Domain controller redundancy system of intelligent heavy-duty vehicle and control method

Abstract

According to the domain controller redundancy system of the intelligent heavy-duty vehicle and the control method, a redundancy mode that an intelligent driving domain and a chassis domain can take over each other is provided on the basis of an existing domain control architecture scheme, so that the intelligent driving domain and the chassis domain can be controlled by each other to achieve low-speed limp or safe parking of the vehicle when the intelligent driving domain and the chassis domain separately break down; while the reliability of the control system suitable for the vehicle is effectively improved, the cost of redundancy control is also obviously reduced.

Description

Technical Field

[0001] The present invention belongs to the field of automotive electronic technology, and in particular relates to a domain controller redundancy system and a control method for intelligent heavy-duty vehicles. Background Art

[0002] With the improvement of the level of vehicle intelligence, the domain-controlled electronic and electrical architecture has a tendency to gradually replace the traditional distributed electronic and electrical architecture in intelligent heavy-duty vehicles due to its advantages such as concentrated functions, large data transmission bandwidth, and high performance. At present, the domain-controlled electronic and electrical architecture is mainly divided according to vehicle functions, and one or more high-performance domain controllers are used to integrate complex functions within the domain, such as the intelligent driving domain and chassis domain. There is a problem of insufficient control redundancy during unmanned operation. At present, there are two mainstream redundancy methods for domain control. One is to use dual hardware redundancy, which is costly for high-performance domain controllers and is not conducive to large-scale applications; the other is to use the intelligent driving domain controller to judge the vehicle status and control the vehicle emergency braking through an independent controller when it is determined that the vehicle cannot run. However, this method relies too much on the software and hardware reliability of a single domain controller and cannot guarantee the safety of the vehicle after the controller fails under complex working conditions such as turning and obstacle avoidance of heavy-duty vehicles. Summary of the invention

[0003] In view of this, in view of the technical problems existing in the art, the present invention provides a domain controller redundancy system for an intelligent heavy-duty vehicle, specifically comprising: an intelligent driving domain controller, a chassis domain controller, a central gateway, a perception sensor and a chassis subsystem controller;

[0004] Among them, the intelligent driving domain controller includes an intelligent driving function module, a chassis driving function backup module, and a chassis domain state machine; the intelligent driving function module is used to integrate and process the environmental information obtained by the perception sensor, plan the vehicle driving path, and provide the chassis domain controller with a short-term target path and driving signals including the throttle; the chassis domain state machine is used to receive the two-way communication heartbeat signal and fault code sent by the chassis domain controller, as well as the communication heartbeat signal sent by the chassis subsystem controller, to monitor the working status of the chassis domain controller; the chassis driving function backup module is used to realize the vehicle limp control after the chassis domain controller fails;

[0005] The chassis domain controller includes a chassis control function module, a downgraded intelligent driving function backup module, and an intelligent driving domain state machine; wherein the chassis control function module is used to receive driving input signals, and solve the vehicle chassis stability boundary according to the vehicle posture, including: steering radius constraints, and vehicle state constraints solved based on the center of mass sideslip angle-yaw angular velocity phase plane method, and send component control signals to the chassis subsystem controller to maintain the chassis stability state; the intelligent driving domain state machine is used to receive two-way communication heartbeat signals and fault codes sent by the intelligent driving domain controller, and the communication heartbeat signals sent by the chassis subsystem controller, so as to monitor the working state of the intelligent driving domain controller; the downgraded intelligent driving function backup module is used to control the vehicle to stop safely based on the short-term target path or obstacle information after the intelligent driving domain controller fails;

[0006] The central gateway is provided with an inter-domain communication module, which is connected to the intelligent driving domain controller and the chassis domain controller via Ethernet to realize data communication between the two domain controllers;

[0007] Perception sensors include LiDAR, millimeter-wave radar, and cameras, which are used to obtain vehicle environmental information and transmit the environmental information to the intelligent driving domain controller through Ethernet or CAN bus for fusion processing;

[0008] The chassis subsystem controller, including the wire-controlled steering controller, wire-controlled brake controller, electric drive system controller, etc., is connected to the intelligent driving domain controller and the chassis domain controller through the CAN bus at the same time, and is used to convert the target control signal into the chassis subsystem drive signal, and is also used to feedback the working status of the chassis subsystem;

[0009] When the intelligent driving domain controller or the chassis domain controller fails individually, the two can take over each other.

