a redundant execution component (the following description uses a combination of one main execution component and one redundant execution component). It should be noted that regardless of the number of execution components, there is only one drive system.

[0034] Specifically, in the execution of a redundant autonomous driving system, at least one or more of the two control units may operate simultaneously or none of them may operate (all malfunction). During operation, autonomous driving control commands are issued to the execution components to control them to perform corresponding driving behaviors. When performing driving behaviors, the execution components will only respond to control commands from one control unit at a time, and under normal circumstances, the execution components will respond to control commands from the main control unit by default.

[0035] In this embodiment, when any one or more of the at least two control units malfunction, they will report their own faults. However, under normal circumstances, the control mode of the execution component will only be switched from the initial interaction mode to the first interaction mode when the main control unit malfunctions. For example, when the main control unit is normal, even if the redundant control unit malfunctions (such as over-temperature, over-voltage, over-current, or software-level errors), the execution component will continue to obey the control commands of the main control unit, and the control mode will not change. The main control unit will detect the abnormal information of the redundant control unit and report it to the main autonomous driving system.

[0036] In one embodiment, the redundant autonomous driving system further includes at least two CAN buses, and the at least two control units and the at least two execution components communicate through the at least two CAN buses. The first exception type includes a reception exception, and the initial interaction mode includes the communication mode of the initial CAN bus. Based on the first exception type of the main control unit, the at least two control units switch the control mode of the at least two execution components from the initial interaction mode to the first interaction mode, which includes: the main control unit in the at least two control units identifies a target CAN bus with a normal working state from the at least two CAN buses, and sends the identification information corresponding to the target CAN bus to the at least two execution components, thereby switching the communication mode of the at least two execution components from the initial CAN bus to the target CAN bus.

[0037] In this embodiment, in the redundant autonomous driving system, each unit in each control unit and each execution component is connected to at least two CAN buses through a receiving node, including at least one main CAN bus and one redundant CAN bus. Each control unit sends control commands simultaneously through multiple CAN buses, but the execution component only responds to control commands from one CAN bus at a time. Under normal circumstances, the execution component responds to control commands from the main CAN bus by default. A reception anomaly here indicates a fault in the receiving node, such as the inability to receive control commands sent from the CAN bus.

[0038] In this embodiment, when the receiving node of the main control unit fails (e.g., the main CAN bus communication fails or the receiving node between the main CAN bus and the redundant CAN bus fails), the main control unit adds an identification message (e.g., a flag signal) and sends it to an available target CAN bus (e.g., a redundant CAN bus) to notify the execution component which CAN bus is working normally. It should be noted that the execution component will only respond to control commands from one CAN bus, but will respond to identification messages (e.g., flag signals) from all CAN buses. The criterion for a reception anomaly in the main control unit is that the main control unit loses more than four consecutive frames.

[0039] In one embodiment, the at least two control units further include a redundant control unit, the first exception type further includes an operational exception, and the initial interaction mode further includes a response mode to the main control unit; the at least two control units, based on the first exception type of the main control unit, switch the control mode of the at least two execution components from the initial interaction mode to the first interaction mode, including: the redundant control unit in the at least two control units sends its own identification information to the at least two execution components, wherein when the at least two execution components receive the identification information of the redundant control unit within a preset first frame number, the response mode of the at least two execution components is switched from the main control unit to the redundant control unit; when the at least two execution components do not receive the identification information of the redundant control unit within a preset second frame number, the response mode of the at least two execution components is switched from the main control unit to the redundant control unit after the preset second frame number.

[0040] In this embodiment, when the main control unit malfunctions (including over-temperature, over-voltage, over-current, and software-level errors), the redundant control unit sends its own identification information (such as a flag signal) to both the main CAN bus and the redundant CAN bus, notifying the execution component to respond to the redundant control unit's signal. If no flag signal is received from the redundant control unit within 8 frames, the execution component will directly switch to responding to the redundant control unit's signal. Within the 8-frame timeframe, before receiving the flag signal from the redundant control unit, it will respond to the last valid request value issued by the primary driver unit.

