Safety redundancy architecture of autonomous vehicle

Abstract

The invention discloses a safety redundancy architecture of an automatic driving vehicle, which comprises a task layer and a safety layer, the task layer and the safety layer respectively receive input and output through the safety layer, the task layer and the safety layer can ensure the safety of the automatic driving vehicle and simultaneously realize required tasks, and the safety and the reliability of the automatic driving vehicle are improved; functions are limited in the security layer through an algorithm instead of limiting the redundant architecture, constraints are reduced along with extension of the security algorithm, deterministic guarantee for false alarms is kept, dependence on obstacle attributes is eliminated, the part can be integrated into the redundant architecture, hardware is not added, and the cost is low; the security layer simplifies the task layer test work and cost, unlike expensive task layer redundancy, it can secure a single task layer and protect the task layer through a highly redundant security layer running on a low cost embedded platform.

Description

Technical Field

[0001] The present invention belongs to the field of autonomous driving safety technology, and specifically relates to a safety redundant architecture for an autonomous driving vehicle. Background Art

[0002] The number of prototypes of autonomous vehicles has increased rapidly over the past few years, leading to innovations in the future of transportation. However, as autonomous driving technology continues to evolve, achieving collision-free and safe autonomous vehicles still faces a series of technical challenges, and the technical path is not very clear.

[0003] Although the concept of autonomous driving systems was proposed decades ago, its practical application has been constrained by many factors. One of the most prominent issues is the safety of the system, especially in complex and changing traffic environments, ensuring collision-free driving of autonomous vehicles has become a huge challenge. Although fully autonomous driving systems have not yet been put on the road, many accidents have occurred in the application of assisted driving systems alone. In order to solve the safety problem of autonomous driving systems, one of the most commonly used methods in the industry is to adopt architectural redundancy. Architectural redundancy refers to the introduction of multiple relatively independent components with the same or similar functions in the system design to improve the reliability and fault tolerance of the system. In autonomous vehicles, this means using multiple sensors, controllers and actuators and / or corresponding algorithms, and conducting comprehensive analysis on them to ensure that the system can still perform tasks reliably when a component fails or is disturbed.

[0004] The advantage of architectural redundancy is that it can effectively reduce the impact of single point failures on the entire system, thereby improving the safety of autonomous vehicles. For example, when a sensor fails due to harsh environmental conditions, other sensors can make up for the missing information and ensure that the system accurately perceives the surrounding environment. This redundant design makes the system more robust and able to adapt to various complex driving scenarios, including bad weather, temporary road construction, and other uncertain factors. However, there are still some challenges in the current architectural redundancy approach, such as: 1. The software and hardware redundancy overhead scales with the size of the entire system, making the overhead costly for complex autonomous driving systems; 2. Simple redundancy cannot solve the failures shared by all replicas. As long as all replicas of the system use the same algorithm or implementation, they will suffer from the same algorithm errors, resulting in system failures; 3. The responsibilities of the current safety architecture for tasks (navigation) and safety (collision avoidance) are scattered throughout the system, the system's optimization goals are unreasonable, and safety issues are more complex. Summary of the invention

[0005] In view of the above problems, the main purpose of the present invention is to design a safe redundant architecture for autonomous driving vehicles to solve technical problems such as common failure of algorithms with the same architecture and high redundancy cost of complex systems.