[0010] Furthermore, the two communication heartbeat signals received by the chassis domain state machine are sent by the chassis domain controller through Ethernet and chassis bus respectively. When the two heartbeat signals disappear at the same time and the heartbeat signal of the chassis subsystem controller is normal, it is determined that there is a network fault in the chassis domain controller; the chassis domain state machine also receives the chassis domain controller hardware fault code for fault classification, and determines that the controller hardware is faulty when the performance of the chassis domain controller is seriously degraded; when the chassis domain state machine identifies any fault, it sends an enable signal to the chassis driving function backup module;

[0011] The two-way communication heartbeat signals received by the intelligent driving domain state machine are also sent by the chassis domain controller through Ethernet and chassis bus respectively. When the two heartbeat signals disappear at the same time and the heartbeat signal of the chassis subsystem controller is normal, the intelligent driving domain controller network fault is determined; the intelligent driving domain state machine also receives the intelligent driving domain controller hardware fault code for fault classification, and determines the controller hardware fault when the performance of the intelligent driving domain controller is seriously degraded; the intelligent driving domain state machine also judges the chassis stability state. If the received driving signal has a trend that causes vehicle instability, that is, the vehicle state exceeds the stability boundary range determined by the chassis control function module in the chassis domain controller, the intelligent driving domain controller software is determined to be abnormal; when the intelligent driving domain state machine identifies any fault, it sends an enable signal to the degraded intelligent driving function backup module.

[0012] Furthermore, the chassis control function backup module specifically solves the control target of the chassis subsystem according to the proportional mapping relationship based on the driver input signal output by the intelligent driving function module to achieve low-speed limp of the vehicle; the control target of the chassis subsystem specifically includes the target torque of the drive motor, the target front wheel angle, the target wheel speed, etc.;

[0013] The downgraded intelligent driving function backup module is specifically based on the short-term target path of the previous moment provided by the intelligent driving domain controller. It uses tracking methods such as geometric tracking that have lower requirements on the controller's solution performance to send driving signals to the chassis driving function module and control the vehicle to brake and stop along the path.

[0014] Accordingly, the present invention provides a domain controller redundancy method for an intelligent heavy-duty vehicle implemented by using the above system, which consists of two parts: redundant backup of an intelligent driving domain controller and redundant backup of a chassis domain controller;

[0015] The process of redundant backup of the intelligent driving domain controller includes:

[0016] The chassis domain controller receives the vehicle status signal fed back by the chassis subsystem controller in real time, analyzes the current posture of the vehicle, and solves the chassis stability boundary;

[0017] Combine the communication status of the communication heartbeat signal with the fault code of the intelligent driving domain controller to determine whether the intelligent driving domain controller is working normally. If there is a fault, activate the downgraded intelligent driving function backup module, and the chassis domain controller will take over some functions of the intelligent driver controller;

[0018] The process of chassis domain controller redundancy backup includes:

[0019] The intelligent driving domain controller uses the communication status of the integrated communication heartbeat signal and the chassis domain controller fault code to determine whether the chassis controller is working normally. If a fault occurs, the chassis driving function backup module is activated and the chassis domain controller takes over some functions of the intelligent driver controller.

[0020] Furthermore, when the intelligent driving domain controller fails, the chassis domain controller specifically determines whether the vehicle exceeds the stability boundary range during braking and parking in combination with the real-time vehicle posture. If so, the chassis domain controller replans the path based on the obstacle information synchronized by the intelligent driving domain controller at the last moment before the failure, and controls the vehicle to brake and stop along the path.

[0021] When a chassis domain controller fails, the intelligent driving domain controller limits the target vehicle speed and heading angle range, recalculates the driving signals input by the driver including the throttle, front wheel angle, etc., and solves the chassis subsystem control target based on the driving signal with a proportional mapping relationship, and sends it to the chassis subsystem controller to control the vehicle to limp at low speed.

