Intelligent driving control system and method

Abstract

The application discloses an intelligent driving control system and method, and relates to the technical field of automatic driving.The system comprises a driving function module and an expected functional safety capability evaluation module; the driving function module is used for acquiring environmental information, generating first target information, first safety boundary information, driving strategy information and a first control signal, and transmitting the first control signal to a vehicle actuator for execution to control the vehicle; the expected functional safety capability evaluation module is used for acquiring the environmental information, the first target information, the first safety boundary information, the driving strategy information and the first control signal, generating a first risk evaluation result, and further used for generating a second control signal and transmitting the second control signal to the driving function module to adjust the first control signal.Compared with the prior art, the application can solve the expected functional safety problems caused by functional limitations or personnel misuse in the current intelligent driving field, and improve the safety of the intelligent driving control system while meeting the real-time requirements.

Description

Technical Field

[0001] This invention relates to the field of autonomous driving technology, and more specifically, to an intelligent driving control system and method. Background Technology

[0002] With the rapid development of intelligent driving control systems, the need for human control or monitoring of vehicles is gradually decreasing, and various complex sensing systems (such as radar and lidar) and algorithms (such as machine learning) are being introduced, resulting in intelligent driving control systems needing to address more and more complex scenarios.

[0003] Even when the sensing system and algorithms perform their intended functions—meaning neither the sensing system nor the algorithms installed in the vehicle malfunction—limitations in their situational awareness capabilities can still directly impact safety in certain situations. To address this issue, Safety of the Intended Function (SOTIF) emerged. As a supplement to functional safety, SOTIF primarily addresses the functional limitations or misuse by personnel in intelligent driving control systems, and it is strongly correlated with the operating scenarios of the intelligent driving control system and the behavior of relevant road users. Facing the trend of intelligent driving development from assisted driving to autonomous driving, there is an urgent need for an intelligent driving control system that meets the requirements of SOTIF.

[0004] Existing technologies have yielded SOTIF solutions based on tests conducted under pre-set unknown and unsafe scenarios. However, due to the complexity of the scenarios in actual intelligent driving processes, these solutions cannot meet the requirements for real-time monitoring and protection of the intelligent driving control system. Summary of the Invention

[0005] One objective of this invention is to provide an intelligent driving control system to address the shortcomings of existing technologies in providing real-time monitoring and protection for intelligent driving control systems; another objective is to provide an automobile; a third objective is to provide an intelligent driving control method; a fourth objective is to provide a controller; and a fifth objective is to provide a computer-readable storage medium.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0007] In a first aspect, an intelligent driving control system includes interconnected driving function modules and expected functional safety capability assessment modules;

[0008] The driving function module is used to acquire environmental information, generate first target information, first safety boundary information, driving strategy information and first control signal, and send the first control signal to the vehicle actuator to control the vehicle.

[0009] The expected functional safety capability evaluation module is configured to acquire environment information, first target information, first safety boundary information, driving strategy information and a first control signal, and generate a first risk evaluation result.

[0010] In a second aspect, an automobile includes an automobile body and the intelligent driving control system of the first aspect.

[0011] In a third aspect, an intelligent driving control method is applied to the intelligent driving control system of the first aspect, and includes:

[0012] The environment information is sent to the driving function module, the first target information, the first safety boundary information, the driving strategy information and the first control signal are generated, and the first control signal is sent to the vehicle actuator for execution to control the vehicle.

[0013] The environment information, the first target information, the first safety boundary information, the driving strategy information and the first control signal are sent to the expected functional safety capability evaluation module, a first risk evaluation result is generated, and a second control signal is generated according to the first risk evaluation result and transmitted to the driving function module to adjust the first control signal.

[0014] In a fourth aspect, a controller includes a memory and a processor, and the memory stores at least one instruction, at least one program, a code set or an instruction set, which is loaded and executed by the processor to implement the intelligent driving control method of the third aspect.

[0015] In a fifth aspect, a computer readable storage medium stores at least one instruction, at least one program, a code set or an instruction set, which is loaded and executed by a processor to implement the intelligent driving control method of the third aspect.

[0016] Compared with the prior art, the technical scheme of the present application has the following beneficial effects:

[0017] The intelligent driving control system and method can realize real-time monitoring and evaluation of the driving function module through the use of the expected functional safety capability evaluation module, generate a first risk evaluation result, and then determine whether to generate a second control signal to adjust the first control signal generated by the driving function module. The present application can solve the expected functional safety problems caused by functional limitations or personnel misuse in the current intelligent driving field, improve the safety of the intelligent driving control system while meeting the real-time requirements, consume low and efficient computing power, and is particularly suitable for use as a safety strategy under the rapid iteration of intelligent driving functions. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the intelligent driving control system structure in Embodiment 1 of the present invention;

[0019] Figure 2 This is a schematic diagram of the expected functional safety capability assessment module structure in Embodiment 1 of the present invention;

[0020] Figure 3 This is a schematic diagram of the intelligent driving control method in Embodiment 3 of the present invention;

[0021] Figure 4 This is a schematic diagram of the expected functional safety capability assessment method in Embodiment 3 of the present invention. Detailed Implementation

[0022] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms are interchangeable where appropriate; this is merely a way of distinguishing objects with the same attributes in the embodiments of this application. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion, so that a process, method, system, product, or apparatus that comprises a series of elements is not necessarily limited to those elements, but may include other elements not explicitly listed or inherent to those processes, methods, products, or apparatuses.

