Fault control method, device and equipment of automatic driving system, and storage medium

Abstract

The present application relates to the technical field of vehicle power supply, and discloses a fault control method, device and equipment of an automatic driving system and a storage medium. The method comprises the following steps: detecting whether the power supply of a first power supply module, a second power supply module and at least one third power supply module is abnormal; if abnormal, determining a corresponding vehicle control strategy based on the detection result; and controlling the main drive circuit, the software control circuit and / or the redundant drive circuit to drive the vehicle to safely travel in a fault state based on the vehicle control strategy. The present application detects the abnormal power supply of the first power supply module, the second power supply module and the at least one third power supply module, determines the corresponding vehicle control strategy, and controls the main drive circuit, the software control circuit and / or the redundant drive circuit to drive the vehicle to safely travel in a fault state based on the vehicle control strategy, so that the vehicle can still safely travel in a fault state when the power supply module is in a failure state.

Description

Technical Field

[0001] This invention relates to the field of vehicle power supply technology, and in particular to a fault control method, device, equipment and storage medium for an autonomous driving system. Background Technology

[0002] With the advent of autonomous driving, the requirements for automotive power systems are becoming increasingly stringent. To meet the requirements of the international standard ISO 26262 "Road Vehicles - Functional Safety," vehicles with advanced autonomous driving levels (L3 and above) must possess a redundant power architecture. Previously, vehicles typically had only one power supply system. Taking electric vehicles as an example, the low-voltage power system consisted of a high-voltage battery pack connected to a DC / DC converter, which stepped down the voltage to 12V. The DC / DC output was then connected to the 12V battery and the vehicle's electrical components. Failure of this single power supply system could lead to the failure of the entire vehicle's software control circuitry and drive circuitry, resulting in a traffic accident.

[0003] Therefore, when a vehicle malfunctions, the autonomous driving system needs to continue performing dynamic driving tasks for a certain period of time until the driver takes over or a safe stop is achieved. This necessitates redundant design in critical systems affecting driving safety, including braking redundancy, steering redundancy, and power supply module redundancy. Summary of the Invention

[0004] The main objective of this invention is to solve the technical problem in the prior art where the vehicle's software control circuit and drive circuit both fail when the vehicle's only power source fails, resulting in the vehicle being unable to drive safely under fault conditions.

[0005] The first aspect of this invention provides a fault control method for an autonomous driving system. The autonomous driving system includes a first power supply module, a second power supply module, and at least one third power supply module. The first power supply module and the second power supply module constitute the main power supply circuit of the vehicle, and the at least one third power supply module constitutes a redundant power supply circuit of the vehicle. The first power supply module supplies power to the main drive circuit of the vehicle, and the second and third power supply modules supply power to the software control circuit and the redundant drive circuit of the vehicle. The method includes: detecting whether the power supply of the first power supply module, the second power supply module, and the at least one third power supply module is abnormal; if abnormal, determining a corresponding vehicle control strategy based on the detection result; and controlling the main drive circuit, the software control circuit, and / or the redundant drive circuit to drive the vehicle safely under fault conditions based on the vehicle control strategy.

[0006] Optionally, in a first implementation of the first aspect of the present invention, detecting whether the power supply of the first power supply module, the second power supply module, and the at least one third power supply module is abnormal includes: acquiring the rated voltage information of the circuits where the first power supply module, the second power supply module, and the at least one third power supply module are located; polling the current first voltage information of each module in the circuit where the first power supply module, the second power supply module, or the at least one third power supply module is located, and the connection status information of each module with the first power supply module, the second power supply module, or the at least one third power supply module; calculating the second voltage information of the circuit where the first power supply module, the second power supply module, or the at least one third power supply module is located based on the connection status information of each module in the circuit where the first power supply module, the second power supply module, or the at least one third power supply module is located and the first voltage information; determining whether the difference between each second voltage information and the corresponding rated voltage information meets a preset error threshold; if it meets the threshold, determining that the power supply of the first power supply module, the second power supply module, and the at least one third power supply module is normal; if it does not meet the threshold, determining that there is an abnormal power supply module among the first power supply module, the second power supply module, and / or the at least one third power supply module.

[0007] Optionally, in a second implementation of the first aspect of the present invention, the step of determining the corresponding vehicle control strategy based on the detection result includes: if the detection result includes an abnormality in the first power supply module or an abnormality in both the second power supply module and the third power supply module, then the vehicle control strategy is determined to be to decelerate the vehicle and stop it at a safe location; if the detection result only includes an abnormality in the second power supply module or an abnormality in the third power supply module, then the vehicle control strategy is determined to be to decelerate the vehicle or drive normally.