[0041] In one implementation, the first exception type further includes a request exception, and the initial interaction method further includes a response method to any one of the at least two control units, the initial interaction method including an initial CAN bus communication method; before the at least two control units switch the control method of the at least two execution components from the initial interaction method to the first interaction method based on the first exception type of the main control unit, the method further includes: if the difference between the braking request values ​​sent between any one control unit and the main control unit exceeds a preset first value range, or the steering request value exceeds a preset second value range, then the first exception type is determined to be a request exception; the at least two control units switching the control method of the at least two execution components from the initial interaction method to the first interaction method based on the first exception type of the main control unit includes: the main control unit among the at least two control units sending its own identification information to the at least two execution components, and switching the response method of the at least two execution components from any one control unit to the main control unit.

[0042] In this embodiment, under normal circumstances, the request values ​​sent by the main control unit and the redundant control unit are consistent. When the request values ​​sent by the main control unit and the redundant control unit are inconsistent, the chassis obeys the main control unit, and the redundant control unit reports an abnormal information indicating inconsistent request values. Specifically, even if the control unit currently responding to the execution component is not the main control unit, it will switch to responding to the main control unit. The inconsistency determination condition for the braking request value is: the brake pedal conversion value exceeds 10% for 300ms; the inconsistency determination condition for the steering request value is: the angle difference is 30 degrees for 500ms.

[0043] Finally, if an anomaly is detected in the main control unit and an anomaly is also detected in the redundant control unit, that is, if the main control unit and the redundant control unit fail simultaneously (judgment condition: the main control unit and the redundant control unit lose more than 4 frames simultaneously), then the autonomous driving will stop: braking will bring the vehicle to a stop with a deceleration of 0.65g, and steering will maintain the request value of the last valid frame.

[0044] 102. When the working state of at least one of the at least two execution components is abnormal, the at least two execution components send abnormal information to the at least two control units and execute the corresponding abnormal warning strategy;

[0045] In this embodiment, the previous section explained how to switch the interaction mode with the execution component when the control unit malfunctions. Next, it describes how the execution component itself executes the abnormal warning strategy when the execution component malfunctions, and how this affects the interaction mode with the control unit.

[0046] In this embodiment, the main execution component includes at least a main braking unit and a main steering unit, and the redundant execution component includes at least a redundant braking unit and a redundant steering unit. Unlike when a control unit malfunctions (when one control unit malfunctions, another control unit is switched to interact with the execution component), when any unit in the main execution component or the redundant execution component malfunctions, its malfunction level needs to be detected to determine whether to provide limited autonomous driving behavior, pull over to the side of the road, or brake directly to a stop. This is because the safety issues caused by malfunctions in the execution component are greater, and cannot be solved simply by switching from a main unit to a redundant unit (see the next step for details).

[0047] In one embodiment, each of the at least two execution components includes at least a braking unit, the braking unit including a main braking unit and a redundant braking unit; when the working state of at least one of the at least two execution components is abnormal, the at least two execution components send abnormal information to the at least two control units and execute the corresponding abnormal warning strategy, including: when the working state of the main braking unit or the redundant braking unit in the at least two execution components is malfunctioning, the main braking unit or the redundant braking unit with a normal working state sends abnormal information to the at least two control units, and responds to the control commands sent by the at least two control units using the main braking unit or the redundant braking unit with a normal working state.

[0048] In this embodiment, when the main braking unit fails, the redundant braking unit will obey the control commands of the main CAN bus. When the redundant braking unit fails, the main braking unit will obey the control commands of the main CAN bus. The switched redundant braking unit and the main control unit will simultaneously report abnormal information to the main control unit and the redundant control unit (and simultaneously send information to the main CAN bus and the redundant CAN bus to the main control unit and the redundant control unit).

[0049] In one embodiment, each of the at least two execution components includes at least a steering unit, the steering unit including a main steering unit and a redundant steering unit, the main steering unit being connected to the main CAN bus, and the redundant steering unit being connected to the redundant CAN bus; the step of sending abnormal information to the at least two control units and executing a corresponding abnormal warning strategy when at least one of the at least two execution components is in an abnormal operating state includes: when the main steering unit in the at least two execution components is in a failed operating state, the redundant steering unit sends abnormal information to the at least two control units through the redundant CAN bus and provides a preset first proportion of steering assistance; when the redundant steering unit in the at least two execution components is in a failed operating state, the main steering unit sends abnormal information to the at least two control units through the main CAN bus and provides a preset first proportion of steering assistance; when the main steering unit or the redundant steering unit in the at least two execution components is in a safety degradation operating state, the main steering unit and the redundant steering unit send abnormal information to the at least two control units through the main CAN bus and the redundant CAN bus respectively, and provide a preset second proportion of steering assistance respectively.