[0023] The embodiments of the present invention will be described below with reference to the accompanying drawings and preferred embodiments. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred embodiments are only for illustrating the present invention and not for limiting the scope of protection of the present invention.

[0024] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. Therefore, the drawings only show the components related to the present invention and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0025] It will be understood by those skilled in the art that certain well-known structures and their descriptions may be omitted in the accompanying drawings.

[0026] For the convenience of understanding and implementing the present application, the general technical architecture of the intelligent driving control system is briefly described as follows:

[0027] The intelligent driving control system can be divided into three core processes: perception and positioning, decision planning, and execution control, from the business process.

[0028] 1) Perception and positioning: In order to ensure that the autonomous vehicle can make correct judgments in different scenarios, real-time dynamic acquisition and identification processing of surrounding environment information are needed, including but not limited to the state of the vehicle, traffic flow information, road conditions, traffic signs, etc. to meet the needs of vehicle decision planning;

[0029] 2) Decision planning: Through the collected data, the next behavior of the vehicle is judged and guided, including path planning and behavior decision (including vehicle behavior decision and traffic participant behavior prediction);

[0030] 3) Execution control: The decision is converted into signal instructions for controlling the related systems of the vehicle such as the accelerator and brake.

[0031] The technical solutions of the present application are further described below in conjunction with the drawings and examples.

[0032] Example 1

[0033] This embodiment proposes an intelligent driving control system, referring to Figure 1 , which comprises a driving function module and an expected functional safety capability evaluation module connected to each other;

[0034] The driving function module is used to acquire environmental information, generate first target information, first safety boundary information, driving strategy information and first control signal, and send the first control signal to the vehicle actuator for execution to control the vehicle.

[0035] The expected functional safety capability evaluation module is used to acquire environmental information, first target information, first safety boundary information, driving strategy information and first control signal, and generate a first risk assessment result. It is also used to generate a second control signal according to the first risk assessment result and transmit it to the driving function module for adjusting the first control signal.

[0036] The embodiment ensures real-time monitoring and evaluation of intelligent driving capability during vehicle operation through the connection and cooperation between the expected functional safety capability evaluation module and the driving function module, and according to the first risk evaluation result, the driving function module is always operated in a safe state through the second control signal. Compared with the prior art, the intelligent driving control system can solve the expected functional safety problem caused by functional limitations or personnel misuse in the current intelligent driving field, improve the safety of the intelligent driving control system while meeting the real-time requirement, has low computing power consumption and is efficient, and is particularly suitable for use as a safety strategy under the condition of rapid iteration of intelligent driving functions.

[0037] It should be noted that the environment information represents the operating environment information of the vehicle, including vehicle external environment information and / or internal environment information.

[0038] In some examples, the environment information includes, but is not limited to, weather, temperature, humidity, light, time interval, distance, signal light state, road information, etc.

[0039] In some examples, the environment information includes state information of the vehicle itself, such as vehicle position, orientation, driving distance, speed, and / or tire speed, etc.

[0040] In some examples, the environment information includes information of the passengers in the vehicle, such as driver state information.

[0041] In other examples, the environment information includes current time state information and / or next time state information of other targets.

[0042] In some examples, the environment information is obtained based on sensors by the driving function module; the sensors include, but are not limited to, infrared cameras, visible light cameras, millimeter wave radars, laser radars, ultrasonic radars, pedal stroke sensors, temperature sensors, wheel speed sensors, sound wave sensors, satellite positioning devices, and / or inertial sensors; further, the sensors can be installed on the vehicle, and can also be worn by the vehicle passengers.

[0043] In other examples, the environment information is obtained based on a communication network, such as obtaining real-time traffic information and / or map information through V2X (Vehicle to Everything, vehicle networking, including vehicle-to-vehicle, vehicle-to-infrastructure, vehicle-to-pedestrian, and vehicle-to-external network); as a non-limiting example, DSRC (Dedicated Short-Range Communications) can be used as the V2X network, and C-V2X (Cellular Vehicle-to-Everything) can also be used as the V2X network.

[0044] It should be noted that the first target information is a target level-based perception result, i.e., target information about all moving targets and / or non-moving targets on the road.