[0008] Optionally, in a third implementation of the first aspect of the present invention, if the vehicle control strategy is to decelerate the vehicle to a safe position and stop, the step of controlling the main drive circuit, the software control circuit, and / or the redundant drive circuit to drive the vehicle safely under fault conditions based on the vehicle control strategy includes: if only the first power supply module is abnormal in the detection results, determining that the software control circuit controls the vehicle, and controlling the redundant drive unit to brake and stop the vehicle; if at least the second power supply module and the third power supply module are abnormal at the same time in the detection results, controlling the main drive unit to brake and stop the vehicle.

[0009] Optionally, in a fourth implementation of the first aspect of the present invention, the redundant drive system includes a redundant braking unit and a redundant electronic power steering unit. The method for determining that the vehicle will be controlled by the software control circuit if only the first power supply module is abnormal in the detection results, and controlling the redundant drive unit to brake and stop the vehicle, includes: if only the first power supply module is abnormal in the detection results, configuring the message sent by the software control circuit to have the highest priority, and verifying whether the software control circuit receives a signal from the vehicle's electronic control unit; if not received, generating redundant braking commands and redundant electronic power steering commands, and braking and stopping the vehicle through the redundant braking unit and the redundant electronic power steering unit.

[0010] Optionally, in a fifth implementation of the first aspect of the present invention, if the detection result only includes an abnormality in the second power supply module or the third power supply module, the step of controlling the main drive circuit, the software control circuit, and / or the redundant drive circuit to drive the vehicle safely under fault conditions based on the vehicle control strategy includes: if the detection result only includes an abnormality in the second power supply module, switching the operating mode of the software control circuit and controlling the vehicle to decelerate based on the main drive unit, wherein the operating mode of the software control circuit includes control by the main computing unit and control by the redundant computing unit; if the detection result only includes an abnormality in the third power supply module, maintaining the operating mode of the software control circuit and controlling the vehicle to drive normally based on the main drive unit.

[0011] Optionally, in a sixth implementation of the first aspect of the present invention, before detecting whether the power supply of the first power supply module, the second power supply module, and the at least one third power supply module is abnormal, the method further includes: detecting whether the vehicle has an ignition signal; if so, generating a power-on command to power on the circuits containing the first power supply module, the second power supply module, and the at least one third power supply module.

[0012] A second aspect of the present invention provides a fault control device for an autonomous driving system, comprising: a detection module for detecting whether the power supply of the first power supply module, the second power supply module, and the at least one third power supply module is abnormal; a determination module for determining a corresponding vehicle control strategy based on the detection result if an abnormality is found; and a control module for controlling the main drive circuit, the software control circuit, and / or the redundant drive circuit to drive the vehicle safely under fault conditions based on the vehicle control strategy.

[0013] Optionally, in a first implementation of the second aspect of the present invention, the detection module includes: an acquisition unit, configured to acquire the rated voltage information of the circuits where the first power supply module, the second power supply module, and the at least one third power supply module are located; an inquiry unit, configured to poll the current first voltage information of each module in the circuit where the first power supply module, the second power supply module, or the at least one third power supply module is located, and the connection status information of each module with the first power supply module, the second power supply module, or the at least one third power supply module; a calculation unit, configured to calculate the second voltage information of the circuit where the first power supply module, the second power supply module, or the at least one third power supply module is located based on the connection status information of each module in the circuit where the first power supply module, the second power supply module, or the at least one third power supply module is located and the first voltage information; a judgment unit, configured to judge whether the difference between each second voltage information and the corresponding rated voltage information meets a preset error threshold; a first determination unit, configured to determine that the power supply of the first power supply module, the second power supply module, and the at least one third power supply module is normal if the threshold is met; and a second determination unit, configured to determine that an abnormal power supply module exists from the first power supply module, the second power supply module, and / or the at least one third power supply module if the threshold is not met.

[0014] Optionally, in a second implementation of the second aspect of the present invention, the determining module includes: a third determining unit, configured to determine the vehicle control strategy as decelerating the vehicle to a safe location and stopping if the detection result includes an abnormality in the first power supply module or an abnormality in both the second power supply module and the third power supply module; and a fourth determining unit, configured to determine the vehicle control strategy as decelerating the vehicle or driving normally if the detection result only includes an abnormality in the second power supply module or an abnormality in the third power supply module.

[0015] Optionally, in a third implementation of the second aspect of the present invention, the control module includes: a first control unit, configured to determine, if only the first power supply module is abnormal in the detection results, that the vehicle shall be controlled by the software control circuit, and to control the redundant drive unit to brake and stop the vehicle; and a second control unit, configured to control the main drive unit to brake and stop the vehicle if at least the second power supply module and the third power supply module are simultaneously abnormal in the detection results.

