Autonomous vehicle system failure smooth handover method, system, and vehicle

Abstract

The application provides an automatic driving vehicle system fault smooth switching method, system and vehicle. The method comprises the following steps: for a plurality of sub-processes with logical relationship included in a decision information generation process, a first processing unit and a second processing unit respectively acquire processing result data of sub-processes thereof; the first processing unit and the second processing unit respectively save the processing result data of the sub-processes thereof as local data blocks and send the processing result data to the other party; the first processing unit and the second processing unit respectively save the processing result data of the sub-processes of the other party received as synchronization data blocks; when a preset master-backup switching condition is met, the first processing unit and the second processing unit perform master-backup switching, and a processing unit originally used as a backup generates decision information based on the synchronization data blocks. The method can uninterruptedly generate current decision information when master-backup switching is performed, and smooth switching of an automatic driving vehicle system is realized.

Description

Methods, systems, and vehicles for smooth failover in autonomous vehicle systems Technical Field

[0001] This application relates to the field of electronic technology, and more specifically to a method, system, and vehicle for smooth fault switching in an autonomous driving vehicle system. Background Technology

[0002] Autonomous vehicles, also known as driverless vehicles, computer-driven vehicles, or wheeled mobile robots, are intelligent cars that achieve driverless operation through computer systems. Autonomous vehicles rely on the collaborative efforts of artificial intelligence, visual computing, radar, monitoring devices, and global positioning systems to allow computers to automatically operate motor vehicles.

[0003] The in-vehicle system, also known as the in-vehicle terminal system, is the vehicle's management and control system, integrating functions such as online monitoring, dispatch management, report management, and real-time vehicle status information management. The reliability of the autonomous driving in-vehicle system directly affects the driving safety of the vehicle.

[0004] Currently, autonomous vehicle systems typically employ redundant modules in their core modules to improve system reliability. When the primary module fails, it switches to the backup module for vehicle control, allowing the system to continue operating normally. However, during the switch between primary and backup modules, the data calculated by the two modules may be inconsistent, resulting in an uneven switchover and posing a safety hazard to autonomous vehicles.

[0005] Therefore, how to achieve a smooth transition of autonomous driving vehicle systems and ensure the safety of autonomous vehicles has become an urgent technical problem to be solved. Summary of the Invention

[0006] This application is made in consideration of the above-mentioned problems. This application provides a method, system, and vehicle for smooth fault switching in an autonomous driving vehicle system. By breaking down the decision information calculation process into multiple sub-processes and synchronizing the processing results of each sub-process to the other processing unit, the current decision information can be continuously generated during the master-slave switch, making the master-slave switch more smooth and ensuring the safety of autonomous vehicles.

[0007] According to one aspect of this application, a method for smooth fault switching in an autonomous driving vehicle system is provided. The autonomous driving vehicle system includes a first processing unit and a second processing unit operating in a primary / standby relationship. The first processing unit and the second processing unit are communicatively connected and are used to generate decision information for the autonomous driving vehicle system based on acquired perception information, respectively. The method includes:

[0008] For the multiple logically related sub-processes included in the process of generating the decision information by the first processing unit and the second processing unit, the first processing unit and the second processing unit respectively obtain the processing result data of their own sub-processes;

[0009] The first processing unit and the second processing unit each save the processing result data of their own sub-process as local data blocks and send the processing result data to each other;

[0010] The first processing unit and the second processing unit respectively save the processing result data of the sub-process received from each other as a synchronization data block;

[0011] When the preset master / slave switching conditions are met, the first processing unit and the second processing unit perform a master / slave switching, and the processing unit that was originally on standby generates the decision information of the autonomous driving vehicle system based on the synchronization data block.

[0012] In one embodiment of this application, the processing unit, originally intended as a backup, generates decision information for the autonomous driving vehicle system based on the synchronized data block, including:

[0013] Compare each of the local data blocks with each of the synchronized data blocks;

[0014] When data is inconsistent, the sub-process corresponding to the synchronized data block and its associated sub-processes are determined according to the execution order corresponding to the logical relationship.

[0015] Based on the synchronization data block, the sub-processes corresponding to the synchronization data block and their associated sub-processes are executed to generate the current decision information of the autonomous driving vehicle system.

[0016] In one embodiment of this application, the primary / standby switchover conditions include:

[0017] When a failure is detected in the primary processing unit while the backup processing unit does not fail; or...

[0018] When a failure is detected in the primary processing unit and the backup processing unit has recovered from the failure; or...

[0019] When it is detected that the second processing unit, which is the primary unit, has not failed and the first processing unit, which is the backup unit, has recovered from the failure.

[0020] In one embodiment of this application, the fault detection method of the first processing unit or the second processing unit includes:

[0021] Perform heartbeat detection on the first processing unit or the second processing unit, and obtain the fault detection result of the first processing unit or the second processing unit based on the heartbeat detection result; or,

[0022] Communication detection is performed on the first processing unit or the second processing unit, and a fault detection result of the first processing unit or the second processing unit is obtained based on the communication detection result.