[0045] In some examples, the first target information includes target type information, such as a car, a bicycle, a pedestrian, a roadblock, a signal light, a building, and / or a road;

[0046] In some examples, the first target information includes target quantity information;

[0047] In some examples, the first target information includes target state information, such as a moving state or a non-moving state;

[0048] In some examples, the first target information includes relative position information and / or absolute position information of a car, a bicycle, a pedestrian, a roadblock, a building, and / or a road sign;

[0049] In some examples, the first target information includes speed information of a car, a bicycle, a motorcycle, and / or a pedestrian;

[0050] In some examples, the first target information includes acceleration information of a target;

[0051] In some examples, the first target information includes time distance information between the vehicle and the target;

[0052] In other examples, the first target information includes moving direction information of a target.

[0053] It should be noted that the first control signal is executed by a vehicle actuator to control the vehicle to accelerate, brake, steer, and / or interact.

[0054] In some examples, the first control signal is a lateral and longitudinal control signal, such as an electronic acceleration signal, an electronic brake signal, an electronic steering signal, or a combination thereof;

[0055] In some examples, the first control signal is an HMI (Human Machine Interface) control signal, including but not limited to touch interaction, voice interaction, gesture interaction, and / or visual interaction;

[0056] In other examples, the first control signal includes a lateral and longitudinal control signal and an HMI control signal.

[0057] It should be noted that the first safety boundary information includes but is not limited to a boundary range of a safe distance between the vehicle and other targets, a boundary range of a safe boundary between the vehicle and the moving direction of other targets, and / or a boundary range of a brake available time of the vehicle.

[0058] Exemplarily, the driving strategy information includes, but is not limited to, vehicle planning path information, vehicle planning speed information, vehicle planning orientation information (i.e. vehicle planning posture information), vehicle planning steering information and / or other target behavior prediction information (i.e. trend).

[0059] As a non-limiting example, the vehicle actuator includes, but is not limited to, a lateral and longitudinal controller and / or an HMI display actuator.

[0060] It should be noted that the second control signal can be an override of the first control signal or a modification of the first control signal, so that the vehicle operates in a safe state;

[0061] In some examples, the second control signal is a brake increase signal to shorten the braking distance;

[0062] In some examples, the second control signal is an emergency brake signal;

[0063] In other examples, the second control signal is a takeover reminder signal to remind the occupants of the vehicle to take over to make the vehicle enter a safe state.

[0064] In a preferred embodiment, referring to Figure 2 , the expected functional safety capability evaluation module includes:

[0065] a perception capability evaluation module, configured to obtain environment information, generate second target information and second safety boundary information, and further configured to evaluate the first target information and the first safety boundary information according to the second target information and the second safety boundary information, and generate a second risk evaluation result;

[0066] a decision planning capability evaluation module, configured to generate safety interval information and third safety boundary information about the trend of the most dangerous target and the distance from the most dangerous target according to the second target information and the second safety boundary information, and further configured to evaluate the driving strategy information according to the safety interval information and the third safety boundary information, and generate a third risk evaluation result;

[0067] an execution control capability evaluation module, configured to generate control signal boundary information according to the safety interval information and the third safety boundary information, and further configured to evaluate the first control signal according to the control signal boundary information, and generate a fourth risk evaluation result;

[0068] a comprehensive evaluation module, configured to generate a first risk evaluation result according to the second risk evaluation result, the third risk evaluation result and the fourth risk evaluation result, and further configured to generate a second control signal based on the safety interval information and the third safety boundary information according to the first risk evaluation result.

[0069] The preferred embodiment provides a design method of a prospective functional safety capability evaluation module in an intelligent driving control system, which ensures real-time risk evaluation of each link of the intelligent driving capability during vehicle operation, adjusts the first control signal through a second control signal when the capability is insufficient to cope with, ensures the system to enter a safe state and reduces the risk to the lowest level, solves the prospective functional safety and is applicable to the safety strategy under the rapid iteration of future intelligent driving functions.

[0070] It should be noted that the second target information is target information about a dangerous target;

[0071] In some examples, the dangerous target is determined based on the distance between the host vehicle and other targets;

[0072] In other examples, the dangerous target is determined based on the trend (such as the intended moving direction and intended moving speed) of the host vehicle and / or other targets.

[0073] As a non-limiting example, the second safety boundary information is a safety boundary range of the distance, time interval and / or trend between the host vehicle and the dangerous target.

[0074] It should be noted that the safety interval information is a safety region range in which the host vehicle can travel.

[0075] In addition, the third safety boundary information includes a safety boundary range of the trend of the most dangerous target, such as the minimum value of the speed of the preceding vehicle at the next moment or the maximum value of the speed of the following vehicle at the next moment, and / or a safety boundary range of the steering angle of the most dangerous target, and further includes a safety boundary range of the distance between the host vehicle and the most dangerous target.

[0076] In some examples, the trend of the most dangerous target is obtained based on the environmental information perceived by the host vehicle.

[0077] In other examples, the trend of the most dangerous target is obtained by the host vehicle through V2X.

[0078] It should be noted that the type and / or source of the environmental information used to obtain the first target information and the second target information, and / or the first safety boundary information and the second safety boundary information, can be completely the same or different.

