A safety-redundant architecture for autonomous vehicles

Abstract

The application discloses a safety redundancy architecture of an automatic driving vehicle, comprising a task layer and a safety layer, the task layer and the safety layer respectively receive input, and output through the safety layer, the task layer and the safety layer can guarantee the safety of the automatic driving vehicle while realizing the required task, and improve the safety and reliability of the automatic driving vehicle; in the safety layer, the function is limited through an algorithm, rather than the limitation of the redundancy architecture, with the expansion of the safety algorithm, the constraint is reduced, while the certainty guarantee for false positives is maintained, the dependence on the attribute of the obstacle is eliminated, and this part can be integrated into the redundancy architecture, without increasing the hardware, and the cost is low; the safety layer simplifies the task layer test work and cost, unlike the expensive task layer redundancy, it can make a single task layer safe, and protect the task layer through a highly redundant safety layer running on a low-cost embedded platform.

Description

Technical Field

[0001] This invention belongs to the field of autonomous driving safety technology, specifically relating to a safety redundancy architecture for autonomous vehicles. Background Technology

[0002] Autonomous vehicle prototypes have seen rapid development in recent years, with their numbers constantly increasing and leading innovation in the future of transportation. However, as autonomous driving technology continues to evolve, achieving collision-free, safe autonomous vehicles still faces a series of technical challenges, and the technological path is not entirely clear.

[0003] Although the concept of autonomous driving systems was proposed decades ago, their practical application has been constrained by various factors. One of the most prominent issues is system safety, especially in complex and ever-changing traffic environments, where ensuring collision-free driving of autonomous vehicles has become a significant challenge. While fully autonomous driving systems are not yet on the road, even the application of driver assistance systems has resulted in numerous accidents. To address the safety issues of autonomous driving systems, one of the most common methods currently used in the industry is architectural redundancy. Architectural redundancy refers to introducing multiple relatively independent components with the same or similar functions into the system design to improve the system's reliability and fault tolerance. In autonomous vehicles, this means employing multiple sensors, controllers, and actuators and / or corresponding algorithms, and comprehensively analyzing them to ensure that the system can still reliably perform its tasks even if one component fails or is interfered with.

[0004] The advantage of architectural redundancy lies in its ability to effectively reduce the impact of single-point failures on the entire system, thereby improving the safety of autonomous vehicles. For example, when a sensor fails due to adverse environmental conditions, other sensors can compensate for the missing information, ensuring the system's accurate perception of the surrounding environment. This redundancy design makes the system more robust and adaptable to various complex driving scenarios, including severe weather, temporary road construction, and other uncertainties. However, current architectural redundancy methods still face some challenges, such as: 1. The overhead of hardware and software redundancy scales with the size of the entire system, making it costly for complex autonomous driving systems; 2. Simple redundancy cannot solve the problem of shared faults among all replicas. As long as all replicas of the system use the same algorithm or implementation, they will suffer from the same algorithmic errors, leading to system failure; 3. The responsibilities of tasks (navigation) and safety (collision avoidance) in current safety architectures are distributed throughout the system, resulting in unreasonable system optimization goals and complex safety issues. Summary of the Invention

[0005] To address the aforementioned problems, the main objective of this invention is to design a safety redundancy architecture for autonomous vehicles, thereby resolving technical issues such as the common failure of algorithms within the same architecture and the high redundancy cost of complex systems.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] A safety redundancy architecture for an autonomous vehicle, the architecture comprising a task layer and a safety layer, wherein the task layer and the safety layer respectively receive input and output through the safety layer;

[0008] The task layer, including the autonomous driving algorithm, completes the tasks required by the autonomous vehicle based on the input information. The required tasks include one or more of perception, prediction, planning, and control. In the process of completing the required tasks, the task layer discloses its internal state and output results to the safety layer, and adjusts the behavior of the task layer through corrective and optimization measures based on the safety judgments and optimization prompts output by the safety layer.

[0009] The security layer, including security algorithms and fault handling procedures, is used for security monitoring and fault handling of the task layer.

[0010] The security algorithm includes calculating and storing basic results based on input information. The basic results include the results of security calculations for the tasks required by the vehicle. The algorithm receives the output results of the task layer and compares them with the basic results. The algorithm also includes security verification, which judges whether the internal state and output results of the tasks required by the task layer are reasonable based on the comparison.