[0006] In order to achieve the above purpose, the present invention adopts the following technical solutions: A safety redundant architecture for an autonomous driving vehicle, the architecture comprising a task layer and a safety layer, the task layer and the safety layer respectively receiving inputs and outputting through the safety layer; The task layer includes an autonomous driving algorithm, which completes the tasks required by the autonomous driving vehicle based on input information. The required tasks include one or more of perception, prediction, planning, and control. In the process of completing the required tasks, the task layer discloses its internal state and output results to the safety layer, and adjusts the behavior of the task layer through corrective and optimization measures based on the safety judgments and optimization prompts output by the safety layer. The safety layer includes safety algorithms and fault handling procedures, which are used for safety monitoring and fault handling of the task layer; The safety algorithm includes calculating according to the input information and storing it as a basic result, wherein the basic result includes the result of the safety calculation of the task required by the vehicle, receiving the output result of the task layer and comparing it with the basic result; and also includes safety verification, and judging whether the internal state and output result of the task required by the task layer are reasonable based on the comparison; The fault handling procedure analyzes and determines through the comparison results of the safety algorithm. When the output results of each task in the task layer are consistent with the basic results stored in the safety layer, the output of the architecture is executed. When the output results of each task in the task layer are inconsistent with the basic results stored in the safety layer, the severity of the fault is determined and a fault code is reported. The autonomous driving vehicle downgrades the vehicle function to the minimum risk state based on the fault code, and transmits the optimization measure trigger flag and / or the corrective measure flag to the task layer.

[0007] As a further description of the present invention, the task layer includes an autonomous driving algorithm of a perception module, a prediction module, a positioning module, a planning module, and a control module, which is tested based on SIL / HIL / full vehicle; According to the task requirements of the autonomous driving vehicle, the output results of each module are calculated through the autonomous driving algorithm of the task layer. At the same time, the safety layer stores the calculation results of the same input and compares them with the outputs of each module of the autonomous driving task layer. According to the mission requirements of the autonomous vehicle, the basic results are calculated and stored through the security algorithm of the security layer.

[0008] As a further description of the present invention, the task layer utilizes the optimization prompts of the safety layer to identify areas near the autonomous driving vehicle where obstacles exist and the collision risk caused by such obstacles; The task layer uses the faults detected by the safety layer to correct the behavior of the autonomous vehicle; The task layer provides a functional interface used by the safety layer to request corrective actions.

[0009] As a further description of the present invention, the safety algorithm of the safety layer is a deep clustering algorithm, which is verifiable and can be logically analyzed, meets the verification requirements of the input information of the task layer calculation results, provides corresponding task functions under corresponding constraints of the autonomous driving vehicle, and ensures the reliability of the architecture of the autonomous driving vehicle when a single sensor fails.

[0010] As a further description of the present invention, the safety algorithm of the safety layer compares the output results of the task layer with the basic results of the safety layer to determine whether the outputs are consistent; wherein, the safety algorithm includes a function list and a constraint list, the function list includes all interfaces required for input and output of the autonomous driving vehicle, and the constraint list constrains part or all of the functions in the function list.

[0011] As a further description of the present invention, the safety algorithm of the safety layer is used to verify the accuracy and robustness of the autonomous driving algorithm in the task layer, to judge the internal state and output results of each module in the task layer, and to determine whether the state of the target is within the set threshold for safety verification, and the state of the target includes speed and position.

[0012] As a further description of the present invention, the fault handling procedure is a low-latency obstacle detection algorithm, which is used to provide the detected obstacle output to the target detection of the task layer and transmit it to the task layer as an optimization prompt.

[0013] As a further description of the present invention, the fault handling program is used to perform fault detection on each task function in the safety layer, compare the output results of the same function in the task layer, and perform safety output.

[0014] As a further description of the present invention, the fault handling procedure is used to determine the severity of each detected fault.

[0015] As a further description of the present invention, the fault handling procedure is used to monitor the compliance of the task layer with the output constraints of the safety layer, and take corrective measures to restore compliance with the constraints or handle functional losses in response to violations of the constraints.