[0079] In an optional embodiment, after the perception capability evaluation module obtains the environmental information, the second target information and the second safety boundary information are generated by using a first preset algorithm; the first preset algorithm includes a machine learning method based on historical data and / or an identification method based on a preset rule.

[0080] In some examples, the machine learning method includes, but is not limited to, an automatic driving multi-sensor fusion algorithm, a target detection deep learning algorithm, and / or a target detection machine learning algorithm.

[0081] In some examples, the preset rule is whether the distance between the host vehicle and the dangerous target is less than a preset threshold.

[0082] In some examples, the preset rule is whether the time distance between the host vehicle and the dangerous target is less than a preset threshold.

[0083] It should be noted that the algorithm used to generate the first target information and / or the first safety boundary information can be the same as or different from the first preset algorithm used to generate the second target information and / or the second safety boundary information.

[0084] In some examples, the first target information and / or the first safety boundary information are obtained by processing the environment information using a machine learning method based on historical data, and the second target information and / or the second safety boundary information are obtained by processing the environment information using a recognition method based on a preset rule.

[0085] In an optional embodiment, the process of generating the first risk assessment result and the second control signal by the comprehensive evaluation module includes:

[0086] The comprehensive evaluation module obtains the safety interval information, the third safety boundary information, the second risk assessment result, the third risk assessment result, and the fourth risk assessment result.

[0087] According to the second risk assessment result, the third risk assessment result, and the fourth risk assessment result, it is determined whether the driving function module is sufficient to support the current scene. If yes, the first risk assessment result is generated as safe and controllable, and the driving function module is not intervened. Otherwise, the first risk assessment result is generated as safe and uncontrollable, and the second control signal is generated based on the safety interval information and the third safety boundary information and sent to the driving function module.

[0088] In some examples, the second risk assessment result, the third risk assessment result, and the fourth risk assessment result all indicate that there is no risk, the comprehensive evaluation module considers that the driving function module is sufficient to support the current scene, and the first risk assessment result is generated as safe and controllable.

[0089] In some examples, the second risk assessment result and / or the third risk assessment result both indicate that there is an unbearable risk, and the fourth risk assessment result indicates that there is no risk. The comprehensive evaluation module considers that the driving function module is sufficient to support the current scene, and the first risk assessment result is generated as safe and controllable. At this time, the driving function module is not intervened, i.e., the second control signal is not generated.

[0090] In some examples, the second risk assessment result and the third risk assessment result both represent no risk, the fourth risk assessment result represents unbearable risk, the comprehensive assessment module considers that the driving function module is insufficient to support the current scene, and the first risk assessment result is generated as uncontrolled safety, and a second control signal for increasing braking is generated and sent to the driving function module;

[0091] More specifically, in a specific implementation process, for a pedestrian target, the first target information output by the driving function module represents that the distance between the vehicle and the pedestrian target is 30 m, the second target information output by the perception capability assessment module represents that the distance between the vehicle and the pedestrian target is 20 m, the deviation value exceeds the preset threshold value 5 m, the second risk assessment result obtained by the comprehensive assessment module represents that there is unbearable risk, but the third risk assessment result and the fourth risk assessment result represent that there is no collision risk relying on the moving speed of the current pedestrian target and the first control signal generated by the driving function module, and the first risk assessment result is generated as controllable safety.

[0092] Further, the second risk assessment result is generated by evaluating the first target information and the first safety boundary information according to the second target information and the second safety boundary information, and the generating the second risk assessment result comprises:

[0093] The perception capability assessment module acquires the first target information and the first safety boundary information;

[0094] It is verified whether the first target information has a deviation from the second target information exceeding a preset condition and / or whether the first safety boundary information has a deviation from the second safety boundary information: if yes, the second risk assessment result is generated as high safety risk; otherwise, the second risk assessment result is generated as acceptable risk.

[0095] In some examples, the second target information generated by the perception capability assessment module has no deviation from the acquired first target information, such as the distance information between the vehicle and the same target being consistent, and the perception capability assessment module generates the second risk assessment result as acceptable risk at this time;

[0096] In some examples, for the same target, the second target information generated by the perception capability assessment module has a large deviation from the acquired first target information, and there is potential risk, but the distance between the vehicle and the target obtained based on the first target information and the second target information both satisfies the first safety boundary information and the second safety boundary information, that is, the safety boundary is not triggered, and there is a controllable interval, and the perception capability assessment module generates the second risk assessment result as acceptable risk at this time;

[0097] In another example, for the same target, the second safety boundary information generated by the perception capability evaluation module has a large deviation from the first safety boundary information obtained, such as the safety boundary area shown by the second safety boundary information being significantly smaller than the first safety boundary information, and the second risk evaluation result generated is high safety risk.