[0023] In one embodiment of this application, the primary / backup relationship between the first processing unit and the second processing unit is determined by a preset primary / backup election strategy, which includes:

[0024] The first processing unit is used as the primary processing unit, and the second processing unit is used as the backup processing unit; or,

[0025] The first processing unit and the second processing unit compete for the lock. The one that wins the lock becomes the primary processing unit, and the one that fails to win the lock becomes the backup processing unit.

[0026] In one embodiment of this application, the method further includes:

[0027] Before generating the decision information, the first processing unit and the second processing unit respectively acquire sensor information collected in real time by the sensor, and generate perception information based on the sensor information. The sensor includes one or more of the following: image sensor, positioning sensor, light sensor, infrared sensor, and radar sensor.

[0028] In one embodiment of this application, when a preset primary / standby switching condition is met, the first processing unit and the second processing unit perform a primary / standby switching based on a received switching trigger instruction, wherein the switching trigger instruction is issued by a control unit for generating control instructions based on the decision information.

[0029] According to a second aspect of this application, an autonomous driving vehicle system is provided, including a first processing unit, a second processing unit, and a control unit, wherein the first processing unit, the second processing unit, and the control unit are respectively communicatively connected.

[0030] The first processing unit and the second processing unit are configured to operate under a defined primary / backup relationship;

[0031] The control unit is used to perform fault detection on the first processing unit and the second processing unit respectively, obtain fault detection results, and generate a switching trigger command based on the fault detection results and send it to the first processing unit and the second processing unit.

[0032] The first processing unit and the second processing unit are further configured to perform fault smoothing switching based on the switching trigger instruction and the aforementioned fault smoothing switching method during runtime.

[0033] In one embodiment of this application, the control unit is further configured to determine the primary / standby relationship between the first processing unit and the second processing unit based on a preset primary / standby election strategy.

[0034] In one embodiment of this application, the first processing unit and the second processing unit are further configured to acquire sensor information collected in real time by the sensor, wherein the sensor includes one or more of an image sensor, a positioning sensor, a light sensor, an infrared sensor, and a radar sensor.

[0035] In one embodiment of this application, the control unit includes:

[0036] A heartbeat detection module is used to perform heartbeat detection on the first processing unit and the second processing unit respectively, and obtain fault detection results for the first processing unit and the second processing unit based on the heartbeat detection results; or,

[0037] The communication detection module is used to perform communication detection on the first processing unit and the second processing unit respectively, and to obtain the fault detection results of the first processing unit and the second processing unit based on the communication detection results.

[0038] In one embodiment of this application, the control unit includes a switching trigger instruction generation module, which is used to:

[0039] When the fault detection result indicates that the primary processing unit has failed while the backup processing unit has not failed, a switchover trigger command is generated; or...

[0040] When the fault detection result indicates that the primary processing unit has failed while the backup processing unit has recovered from the fault, a switchover trigger command is generated; or...

[0041] When the fault detection result indicates that the second processing unit, which is the primary unit, has not failed and the first processing unit, which is the backup unit, has recovered from the fault, a switching trigger command is generated.

[0042] In one embodiment of this application, the control unit includes a first controller and a second controller operating in a master-slave relationship.

[0043] In one embodiment of this application, the autonomous driving vehicle system further includes an Ethernet switch, and the first processing unit, the second processing unit, the first controller, and the second controller are respectively connected to the Ethernet switch.

[0044] In one embodiment of this application, the autonomous driving vehicle system includes a first temperature sensor and a first positioning sensor connected to the first controller, and a second temperature sensor and a second positioning sensor connected to the second controller.

[0045] According to a third aspect of this application, a vehicle is provided, characterized in that the vehicle includes the aforementioned autonomous driving vehicle system.

[0046] This application breaks down the decision information calculation process into multiple sub-processes and synchronizes the processing results of each sub-process to the other processing unit, thereby enabling the continuous generation of current decision information during primary / standby switching, making the primary / standby switching smoother, and the calculation results of the standby processing unit are close to the calculation results of the primary processing unit that has already malfunctioned. Attached Figure Description

[0047] The above and other objects, features, and advantages of the present invention will become more apparent from the more detailed description of the embodiments of the invention in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same parts or steps.

[0048] Figure 1 is a schematic block diagram of an autonomous driving vehicle system according to an embodiment of the present application;

[0049] Figure 2 is a schematic flowchart of a fault smoothing method for an autonomous driving vehicle system according to an embodiment of this application;

[0050] Figure 3 is a schematic flowchart of a method for a backup processing unit to generate decision information for an autonomous driving vehicle system based on a synchronous data block, according to an embodiment of this application.

[0051] Figure 4 is a schematic block diagram of an autonomous driving vehicle system according to another embodiment of this application;

[0052] Figure 5 is a schematic block diagram of an autonomous driving vehicle system according to a first embodiment of this application;

[0053] Figure 6 is a schematic flowchart of a fault smoothing method for an autonomous driving vehicle system according to a second embodiment of this application. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of the present invention more apparent, exemplary embodiments according to the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are merely a part of the embodiments of the present invention, and not all of the embodiments of the present invention. It should be understood that the present invention is not limited to the exemplary embodiments described herein. Based on the embodiments of the present invention described herein, all other embodiments obtained by those skilled in the art without inventive effort should fall within the protection scope of the present invention.