[0011] The fault handling procedure analyzes and judges the results of the comparison of the safety algorithm. When the output results of each task in the task layer are consistent with the basic results stored in the safety layer, the output of the architecture is executed. When the output results of each task in the task layer are inconsistent with the basic results stored in the safety layer, the severity of the fault is determined and a fault code is reported. The autonomous vehicle degrades its overall vehicle function to the minimum risk state based on the fault code and transmits the optimization measure trigger flag and / or corrective measure flag to the task layer.

[0012] As a further description of the present invention, the task layer includes an autonomous driving algorithm comprising a perception module, a prediction module, a localization module, a planning module, and a control module, which has undergone testing based on SIL / HIL / vehicle.

[0013] Based on the task requirements of autonomous vehicles, the output results of each module are calculated through the autonomous driving algorithm of the task layer. At the same time, the safety layer stores the calculation results of the same input and compares them with the output of each module of the autonomous driving task layer.

[0014] Based on the mission requirements of autonomous vehicles, the basic results are calculated and stored through the safety algorithm of the safety layer.

[0015] As a further description of the present invention, the task layer utilizes the optimized prompts of the safety layer to identify areas near the autonomous vehicle where there are obstacles and the collision risk caused by these obstacles.

[0016] The task layer uses faults detected by the security layer to correct the behavior of the autonomous vehicle;

[0017] The task layer provides functional interfaces for the security layer to request corrective actions.

[0018] As a further description of the present invention, the security algorithm of the security layer is a deep clustering algorithm. This algorithm is verifiable and logically analyzable, meets the verification requirements of the input information of the task layer calculation results, provides the corresponding task functions under the corresponding constraints of the autonomous vehicle, and ensures the reliability of the architecture of the autonomous vehicle when a single sensor fails.

[0019] As a further description of the present invention, the security algorithm of the security layer compares the output of the task layer with the basic result of the security layer to determine whether their outputs are consistent; wherein, it includes a function list and a constraint list, the function list includes all interfaces required for input and output by the autonomous vehicle, and the constraint list constrains some or all of the functions in the function list.

[0020] As a further description of the present invention, the safety algorithm of the safety layer is used to verify the accuracy and robustness of the autonomous driving algorithm in the task layer, to judge the internal state and output results of each module in the task layer, and to determine whether the state of the target is within the set threshold for safety verification. The state of the target includes speed and position.

[0021] As a further description of the present invention, the fault handling program is a low-latency obstacle detection algorithm, which is used to provide the detected obstacle output to the target detection of the task layer, and transmit it to the task layer as an optimization prompt.

[0022] As a further description of the present invention, the fault handling program is used to perform fault detection on each task function in the security layer, compare the output results of the same function in the task layer, and perform a safe output.

[0023] As a further description of the present invention, the fault handling procedure is used to determine the severity of each detected fault.

[0024] As a further description of the present invention, the fault handling procedure is used to monitor the compliance of the task layer with the output constraints of the security layer, and to take corrective measures to restore compliance with the constraints or to restore the processing function in the event of a violation of the constraints.

[0025] Compared with the prior art, the technical advantages of the present invention are as follows:

[0026] This invention provides a safety redundancy architecture for autonomous vehicles, comprising a task layer and a safety layer. The task layer and safety layer receive inputs and output through the safety layer. By combining the task layer and safety layer, the required tasks can be accomplished while ensuring the safety of the autonomous vehicle, thus improving its safety and reliability. The safety layer components are designed to perform only the tasks required by the autonomous vehicle, helping to reduce the size of the safety layer software and simplify software verification. Functional limitations are imposed on the safety layer through algorithms, rather than on the redundant architecture. As the safety algorithm expands, constraints are reduced while maintaining deterministic guarantees against false alarms and eliminating dependence on obstacle attributes. This part can be integrated into the redundant architecture without adding hardware, resulting in low cost. The safety layer simplifies the testing work and reduces costs of the task layer. Unlike expensive task layer redundancy, it can make a single task layer safe and protect the task layer through a highly redundant safety layer running on a low-cost embedded platform. Attached Figure Description