[0016] Optionally, in a fourth implementation of the second aspect of the present invention, the first control module is further configured to: if only the first power supply module is abnormal in the detection results, configure the message sent by the software control circuit to have the highest priority, and check whether the software control circuit receives the signal sent by the vehicle's electronic control unit; if not received, generate redundant braking commands and redundant electronic power steering commands, and brake and stop the vehicle through the redundant braking unit and the redundant electronic power steering unit.

[0017] Optionally, in a fifth implementation of the second aspect of the present invention, the control module further includes: a deceleration unit, configured to switch the operating mode of the software control circuit and control the vehicle to decelerate based on the main drive unit if the detection result only includes an abnormality in the second power supply module; and a driving unit, configured to maintain the operating mode of the software control circuit and control the vehicle to drive normally based on the main drive unit if the detection result only includes an abnormality in the third power supply module.

[0018] Optionally, in a sixth implementation of the second aspect of the present invention, the detection module is further configured to: detect whether the vehicle has an ignition signal; if so, generate a power-on command to power on the circuit containing the first power supply module, the second power supply module, and the at least one third power supply module.

[0019] A third aspect of the present invention provides an electronic device, comprising: a memory and at least one processor, wherein the memory stores instructions, and the memory and the at least one processor are interconnected via a circuit; the at least one processor invokes the instructions in the memory to cause the electronic device to execute the fault control method of the above-described autonomous driving system.

[0020] A fourth aspect of the present invention provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the fault control method of the above-described autonomous driving system.

[0021] In the technical solution of the present invention, by detecting abnormal power supply conditions of the first power supply module, the second power supply module and at least one third power supply module, a corresponding vehicle control strategy is determined, and based on the vehicle control strategy, the main drive circuit, the software control circuit and / or the redundant drive circuit are controlled to drive the vehicle safely in the fault state, so that when the power supply module fails, the vehicle can still drive safely in the fault state. Attached Figure Description

[0022] Figure 1This is a schematic diagram of the first embodiment of the fault control method for an autonomous driving system in this invention.

[0023] Figure 2 This is a schematic diagram of a second embodiment of the fault control method for an autonomous driving system according to the present invention;

[0024] Figure 3 This is a schematic diagram of the overall structure for power supply to the vehicle in an embodiment of the present invention;

[0025] Figure 4 This is a schematic diagram of one embodiment of the fault control device for an autonomous driving system according to the present invention;

[0026] Figure 5 This is a schematic diagram of another embodiment of the fault control device for an autonomous driving system in this invention.

[0027] Figure 6 This is a schematic diagram of one embodiment of the electronic device in this invention. Detailed Implementation

[0028] This invention detects abnormal power supply conditions in the first power supply module, the second power supply module, and at least one third power supply module, determines the corresponding vehicle control strategy, and controls the main drive circuit, software control circuit, and / or redundant drive circuit based on the vehicle control strategy to drive the vehicle safely in a fault state, so that the vehicle can still drive safely in a fault state when the power supply module fails.

[0029] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” or “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] For ease of understanding, the specific process of the embodiments of the present invention is described below. Please refer to [link / reference]. Figure 1 The first embodiment of the fault control method for an autonomous driving system in this invention includes:

[0031] 101. Check whether the power supply of the first power supply module, the second power supply module, and at least one third power supply module is abnormal;

[0032] The system detects whether the vehicle has an ignition signal. If so, it acquires the preset operating parameters of the first power supply module, the second power supply module, or at least one third power supply module, as well as the operating modules connected to the first power supply module, the second power supply module, or at least one third power supply module. Based on the preset operating parameter information and the operating modules, it generates power-on commands to power on the circuits containing the first power supply module, the second power supply module, and at least one third power supply module.

[0033] Furthermore, the rated voltage information of the circuits containing the first power supply module, the second power supply module, and at least one third power supply module is obtained respectively; the current first voltage information of each module in the circuit containing the first power supply module, the second power supply module, or at least one third power supply module, and the connection status information of each module with the first power supply module, the second power supply module, or at least one third power supply module are polled; based on the connection status information and the first voltage information of each module in the circuit containing the first power supply module, the second power supply module, or at least one third power supply module, the second voltage information of the circuit containing the first power supply module, the second power supply module, or at least one third power supply module is calculated; it is determined whether the difference between each second voltage information and the corresponding rated voltage information meets a preset error threshold; if it does, the power supply of the first power supply module, the second power supply module, and at least one third power supply module is determined to be normal; if it does not, the power supply module with an abnormality is determined from the first power supply module, the second power supply module, and / or at least one third power supply module. Alternatively, the current power supply data of the first power supply module, the second power supply module, or at least one third power supply module is obtained, and it is determined whether the power supply data meets a preset power supply standard.