[0055] Currently, core modules of autonomous driving vehicle systems typically employ redundancy to improve system reliability. However, during the switchover between primary and backup modules, the data calculated by the two modules may be inconsistent, leading to an inability to smoothly switch between them and posing a safety hazard to autonomous vehicles. Based on this, this application proposes a method, system, and vehicle for smooth fault switching in an autonomous driving vehicle system.

[0056] First, the autonomous driving vehicle system 100 for implementing embodiments of the present invention will be described with reference to FIG1.

[0057] As shown in Figure 1, the autonomous driving vehicle system 100 includes a first processor 111, a second processor 112, a memory 120, and a communication interface 130, which operate in a primary / backup relationship. The memory 120, the first processor 111, the second processor 112, and the communication interface 130 can communicate via a communication bus 140.

[0058] Optionally, the communication interface 130 may also include a transmitter and / or a receiver.

[0059] The first processor 111 and the second processor 112 may be a microcontroller unit (MCU), a central processing unit (CPU), a digital signal processor (DSP), a single-chip microcomputer, an embedded device, or other processing units with data processing capabilities and / or instruction execution capabilities, and may control other components in the autonomous driving vehicle system to perform the desired functions.

[0060] The memory 120 can be various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM), cache memory, synchronous dynamic random access memory (SDRAM), etc. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may also be stored on the computer-readable storage medium, and the memory 120 can execute the program instructions to implement the fault-smoothing handover method in the embodiments of the present invention described below.

[0061] Next, a method for smooth fault switching of an autonomous driving vehicle system according to an embodiment of this application will be described with reference to FIG2.

[0062] As shown in Figure 2, the fault smoothing handover method provided in this application includes:

[0063] In step S210, for the multiple logically related sub-processes included in the process of generating the decision information by the first processing unit and the second processing unit, the first processing unit and the second processing unit respectively obtain the processing result data of their own sub-processes.

[0064] During the generation of the decision information, the first processing unit and the second processing unit each use the same preset splitting strategy to divide the generation process into multiple logically related sub-processes. The first and second processing units are primary and backup units, therefore the programs they run are identical, and consequently, the sub-processes they ultimately obtain are also identical.

[0065] Here, the first processing unit and the second processing unit can be two general-purpose or dedicated processors installed on an autonomous vehicle, or they can be electronic control units (ECUs).

[0066] Specifically, the perceived information may include environmental information surrounding the autonomous vehicle. This environmental information includes dynamic and / or static objects, specifically the appearance, shape, and / or location of dynamic objects, and the appearance, shape, and / or location of static objects. Examples of dynamic objects include pedestrians, motor vehicles, or non-motorized vehicles; examples of static objects include curbs, trees, road signs, lanes, or other obstacles.

[0067] Perception information can be obtained by processing sensor information collected by sensors, or it can be obtained through vehicle-to-everything (V2X), vehicle-to-vehicle (V2V), or vehicle-to-infrastructure (V2I) networks. This application does not specifically limit the method of obtaining perception information.

[0068] When the perceived information is obtained by processing the sensor information collected by the sensor, the fault smoothing switching method provided in this application can also be applied to the entire process of generating decision information based on sensor information.

[0069] For example, during autonomous driving, onboard sensors can collect sensor information and send it to the ECU. The ECU uses a preset algorithm to process the sensor information and generates decision information for the autonomous driving system based on the acquired sensor information. Based on the decision results, control commands are generated, and then autonomous driving is completed according to the control commands.

[0070] The method for generating decision information for the autonomous driving vehicle system based on the acquired perception information can be flexibly set by those skilled in the art according to actual needs, and this application does not impose specific limitations. The process of generating decision information is also a process of processing data according to logical relationships by a program. Each step of the program processing can be divided into multiple sub-processes according to the same preset splitting strategy. These multiple sub-processes can specifically be multiple sub-processes with certain logical relationships in the program operation. The logical relationships can be determined according to the program's algorithm and splitting strategy. For example, the logical relationships can be sequential, parallel, or nested loops. The embodiments of this application do not impose specific limitations on the logical relationships.

[0071] In step S220, the first processing unit and the second processing unit respectively save the processing result data of their own sub-processes as local data blocks and send the processing result data to each other.

[0072] It should be understood that the storage medium for storing local data blocks can be the storage medium of the first processing unit and the second processing unit. When the first processing unit and the second processing unit save the processing result data as local data blocks, they can save it in volatile memory or in non-volatile memory.

[0073] In step S230, the first processing unit and the second processing unit respectively save the processing result data of the sub-process received from each other as a synchronization data block.

[0074] When the first processing unit and the second processing unit save the received processing result data as a synchronization data block, they can save it in volatile memory or non-volatile memory, in the same memory as the local data block, or in a different memory.