[0016] Compared with the prior art, the technical effects of the present invention are: The present invention provides a safety redundant architecture for an autonomous driving vehicle, comprising a task layer and a safety layer, wherein the task layer and the safety layer receive inputs respectively and output through the safety layer, and through the task layer and the safety layer, the required tasks of the autonomous driving vehicle can be achieved while ensuring its safety, thereby improving the safety and reliability of the autonomous driving vehicle; the safety layer components are designed to complete only the tasks required for the autonomous driving vehicle, which helps to reduce the size of the safety layer software and simplify software verification; in the safety layer, functions are restricted by algorithms rather than by the redundant architecture, and as the safety algorithm expands, constraints are reduced while maintaining deterministic guarantees against false alarms and eliminating dependence on obstacle properties, and this part can be integrated into the redundant architecture without increasing hardware and at a low cost; the safety layer simplifies the task layer testing work and cost, and unlike expensive task layer redundancy, it can make a single task layer safe, and protect the task layer through a highly redundant safety layer running on a low-cost embedded platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a schematic diagram of the structure of the present invention; Figure 2 It is a schematic diagram of the architecture workflow of the present invention; Figure 3 A schematic diagram of the cooperation of the architecture of the present invention when sensing a target state; Figure 4 It is a schematic diagram of the working principle of the architecture security layer of the present invention. DETAILED DESCRIPTION

[0018] The present invention is described in detail below in conjunction with the accompanying drawings: In one embodiment of the present invention, a safety redundant architecture of an autonomous driving vehicle is disclosed, referring to Figure 1-4 As shown, the architecture includes a task layer and a safety layer. The task layer and the safety layer receive inputs respectively. The inputs include the target detected by visual perception and lidar perception and the result output of the environmental state, and are output through the safety layer. Through the task layer and the safety layer, the required tasks of the autonomous driving vehicle can be achieved while ensuring its safety.

[0019] The task layer, including the autonomous driving algorithm, completes the tasks required for the autonomous driving vehicle based on input information. The input information includes perception input information and the vehicle's own positioning / speed / heading, etc. The required tasks include one or more of perception, prediction, planning, and control. In the process of completing the required tasks, the task layer discloses its internal state and output results to the security layer, and adjusts the behavior of the task layer through corrective and optimization measures based on the safety judgments and optimization prompts output by the security layer (the task layer receives the optimization prompts and / or corrective measures transmitted by the security layer, and triggers the adjustment of the behavior of the task layer in the form of faults).

[0020] The safety layer includes a safety algorithm and a fault handling program, which are used for safety monitoring and fault handling of the task layer; the safety algorithm includes calculations based on input information and storage as basic results, the basic results include the results of safety calculations for the tasks required by the vehicle (including the necessary calculation results for the safety calculation outputs of each task), receiving the output results of the task layer and comparing them with the basic results; it also includes safety verification, and at the same time, based on the comparison, it judges whether the internal state and output results of the tasks required by the task layer are reasonable; the fault handling program analyzes and determines through the comparison results of the safety algorithm, when the output results of each task in the task layer are consistent with the basic results stored in the safety layer, the output of the architecture is executed, and when the output results of each task in the task layer are inconsistent with the basic results stored in the safety layer, the severity of the fault is determined and a fault code is reported, and the autonomous driving vehicle downgrades the vehicle function to the minimum risk state according to the fault code, and transmits the optimization measure trigger flag and / or the corrective measure flag to the task layer.

[0021] Specifically, this embodiment conducts a detailed analysis of the above-mentioned task layer and security layer, and the contents are as follows: Task layer: The task layer is an autonomous driving algorithm that includes perception module, prediction module, positioning module, planning module, and control module. It is responsible for completing all tasks required by the autonomous driving vehicle. According to the task requirements of the autonomous driving vehicle, the output results of each module are calculated by the autonomous driving algorithm of the task layer. At the same time, the security layer stores the calculation results of the same input and compares them with the outputs of each module of the autonomous driving task layer. According to the task requirements of the autonomous driving vehicle, the basic results are calculated and stored by the security algorithm of the security layer. Taking perception as an example, the perception target state results calculated by the security algorithm of the security layer will be stored in the security layer. At the same time, the perception target state results calculated by the task layer will also be sent to the security layer through the middleware for storage.