[0022] The domain controller redundant system and control method for intelligent heavy-duty vehicles provided by the present invention provide a redundant method in which the intelligent driving domain and the chassis domain can take over each other on the basis of the existing domain control architecture solution, so that when a failure occurs in either of them, the other can control the vehicle to limp at a low speed or park safely. While effectively improving the reliability of the control system suitable for such vehicles, it also significantly reduces the cost of redundant control. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A schematic diagram of a domain control redundancy system for intelligent heavy-duty vehicles provided by the present invention;

[0024] Figure 2 A schematic diagram of a control framework of a normal state of a domain control redundancy system provided in an embodiment of the present invention;

[0025] Figure 3 A schematic diagram of a control framework of a domain controller failure state of a chassis of a domain control redundancy system provided in an embodiment of the present invention;

[0026] Figure 4 A schematic diagram of a control framework for a fault state of an intelligent driving domain controller in a domain control redundancy system provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0027] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] The domain controller redundancy system of the intelligent heavy-duty vehicle provided by the present invention is as follows: Figure 1 As shown, it specifically includes: an intelligent driving domain controller 20, a chassis domain controller 30, a central gateway 10, a perception sensor and a chassis subsystem controller;

[0029] Among them, the intelligent driving domain controller 20 includes an intelligent driving function module 21, a chassis driving function backup module 23, and a chassis domain state machine 22; wherein the intelligent driving function module is used to integrate and process the environmental information obtained by the perception sensor, plan the vehicle driving path, and provide the chassis domain controller with a short-term target path and driving signals including the throttle, etc.; the chassis domain state machine is used to receive two-way communication heartbeat signals and fault codes sent by the chassis domain controller, as well as the communication heartbeat signals sent by the chassis subsystem controller, to monitor the working status of the chassis domain controller; the chassis driving function backup module is used to realize the vehicle limp control after the chassis domain controller fails;

[0030] The chassis domain controller 30 includes a chassis control function module 31, a downgraded intelligent driving function backup module 33, and an intelligent driving domain state machine 32; wherein the chassis control function module is used to receive driving input signals, and solve the vehicle chassis stability boundary according to the vehicle posture, including: steering radius constraints, and vehicle state constraints solved based on the center of mass sideslip angle-yaw angular velocity phase plane method, and send component control signals to the chassis subsystem controller to maintain the chassis stability state; the intelligent driving domain state machine is used to receive two-way communication heartbeat signals and fault codes sent by the intelligent driving domain controller, and the communication heartbeat signal sent by the chassis subsystem controller, so as to monitor the working state of the intelligent driving domain controller; the downgraded intelligent driving function backup module is used to control the vehicle to stop safely based on the short-term target path or obstacle information after the intelligent driving domain controller fails;

[0031] The central gateway 10 is provided with an inter-domain communication module 11, which is connected to the intelligent driving domain controller and the chassis domain controller via Ethernet to realize data communication between the two domain controllers;

[0032] The perception sensors include a laser radar 41, a millimeter wave radar 42, a camera 43, etc., which are used to obtain vehicle environment information and transmit the environment information to the intelligent driving domain controller through Ethernet or CAN bus for fusion processing;

[0033] The chassis subsystem controller includes a steering-by-wire controller 51, a brake-by-wire controller 52, an electric drive system controller 53, etc., which is connected to the intelligent driving domain controller and the chassis domain controller via the CAN bus, and is used to convert the target control signal into a chassis subsystem drive signal, and is also used to feedback the working status of the chassis subsystem;

[0034] When the intelligent driving domain controller or the chassis domain controller fails individually, the two can take over each other.

[0035] In a preferred embodiment of the present invention, the two communication heartbeat signals received by the chassis domain state machine are respectively sent by the chassis domain controller through Ethernet and the chassis bus. When the two heartbeat signals disappear at the same time and the heartbeat signal of the chassis subsystem controller is normal, it is determined that there is a network fault in the chassis domain controller; the chassis domain state machine also receives the chassis domain controller hardware fault code for fault classification, and determines that the controller hardware fault occurs when the performance of the chassis domain controller is seriously degraded; when the chassis domain state machine identifies any fault, an enable signal is sent to the chassis driving function backup module;

[0036] The two-way communication heartbeat signals received by the intelligent driving domain state machine are also sent by the chassis domain controller through Ethernet and chassis bus respectively. When the two heartbeat signals disappear at the same time and the heartbeat signal of the chassis subsystem controller is normal, the intelligent driving domain controller network fault is determined; the intelligent driving domain state machine also receives the intelligent driving domain controller hardware fault code for fault classification, and determines the controller hardware fault when the performance of the intelligent driving domain controller is seriously degraded; the intelligent driving domain state machine also judges the chassis stability state. If the received driving signal has a trend that causes vehicle instability, that is, the vehicle state exceeds the stability boundary range determined by the chassis control function module in the chassis domain controller, the intelligent driving domain controller software is determined to be abnormal; when the intelligent driving domain state machine identifies any fault, it sends an enable signal to the degraded intelligent driving function backup module.