[0027] Figure 1 This is a schematic diagram of the architecture of the present invention;

[0028] Figure 2 This is a schematic diagram of the architecture and workflow of the present invention;

[0029] Figure 3 This is a schematic diagram illustrating the cooperation of the architecture of the present invention when sensing the target state;

[0030] Figure 4 This is a schematic diagram illustrating the working principle of the security layer architecture of the present invention. Detailed Implementation

[0031] The present invention will now be described in detail with reference to the accompanying drawings:

[0032] In one embodiment of the present invention, a safety redundancy architecture for an autonomous vehicle is disclosed, with reference to... Figure 1-4 As shown, the architecture includes a task layer and a security layer. The task layer and the security layer receive inputs, including the results of the target detected by visual perception and lidar perception, as well as the environmental status. The results are output through the security layer. Through the task layer and the security layer, the required tasks can be achieved while ensuring the safety of the autonomous vehicle.

[0033] The task layer, including the autonomous driving algorithm, completes the tasks required by the autonomous vehicle based on input information, including perception input information and the vehicle's own positioning / speed / heading, etc. The required tasks include one or more of perception, prediction, planning, and control. In the process of completing the required tasks, the task layer discloses its internal state and output results to the safety layer, and adjusts the behavior of the task layer through corrective and optimization measures based on the safety judgment and optimization prompts output by the safety layer (the task layer receives optimization prompts and / or corrective measures transmitted by the safety layer and adjusts the behavior of the task layer in the form of faults).

[0034] The safety layer includes safety algorithms and fault handling procedures for monitoring and handling safety issues at the task layer. The safety algorithms include calculating and storing basic results based on input information. These basic results include the results of safety calculations for the vehicle's required tasks (including necessary calculation results for each task). The algorithms receive the output results from the task layer and compare them with the basic results. They also include safety verification, which judges the reasonableness of the internal state and output results of the tasks required by the task layer based on the comparison. The fault handling procedures analyze and determine the fault severity based on the comparison results of the safety algorithms. When the output results of each task at the task layer are consistent with the basic results stored in the safety layer, the output of the architecture is executed. When the output results of each task at the task layer are inconsistent with the basic results stored in the safety layer, the severity of the fault is determined and a fault code is reported. The autonomous vehicle degrades its overall vehicle function to a minimum risk state based on the fault code and transmits optimization trigger flags and / or corrective action flags to the task layer.

[0035] Specifically, this embodiment provides a detailed analysis of the aforementioned task layer and security layer, as follows:

[0036] Task Layer: The task layer comprises autonomous driving algorithms including perception, prediction, localization, planning, and control modules. It is responsible for completing all tasks required by the autonomous vehicle. Based on the task requirements of the autonomous vehicle, the task layer's autonomous driving algorithms calculate the output results of each module. Simultaneously, the safety layer stores the calculation results for the same input and compares them with the outputs of each module in the task layer. Based on the task requirements of the autonomous vehicle, the safety layer's safety algorithms calculate and store the basic results. Taking perception as an example, the perceived target state result calculated by the safety layer's safety algorithms is stored in the safety layer, while the perceived target state result calculated by the task layer is also sent to the safety layer for storage via middleware.

[0037] Safety Layer: The safety layer is responsible for providing specific safety assurance. The safety layer must meet the verification requirements of safety-critical software, namely, logical analyzability and full verifiability. The safety layer does not need to be able to complete the tasks of autonomous vehicles, but only needs to be able to reach a safe state. Functionally, it is divided into two parts: (1) Safety algorithm, which is a deep clustering algorithm. The results of clustering the target states perceived by the safety layer and the task layer are compared. The target state results perceived by the safety clustering algorithm are used as the basic results and compared with the output structure of the task layer. Reasonableness verification is performed (the state output of the detected target by visual perception and laser perception determines whether the state (speed / position, etc.) of the target is within a reasonable threshold. Safety verification is performed. If it is within the set threshold, the verification is successful. If it is outside the set threshold, the verification fails). The safety verification mainly checks the accuracy and robustness of the autonomous driving algorithm of the task layer by comparing the output results, and ensures the reliability of the architecture when a single sensor fails. (2) Fault handling procedure: By analyzing and judging the comparison results in the safety layer, if the output results of the safety algorithm and the task layer are inconsistent, a fault code is reported. Through the vehicle diagnostic management module, the corresponding fault code is mapped to the vehicle function degradation level. After receiving the corresponding function degradation, the control enters the vehicle function degradation according to the fault degradation code and enters the minimum risk state of the autonomous vehicle.