[0022] Safety layer: The safety layer is responsible for providing specific safety assurance. The safety layer must meet the verification requirements of safety-critical software, that is, it must be logically analyzable and fully verifiable. The safety layer does not need to be able to complete the task of the autonomous driving vehicle, but only needs to be able to reach a safe state. It is functionally divided into two parts: (1) Safety algorithm, which is a deep clustering algorithm. The results of clustering the target states perceived by the above-mentioned safety layer and the task layer are compared. The safety layer uses the perceived target state results based on the logic output of the safety clustering algorithm as the basic results and compares them with the output structure of the task layer; performs rationality verification (the state output of the detection target of visual perception and laser perception determines whether the state of the target (speed / position, etc.) is within a reasonable threshold, and performs safety verification. If it is within the set threshold, the verification is successful, and if it is outside the set threshold, the verification fails). The safety verification mainly verifies the accuracy and robustness of the task layer autonomous driving algorithm by comparing the output results, ensuring the reliability of the architecture when a single sensor fails. (2) The fault handling procedure analyzes and determines the comparison results in the safety layer. If the output results of the safety algorithm and the task layer are inconsistent, a fault code is reported. The corresponding fault code is mapped to the vehicle function degradation level through the vehicle diagnosis management module. After the control receives the corresponding function degradation, it enters the vehicle function degradation according to the fault degradation code and enters the minimum risk state of the autonomous driving vehicle.

[0023] This embodiment, while defining the above architecture, also includes overall design requirements and optional functions.

[0024] Task layer: In this architecture, only a few requirements are placed on the task layer, so that the task layer can be developed independently. The task layer represents a high-performance complex autonomous driving system. When the task layer fails, there is no guarantee that the autonomous driving vehicle will continue to perform its tasks. The mission capability of the autonomous driving vehicle is completely dependent on the task layer. Therefore, the task layer is tested based on SIL (soft wear in loop) / HIL (hardware in loop) / full vehicle testing to confirm the robustness of the output results of the autonomous driving algorithm by detecting the artificially designed target state, so that it can operate with a reasonable confidence level under common conditions.

[0025] Task layer - Design requirement 1: Send the status of the task layer perception module, prediction module, positioning module, planning module, and control module to the security layer through "heartbeat" (counter method), and send the output of each module to the security layer. The required specific interface (security algorithm of the relevant module in the security layer) depends on the components of the security layer. This part of the content is easy to implement through the publish-subscribe access model of the prior art, where the publisher is the task layer of this embodiment and the subscriber is the security layer of this embodiment.

[0026] Mission Layer - Optional Design Requirement 1: Leverage optimization cues from the safety layer (the safety layer performs a low-latency obstacle detection algorithm so it can feed this output to the mission layer’s object detection, identifying areas near the autonomous vehicle where obstacles exist and the collision risk posed by such obstacles).

[0027] Task layer - optional design requirement 2: Use the faults detected by the safety layer to correct the behavior of the task layer (when the safety layer detects the output and status of the task layer in real time, when the status is abnormal and the rationality check of the output is abnormal, the fault state is characterized by a fault code, and different degradation behaviors are taken by the autonomous driving vehicle based on different fault states).

[0028] Task Layer - Optional Design Requirement 3: Provide a functional interface that the safety layer can use to request specific corrective actions.

[0029] Security layer: The security algorithm of the security layer must be verifiable and logically analyzable.

[0030] (1) Security algorithm: The security algorithm needs to provide specific task functions under specific constraints.

[0031] Safety algorithm-design requirement 1: Function list, including all interfaces of required inputs and main outputs.

[0032] Security Algorithm-Design Requirement 2: List of specific functions provided by the algorithm; Safety Algorithm - Design Requirement 3: A list of specific constraints under which a specific function is valid.

[0033] The safety algorithm compares the output results of the task layer with the basic results of the safety layer to determine whether the outputs are consistent and detect whether the corresponding missed detections are safety missed detections. When they are inconsistent, the corresponding fault trigger conditions are reported and fault handling is completed through the corresponding fault trigger conditions; wherein, the function list and the constraint list are included, the function list includes all the input and output interfaces required for the autonomous driving vehicle, and the constraint list constrains some or all of the functions in the function list.

[0034] (2) Fault Handler: For low-latency obstacle detection algorithms, the fault handler must determine whether the safety layer and task layer outputs are valid and proactively correct them (by downgrading and correcting vehicle behavior) when a fault is detected. Fault handling is responsible for executing the final architecture output only if no fault is detected in other layers.