[0075] It should be noted that when the first processing unit and the second processing unit send the processing result data, they may send the processing result data of the current sub-process, the processing result data of all previous sub-processes, or the processing result data of the two or more most recent sub-processes.

[0076] In step S240, when the preset master-slave switching conditions are met, the first processing unit and the second processing unit perform a master-slave switching, and the processing unit that was originally the backup generates the decision information of the autonomous driving vehicle system based on the synchronization data block.

[0077] Specifically, the switching condition can be whether the current primary processing unit is functioning correctly. For example, by acquiring the real-time operating status of the current primary and standby processing units, it can be determined whether the primary processing unit is operating normally, and vice versa. When an abnormal operating status is detected in the primary processing unit, it is determined that the primary processing unit meets the switching condition.

[0078] After the first processing unit and the second processing unit perform a primary / backup switch, the processing unit that was originally the backup will become the primary processing unit to generate decision information. At this time, it generates the decision information of the autonomous driving vehicle system based on the synchronization data block.

[0079] By breaking down the decision information calculation process into multiple sub-processes and synchronizing the processing results of each sub-process to the other processing unit, the current decision information can be generated uninterruptedly during the primary / backup switch, making the primary / backup switch smoother and ensuring that the calculation results of the backup processing unit are close to those of the primary processing unit that has already malfunctioned.

[0080] Figure 3 is a schematic block diagram of a method for a backup processing unit to generate decision information for an autonomous driving vehicle system based on a synchronization data block, according to an embodiment of this application. As shown in Figure 3, according to an embodiment of this application, the backup processing unit generates decision information for the autonomous driving vehicle system based on the synchronization data block, including:

[0081] S310. Compare each local data block with each synchronous data block;

[0082] S320. When the data is inconsistent, determine the sub-process corresponding to the synchronized data block and its associated sub-processes according to the execution order corresponding to the logical relationship.

[0083] S330. Based on the synchronization data block, execute the sub-process corresponding to the synchronization data block and its associated sub-processes to generate the current decision information of the autonomous driving vehicle system.

[0084] It is understandable that when the data is consistent, the current decision information of the autonomous driving vehicle system can be generated based on either local data blocks or synchronized data blocks.

[0085] Specifically, since the process of generating decision information is divided into multiple sub-processes, when data is inconsistent, the sub-process corresponding to the inconsistent data block is started first, and the corresponding sub-processes are executed in the execution order corresponding to the logical relationship. Decision information is generated based on the synchronous data block. For example, when multiple data blocks are inconsistent, the decision information is calculated starting from the sub-process corresponding to the earliest generated data block, following the execution order corresponding to the logical relationship.

[0086] By generating the current decision information of the autonomous vehicle system from the subprocess corresponding to the inconsistent data block when data is inconsistent, the generation of decision information is made more continuous in time.

[0087] According to one embodiment of this application, the primary / standby switching conditions include:

[0088] When a failure is detected in the primary processing unit while the backup processing unit does not fail; or...

[0089] When a failure is detected in the primary processing unit and the backup processing unit has recovered from the failure; or...

[0090] When it is detected that the second processing unit, which is the primary unit, has not failed and the first processing unit, which is the backup unit, has recovered from the failure.

[0091] Switching occurs when a failure is detected in the primary processing unit (the second unit), while the backup processing unit has recovered from the failure. Logically, the second processing unit acts as a backup, making troubleshooting easier. Switching also occurs when the primary processing unit is functioning correctly and the backup processing unit has recovered from the failure, reducing the number of switchovers.

[0092] It should be noted that in the above primary / standby switching conditions, the first processing unit is assumed to be the primary processing unit and the second processing unit to be the standby processing unit. In specific implementations, the second processing unit can also be the primary processing unit and the first processing unit the standby processing unit. This application does not limit the primary and standby processing units. The primary and standby processing units can be determined according to the system's preset primary / standby election method when the system starts running. The system's preset primary / standby election method can adopt existing methods, which will not be elaborated here.

[0093] According to one embodiment of this application, the primary / backup relationship between the first processing unit and the second processing unit can also be determined by a preset primary / backup election strategy. The primary / backup election strategy can be to use the first processing unit as the primary processing unit and the second processing unit as the backup processing unit.

[0094] According to another embodiment of this application, the first processing unit and the second processing unit compete for the lock, with the one that wins the lock serving as the primary processing unit and the one that fails to win the lock serving as the backup processing unit.

[0095] According to one embodiment of this application, the fault detection method of the first processing unit or the second processing unit includes:

[0096] A heartbeat detection is performed on the first processing unit or the second processing unit, and a fault detection result of the first processing unit or the second processing unit is obtained based on the heartbeat detection result.

[0097] According to another embodiment of this application, the fault detection method of the first processing unit or the second processing unit includes: performing communication detection on the first processing unit or the second processing unit, and obtaining a fault detection result of the first processing unit or the second processing unit based on the communication detection result.

[0098] The following uses the first processing unit as an example to illustrate the process of heartbeat detection and communication detection.