[0098] Further, the driving strategy information is evaluated according to the safety interval information and the third safety boundary information to generate a third risk evaluation result, including:

[0099] The decision planning capability evaluation module obtains driving strategy information;

[0100] The driving strategy information is verified to see if it is adapted to the safety interval information and the third safety boundary information: if yes, the third risk evaluation result is generated as risk acceptable; otherwise, the third risk evaluation result is generated as high safety risk.

[0101] In some examples, for the vehicle planning path information in the driving strategy information, when the vehicle planning path is within the drivable safety region range and has no conflict with the third safety boundary information, such as the distance between the ego vehicle and the most dangerous target at any position in the vehicle planning path being within the safety boundary range, the decision planning capability evaluation module generates the third risk evaluation result as risk acceptable.

[0102] In some examples, for the vehicle planning path information in the driving strategy information, when the vehicle planning path is within the drivable safety region range but has a conflict with the third safety boundary information, such as the distance between the ego vehicle and the most dangerous target at a position in the vehicle planning path exceeding the safety boundary range, the decision planning capability evaluation module generates the third risk evaluation result as high safety risk.

[0103] In another example, the trend information of the target on the road is received through V2X, and for the vehicle planning path information and the vehicle planning direction information in the driving strategy information, when the vehicle planning path is within the drivable safety region range but the vehicle planning direction at a certain position has a conflict with the trend of the most dangerous target, the decision planning capability evaluation module generates the third risk evaluation result as high safety risk.

[0104] Further, the first control signal includes a lateral and longitudinal control signal and / or an HMI control signal, and the control signal boundary information includes a lateral and longitudinal control maximum range and / or an HMI control signal maximum tolerance time.

[0105] The first control signal is evaluated according to the control signal boundary information to generate a fourth risk evaluation result, including:

[0106] The execution control capability evaluation module obtains the lateral and longitudinal control signal and / or the HMI control signal, and verifies whether the lateral and longitudinal control signal is within the maximum range of lateral and longitudinal control, and / or whether the HMI control signal is within the maximum tolerance time interval: if yes, the fourth risk assessment result is generated as risk acceptable; otherwise, the fourth risk assessment result is generated as high safety risk.

[0107] It should be noted that the control signal boundary information is the boundary range of the first control signal (such as the size range of the control signal corresponding to the acceleration, the size range of the steering angle), and / or the maximum tolerance time interval (FTTI) of the first control signal.

[0108] FTTI refers to the time interval from system failure or abnormality to the occurrence of harm (such as collision) without safety strategy, which is used as a standard for subsequent safety design, i.e. safety control needs to be completed within this time interval to avoid collision or harm.

[0109] In some examples, for the first control signal being the lateral and longitudinal control signal, when the acceleration and / or the size of the steering angle pointed by the first control signal conflicts with the control signal boundary information, i.e. exceeds the control signal boundary range, the execution control capability evaluation module generates the fourth risk assessment result as high safety risk.

[0110] In some examples, for the first control signal being the HMI control signal, when the response time required by the first control signal conflicts with the control signal boundary information, exceeds the maximum tolerance time interval, the execution control capability evaluation module generates the fourth risk assessment result as high safety risk.

[0111] In some examples, for the first control signal including the lateral and longitudinal control signal and the HMI control signal, when the acceleration and / or the size of the steering angle pointed by the lateral and longitudinal control signal, and the response time required by the HMI control signal, all do not conflict with the control signal boundary information, the execution control capability evaluation module generates the fourth risk assessment result as risk acceptable.

[0112] Further, when the first risk assessment result generated by the comprehensive evaluation module is safety uncontrollable, the current scene is marked and the data corresponding to the current scene is sent to the remote communication end for learning. Through this technical solution, the driving function module can be updated in real time, the driving function can be iterated quickly, and the system safety can be further improved.

[0113] In an optional embodiment, the safety interval information and the third safety boundary information obtained by the comprehensive evaluation module come from the decision planning capability evaluation module directly or the execution control capability evaluation module.

[0114] In an optional embodiment, the comprehensive evaluation module comprises a comprehensive evaluation unit and a deficiency processing unit connected in sequence.

[0115] The comprehensive evaluation unit is connected with the perception capability evaluation module, the decision planning capability evaluation module, the execution control capability evaluation module and the deficiency processing unit respectively, and is configured to obtain the second risk evaluation result, the third risk evaluation result and the fourth risk evaluation result, and generate the first risk evaluation result.

[0116] The deficiency processing unit is configured to obtain the first risk evaluation result, the safety interval information and the third safety boundary information, and generate the second control signal based on the safety interval information and the third safety boundary information according to the first risk evaluation result.

[0117] In some examples, the safety interval information and the third safety boundary information obtained by the deficiency processing unit are forwarded by the comprehensive evaluation unit.

[0118] In some examples, the safety interval information and the third safety boundary information obtained by the deficiency processing unit are forwarded by the execution control capability evaluation module.

[0119] In some other examples, the safety interval information and the third safety boundary information obtained by the deficiency processing unit are directly sent by the decision planning capability evaluation module.