[0035] Fault Handlers - Design Requirement 1: Ability to monitor compliance with safety layer constraints. In case of constraint violation, take corrective action to restore compliance with constraints or handle loss of functionality.

[0036] Fault Handling Procedure - Design Requirement 2: Perform fault monitoring for the functions of each module in the safety layer, such as monitoring the status of each node, comparing tasks and safety outputs of the same function; Figure 3 As shown, the state output of the detection target of visual perception and laser perception is analyzed through a deep clustering algorithm to determine whether the state of the target (speed / position, etc.) is within a reasonable threshold and perform a safety check.

[0037] It is used to provide the detected obstacle output to the target detection of the task layer and transmit it to the task layer as an optimization hint. The task layer uses the optimization hint of the safety layer to identify the areas where obstacles exist near the autonomous driving vehicle and the collision risks caused by such obstacles. The task layer uses the faults detected by the safety layer to correct the behavior of the autonomous driving vehicle.

[0038] Fault Handler - Design Requirement 3: For each detectable fault, logic to determine the severity of the fault.

[0039] like Figure 3 As shown, the application of the above architecture is illustrated by taking the perception target detection task as an example.

[0040] The mission layer is an autonomous driving system that is able to accomplish the mission of an autonomous vehicle, which is to drive from one point to another while maintaining safety in most common scenarios.

[0041] Mission Layer - Design Requirement 1: The only requirement is that the mission layer exposes its perception information to the security layer, which is achieved through subscription outputs in the case of a subscribe-publish model (such as Apollo CyberRT).

[0042] Mission Layer - Optional Design Requirement 1: Since the safety layer performs a low-latency obstacle detection algorithm, it can provide this output to the object detection of the mission layer, identifying areas near the autonomous vehicle where obstacles exist and the collision risk posed by such obstacles.

[0043] Task layer - optional design requirement 2: For the object detection task, any FN information detected in the task layer output in the security layer (detected by the security layer, not detected by the task layer) can be used by the task layer object detector. It can prioritize the FN area and perform additional calculations or use higher resolution inputs in this area. Among them, FN is the perceived false negative measurement indicator, which is used to describe the situation where the classifier mistakenly predicts a positive sample as a negative sample, that is, a false negative.

[0044] Mission Layer - Optional Design Requirement 3: When the safety layer constraints are violated but no serious faults are detected, the autonomous vehicle may enter a degraded state. In the absence of actual FN errors, emergency braking is an unnecessary extreme reaction. At this time, the safety layer can change the mission of the autonomous vehicle and request a safe stop, such as parking on the side of the road.

[0045] The algorithms used in the safety layer provide specific functionality when the required constraints are met. To address errors in obstacle presence detection, this embodiment uses a deep clustering algorithm, which is a geometric algorithm based on LiDAR.

[0046] Safety Algorithm-Design Requirement 1: The algorithm is able to use the LiDAR range image as input to detect the presence of obstacles and provide a bounding box for the obstacles. This output can be used by the task layer to improve the target detection performance.

[0047] Safety Algorithm-Design Requirement 2: Using the parameters of the LiDAR sensor in the autonomous driving simulator LGSV, the following detectability model is derived. Where y is the obstacle height, x is the distance from the LiDAR sensor to the obstacle, and the obstacle is always detected when the following inequality is met: y ≥ 0.037x − 0.034. When this constraint is not met, the object can still be detected, but it is no longer 100% detectable.

[0048] Security Algorithm-Design Requirement 3: The deep clustering algorithm is effective under three constraints: Obstacles must meet a minimum width requirement, which is the horizontal separation between the LiDAR beams.

[0049] The distance from the obstacle to the autonomous vehicle must be greater than the first lidar echo from the ground.

[0050] The LiDAR beam must return from the first obstacle it encounters, which means no returns are lost due to energy dissipation and no returns appear to be closer than the actual obstacle.