[0099] If the heartbeat information sent by the first processing unit is received within the preset time threshold, it is determined that the first processing unit has not malfunctioned.

[0100] If no heartbeat information is received from the first processing unit within a preset time threshold, it is determined that the first processing unit has malfunctioned.

[0101] The communication detection performed on the first processing unit determines that the first processing unit is not faulty if it can communicate with the network, otherwise it determines that the first processing unit is faulty.

[0102] The communication detection performed on the first processing unit or the second processing unit can be a packet internet explorer (ping) test or a remote login (telnet) test.

[0103] According to one embodiment of this application, the method further includes:

[0104] Before generating the decision information, the first processing unit and the second processing unit respectively acquire sensor information collected in real time by the sensor, and generate perception information based on the sensor information.

[0105] Sensors can include image sensors, radar sensors, positioning sensors, wind speed sensors, light sensors, infrared sensors, etc. Image sensors, such as front-facing, side-facing, and rear-facing cameras, collect environmental information as image data within the camera's field of view. Radar sensors, such as ultrasonic radar, millimeter-wave radar, and lidar, can also be other types of radar sensors; no specific limitation is made here. Positioning sensors can be Global Positioning System (GPS), Global Navigation Satellite System (GNSS), or Inertial Navigation System (INS), etc. The environmental information collected by positioning sensors is the vehicle's position information; wind speed sensors collect environmental information such as wind speed and direction; and light sensors collect environmental information such as light intensity.

[0106] According to one embodiment of this application, when a preset primary / standby switching condition is met, the first processing unit and the second processing unit perform a primary / standby switching based on a received switching trigger instruction, wherein the switching trigger instruction is issued by a control unit for generating control instructions based on the decision information.

[0107] Next, an autonomous driving vehicle system according to an embodiment of this application will be described with reference to FIG4.

[0108] As shown in Figure 4, the autonomous driving vehicle system 400 includes a first processing unit 410, a second processing unit 420, and a control unit 430, which are communicatively connected to each other.

[0109] The first processing unit 410 and the second processing unit 420 are configured to operate in a defined primary / backup relationship.

[0110] The control unit 430 is used to perform fault detection on the first processing unit 410 and the second processing unit 420 respectively, obtain fault detection results, and generate a switching trigger command based on the fault detection results and send it to the first processing unit 410 and the second processing unit 420.

[0111] The first processing unit 410 and the second processing unit 420 are further configured to perform fault smoothing switching based on the switching trigger instruction during runtime, using the fault smoothing switching method described above according to any one of the embodiments of this application.

[0112] The control unit 430 in the autonomous driving vehicle system 400 can be a general-purpose processor, a microcontroller unit (MCU), an application-specific integrated circuit (ASIC), a programmable logic device (PLD), a digital signal processor (DSP), or a combination thereof. The PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof; this application embodiment does not specifically limit this.

[0113] In the above implementation process, the first processing unit and the second processing unit divide the decision information calculation process into multiple sub-processes and synchronize the processing result data of each sub-process to the other processing unit. This enables the continuous generation of current decision information during the primary / backup switch, making the primary / backup switch smoother, and the calculation result of the backup processing unit is close to the calculation result of the primary processing unit that has already malfunctioned.

[0114] According to one embodiment of this application, the control unit is further configured to determine the primary / standby relationship between the first processing unit and the second processing unit based on a preset primary / standby election strategy. The primary / standby election strategy may be that the first processing unit is the primary processing unit and the second processing unit is the standby processing unit; or, the first processing unit and the second processing unit compete for the lock, with the unit that wins the lock becoming the primary processing unit and the unit that fails to win the lock becoming the standby processing unit.

[0115] According to one embodiment of this application, the first processing unit and the second processing unit are further configured to acquire sensor information collected in real time by the sensor, wherein the sensor includes one or more of an image sensor, a positioning sensor, a light sensor, an infrared sensor, and a radar sensor.

[0116] Sensors can include image sensors, radar sensors, positioning sensors, wind speed sensors, light sensors, infrared sensors, etc. Image sensors, such as vehicle cameras, are used to identify environmental information such as pedestrians, bicycles, motor vehicles, road tracks, road signs, and traffic lights; radar sensors, such as ultrasonic radar, millimeter-wave radar, and lidar, are used to detect and locate objects.

[0117] It should be noted that the sensor can also be other types of sensors, and no specific limitation is made here.

[0118] According to one embodiment of this application, the control unit includes:

[0119] A heartbeat detection module is used to perform heartbeat detection on the first processing unit and the second processing unit respectively, and obtain fault detection results for the first processing unit and the second processing unit based on the heartbeat detection results; or,

[0120] The communication detection module is used to perform communication detection on the first processing unit and the second processing unit respectively, and to obtain the fault detection results of the first processing unit and the second processing unit based on the communication detection results.

[0121] According to one embodiment of this application, the control unit includes a switching trigger instruction generation module, the switching trigger instruction generation module being used for:

[0122] When the fault detection result indicates that the primary processing unit has failed while the backup processing unit has not failed, a switchover trigger command is generated; or...