[0050] In this embodiment, when the main steering unit fails (no steering assist at all, such as due to overheating, overvoltage, or overcurrent), the redundant steering unit will follow the instructions of the connected redundant CAN bus and report the abnormal information to the redundant CAN bus. At this time, the redundant steering unit will only provide a first proportion (e.g., 50%) of steering assistance. Alternatively, when the redundant steering unit fails (no steering assist at all, due to overheating, overvoltage, or overcurrent), the main steering unit will continue to follow the instructions of the main CAN bus and report the abnormal information to the redundant CAN bus, but the steering assistance will also be reduced to the first proportion (e.g., 50%).

[0051] In addition, when the main steering unit or the redundant steering unit is degraded (e.g., due to torque sensor failure, angle sensor failure, etc.), the main steering unit and the redundant steering unit can still communicate normally. Therefore, they will report abnormal information at the same time and maintain the preset first proportion of steering assistance, such as the maximum steering assistance of the current safety level (100%).

[0052] In one embodiment, the at least two execution components include a drive unit; when the working state of at least one of the at least two execution components is abnormal, the at least two execution components send abnormal information to the at least two control units and execute the corresponding abnormal warning strategy, including: when the working state of the drive unit in the at least two execution components is faulty, the drive unit sends abnormal information to the at least two control units and performs security degradation processing.

[0053] 103. Based on the abnormal information, the at least two control units switch the control mode of the at least two execution components from the initial interaction mode to the second interaction mode.

[0054] In this embodiment, by determining which drive unit in the execution components experiences an anomaly and what type of anomaly, the second anomaly type and anomaly level corresponding to the anomaly information can be determined. The at least two control units, based on the anomaly information, switch the control mode of the at least two execution components from the initial interaction mode to the second interaction mode. This includes: the at least two control units determining the corresponding second anomaly type and anomaly level based on the anomaly information; the second anomaly type including brake failure, steering failure, steering safety degradation, and drive failure; and the anomaly level including a first anomaly level, a second anomaly level, and a third anomaly level; based on the combination of the second anomaly type and the anomaly level, matching the second interaction mode corresponding to the warning level, and switching the control mode of the at least two execution components from the initial interaction mode to the second interaction mode corresponding to the warning level.

[0055] Specifically, when at least two control units switch the control mode of the at least two actuators from the initial interaction mode to a second interaction mode of stopping the vehicle in a preset area based on the brake failure, steering failure or steering safety degradation corresponding to the abnormal information and the first abnormal level;

[0056] Specifically, when at least two control units switch the control mode of the at least two execution components from the initial interaction mode to the second interaction mode of braking based on the steering failure or steering safety degradation corresponding to the abnormal information and the second abnormal level;

[0057] Specifically, when at least two control units switch the control mode of the drive component in the at least two execution components from the initial interaction mode to the second interaction mode of stopping the acceleration request command based on the drive fault and the third abnormality level corresponding to the abnormal information.

[0058] This means that when the braking unit fails, only the first safety level will be triggered, in which case the vehicle will be controlled to pull over or stop in a safe area. A failure or degraded safety level in the steering unit will trigger both the first and second safety levels, controlling the vehicle to pull over or stop in a safe area, or bringing it to an emergency stop in place. A failure in the drive unit will trigger the third safety level, preventing the vehicle from accelerating. In summary, regarding the urgency of safety control in the second interaction mode, the second safety level > the first safety level > the third safety level.

[0059] In addition, in the redundant autonomous driving system, the main control unit, redundant control unit, and main braking unit each have receiving nodes deployed on the main CAN bus and redundant CAN bus (6 receiving nodes in total); the redundant braking unit and main steering unit each have receiving nodes deployed on the main CAN bus (2 receiving nodes in total); and the redundant steering unit each has receiving nodes deployed on the redundant CAN bus (1 receiving node in total). When any receiving node fails (i.e., the corresponding sub-CAN bus goes offline), the abnormal information of the failed receiving node will be automatically reported. Specifically, when the receiving node corresponding to the main steering unit or redundant steering unit fails, since there is only one receiving node, the system directly switches to another redundant steering unit or main steering unit to respond.