[0051] Fault Handling Procedure - Design Requirement 1: As mentioned above, the main dynamic constraint for target detection that needs to be monitored is the validity of the LiDAR echo.

[0052] Constraints may be violated when particulate obstacles in the air (e.g., water droplets, dust) reflect and dissipate the LiDAR beam, causing the echo to return early or not at all. Therefore, the visibility of the LiDAR under current weather conditions requires special testing.

[0053] In this embodiment, the speed of the vehicle is limited to ensure that the obstacle detection range covers the safe stopping distance of the vehicle. The maximum safe speed of the autonomous driving vehicle in the current weather is expressed as follows: ; in, is the maximum safe speed of the vehicle in the current weather. is the maximum detection range of LiDAR under optimal weather conditions, and is the attenuation coefficient of the lidar under optimal weather conditions and current weather conditions (the attenuation coefficient is 0:1 in optimal weather, 1 in haze, 10 in fog, etc.), is the maximum deceleration of the vehicle.

[0054] Fault Handling Procedure - Design Requirement 2: Due to the excellent performance of the deep clustering algorithm under constraints, it is only necessary to evaluate whether the task layer fully detects all obstacles detected by the safety layer safety algorithm. If no / more obstacles are detected, an FN / FP fault is detected. Among them, FP is a measure of false positive, which is used to describe the situation where the classifier mistakenly predicts a negative sample as a positive sample, that is, a false detection or false alarm.

[0055] Fault handling procedure - Design requirement 3: In order to determine the appropriate response to an obstacle, the risk level of the obstacle must first be determined, that is, whether the obstacle poses a risk of collision with the autonomous vehicle. A collision risk physical model can be used, that is, if the obstacle's presence area overlaps with the autonomous vehicle's presence area in the future, the obstacle trench collision risk is determined.

[0056] In this embodiment, the RSS model is used as the bottom-line collision avoidance strategy, and the expression is as follows: ; in, is the minimum longitudinal distance, is the current speed of the preceding vehicle, is the reaction time, is the maximum longitudinal acceleration of the vehicle, is the minimum deceleration of the vehicle, is the current speed of the vehicle.

[0057] This embodiment ensures that the above architecture can safely control the autonomous driving vehicle while achieving its functions through security monitoring and fault handling at the corresponding task layer. This not only solves the expensiveness of the hardware redundancy overhead of the complex autonomous driving system, but also fundamentally avoids the safety risks caused by common cause failures, and ensures that performance and safety performance are distinguished.

[0058] Through the above content, the technical solution of the present invention is disclosed. Compared with the prior art, the present invention has the following advantages: 1. The present invention improves the safety and reliability of autonomous driving vehicles through the cooperation of the task layer and the safety layer; 2. The safety layer components of the present invention are designed to only complete the tasks required for the autonomous vehicle, which helps to reduce the size of the safety layer software and simplify software verification; 3. The present invention limits the functions in the security layer through algorithms rather than limiting the redundant architecture. With the expansion of the security algorithm, the constraints are reduced while maintaining the deterministic guarantee for false alarms and eliminating the dependence on the attributes of obstacles. This part can be integrated into the redundant architecture without adding hardware and has a low cost. 4. The security layer of the present invention simplifies the task layer testing work and cost. Unlike expensive task layer redundancy, it can make a single task layer safe and protect the task layer through a highly redundant security layer running on a low-cost embedded platform.

[0059] The above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Other modifications or equivalent substitutions made to the technical solution of the present invention by ordinary technicians in this field should be included in the scope of the claims of the present invention as long as they do not depart from the spirit and scope of the technical solution of the present invention.