[0123] When the fault detection result indicates that the primary processing unit has failed while the backup processing unit has recovered from the fault, a switchover trigger command is generated; or...

[0124] When the fault detection result indicates that the second processing unit, which is the primary unit, has not failed and the first processing unit, which is the backup unit, has recovered from the fault, a switching trigger command is generated.

[0125] Next, the autonomous driving vehicle system according to the first embodiment of this application will be described with reference to FIG5.

[0126] In this embodiment, the processing unit adopts a System on Chip (SoC), and the controller adopts a Micro Controller Unit (MCU). Specifically, the SoC is configured using an Advanced Reduced Instruction Set Machine (ARM). The autonomous driving vehicle system includes a first SoC 521, a second SoC 522, a first MCU 541, and a second MCU 542. The first SoC 521 and the second SoC 522 are mutually connected to the mutually supporting first MCU 541 and second MCU 542.

[0127] When one SoC module fails, another SoC module can continue to operate, improving the reliability of the SoC.

[0128] When one MCU module fails, another MCU module can continue to work, improving the reliability of the MCU.

[0129] The vehicle-mounted camera 511, millimeter-wave radar 512, ultrasonic radar 513, and lidar 514 are connected to the first SoC 521 and the second SoC 522 to collect sensor data. This sensor data is sent to the first SoC 521 and the second SoC 522 for dual-channel acquisition. The first SoC 521 is connected to the first SDRAM 523 and the first Flash 524 to form the minimum operating unit, used to process sensor data, calculate decision information, and run other programs. The second SoC 522 is connected to the second SDRAM 525 and the second Flash 526. The first SoC 521 and the second SoC 522 constitute the primary and backup SoCs, connected to the Ethernet switching chip 531. The Ethernet switching chip 531 is connected to the vehicle Ethernet and also to the first MCU 541 and the second MCU 542. The first MCU 541 is connected to the first GPS / IMU 543 and the first temperature sensor 544. The second MCU 542 is connected to the second GPS / IMU 545 and the second temperature sensor 546. The first MCU 541 and the second MCU 542, constituting the primary and backup configuration, are respectively connected to the Controller Area Network (CAN) bus 552 and the debug interface 543. As can be seen from the architecture diagram in Figure 5, the SoCs are two chips that act as primary and backup for each other, and the MCUs, GPS / IMU 543, and temperature sensors are also two chips that act as primary and backup, providing hardware redundancy and improving the reliability of the SoCs and MCUs.

[0130] It should be noted that the composition and structure of the autonomous driving vehicle system shown in Figure 5 are exemplary and not restrictive. The autonomous driving vehicle system may also have other components and structures as needed.

[0131] Internally, the MCU interacts with the first SoC521 and the second SoC522 via an Ethernet switch chip. Simultaneously, the Global Positioning System (GPS), Inertial Measurement Unit (IMU), and temperature sensor also interact with the MCU. Externally, the MCU provides a debug interface and a vehicle control CAN interface. The debug interface is primarily responsible for debugging the board, while the CAN interface enables vehicle control functions.

[0132] The SoC receives sensor information from vehicle cameras, millimeter-wave radar, ultrasonic radar, and lidar, performs perception information calculations to obtain perception decision information, and sends the decision information to the MCU. The perception information decision calculation is broken down into multiple sub-processes, with the end of each sub-process serving as a node. Each node stores the calculated data and sends it to another SoC.

[0133] The MCU is responsible for fault detection and primary / standby election between the two SoCs. When the primary SoC fails, it triggers a primary / standby switchover and notifies each node of the standby SoC to compare the calculated data with the synchronized data. If they are inconsistent, the synchronized data takes precedence, and the decision information is recalculated. The MCU generates control commands based on the received decision information and sends them to the corresponding actuators.

[0134] This embodiment solves the problem of uneven switching between SoC master and backup modules by breaking down the decision information calculation process of the master module and backup module into multiple sub-processes and synchronizing the calculation data of each node to the peer node.

[0135] The aforementioned autonomous driving system is installed on an autonomous vehicle. Next, a fault smoothing method for the autonomous vehicle system according to the second embodiment of this application will be described with reference to FIG6.

[0136] The specific steps of the smooth fault handover method include:

[0137] Step S501: The primary MCU determines the primary / secondary relationship between the first SoC and the second SoC based on a preset primary / secondary election strategy.

[0138] The method for determining the master / standby relationship between the first MCU and the second MCU can be the existing method, which will not be elaborated here.

[0139] In step S502, the first SoC and the second SoC respectively receive sensor data sent by the vehicle-mounted sensor.

[0140] Specifically, sensor data includes data collected through vehicle cameras, millimeter-wave radar, ultrasonic radar, and lidar.

[0141] In this step, the onboard sensors on the autonomous vehicle collect sensor data and send it to the ARM cores of the first and second SoCs. Correspondingly, the ARM cores of the first and second SoCs receive this sensor data.