[0037] In a preferred embodiment of the present invention, the chassis control function backup module specifically solves the control target of the chassis subsystem according to the proportional mapping relationship based on the driver input signal output by the intelligent driving function module to achieve low-speed limp of the vehicle; the control target of the chassis subsystem specifically includes the target torque of the drive motor, the target front wheel angle, the target wheel speed, etc.;

[0038] The downgraded intelligent driving function backup module is specifically based on the short-term target path of the previous moment provided by the intelligent driving domain controller. It uses tracking methods such as geometric tracking that have lower requirements on the controller's solution performance to send driving signals to the chassis driving function module and control the vehicle to brake and stop along the path.

[0039] Accordingly, the present invention provides a domain controller redundancy method for an intelligent heavy-duty vehicle implemented by using the above system, which consists of two parts: redundant backup of an intelligent driving domain controller and redundant backup of a chassis domain controller;

[0040] The process of redundant backup of the intelligent driving domain controller includes:

[0041] The chassis domain controller receives the vehicle status signal fed back by the chassis subsystem controller in real time, analyzes the current posture of the vehicle, and solves the chassis stability boundary;

[0042] Combine the communication status of the communication heartbeat signal with the fault code of the intelligent driving domain controller to determine whether the intelligent driving domain controller is working normally. If there is a fault, activate the downgraded intelligent driving function backup module, and the chassis domain controller will take over some functions of the intelligent driver controller;

[0043] The process of chassis domain controller redundancy backup includes:

[0044] The intelligent driving domain controller uses the communication status of the integrated communication heartbeat signal and the chassis domain controller fault code to determine whether the chassis controller is working normally. If a fault occurs, the chassis driving function backup module is activated and the chassis domain controller takes over some functions of the intelligent driver controller.

[0045] In a preferred embodiment of the present invention, when the intelligent driving domain controller fails, the chassis domain controller specifically determines whether the vehicle exceeds the stability boundary range during braking and parking in combination with the real-time vehicle posture. If so, the path is replanned based on the obstacle information synchronized by the intelligent driving domain controller at the last moment before the failure, and the vehicle is controlled to brake and stop along the path;

[0046] When a chassis domain controller fails, the intelligent driving domain controller limits the target vehicle speed and heading angle range, recalculates the driving signals input by the driver including the throttle, front wheel angle, etc., and solves the chassis subsystem control target based on the driving signal with a proportional mapping relationship, and sends it to the chassis subsystem controller to control the vehicle to limp at low speed.

[0047] Figure 2-4 Several optional domain control redundancy system optional forms based on the present invention are provided. For example Figure 2In the system shown, the environment perception module 24 of the intelligent driving domain controller 20 obtains the environment data recorded by the perception sensors such as the laser radar 41, the millimeter wave radar 42, and the camera 43 through the Ethernet or CAN bus, performs fusion processing, obtains the coordinate data of the road boundary and obstacles in the surrounding environment of the vehicle, and provides it to the decision-making planning module 25; the decision-making planning module 25 determines the expected driving behavior of the vehicle according to the vehicle driving task, including uniform speed passage, steering and obstacle avoidance, etc., and plans a short-term target path in combination with the environmental information, and provides it to the tracking control module 26, and at the same time sends the short-term target path and obstacle coordinate information to the chassis domain controller through the data synchronization module 27; the tracking control module 26 solves the target driving signal of the vehicle, such as the throttle, the target heading angle, etc., according to the vehicle posture information received by the data synchronization module 27, and sends it to the chassis domain controller through the data synchronization module 27; the safety constraint module of the chassis domain controller receives the component status feedback from the chassis subsystem controller, and solves The vehicle posture and stability boundary are solved, the vehicle stability state is identified, and the stability boundary is provided to the chassis control module 36, the intelligent driving domain state machine 32 and the data synchronization module 35; the chassis control module 36 solves the control targets of subsystems such as wire-controlled steering, wire-controlled braking, and drive torque based on the stability boundary and the target driving signal received by the data synchronization module 35, and sends them to the subsystem controllers such as the wire-controlled steering system controller 51, the wire-controlled braking system controller 52, and the electric drive system controller 53 through the bus to realize vehicle driving control; the intelligent driving domain state machine 32 comprehensively determines whether the chassis controller is unable to work by combining the communication status and the fault code of the chassis domain controller 30, and the specific implementation method is consistent with the above-mentioned domain control redundant system embodiment; the chassis domain state machine 22 comprehensively determines whether the chassis controller is unable to work by combining the communication status, the status code of the intelligent driving domain controller 20 and the stability boundary provided by the chassis safety constraint module 34, and the specific implementation method is consistent with the above-mentioned implementation method based on the present invention.