[0120] In an optional embodiment, the driving function module comprises a perception positioning module, a decision planning module and an execution control module connected in sequence.

[0121] The perception positioning module is further connected with the perception capability evaluation module, and is configured to obtain environment information, and generate the first target information and the first safety boundary information.

[0122] The decision planning module is further connected with the decision planning capability evaluation module, and is configured to generate the driving strategy information according to the first target information and the first safety boundary information.

[0123] The execution control module is further connected with the execution control capability evaluation module and the vehicle actuator respectively, and is configured to generate the first control signal according to the driving strategy information; and is further connected with the comprehensive evaluation module, and is configured to obtain the second control signal.

[0124] Embodiment 2

[0125] The embodiment provides an automobile, which comprises an automobile body and the intelligent driving control system in the embodiment 1.

[0126] It can be understood that the optional items in Embodiment 1 above also apply to this embodiment, so they are not repeated here.

[0127] Embodiment 3

[0128] This embodiment proposes an intelligent driving control method, which applies the intelligent driving control system proposed in Embodiment 1, and refers to Figure 3 , including:

[0129] sending the environment information to the driving function module, generating first target information, first safety boundary information, driving strategy information, and first control signals, and sending the first control signals to the vehicle actuator for execution to control the vehicle;

[0130] sending the environment information, the first target information, the first safety boundary information, the driving strategy information, and the first control signals to the expected functional safety capability evaluation module, generating a first risk assessment result, and generating a second control signal according to the first risk assessment result and transmitting it to the driving function module to adjust the first control signal.

[0131] It should be noted that the second control signal is generated according to the first risk assessment result and transmitted to the driving function module, specifically: when the first risk assessment result does not meet the expectation, i.e., does not meet the preset condition, the expected functional safety capability evaluation module generates the second control signal; when the first risk assessment result meets the expectation, i.e., meets the preset condition, the expected functional safety capability evaluation module can not generate the second control signal, or can generate a second control signal indicating to maintain the current state, such as an empty instruction.

[0132] In a preferred embodiment, the expected functional safety capability evaluation module includes a perception capability evaluation module, a decision planning capability evaluation module, an execution control capability evaluation module, and a comprehensive evaluation module; the environment information, the first target information, the first safety boundary information, the driving strategy information, and the first control signals are sent to the expected functional safety capability evaluation module to generate a first risk assessment result, and a second control signal is generated according to the first risk assessment result and transmitted to the driving function module, referring to Figure 4 , including:

[0133] sending the environment information to the perception capability evaluation module to generate second target information and second safety boundary information; sending the first target information and the first safety boundary information to the perception capability evaluation module for evaluation to generate a second risk assessment result;

[0134] sending the second target information and the second safety boundary information to the decision planning capability evaluation module to generate safety interval information, third safety boundary information about the trend of the most dangerous target and the distance from the most dangerous target; sending the driving strategy information to the decision planning capability evaluation module for evaluation to generate a third risk evaluation result;

[0135] sending the safety interval information and the third safety boundary information to the execution control capability evaluation module to generate control signal boundary information; sending the first control signal to the execution control capability evaluation module for evaluation to generate a fourth risk evaluation result;

[0136] sending the second risk evaluation result, the third risk evaluation result and the fourth risk evaluation result to the comprehensive evaluation module to generate a first risk evaluation result; and sending a second control signal to the driving function module based on the safety interval information and the third safety boundary information according to the first risk evaluation result.

[0137] In an optional embodiment, the comprehensive evaluation module comprises an expected functional safety capability evaluation unit and an insufficiency processing unit; and the process of generating the first risk evaluation result and the second control signal by the comprehensive evaluation module is specifically as follows:

[0138] The expected functional safety capability evaluation unit acquires the second risk evaluation result, the third risk evaluation result and the fourth risk evaluation result, judges whether the capability of the driving function module is sufficient to support the current scene, i.e. whether safety can be ensured: if yes, a corresponding first risk evaluation result is generated, and the driving function module is not intervened, and the current round of monitoring is ended; otherwise, a corresponding first risk evaluation result is generated and sent to the insufficiency processing unit, and the insufficiency processing unit acquires the safety interval information and the third safety boundary information to generate the second control signal.

[0139] In some examples, the safety interval information and the third safety boundary information acquired by the insufficiency processing unit are derived from the expected functional safety capability evaluation unit;

[0140] In other examples, the safety interval information and the third safety boundary information acquired by the insufficiency processing unit are derived from the execution control capability evaluation module or the decision planning capability evaluation module.

[0141] It can be understood that the embodiment corresponds to the system of embodiment 1, and the optional items in the above embodiment 1 are also applicable to the present embodiment, and thus are not repeated here.

[0142] Embodiment 4

[0143] The embodiment provides a controller, including a memory and a processor, at least one instruction, at least one program, a code set or an instruction set are stored in the memory, the at least one instruction, at least one program, code set or instruction set is loaded and executed by the processor to realize the intelligent driving control method in embodiment 3.