[0034] 102. If an anomaly is detected, determine the corresponding vehicle control strategy based on the detection results;

[0035] If an abnormality is detected in the power supply, the abnormal power supply module will be output as the detection result. Alternatively, if the power supply data does not meet the preset power supply standard, the corresponding abnormal power supply data will be obtained, the abnormality type corresponding to the abnormal power supply data will be identified, and the abnormal power supply module will be matched from the preset correspondence between abnormality types and power supply modules based on the abnormality type. The abnormal power supply module will then be output as the detection result.

[0036] If the detection results indicate that the first power supply module is abnormal or that both the second and third power supply modules are abnormal, then the vehicle control strategy is determined to be to decelerate the vehicle and stop it at a safe location.

[0037] If the detection results only indicate that the second power supply module is faulty, the vehicle control strategy is determined to be deceleration; if the detection results only indicate that the third power supply module is faulty, the vehicle control strategy is determined to be normal driving.

[0038] After determining the corresponding vehicle control strategy, control commands are generated based on the autonomous driving system and sent to the main drive circuit, software control circuit and / or redundant drive circuit to drive the vehicle, so as to enable the vehicle to drive safely in fault conditions.

[0039] 103. Based on the vehicle control strategy, control the main drive circuit, software control circuit and / or redundant drive circuit to drive the vehicle safely in fault conditions.

[0040] If the vehicle control strategy is to decelerate and stop at a safe location, and only the first power supply module is found to be abnormal in the detection results, the software control circuit will control the vehicle and control the redundant drive unit to brake and stop the vehicle; if at least the second and third power supply modules are found to be abnormal in the detection results, the main drive unit will be controlled to brake and stop the vehicle.

[0041] If the detection result only indicates an abnormality in the second power supply module, the operating mode of the software control circuit is switched from the operating mode controlled by the main computing unit to the operating mode controlled by the redundant computing unit, and the vehicle is controlled to decelerate based on the main drive unit; if the detection result only indicates an abnormality in the third power supply module, the current operating mode of the software control circuit is maintained, that is, the operating mode controlled by the main computing unit, and the vehicle is controlled to drive normally based on the main drive unit.

[0042] Furthermore, when the main drive unit receives the deceleration signal, it acquires the vehicle's current traffic frequency and target traffic frequency, and generates an angle adjustment signal; it then sends the angle adjustment signal to the main drive unit's signal receiver so that the main drive unit adjusts to the relative angle corresponding to the angle adjustment signal, thereby achieving vehicle deceleration.

[0043] Furthermore, when the autonomous driving system detects that the vehicle has adjusted to the target traffic frequency, it obtains the vehicle's current driving speed and determines whether the driving speed is within the preset safety threshold range. If it is not within the preset safety threshold range, the autonomous driving system generates warning information and a warning signal.

[0044] In this embodiment of the invention, by detecting abnormal power supply conditions of the first power supply module, the second power supply module, and at least one third power supply module, a corresponding vehicle control strategy is determined. Based on the vehicle control strategy, the main drive circuit, software control circuit, and / or redundant drive circuit are controlled to drive the vehicle safely in a fault state, so that the vehicle can still drive safely in a fault state when the power supply module fails.

[0045] Please see Figure 2 and Figure 3 The second embodiment of the fault control method for an autonomous driving system in this invention is applied to... Figure 3 The fault control methods for the autonomous driving system, as shown in the overall vehicle power supply architecture diagram, include:

[0046] 201. Check whether the power supply of the first power supply module, the second power supply module, and at least one third power supply module is abnormal;

[0047] The autonomous driving system includes a main battery, a first power supply module, a second power supply module, and at least one third power supply module, and a voltage acquisition module. The main battery is connected to the first power supply module, the second power supply module, and at least one third power supply module, and starts the first power supply module, the second power supply module, and at least one third power supply module to operate based on the operating parameters of the first power supply module, the second power supply module, and at least one third power supply module. The voltage acquisition module is used to detect the voltage information of the circuits where the first power supply module, the second power supply module, and the third power supply module are located. The first power supply module is used to supply power to the vehicle's main drive circuit and entertainment module. The main drive circuit includes a main braking unit and a main electronic power steering unit, as well as other vehicle electrical appliances, including the vehicle's entertainment appliances. The second and third power supply modules are used to supply power to the vehicle's software control circuit and redundant drive circuit. The software control circuit includes a main computing unit, a power distribution unit, and a redundant computing unit. The redundant drive unit includes a redundant braking unit and a redundant electronic power steering unit. The redundant braking system includes electronic brake calipers for the front wheels powered by the second power supply module and electronic brake calipers for the rear wheels powered by the third power supply module.

[0048] The redundant system is not a full-power system, so its power supply does not need to be designed according to the original system's power. Based on the power calculations of commonly used electrical appliances, the first DC / DC converter is 3000W, the second is 2500W, and the third is 1200W.