Claims

1. A safety redundant architecture for an autonomous driving vehicle, characterized in that: The architecture includes a task layer and a security layer, wherein the task layer and the security layer receive inputs respectively and output through the security layer; The task layer includes an autonomous driving algorithm, which completes the tasks required by the autonomous driving vehicle based on input information. The required tasks include one or more of perception, prediction, planning, and control. In the process of completing the required tasks, the task layer discloses its internal state and output results to the safety layer, and adjusts the behavior of the task layer through corrective and optimization measures based on the safety judgments and optimization prompts output by the safety layer. The safety layer includes safety algorithms and fault handling procedures, which are used for safety monitoring and fault handling of the task layer; The safety algorithm includes calculating according to the input information and storing it as a basic result, wherein the basic result includes the result of the safety calculation of the task required by the vehicle, receiving the output result of the task layer and comparing it with the basic result; and also includes safety verification, and judging whether the internal state and output result of the task required by the task layer are reasonable based on the comparison; The fault handling procedure analyzes and determines through the comparison results of the safety algorithm. When the output results of each task in the task layer are consistent with the basic results stored in the safety layer, the output of the architecture is executed. When the output results of each task in the task layer are inconsistent with the basic results stored in the safety layer, the severity of the fault is determined and a fault code is reported. The autonomous driving vehicle downgrades the vehicle function to the minimum risk state based on the fault code, and transmits the optimization measure trigger flag and / or the corrective measure flag to the task layer.

2. The safety redundant architecture of an autonomous driving vehicle according to claim 1, characterized in that: The task layer includes the autonomous driving algorithms of the perception module, prediction module, positioning module, planning module, and control module, which have been tested based on SIL / HIL / full vehicle; According to the task requirements of the autonomous driving vehicle, the output results of each module are calculated through the autonomous driving algorithm of the task layer. At the same time, the safety layer stores the calculation results of the same input and compares them with the outputs of each module of the autonomous driving task layer. According to the mission requirements of the autonomous vehicle, the basic results are calculated and stored through the security algorithm of the security layer.

3. The safety redundant architecture of an autonomous driving vehicle according to claim 1, characterized in that: The task layer uses the optimization prompts of the safety layer to identify areas near the autonomous driving vehicle where obstacles exist and the collision risks caused by the obstacles; The task layer uses the faults detected by the safety layer to correct the behavior of the autonomous vehicle; The task layer provides a functional interface used by the safety layer to request corrective actions.

4. The safety redundant architecture of an autonomous driving vehicle according to claim 2, characterized in that: The safety algorithm of the safety layer is a deep clustering algorithm, which is verifiable and can be logically analyzed. It meets the verification requirements of the input information of the task layer calculation results, provides corresponding task functions under the corresponding constraints of the autonomous driving vehicle, and ensures the reliability of the architecture of the autonomous driving vehicle when a single sensor fails.

5. The safety redundant architecture of an autonomous driving vehicle according to claim 4, characterized in that: The safety algorithm of the safety layer compares the output result of the task layer with the basic result of the safety layer to determine whether the output is consistent; wherein, it includes a function list and a constraint list, wherein the function list includes all interfaces required for input and output of the autonomous driving vehicle, and the constraint list constrains part or all of the functions in the function list.

6. The safety redundant architecture of an autonomous driving vehicle according to claim 4, characterized in that: The safety algorithm of the safety layer is used to verify the accuracy and robustness of the autonomous driving algorithm in the task layer, to judge the internal state and output results of each module in the task layer, and to determine whether the state of the target is within the set threshold for safety verification. The state of the target includes speed and position.

7. The safety redundant architecture of an autonomous driving vehicle according to claim 1, characterized in that: The fault handling procedure described is a low-latency obstacle detection algorithm that provides the detected obstacle output to the target detection at the task layer and is transmitted to the task layer as an optimization hint.

8. The safety redundant architecture of an autonomous driving vehicle according to claim 1, characterized in that: The fault handling program is used to perform fault detection on each task function in the safety layer, compare the output results of the same function in the task layer, and perform safety output.

9. The safety redundant architecture of an autonomous driving vehicle according to claim 8, characterized in that: The fault handling procedure is used to determine the severity of each detected fault.

10. The safety redundant architecture of an autonomous driving vehicle according to claim 5, characterized in that: The fault handling procedure is used to monitor the compliance of the task layer with the output constraints of the safety layer, and take corrective measures to restore compliance with the constraints or handle functional losses in response to violations of the constraints.

Images