[0144] It can be understood that the optional items in the above embodiment 3 also apply to the present embodiment, and therefore will not be repeated here.

[0145] Embodiment 5

[0146] The embodiment provides a computer readable storage medium, at least one instruction, at least one program, a code set or an instruction set are stored on the storage medium, the at least one instruction, at least one program, code set or instruction set is loaded and executed by the processor to realize the intelligent driving control method in embodiment 3.

[0147] Exemplarily, the storage medium includes but is not limited to a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0148] Exemplarily, the instruction, program, code set or instruction set can be implemented by using a programming language such as Java, Python, C++, R or Golang.

[0149] Exemplarily, the processor includes but is not limited to a smart phone, a personal computer, a server, a network device, etc., and is used to execute all or part of the steps of the intelligent driving control method in embodiment 3.

[0150] The embodiment also provides a computer program product including intelligent driving control instructions, when the computer program product is run on a computer, the computer program product makes the computer execute the steps in the method described in the foregoing embodiment 3.

[0151] It can be understood that the optional items in the above embodiment 3 also apply to the present embodiment, and therefore will not be repeated here.

[0152] The same or similar reference signs correspond to the same or similar components;

[0153] The terms describing the positional relationship in the drawings are only used for exemplary illustration, and cannot be understood as a limitation to the patent;

[0154] Obviously, the above embodiments of the present application are merely exemplary for clearly illustrating the present application, but not limitation to the embodiments of the present application. Based on the above description, other different forms of changes or variations can be made by those skilled in the art, and each function module or unit can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part. Here, it is not necessary and impossible to enumerate all the embodiments. Any modification, equivalent replacement and improvement made within the spirit and principle of the present application shall be included in the protection scope of the claims of the present application.

Claims

1. An intelligent driving control system, characterized in that, This includes interconnected driving function modules and expected functional safety capability assessment modules; The driving function module is used to acquire environmental information, generate first target information, first safety boundary information, driving strategy information and first control signal, and send the first control signal to the vehicle actuator to control the vehicle. The expected functional safety capability assessment module is used to acquire environmental information, first target information, first safety boundary information, driving strategy information, and first control signal to generate a first risk assessment result; it is also used to generate a second control signal based on the first risk assessment result and transmit it to the driving function module for adjusting the first control signal; The expected functional safety capability assessment module includes: The perception capability assessment module is used to acquire environmental information, generate second target information and second security boundary information; it is also used to assess the first target information and the first security boundary information based on the second target information and the second security boundary information, and generate a second risk assessment result. The decision-making and planning capability assessment module is used to generate safe zone information and third safe boundary information regarding the trend of the most dangerous target and the distance to the most dangerous target based on the second target information and the second safety boundary information; it is also used to assess the driving strategy information based on the safe zone information and the third safety boundary information to generate a third risk assessment result. The execution control capability assessment module is used to generate control signal boundary information based on the safety interval information and the third safety boundary information; it is also used to assess the first control signal based on the control signal boundary information to generate a fourth risk assessment result. The comprehensive assessment module is used to generate a first risk assessment result based on the second risk assessment result, the third risk assessment result, and the fourth risk assessment result; it is also used to generate a second control signal based on the first risk assessment result, the safety interval information, and the third safety boundary information.

2. The intelligent driving control system according to claim 1, characterized in that, After acquiring environmental information, the perception capability assessment module uses a first preset algorithm to generate the second target information and the second security boundary information; the first preset algorithm includes a machine learning method based on historical data and / or a recognition method based on preset rules.

3. The intelligent driving control system according to claim 1, characterized in that, The process by which the comprehensive assessment module generates the first risk assessment result and the second control signal includes: The comprehensive assessment module acquires the safety zone information, the third safety boundary information, the second risk assessment result, the third risk assessment result, and the fourth risk assessment result; Based on the second risk assessment result, the third risk assessment result, and the fourth risk assessment result, it is determined whether the driving function module is sufficient to support the current scenario: if so, the first risk assessment result is generated as safe and controllable, and no intervention is made in the driving function module; otherwise, the first risk assessment result is generated as safe and uncontrollable, and based on the safety interval information and the third safety boundary information, the second control signal is generated and sent to the driving function module.

4. The intelligent driving control system according to claim 3, characterized in that, The step of evaluating the first target information and the first security boundary information based on the second target information and the second security boundary information to generate a second risk assessment result includes: The perception capability assessment module acquires the first target information and the first security boundary information; Verify whether the first target information deviates from the second target information beyond a preset condition, and / or whether the first security boundary information deviates from the second security boundary information: if so, generate the second risk assessment result as high security risk; otherwise, generate the second risk assessment result as acceptable risk.