[0049] Furthermore, after detecting the presence of an ignition signal in the vehicle, the voltage acquisition module collects the voltage information and connection status information of each module in the first, second, or third power supply module and sends it to the autonomous driving system. Based on the voltage information and connection status information of each module, the autonomous driving system calculates whether the working state of the circuit in which the first, second, or third power supply module is located meets the preset working state. If the preset working state is not met, it proves that the first, second, or at least third power supply module is abnormal. The system identifies the abnormal power supply module and generates a power supply switching command. Through the power supply switching command, the system controls the main drive circuit, software control circuit, and / or redundant drive circuit to drive the vehicle safely under fault conditions.

[0050] 202. If the detection results include an abnormality in the first power supply module or an abnormality in both the second and third power supply modules, then the vehicle control strategy is determined to be to decelerate the vehicle and stop it at a safe location.

[0051] When the power supply of the first power supply module is abnormal, the messages sent by the main computing unit and the redundant computing unit are configured to have the highest priority, and the main computing unit and the redundant computing unit are checked to see if they have received the signal sent by the vehicle's electronic control unit; if not received, the redundant braking system braking command and the redundant electronic power steering command are generated, and the vehicle is braked and stopped through the redundant electronic power steering system, the electronic brake hydraulic caliper front wheel and the electronic brake hydraulic caliper rear wheel.

[0052] Furthermore, upon receiving the braking command from the redundant braking system, the system acquires the current control information of the front and rear electronic brake caliper wheels. Based on this control information, it generates braking pressure on the front and rear electronic brake caliper wheels and brakes the vehicle accordingly. During braking, it acquires the real-time braking pressure of the front and rear electronic brake caliper wheels and the vehicle's speed, and compares the braking pressures of the front and rear wheels. If the braking pressure of the front electronic brake caliper wheels is less than that of the rear wheels, a warning signal is sent to the autonomous driving system to reduce the vehicle's current speed. If the braking pressure of the front electronic brake caliper wheels is not less than that of the rear wheels, and the system detects that the vehicle is in a parking position and its speed is zero, it locks the front and rear electronic brake caliper wheels.

[0053] When the power supply of the second power supply module and at least one third power supply module is abnormal, a braking command for the main braking system and a main electronic power steering command are generated, and the vehicle is braked and stopped through the main braking system and the main electronic power steering system.

[0054] 203. If the test results only show that the second power supply module or the third power supply module is abnormal, then the vehicle control strategy is determined to be either decelerating or driving normally.

[0055] When the power supply of the second power supply module is abnormal, the functions of the main computing unit other than the computing function are restricted. The redundant computing unit and the power distribution unit operate normally, generate a signal that the main power supply circuit of the main computing unit has failed, configure the priority of the message sent by the redundant computing unit to be higher than that of the main computing unit, and control the vehicle through the main braking system and the main electronic power steering system.

[0056] When the power supply of at least one third power supply module is abnormal, the main computing unit is configured to send messages with a higher priority than the redundant computing unit, and the vehicle is controlled through the main braking system and the main electronic power steering system.

[0057] 204. Based on the vehicle control strategy, control the main drive circuit, software control circuit and / or redundant drive circuit to drive the vehicle safely in fault conditions.

[0058] When the power supply of the first power supply module and the second power supply module is abnormal, the functions of the main computing unit other than the computing function are restricted, a signal of failure of the main power supply circuit of the main computing unit is generated, the power distribution unit and the redundant computing unit work normally, the priority of the message sent by the redundant computing unit is configured to be higher than that of the main computing unit, and it is checked whether the redundant computing unit receives the signal sent by the electronic control unit; if it does not receive it, a braking command of the redundant braking system and a redundant electronic power steering command are generated, and the vehicle is braked and stopped by the rear wheels through the redundant electronic power steering system and the electronic brake hydraulic caliper.

[0059] Furthermore, the power distribution unit includes a cooling subunit, a lidar subunit, a gateway subunit, and a positioning subunit. The gateway subunit receives braking and stopping commands from the autonomous driving system. Based on the vehicle's surrounding information obtained from the lidar and positioning subunits, it determines whether parking is suitable. If parking is permitted in the current area, the redundant braking system and redundant electronic power steering system are used to brake and stop the vehicle.

[0060] Furthermore, based on the lidar subunit and the positioning subunit, the obstacles around the vehicle in the current area are obtained, and it is determined whether the distance between the vehicle and the surrounding obstacles is within a safe range. If it is within a safe range, an on-site parking instruction is sent to the vehicle. If it is not within a safe range, the nearest parking location to the vehicle is obtained, and the relevant satellite data at that location is acquired to identify whether the vehicle can park there. If it is identified that parking is not allowed, the data of the parking location is acquired.

[0061] When the power supply of the first power supply module and at least one third power supply module is abnormal, the main computing unit checks whether it has received a signal from the electronic control unit. If it has not received a signal, it generates a redundant braking system braking command and a redundant electronic power steering command, and uses the redundant electronic power steering system and electronic brake hydraulic calipers to brake and stop the vehicle at the front wheels.