[0142] Step S503: The first SoC and the second SoC divide the calculation process of decision information into sub-process 1 - sub-process N;

[0143] In this step, the SoC decision information calculation process is broken down into multiple calculation sub-processes. In the subsequent calculation of decision information, when the result of each sub-process is generated at the end, the calculation result will be saved; at the same time, the saved data will be sent to another SoC.

[0144] In step S504, the ARBs of the first SoC and the second SoC calculate the decision information of the autonomous driving vehicle system based on the acquired sensor data using a preset algorithm. During this process, the first SoC and the second SoC save the processing result data of each sub-process as a local data block and send the processing result data to each other.

[0145] In step S505, the first SoC and the second SoC save the received processing result data as a synchronization data block respectively;

[0146] These node data are used to restore the field data during primary / standby switchover. When a primary / standby switchover occurs, the standby machine will use the synchronized node data to overwrite the local computing data and recalculate. In this way, the decision information generated after the switchover is closer to the decision information before the primary / standby switchover, so the primary / standby switchover is smoother.

[0147] Step S506: During the operation of the first SoC and the second SoC, the main MCU performs fault detection on the main SoC. When a fault is detected, a main / standby switchover command is issued.

[0148] For example, the decision information calculation programs of the first SoC and the second SoC send heartbeats to the MCU respectively. If the heartbeat is interrupted, the SoC is considered to be faulty.

[0149] Step S507: When the primary SoC fails, the first SoC and the second SoC perform a primary / backup switch. The original backup SoC generates the decision information of the autonomous driving vehicle system based on the synchronization data block.

[0150] Step S508: The SoC sends the decision information to the MCU.

[0151] Step S509: After receiving the decision information, the MCU, acting as the main MCU, generates control commands based on the decision information and sends them to the corresponding actuators, so that the control actuators can perform automatic driving according to the control commands.

[0152] Specifically, the MCU generates control commands based on the decision information produced by the SoC and sends them to the CAN or to the SoC via Scalable service-oriented middleware over IP (SOME / IP) protocol, Inter-Integrated Circuit (IIC) bus, etc.

[0153] In the above implementation process, the first SoC and the second SoC break down the decision information calculation process into multiple sub-processes and synchronize data from multiple nodes to each other, so as to continuously generate the current decision information during the master-slave switchover, making the master-slave switchover smoother.

[0154] This application also provides a vehicle that includes the aforementioned autonomous driving vehicle system.

[0155] Although exemplary embodiments have been described herein with reference to the accompanying drawings, it should be understood that the above exemplary embodiments are merely illustrative and are not intended to limit the scope of the invention. Various changes and modifications can be made therein by those skilled in the art without departing from the scope and spirit of the invention. All such changes and modifications are intended to be included within the scope of the invention as claimed in the appended claims.

[0156] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0157] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed.

[0158] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0159] Similarly, it should be understood that, in order to streamline the invention and aid in understanding one or more of the various aspects of the invention, features of the invention are sometimes grouped together in a single embodiment, figure, or description thereof in the description of exemplary embodiments of the invention. However, this method of the invention should not be construed as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as reflected in the corresponding claims, its inventive point lies in solving the corresponding technical problem with fewer features than all of those in a single disclosed embodiment. Therefore, the claims following the detailed description are hereby expressly incorporated into that detailed description, wherein each claim itself is a separate embodiment of the invention.

[0160] Those skilled in the art will understand that, apart from the mutual exclusion of features, all features disclosed in this specification (including the accompanying claims, abstract, and drawings) and all processes or units of any method or apparatus so disclosed can be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstract, and drawings) may be replaced by an alternative feature that serves the same, equivalent, or similar purpose.

[0161] Furthermore, those skilled in the art will understand that although some embodiments described herein include certain features but not others included in other embodiments, combinations of features from different embodiments are intended to be within the scope of the invention and form different embodiments. For example, in the claims, any of the claimed embodiments can be used in any combination.

[0162] The various component embodiments of the present invention can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some modules in the article analysis device according to embodiments of the present invention. The present invention can also be implemented as an apparatus program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such programs implementing the present invention can be stored on a computer-readable medium, or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0163] It should be noted that the above embodiments are illustrative of the invention and not restrictive, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names.

[0164] The above description is merely a specific embodiment of the present invention or an explanation of that embodiment. The scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. The scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for smooth fault switching in an autonomous driving vehicle system, characterized in that, The autonomous driving vehicle system includes a first processing unit and a second processing unit operating in a primary / backup relationship. The first processing unit and the second processing unit are communicatively connected and are used to generate decision information for the autonomous driving vehicle system based on acquired perception information. The method includes: for multiple logically related sub-processes included in the process of generating the decision information by the first processing unit and the second processing unit, the first processing unit and the second processing unit respectively acquire the processing result data of their own sub-processes; the first processing unit and the second processing unit respectively save the processing result data of their own sub-processes as local data blocks and send the processing result data to each other; the first processing unit and the second processing unit... The second processing unit saves the processing results of the sub-processes received from the other party as synchronization data blocks. When the preset master-slave switching conditions are met, the first processing unit and the second processing unit perform a master-slave switch. The processing unit that was originally on standby generates the decision information of the autonomous driving vehicle system based on the synchronization data blocks. Specifically, this includes: comparing each local data block with each synchronization data block; when the data is inconsistent, determining the sub-process corresponding to the synchronization data block and its associated sub-processes according to the execution order corresponding to the logical relationship; and executing the sub-process corresponding to the synchronization data block and its associated sub-processes based on the synchronization data block to generate the current decision information of the autonomous driving vehicle system.