[0048] For this embodiment, if the chassis domain state machine 22 determines that the chassis domain controller 30 is no longer working, the redundancy method of the chassis domain controller is based on Figure 3 The system shown in the figure includes:

[0049] All signal outputs of the chassis domain controller 30 are cut off, and the chassis domain state machine 22 sends an enable signal to the chassis driving control backup module 28; the tracking control module 26 limits the target vehicle speed and heading angle range, and sends the operating condition restrictions to the decision planning module 25 to update the constraints of the path planning, and re-solves the driving signals such as the throttle and front wheel angle, and sends them to the chassis driving backup module 28. The chassis driving control backup module 28 solves the control targets of the subsystems such as the wire-controlled steering, wire-controlled braking, and drive torque with the driving signals in a proportional mapping manner, and sends them to the subsystem controllers such as the wire-controlled steering system controller 51, the wire-controlled braking system controller 52, and the electric drive system controller 53 through the bus to control the vehicle to limp at low speed.

[0050] Similarly, for this embodiment, if the intelligent driving domain state machine 32 determines that the intelligent driving domain controller 20 is no longer working, the redundancy method of the intelligent driving domain controller is based on Figure 4 The system shown in the figure includes:

[0051] All signal outputs of the intelligent driving domain controller 20 are cut off, and the intelligent driving domain state machine 32 sends an enable signal to the downgraded intelligent driving function backup module 33; the downgraded intelligent driving function backup module 33 controls the vehicle to brake and stop along the path based on the short-term target path synchronized at the last moment before the failure of the intelligent driving domain controller 20; the chassis safety constraint module 34 determines whether the vehicle exceeds the stability boundary range during braking and parking in combination with the real-time vehicle posture, and if so, sends a warning signal to the downgraded intelligent driving function backup module 33, and the downgraded intelligent driving function backup module 33 re-plans the path based on the obstacle information synchronized at the last moment before the failure of the intelligent driving domain controller 20, and controls the vehicle to brake and stop along the path.

[0052] It should be understood that the size of the serial numbers of the steps in the embodiment of the present invention does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0053] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A domain controller redundancy system for an intelligent heavy-duty vehicle, characterized in that: Specifically include: Includes intelligent driving domain controller, chassis domain controller, central gateway, perception sensor and chassis subsystem controller; Among them, the intelligent driving domain controller includes an intelligent driving function module, a chassis driving function backup module, and a chassis domain state machine; the intelligent driving function module is used to integrate and process the environmental information obtained by the perception sensor, plan the vehicle driving path, and provide the chassis domain controller with a short-term target path and driving signals including the throttle; the chassis domain state machine is used to receive the two-way communication heartbeat signal and fault code sent by the chassis domain controller, as well as the communication heartbeat signal sent by the chassis subsystem controller, to monitor the working status of the chassis domain controller; the chassis driving function backup module is used to realize the vehicle limp control after the chassis domain controller fails; The chassis domain controller includes a chassis control function module, a downgraded intelligent driving function backup module, and an intelligent driving domain state machine; wherein the chassis control function module is used to receive driving input signals, and solve the vehicle chassis stability boundary according to the vehicle posture, including: steering radius constraints, and vehicle state constraints solved based on the center of mass sideslip angle-yaw angular velocity phase plane method, and send component control signals to the chassis subsystem controller to maintain the chassis stability state; the intelligent driving domain state machine is used to receive two-way communication heartbeat signals and fault codes sent by the intelligent driving domain controller, and the communication heartbeat signals sent by the chassis subsystem controller, so as to monitor the working state of the intelligent driving domain controller; the downgraded intelligent driving function backup module is used to control the vehicle to stop safely based on the short-term target path or obstacle information after the intelligent driving domain controller fails; The central gateway is provided with an inter-domain communication module, which is connected to the intelligent driving domain controller and the chassis domain controller via Ethernet to realize data communication between the two domain controllers; Perception sensors include LiDAR, millimeter-wave radar, and cameras, which are used to obtain vehicle environmental information and transmit the environmental information to the intelligent driving domain controller via Ethernet or CAN bus for fusion processing; The chassis subsystem controller includes a steer-by-wire controller, a brake-by-wire controller, and an electric drive system controller, which is connected to the intelligent driving domain controller and the chassis domain controller via the CAN bus, and is used to convert the target control signal into a chassis subsystem drive signal, and is also used to feedback the working status of the chassis subsystem; When the intelligent driving domain controller or the chassis domain controller fails individually, the two can take over each other.