[0060] In this embodiment of the invention, when the main control unit in the control unit is in an abnormal operating state, the control unit switches the control mode of the execution component to a first interaction mode based on a first abnormality type of the main control unit; when at least one of the execution components is in an abnormal operating state, the execution component sends abnormal information to the control unit and executes the corresponding abnormality warning strategy; the control unit switches the control mode of the execution component to a second interaction mode based on a second abnormality type and abnormality level corresponding to the abnormal information. This invention improves driving safety when malfunctions occur in the autonomous driving system and chassis actuators.

[0061] The above describes the autonomous driving redundancy control method in the embodiments of the present invention. The following describes the autonomous driving redundancy control device in the embodiments of the present invention. Please refer to [link / reference]. Figure 2 One embodiment of the autonomous driving redundancy control device in this invention includes: at least two control units and at least two execution components, wherein the at least two control units control the at least two execution components according to an initial interaction mode, and the autonomous driving redundancy control device includes:

[0062] The first interaction module 201 is used to switch the control mode of the at least two execution components from the initial interaction mode to the first interaction mode based on the first abnormality type of the main control unit when the working state of the main control unit among the at least two control units is abnormal.

[0063] The early warning module 202 is used to send abnormal information to the at least two control units and execute the corresponding abnormal early warning strategy when the working state of at least one of the at least two execution components is abnormal.

[0064] The second interaction module 203 is used for the at least two control units to switch the control mode of the at least two execution components from the initial interaction mode to the second interaction mode based on the abnormal information.

[0065] In this embodiment of the invention, when the main control unit in the control unit is in an abnormal operating state, the control unit switches the control mode of the execution component to a first interaction mode based on a first abnormality type of the main control unit; when at least one of the execution components is in an abnormal operating state, the execution component sends abnormal information to the control unit and executes the corresponding abnormality warning strategy; the control unit switches the control mode of the execution component to a second interaction mode based on a second abnormality type and abnormality level corresponding to the abnormal information. This invention improves driving safety when malfunctions occur in the autonomous driving system and chassis actuators.

[0066] Please see Figure 3Another embodiment of the autonomous driving redundancy control device in this invention includes: at least two control units and at least two execution components, wherein the at least two control units control the at least two execution components according to an initial interaction mode, and the autonomous driving redundancy control device includes:

[0067] The first interaction module 201 is used to switch the control mode of the at least two execution components from the initial interaction mode to the first interaction mode based on the first abnormality type of the main control unit when the working state of the main control unit among the at least two control units is abnormal.

[0068] The early warning module 202 is used to send abnormal information to the at least two control units and execute the corresponding abnormal early warning strategy when the working state of at least one of the at least two execution components is abnormal.

[0069] The second interaction module 203 is used for the at least two control units to switch the control mode of the at least two execution components from the initial interaction mode to the second interaction mode based on the abnormal information.

[0070] Specifically, it also includes at least two CAN buses, through which the at least two control units and the at least two execution components communicate, the first exception type includes a reception exception, and the initial interaction method includes the initial CAN bus communication method;

[0071] The first interaction module 201 includes a receiving exception handling unit 2011, used for:

[0072] The main control unit in the at least two control units identifies the target CAN bus that is in normal working condition from the at least two CAN buses, and sends the identification information corresponding to the target CAN bus to the at least two execution components, switching the communication mode of the at least two execution components from the initial CAN bus to the target CAN bus.

[0073] Specifically, the at least two control units further include a redundant control unit, the first anomaly type further includes operational anomalies, and the initial interaction method further includes a response method to the main control unit;

[0074] The first interaction module 201 further includes a runtime exception handling unit 2012, used for:

[0075] The redundant control unit in the at least two control units sends its own identification information to the at least two execution components, wherein...

[0076] When the at least two execution components receive the identification information of the redundant control unit within a preset first frame number, the response mode for the at least two execution components will be switched from the main control unit to the redundant control unit.

[0077] If the at least two execution components do not receive the identification information of the redundant control unit within a preset second frame number, the response mode for the at least two execution components will be switched from the main control unit to the redundant control unit after the preset second frame number.