[0062] In this embodiment of the invention, if the detection results include an abnormality in the first power supply module or an abnormality in both the second and third power supply modules, the vehicle control strategy is determined to be to decelerate the vehicle and stop it at a safe location. If the detection results only include an abnormality in the second or third power supply module, the vehicle control strategy is determined to be to decelerate the vehicle or drive normally. Based on the vehicle control strategy, the main drive circuit, software control circuit, and / or redundant drive circuit are controlled to drive the vehicle safely in the fault state, so that the vehicle can still drive safely in the fault state when the power supply module fails.

[0063] The above describes the fault control method of the autonomous driving system in the embodiments of the present invention. The following describes the fault control device of the autonomous driving system in the embodiments of the present invention. Please refer to [link / reference]. Figure 4 One embodiment of the fault control device for an autonomous driving system in this invention includes:

[0064] The detection module 401 is used to detect whether the power supply of the first power supply module, the second power supply module and the at least one third power supply module is abnormal;

[0065] The determination module 402 is used to determine the corresponding vehicle control strategy based on the detection results if an anomaly is detected.

[0066] The control module 403 is used to control the main drive circuit, the software control circuit and / or the redundant drive circuit to drive the vehicle safely in a fault state based on the vehicle control strategy.

[0067] In this embodiment of the invention, by detecting abnormal power supply conditions of the first power supply module, the second power supply module, and at least one third power supply module, a corresponding vehicle control strategy is determined. Based on the vehicle control strategy, the main drive circuit, software control circuit, and / or redundant drive circuit are controlled to drive the vehicle safely in a fault state, so that the vehicle can still drive safely in a fault state when the power supply module fails.

[0068] Please see Figure 5 Another embodiment of the fault control device for the autonomous driving system in this invention includes:

[0069] The detection module 401 is used to detect whether the power supply of the first power supply module, the second power supply module and the at least one third power supply module is abnormal;

[0070] The determination module 402 is used to determine the corresponding vehicle control strategy based on the detection results if an anomaly is detected.

[0071] The control module 403 is used to control the main drive circuit, the software control circuit and / or the redundant drive circuit to drive the vehicle safely in a fault state based on the vehicle control strategy.

[0072] In this embodiment, the detection module 401 includes:

[0073] The acquisition unit 4011 is used to acquire the rated voltage information of the circuits where the first power supply module, the second power supply module, and the at least one third power supply module are located, respectively;

[0074] The query unit 4012 is used to poll the current first voltage information of each module in the circuit where the first power supply module, the second power supply module, or the at least one third power supply module is located, as well as the connection status information between each module and the first power supply module, the second power supply module, or the at least one third power supply module;

[0075] The calculation unit 4013 is used to calculate the second voltage information of the circuit where the first power supply module, the second power supply module, or the at least one third power supply module is located, based on the connection status information of each module in the circuit where the first power supply module, the second power supply module, or the at least one third power supply module is located and the first voltage information;

[0076] The judgment unit 4014 is used to determine whether the difference between each of the second voltage information and the corresponding rated voltage information meets the preset error threshold.

[0077] The first determining unit 4015 is used to determine that the power supply of the first power supply module, the second power supply module, and the at least one third power supply module is normal if the condition is met.

[0078] The second determining unit 4016 is used to determine, if the condition is not met, a power supply module with an abnormality from the first power supply module, the second power supply module, and / or the at least one third power supply module.

[0079] In this embodiment, the determining module 302 includes:

[0080] The third determining unit 4021 is used to determine the vehicle control strategy as decelerating the vehicle to a safe position and stopping if the detection result includes an abnormality in the first power supply module or an abnormality in both the second power supply module and the third power supply module.

[0081] The fourth determining unit 4022 is used to determine the vehicle control strategy as vehicle deceleration or normal driving if the detection result only includes the second power supply module being abnormal or the third power supply module being abnormal.

[0082] In this embodiment, the control module 403 includes:

[0083] The first control unit 4031 is used to determine that the vehicle will be controlled by the software control circuit if only the first power supply module is abnormal in the detection results, and to control the redundant drive unit to brake and stop the vehicle.

[0084] The second control unit 4032 is used to control the main drive unit to brake and stop the vehicle if the detection results show that at least the second power supply module and the third power supply module are simultaneously abnormal.

[0085] In this embodiment, the first control unit 4031 is further configured to:

[0086] If only the first power supply module is abnormal in the detection results, the message sent by the software control circuit is configured to have the highest priority, and it is checked whether the software control circuit receives the signal sent by the vehicle's electronic control unit; if not received, redundant braking command and redundant electronic power steering command are generated, and the vehicle is braked and stopped through the redundant braking unit and the redundant electronic power steering unit.