5. The intelligent driving control system according to claim 3, characterized in that, The step of evaluating the driving strategy information based on the safe zone information and the third safe boundary information to generate a third risk assessment result includes: The decision-making and planning capability assessment module acquires the driving strategy information; Verify whether the driving strategy information is suitable for the safe zone information and the third safety boundary information: if yes, generate the third risk assessment result as acceptable risk; otherwise, generate the third risk assessment result as high safety risk.

6. The intelligent driving control system according to claim 3, characterized in that, The first control signal includes lateral and longitudinal control signals and / or HMI control signals, and the control signal boundary information includes the maximum range of lateral and longitudinal control and / or the maximum tolerance time of the HMI control signal; The step of evaluating the first control signal based on the control signal boundary information to generate a fourth risk assessment result includes: The execution control capability assessment module acquires the horizontal and vertical control signals and / or the HMI control signals, and verifies whether the horizontal and vertical control signals are within the maximum range of horizontal and vertical control, and / or whether the HMI control signals are within the maximum tolerance time: if so, the fourth risk assessment result is generated as acceptable risk; Otherwise, the fourth risk assessment result is generated as high security risk.

7. The intelligent driving control system according to claim 1, characterized in that, The safety interval information and the third safety boundary information obtained by the comprehensive evaluation module are either directly sent by the decision planning capability evaluation module or forwarded by the execution control capability evaluation module.

8. The intelligent driving control system according to claim 1, characterized in that, The comprehensive evaluation module includes a comprehensive evaluation unit and a deficiency processing unit connected in sequence; The comprehensive evaluation unit is connected to the perception capability evaluation module, the decision planning capability evaluation module, the execution control capability evaluation module and the deficiency processing unit, respectively, and is used to generate the first risk evaluation result based on the second risk evaluation result, the third risk evaluation result and the fourth risk evaluation result; The deficiency processing unit is used to acquire the first risk assessment result, the safety interval information, and the third safety boundary information, and generate the second control signal based on the first risk assessment result, the safety interval information, and the third safety boundary information.

9. An intelligent driving control system according to any one of claims 1-8, characterized in that, The driving function module includes a perception and positioning module, a decision-making and planning module, and an execution and control module connected in sequence. The perception and positioning module is also connected to the perception capability assessment module to acquire environmental information and generate the first target information and the first security boundary information. The decision planning module is also connected to the decision planning capability assessment module, and is used to generate the driving strategy information based on the first target information and the first safety boundary information; The execution control module is also connected to the execution control capability evaluation module and the vehicle actuator, respectively, for generating the first control signal based on the driving strategy information; and is also connected to the comprehensive evaluation module for acquiring the second control signal.

10. A vehicle, comprising a vehicle body, characterized in that, It also includes the intelligent driving control system as described in any one of claims 1-9.

11. An intelligent driving control method, applied to the intelligent driving control system according to any one of claims 1-9, characterized in that, include: The environmental information is sent to the driving function module to generate first target information, first safety boundary information, driving strategy information and first control signal, and the first control signal is sent to the vehicle actuator to execute in order to control the vehicle; The environmental information, first target information, first safety boundary information, driving strategy information, and first control signal are sent to the expected functional safety capability assessment module to generate a first risk assessment result. Based on the first risk assessment result, a second control signal is generated and transmitted to the driving function module to adjust the first control signal. The expected functional safety capability assessment module includes a perception capability assessment module, a decision-making and planning capability assessment module, an execution and control capability assessment module, and a comprehensive assessment module. The step of sending environmental information, first target information, first safety boundary information, driving strategy information, and first control signal to the expected functional safety capability assessment module to generate a first risk assessment result, and generating a second control signal based on the first risk assessment result and transmitting it to the driving function module, includes: The environmental information is sent to the perception capability assessment module to generate second target information and second security boundary information; the first target information and the first security boundary information are sent to the perception capability assessment module and assessed to generate a second risk assessment result. The second target information and the second safety boundary information are sent to the decision-making and planning capability assessment module to generate safety zone information, third safety boundary information regarding the trend of the most dangerous target and the distance to the most dangerous target; the driving strategy information is sent to the decision-making and planning capability assessment module and evaluated to generate a third risk assessment result. The safety zone information and the third safety boundary information are sent to the execution control capability assessment module to generate control signal boundary information; the first control signal is sent to the execution control capability assessment module and evaluated to generate a fourth risk assessment result. The second risk assessment result, the third risk assessment result, and the fourth risk assessment result are sent to the comprehensive assessment module to generate a first risk assessment result; based on the first risk assessment result, a second control signal is generated based on the safety zone information and the third safety boundary information and sent to the driving function module.

12. A controller, characterized in that, The system includes a memory and a processor. The memory stores at least one instruction, at least one program, code set, or instruction set. The at least one instruction, at least one program, code set, or instruction set is loaded and executed by the processor to implement the intelligent driving control method as described in claim 11.

13. A computer-readable storage medium, characterized in that, The storage medium stores at least one instruction, at least one program, code set, or instruction set, which is loaded and executed by a processor to implement the intelligent driving control method as described in claim 11.

Images