[0078] Specifically, the first exception type also includes request exceptions, and the initial interaction method also includes a response method to any one of the at least two control units, and the initial interaction method includes an initial CAN bus communication method;

[0079] The first interaction module 201 further includes:

[0080] The request anomaly determination unit 2013 is configured to: determine the first anomaly type as a request anomaly if the difference between the braking request values ​​sent between any one of the control units and the main control unit exceeds a preset first value range, or the steering request value exceeds a preset second value range.

[0081] The request exception handling unit 2014 is used to: send its own identification information to the at least two execution components, and switch the response mode of the at least two execution components from any one of the control units to the main control unit.

[0082] Specifically, each of the at least two execution components includes at least a braking unit, and the braking unit includes a main braking unit and a redundant braking unit;

[0083] The warning module 202 includes a braking warning unit 2021, used for:

[0084] When the main braking unit or redundant braking unit in the at least two execution components is in a failed state, the main braking unit or redundant braking unit in a normal state sends an abnormal information to the at least two control units and responds to the control commands sent by the at least two control units using the main braking unit or redundant braking unit in a normal state.

[0085] Specifically, each of the at least two execution components includes at least a steering unit, the steering unit including a main steering unit and a redundant steering unit, the main steering unit being connected to the main CAN bus, and the redundant steering unit being connected to the redundant CAN bus;

[0086] The warning module 202 further includes a steering warning unit 2022, used for:

[0087] When the main steering unit in the at least two execution components is in a failed state, the redundant steering unit sends an abnormal message to the at least two control units through the redundant CAN bus and provides a preset first ratio of steering assistance.

[0088] When the redundant steering unit in the at least two execution components fails, the main steering unit sends an abnormality message to the at least two control units via the main CAN bus and provides a preset first ratio of steering assistance.

[0089] When the operating state of the main steering unit or the redundant steering unit in the at least two execution components is in a safety degraded state, the main steering unit and the redundant steering unit respectively send abnormal information to the at least two control units through the main CAN bus and the redundant CAN bus, and respectively provide a preset second ratio of steering assistance.

[0090] Specifically, the at least two execution components include a driving unit;

[0091] The early warning module 202 further includes a driving early warning unit 2023, used for:

[0092] When the operating state of the drive unit in the at least two execution components is faulty, the drive unit sends an exception message to the at least two control units and performs a security downgrade process.

[0093] Specifically, the second interaction module 203 includes:

[0094] The control anomaly determination unit 2031 is used for the at least two control units to determine a corresponding second anomaly type and anomaly level based on the anomaly information. The second anomaly type includes brake failure, steering failure, steering safety degradation, and drive failure. The anomaly level includes a first anomaly level, a second anomaly level, and a third anomaly level.

[0095] The interaction switching unit 2032 is used to match a second interaction mode corresponding to the warning level based on the combination of the second abnormality type and the abnormality level, and to switch the control mode of the at least two execution components from the initial interaction mode to the second interaction mode corresponding to the warning level.

[0096] above Figure 2 and Figure 3 The autonomous driving redundancy control device in this embodiment of the invention is described in detail from the perspective of modular functional entities. The autonomous driving redundancy control device in this embodiment of the invention is described in detail from the perspective of hardware processing.

[0097] Figure 4 This is a schematic diagram of the structure of an autonomous driving redundancy control device 400 provided in an embodiment of the present invention. The autonomous driving redundancy control device 400 can vary significantly due to different configurations or performance. It may include one or more central processing units (CPUs) 410 (e.g., one or more processors) and a memory 420, and one or more storage media 430 (e.g., one or more mass storage devices) for storing application programs 433 or data 432. The memory 420 and storage media 430 can be temporary or persistent storage. The program stored in the storage media 430 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the autonomous driving redundancy control device 400. Furthermore, the processor 410 may be configured to communicate with the storage media 430 and execute the series of instruction operations in the storage media 430 on the autonomous driving redundancy control device 400.

[0098] The autonomous driving redundancy control device 400 may also include one or more power supplies 440, one or more wired or wireless network interfaces 450, one or more input / output interfaces 460, and / or one or more operating systems 431, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc. Those skilled in the art will understand that... Figure 4 The illustrated structure of the autonomous driving redundancy control device does not constitute a limitation on the autonomous driving redundancy control device. It may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0099] The present invention also provides an autonomous driving redundancy control device, wherein the computer device includes a memory and a processor, the memory storing computer-readable instructions, and when the computer-readable instructions are executed by the processor, causing the processor to perform the steps of the autonomous driving redundancy control method in the above embodiments. The present invention also provides a computer-readable storage medium, which can be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium, storing instructions that, when executed on a computer, cause the computer to perform the steps of the autonomous driving redundancy control method.