[0087] In this embodiment, the control module 403 further includes:

[0088] The deceleration unit 4033 is used to switch the working mode of the software control circuit if the detection result only includes the second power supply module being abnormal, and to control the vehicle to decelerate based on the main drive unit. The working mode of the software control circuit includes control by the main computing unit and control by the redundant computing unit.

[0089] The driving unit 4034 is used to maintain the working mode of the software control circuit and control the vehicle to drive normally based on the main drive unit if the detection result only includes the abnormality of the third power supply module.

[0090] In this embodiment, the detection module 401 is further configured to:

[0091] The system detects whether the vehicle has an ignition signal; if so, it generates a power-on command to power on the circuits containing the first power supply module, the second power supply module, and at least one third power supply module.

[0092] In this embodiment of the invention, by detecting abnormal power supply conditions of the first power supply module, the second power supply module, and at least one third power supply module, a corresponding vehicle control strategy is determined. Based on the vehicle control strategy, the main drive circuit, software control circuit, and / or redundant drive circuit are controlled to drive the vehicle safely in a fault state, so that the vehicle can still drive safely in a fault state when the power supply module fails.

[0093] above Figure 4 and Figure 5 The fault control device of the autonomous driving system in the embodiments of the present invention will be described in detail from the perspective of modular functional entities. The electronic devices in the embodiments of the present invention will be described in detail from the perspective of hardware processing.

[0094] Figure 6 This is a schematic diagram of the structure of an electronic device 600 provided in an embodiment of the present invention. The electronic device 600 can vary significantly due to differences in configuration or performance, and may include one or more central processing units (CPUs) 610 (e.g., one or more processors) and a memory 620, and one or more storage media 630 (e.g., one or more mass storage devices) for storing application programs 633 or data 632. The memory 620 and storage media 630 can be temporary or persistent storage. The program stored in the storage media 630 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the electronic device 600. Furthermore, the processor 610 may be configured to communicate with the storage media 630 and execute the series of instruction operations in the storage media 630 on the electronic device 600.

[0095] Electronic device 600 may also include one or more power supplies 640, one or more wired or wireless network interfaces 650, one or more input / output interfaces 660, and / or one or more operating systems 631, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc. Those skilled in the art will understand that... Figure 6 The illustrated electronic device structure does not constitute a limitation on electronic devices and may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0096] The present invention also provides a computer-readable storage medium, which can be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when the instructions are executed on a computer, cause the computer to perform the steps of the fault control method of the autonomous driving system.

[0097] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system, device, or unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0098] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0099] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A fault control method for an autonomous driving system, the autonomous driving system comprising a first power supply module, a second power supply module, and at least one third power supply module, wherein, The first power supply module and the second power supply module constitute the main power supply circuit of the vehicle, and the at least one third power supply module constitutes the redundant power supply circuit of the vehicle. The first power supply module supplies power to the main drive circuit of the vehicle, and the second and third power supply modules supply power to the software control circuit and the redundant drive circuit of the vehicle. The fault control method of the autonomous driving system includes: Detect whether the power supply of the first power supply module, the second power supply module, and the at least one third power supply module is abnormal; If an anomaly is detected, the corresponding vehicle control strategy is determined based on the detection results. Based on the vehicle control strategy, the main drive circuit, the software control circuit, and / or the redundant drive circuit are controlled to drive the vehicle safely in fault conditions. The step of detecting whether the power supply of the first power supply module, the second power supply module, and the at least one third power supply module is abnormal includes: acquiring the rated voltage information of the circuits where the first power supply module, the second power supply module, and the at least one third power supply module are located; polling the current first voltage information of each module in the circuit where the first power supply module, the second power supply module, or the at least one third power supply module is located, as well as the connection status information between each module and the first power supply module, the second power supply module, or the at least one third power supply module; calculating the second voltage information of the circuit where the first power supply module, the second power supply module, or the at least one third power supply module is located based on the connection status information of each module in the circuit where the first power supply module, the second power supply module, or the at least one third power supply module is located and the first voltage information; determining whether the difference between each second voltage information and the corresponding rated voltage information meets a preset error threshold; if it meets the threshold, determining that the power supply of the first power supply module, the second power supply module, and the at least one third power supply module is normal; if it does not meet the threshold, determining that there is an abnormal power supply module among the first power supply module, the second power supply module, and / or the at least one third power supply module.

2. The fault control method for an autonomous driving system according to claim 1, characterized in that, The process of determining the corresponding vehicle control strategy based on the detection results includes: If the detection results indicate that the first power supply module is abnormal or that both the second and third power supply modules are abnormal, then the vehicle control strategy is determined to be to decelerate the vehicle and stop it at a safe location. If the detection results show only the second power supply module or the third power supply module is abnormal, then the vehicle control strategy is determined to be either vehicle deceleration or normal driving.