2. The fault smoothing switching method as described in claim 1, characterized in that, The primary / backup switching conditions include: when a failure is detected in the primary processing unit and the backup processing unit does not fail; or, when a failure is detected in the primary processing unit and the backup processing unit has recovered from the failure; or, when a failure is detected in the primary processing unit and the backup processing unit has recovered from the failure.

3. The fault smoothing switching method as described in claim 2, characterized in that, The fault detection method for the first processing unit or the second processing unit includes: performing heartbeat detection on the first processing unit or the second processing unit, and obtaining a fault detection result for the first processing unit or the second processing unit based on the heartbeat detection result; or performing communication detection on the first processing unit or the second processing unit, and obtaining a fault detection result for the first processing unit or the second processing unit based on the communication detection result.

4. The fault smoothing handover method as described in any one of claims 1-3, characterized in that, The primary / backup relationship between the first processing unit and the second processing unit is determined by a preset primary / backup election strategy. The primary / backup election strategy includes: using the first processing unit as the primary processing unit and the second processing unit as the backup processing unit; or, the first processing unit and the second processing unit compete for the lock, with the one that wins the lock becoming the primary processing unit and the one that fails to win the lock becoming the backup processing unit.

5. The fault smoothing switching method as described in any one of claims 1-4, characterized in that, The method further includes: before generating the decision information, the first processing unit and the second processing unit respectively acquire sensor information collected in real time by the sensor, and generate perception information based on the sensor information, wherein the sensor includes one or more of image sensor, positioning sensor, light sensor, infrared sensor, and radar sensor.

6. The fault smoothing handover method as described in any one of claims 1-5, characterized in that, When the preset master / slave switching conditions are met, the first processing unit and the second processing unit perform master / slave switching based on the received switching trigger instruction, which is issued by the control unit used to generate control instructions based on the decision information.

7. An autonomous driving vehicle system, characterized in that, It includes a first processing unit, a second processing unit, and a control unit, which are communicatively connected to each other; the first processing unit and the second processing unit are used to operate in a defined primary / standby relationship. The control unit is configured to perform fault detection on the first processing unit and the second processing unit respectively, obtain fault detection results, and generate a switching trigger command based on the fault detection results and send it to the first processing unit and the second processing unit; the first processing unit and the second processing unit are further configured to perform fault smooth switching based on the switching trigger command during operation using the fault smooth switching method according to any one of claims 1 to 6.

8. The autonomous driving vehicle system as described in claim 7, characterized in that, The control unit is further configured to determine the primary / secondary relationship between the first processing unit and the second processing unit based on a preset primary / secondary election strategy.

9. The autonomous driving vehicle system as described in any one of claims 7-8, characterized in that, The first processing unit and the second processing unit are further configured to acquire sensor information collected in real time by the sensors, wherein the sensors include one or more of image sensors, positioning sensors, light sensors, infrared sensors, and radar sensors.

10. The autonomous driving vehicle system as described in any one of claims 7-9, characterized in that, The control unit includes: a heartbeat detection module, used to perform heartbeat detection on the first processing unit and the second processing unit respectively, and obtain fault detection results of the first processing unit and the second processing unit based on the heartbeat detection results; or, a communication detection module, used to perform communication detection on the first processing unit and the second processing unit respectively, and obtain fault detection results of the first processing unit and the second processing unit based on the communication detection results.

11. The autonomous driving vehicle system as described in any one of claims 7-10, characterized in that, The control unit includes a switching trigger command generation module, which is configured to: generate a switching trigger command when the fault detection result indicates that the primary first processing unit has failed while the backup first processing unit has not failed; or, generate a switching trigger command when the fault detection result indicates that the primary second processing unit has failed while the backup first processing unit has recovered from the fault; or, generate a switching trigger command when the fault detection result indicates that the primary second processing unit has not failed while the backup first processing unit has recovered from the fault.

12. The autonomous driving vehicle system as described in any one of claims 7-11, characterized in that, The control unit includes a first controller and a second controller that operate in a master-slave relationship.

13. The autonomous driving vehicle system as described in claim 12, characterized in that, The autonomous driving vehicle system also includes an Ethernet switch, and the first processing unit, the second processing unit, the first controller, and the second controller are respectively connected to the Ethernet switch.

14. The autonomous driving vehicle system as described in any one of claims 12-13, characterized in that, The autonomous driving vehicle system includes a first temperature sensor and a first positioning sensor connected to the first controller, and a second temperature sensor and a second positioning sensor connected to the second controller.

15. A vehicle, characterized in that, The vehicle includes the autonomous driving vehicle system as described in any one of claims 7-14.

Images