[0100] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0101] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0102] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An autonomous driving redundancy control method, characterized in that, The autonomous driving redundancy control method includes at least two control units and at least two execution components, wherein the at least two control units control the at least two execution components according to an initial interaction mode. When the working state of the main control unit in the at least two control units is abnormal, the at least two control units will switch the control mode of the at least two execution components from the initial interaction mode to the first interaction mode based on the first abnormality type of the main control unit. When at least one of the at least two execution components is in an abnormal working state, the at least two execution components send abnormal information to the at least two control units, and execute a differentiated abnormal warning strategy corresponding to the type of abnormal working state. The switching of control mode and the execution of abnormal warning strategy together constitute a hierarchical redundant safety response. Based on the abnormal information, the at least two control units switch the control mode of the at least two execution components from the initial interaction mode to the second interaction mode; It also includes at least two CAN buses, each comprising at least one main CAN bus and at least one redundant CAN bus. Each of the at least two execution components includes at least one steering unit, comprising a main steering unit and a redundant steering unit. The main steering unit is connected to the main CAN bus, and the redundant steering unit is connected to the redundant CAN bus. When at least one of the at least two execution components is in an abnormal operating state, the at least two execution components send abnormal information to the at least two control units and execute corresponding abnormal warning strategies, including: when the main steering unit in the at least two execution components is in a failed operating state, the redundant... The steering unit sends an abnormality message to the at least two control units via the redundant CAN bus and provides a preset first proportion of steering assistance. When the redundant steering unit in the at least two execution components is in a failed state, the main steering unit sends an abnormality message to the at least two control units via the main CAN bus and provides a preset first proportion of steering assistance. When the main steering unit or the redundant steering unit in the at least two execution components is in a safety degraded state, the main steering unit and the redundant steering unit send an abnormality message to the at least two control units via the main CAN bus and the redundant CAN bus, respectively, and provide a preset second proportion of steering assistance.

2. The autonomous driving redundancy control method according to claim 1, characterized in that, The at least two control units and the at least two execution components communicate via the at least two CAN buses, the first exception type includes a reception exception, and the initial interaction method includes an initial CAN bus communication method; The at least two control units switching the control mode of the at least two execution components from the initial interaction mode to the first interaction mode based on the first exception type of the main control unit includes: The main control unit in the at least two control units identifies the target CAN bus that is in normal working condition from the at least two CAN buses, and sends the identification information corresponding to the target CAN bus to the at least two execution components, switching the communication mode of the at least two execution components from the initial CAN bus to the target CAN bus.

3. The autonomous driving redundancy control method according to claim 1, characterized in that, The at least two control units also include a redundant control unit, the first exception type also includes an operational exception, and the initial interaction method also includes a response method to the main control unit; The at least two control units switching the control mode of the at least two execution components from the initial interaction mode to the first interaction mode based on the first exception type of the main control unit includes: The redundant control unit in the at least two control units sends its own identification information to the at least two execution components, wherein... When the at least two execution components receive the identification information of the redundant control unit within a preset first frame number, the response mode for the at least two execution components will be switched from the main control unit to the redundant control unit. If the at least two execution components do not receive the identification information of the redundant control unit within a preset second frame number, the response mode for the at least two execution components will be switched from the main control unit to the redundant control unit after the preset second frame number.

4. The autonomous driving redundancy control method according to claim 1, characterized in that, The first exception type also includes request exceptions, and the initial interaction method also includes a response method to any one of the at least two control units, and the initial interaction method includes an initial CAN bus communication method; Before the at least two control units switch the control mode of the at least two execution components from the initial interaction mode to the first interaction mode based on the first abnormality type of the main control unit, the method further includes: if the difference between the braking request value sent between any one of the control units and the main control unit exceeds a preset first numerical range, or the steering request value exceeds a preset second numerical range, then the first abnormality type is determined to be a request abnormality. The at least two control units, based on the first exception type of the main control unit, switch the control mode of the at least two execution components from the initial interaction mode to the first interaction mode, including: the main control unit of the at least two control units sends its own identification information to the at least two execution components, and switches the response mode of the at least two execution components from any one of the control units to the main control unit.