3. The fault control method for an autonomous driving system according to claim 2, characterized in that, If the vehicle control strategy is to decelerate the vehicle to a safe location and stop, the step of controlling the main drive circuit, the software control circuit, and / or the redundant drive circuit to drive the vehicle safely under fault conditions based on the vehicle control strategy includes: If only the first power supply module is abnormal in the detection results, it is determined that the vehicle will be controlled by the software control circuit, and the redundant drive unit will be controlled to brake and stop the vehicle. If the detection results indicate that at least the second power supply module and the third power supply module are both abnormal, the main drive unit is controlled to brake and stop the vehicle.

4. The fault control method for an autonomous driving system according to claim 3, wherein the redundant drive system includes a redundant braking unit and a redundant electronic power steering unit, characterized in that, If only the first power supply module is abnormal in the detection results, it is determined that the vehicle will be controlled by the software control circuit, and the redundant drive unit will be controlled to brake and stop the vehicle, including: If only the first power supply module is abnormal in the detection results, the message sent by the software control circuit is configured to have the highest priority, and it is verified whether the software control circuit receives the signal sent by the vehicle's electronic control unit. If no command is received, redundant braking and electronic power steering commands are generated, and the vehicle is braked and stopped by the redundant braking unit and the redundant electronic power steering unit.

5. The fault control method for an autonomous driving system according to claim 2, characterized in that, If the detection results only indicate an abnormality in the second power supply module or the third power supply module, the step of controlling the main drive circuit, the software control circuit, and / or the redundant drive circuit to drive the vehicle safely under fault conditions based on the vehicle control strategy includes: If the detection result only indicates that the second power supply module is abnormal, the operating mode of the software control circuit is switched, and the vehicle is controlled to decelerate based on the main drive unit. The operating mode of the software control circuit includes control by the main computing unit and control by the redundant computing unit. If the detection result only indicates an abnormality in the third power supply module, the operating mode of the software control circuit is maintained, and the vehicle is controlled to drive normally based on the main drive unit.

6. The fault control method for an autonomous driving system according to claim 1, characterized in that, Before detecting whether the power supply of the first power supply module, the second power supply module, and the at least one third power supply module is abnormal, the method further includes: Detect whether the vehicle has an ignition signal; If present, a power-on command is generated to power on the circuit containing the first power supply module, the second power supply module, and the at least one third power supply module.

7. A fault control device for an autonomous driving system, the autonomous driving system comprising a first power supply module, a second power supply module, and at least one third power supply module, wherein, The first power supply module and the second power supply module constitute the main power supply circuit of the vehicle, and the at least one third power supply module constitutes the redundant power supply circuit of the vehicle. The first power supply module supplies power to the main drive circuit of the vehicle, and the second and third power supply modules supply power to the software control circuit and the redundant drive circuit of the vehicle. The fault control device of the autonomous driving system includes: The detection module is used to detect whether the power supply of the first power supply module, the second power supply module and the at least one third power supply module is abnormal; The determination module is used to determine the corresponding vehicle control strategy based on the detection results if an anomaly is detected. The control module is used to control the main drive circuit, the software control circuit and / or the redundant drive circuit to drive the vehicle safely in a fault state based on the vehicle control strategy. The detection module includes: an acquisition unit, configured to acquire the rated voltage information of the circuits containing the first power supply module, the second power supply module, and the at least one third power supply module; an inquiry unit, configured to poll the current first voltage information of each module in the circuit containing the first power supply module, the second power supply module, or the at least one third power supply module, and the connection status information between each module and the first power supply module, the second power supply module, or the at least one third power supply module; a calculation unit, configured to calculate the second voltage information of the circuit containing the first power supply module, the second power supply module, or the at least one third power supply module based on the connection status information of each module in the circuit containing the first power supply module, the second power supply module, or the at least one third power supply module and the first voltage information; a judgment unit, configured to judge whether the difference between each second voltage information and the corresponding rated voltage information meets a preset error threshold; a first determination unit, configured to determine that the power supply of the first power supply module, the second power supply module, and the at least one third power supply module is normal if the threshold is met; and a second determination unit, configured to determine that an abnormal power supply module exists from the first power supply module, the second power supply module, and / or the at least one third power supply module if the threshold is not met.

8. An electronic device, characterized in that, The electronic device includes: a memory and at least one processor, wherein the memory stores instructions, and the memory and the at least one processor are interconnected via a line; The at least one processor invokes the instructions in the memory to cause the electronic device to perform the steps of the fault control method for the autonomous driving system as described in any one of claims 1-6.

9. A computer-readable storage medium storing a computer program thereon, characterized in that, When the computer program is executed by the processor, it implements the various steps of the fault control method for the autonomous driving system as described in any one of claims 1-6.

Images