2. The system according to claim 1, characterized in that: The two communication heartbeat signals received by the chassis domain state machine are sent by the chassis domain controller through Ethernet and chassis bus respectively. When the two heartbeat signals disappear at the same time and the heartbeat signal of the chassis subsystem controller is normal, it is determined that the chassis domain controller has a network failure. The chassis domain state machine also receives the chassis domain controller hardware fault code for fault classification. When the chassis domain controller performance is seriously degraded, it is determined that the controller hardware is faulty. When the chassis domain state machine identifies any kind of fault, it sends an enable signal to the chassis driving function backup module. The two communication heartbeat signals received by the intelligent driving domain state machine are also sent by the chassis domain controller through Ethernet and chassis bus respectively. When the two heartbeat signals disappear at the same time and the heartbeat signal of the chassis subsystem controller is normal, it is determined that the intelligent driving domain controller network is faulty; The intelligent driving domain state machine also receives the intelligent driving domain controller hardware fault code for fault classification. When the performance of the intelligent driving domain controller is seriously degraded, it is determined that the controller hardware is faulty. The intelligent driving domain state machine also determines the chassis stability state. If the received driving signal has a tendency to cause vehicle instability, that is, the vehicle state exceeds the stability boundary range determined by the chassis control function module in the chassis domain controller, the intelligent driving domain controller software is determined to be abnormal. When the intelligent driving domain state machine identifies any fault, an enable signal is sent to the degraded intelligent driving function backup module.

3. The system according to claim 1, characterized in that: The chassis control function backup module specifically solves the control target of the chassis subsystem according to the proportional mapping relationship based on the driver input signal output by the intelligent driving function module to achieve low-speed limp of the vehicle; the control target of the chassis subsystem specifically includes the target torque of the drive motor, the target front wheel angle, and the target wheel speed; The downgraded intelligent driving function backup module is specifically based on the short-term target path of the previous moment provided by the intelligent driving domain controller. It uses a geometric tracking method to send driving signals to the chassis driving function module and control the vehicle to brake and stop along the path.

4. A domain controller redundancy method for an intelligent heavy-duty vehicle, characterized in that: The method is implemented by using the system as described in any one of claims 1 to 3; the method consists of two parts: redundant backup of the intelligent driving domain controller and redundant backup of the chassis domain controller; The process of redundant backup of the intelligent driving domain controller includes: The chassis domain controller receives the vehicle status signal fed back by the chassis subsystem controller in real time, analyzes the current posture of the vehicle, and solves the chassis stability boundary; Combine the communication status of the communication heartbeat signal with the fault code of the intelligent driving domain controller to determine whether the intelligent driving domain controller is working normally. If there is a fault, activate the downgraded intelligent driving function backup module, and the chassis domain controller will take over some functions of the intelligent driver controller; The process of chassis domain controller redundancy backup includes: The intelligent driving domain controller uses the communication status of the integrated communication heartbeat signal and the chassis domain controller fault code to determine whether the chassis controller is working normally. If a fault occurs, the chassis driving function backup module is activated and the chassis domain controller takes over some functions of the intelligent driver controller.

5. The method according to claim 4, characterized in that: When the intelligent driving domain controller fails, the chassis domain controller determines whether the vehicle exceeds the stability boundary range during braking and parking based on the real-time vehicle posture. If so, the chassis domain controller replans the path based on the obstacle information synchronized by the intelligent driving domain controller at the last moment before the failure, and controls the vehicle to brake and stop along the path. When a chassis domain controller fails, the intelligent driving domain controller limits the target vehicle speed and heading angle range, recalculates the driving signals input by the driver including the throttle and front wheel angle, and solves the chassis subsystem control target based on the driving signal with a proportional mapping relationship, and sends it to the chassis subsystem controller to control the vehicle to limp at low speed.

Images