5. The autonomous driving redundancy control method according to claim 1, characterized in that, Each of the at least two execution components includes at least a braking unit, and the braking unit includes a main braking unit and a redundant braking unit. When at least one of the at least two execution components is in an abnormal operating state, the at least two execution components send abnormal information to the at least two control units and execute the corresponding abnormal warning strategy, including: When the main braking unit or redundant braking unit in the at least two execution components is in a failed state, the main braking unit or redundant braking unit in a normal state sends an abnormal information to the at least two control units and responds to the control commands sent by the at least two control units using the main braking unit or redundant braking unit in a normal state.

6. The autonomous driving redundancy control method according to claim 1, characterized in that, The at least two execution components include a drive unit; When at least one of the at least two execution components is in an abnormal operating state, the at least two execution components send abnormal information to the at least two control units and execute the corresponding abnormal warning strategy, including: When the operating state of the drive unit in the at least two execution components is faulty, the drive unit sends an exception message to the at least two control units and performs a security degradation process.

7. The autonomous driving redundancy control method according to claim 1, characterized in that, The at least two control units switching the control mode of the at least two execution components from the initial interaction mode to the second interaction mode based on the abnormal information includes: The at least two control units determine a corresponding second anomaly type and anomaly level based on the anomaly information. The second anomaly type includes brake failure, steering failure, steering safety degradation, and drive failure. The anomaly level includes a first anomaly level, a second anomaly level, and a third anomaly level. Based on the combination of the second anomaly type and the anomaly level, a second interaction mode corresponding to the warning level is matched, and the control mode of the at least two execution components is switched from the initial interaction mode to the second interaction mode corresponding to the warning level.

8. An automatic driving redundancy control device, characterized in that, The autonomous driving redundancy control device includes at least two control units and at least two execution components, wherein the at least two control units control the at least two execution components according to an initial interaction mode. The first interaction module is used to switch the control mode of the at least two execution components from the initial interaction mode to the first interaction mode when the working state of the main control unit in the at least two control units is abnormal, based on the first abnormality type of the main control unit. The early warning module is used to send abnormal information to the at least two control units when the working state of at least one of the at least two execution components is abnormal, and to execute a differentiated abnormal early warning strategy corresponding to the type of abnormal working state. The switching of control mode and the execution of abnormal early warning strategy together constitute a hierarchical redundant safety response. The second interaction module is used by the at least two control units to switch the control mode of the at least two execution components from the initial interaction mode to the second interaction mode based on the abnormal information. It also includes at least two CAN buses, each comprising at least one main CAN bus and at least one redundant CAN bus. Each of the at least two execution components includes at least one steering unit, comprising a main steering unit and a redundant steering unit. The main steering unit is connected to the main CAN bus, and the redundant steering unit is connected to the redundant CAN bus. When at least one of the at least two execution components is in an abnormal operating state, the at least two execution components send abnormal information to the at least two control units and execute corresponding abnormal warning strategies, including: when the main steering unit in the at least two execution components is in a failed operating state, the redundant... The steering unit sends an abnormality message to the at least two control units via the redundant CAN bus and provides a preset first proportion of steering assistance. When the redundant steering unit in the at least two execution components is in a failed state, the main steering unit sends an abnormality message to the at least two control units via the main CAN bus and provides a preset first proportion of steering assistance. When the main steering unit or the redundant steering unit in the at least two execution components is in a safety degraded state, the main steering unit and the redundant steering unit send an abnormality message to the at least two control units via the main CAN bus and the redundant CAN bus, respectively, and provide a preset second proportion of steering assistance.

9. An automated driving redundancy control device, characterized in that, The autonomous driving redundancy control device includes: a memory and at least one processor, wherein the memory stores instructions; The at least one processor invokes the instructions in the memory to cause the autonomous driving redundancy control device to perform the steps of the autonomous driving redundancy control method as described in any one of claims 1-7.

10. A computer-readable storage medium storing instructions thereon, characterized in that, When the instruction is executed by the processor, it implements the steps of the autonomous driving redundancy control method as described in any one of claims 1-7.

Images