[0038] This embodiment, while defining the above architecture, also includes overall design requirements and optional functions.

[0039] Task Layer: In this architecture, only a few requirements are imposed on the task layer, allowing it to be developed independently. The task layer represents a high-performance, complex autonomous driving system. When the task layer fails, the autonomous vehicle cannot be guaranteed to continue performing its tasks; the vehicle's mission capabilities depend entirely on the task layer. Therefore, the task layer undergoes SIL (software in loop) / HIL (hardware in loop) / vehicle testing. By detecting predetermined target states designed by the user, the robustness of the autonomous driving algorithm's output is confirmed, ensuring it can operate with reasonable confidence under common conditions.

[0040] Task Layer - Design Requirement 1: The status of the task layer's perception module, prediction module, localization module, planning module, and control module is sent to the security layer via a "heartbeat" (counter mechanism), and the outputs of each module are also sent to the security layer. The specific interfaces required (the security algorithms of the relevant modules in the security layer) depend on the components of the security layer. This part can be easily implemented using the existing publish-subscribe access model, where the publisher is the task layer in this embodiment, and the subscriber is the security layer in this embodiment.

[0041] Task Layer - Optional Design Requirement 1: Utilize the optimization hints of the safety layer (the safety layer executes a low-latency obstacle detection algorithm, so it can provide this output to the task layer for object detection, identifying areas near the autonomous vehicle where there are obstacles and the collision risks caused by such obstacles).

[0042] Task Layer - Optional Design Requirement 2: Use faults detected by the safety layer to correct the behavior of the task layer (when the safety layer detects the output and state of the task layer in real time, when the state is abnormal and the rationality verification of the output is abnormal, the fault state is characterized by fault codes, and different degradation behaviors are taken by the autonomous vehicle based on different fault states).

[0043] Task Layer - Optional Design Requirement 3: Provide a functional interface for the security layer to request specific corrective actions.

[0044] Security layer: The security algorithm of the security layer must be verifiable and logically analyzable.

[0045] (1) Safe algorithm: Safe algorithm needs to provide specific task functions under specific constraints.

[0046] Security Algorithm - Design Requirement 1: Function list, including all interfaces for required inputs and main outputs.

[0047] Security Algorithm - Design Requirement 2: List of specific functions provided by the algorithm;

[0048] Security Algorithm - Design Requirement 3: A list of specific constraints that are effective for specific functions.

[0049] The safety algorithm compares the output of the task layer with the basic results of the safety layer to determine whether the outputs are consistent and detects whether the corresponding missed detections are safety missed detections. When there is a discrepancy, the corresponding fault trigger condition is reported, and the fault handling is completed according to the corresponding fault trigger condition. It includes a function list and a constraint list. The function list includes all the input and output interfaces required by the autonomous vehicle, and the constraint list constrains some or all of the functions in the function list.

[0050] (2) Fault handling procedure: As a low-latency obstacle detection algorithm, the fault handling procedure must determine whether the output of the safety layer and the task layer is valid, and actively correct it when a fault is detected (by degrading the vehicle behavior). Only when no fault is detected in other layers will the fault handling procedure be responsible for executing the final architecture output.

[0051] Fault Handling Procedure - Design Requirement 1: Ability to monitor compliance with safety layer constraints. In the event of a constraint violation, take corrective action to restore compliance or handle functional loss.

[0052] Fault Handling Procedure - Design Requirement 2: Perform fault monitoring for the function of each module in the security layer, such as monitoring the status of each node and comparing tasks with the same function with security outputs; for example... Figure 3 As shown, the state output of the detected target by visual perception and laser perception is obtained through deep clustering algorithm, and it is determined whether the state (velocity / position, etc.) of the target is within a reasonable threshold for safety verification.

[0053] The detection of obstacles is output to the target detection of the task layer and transmitted to the task layer as an optimization prompt. The task layer uses the optimization prompts from the safety layer to identify the area near the autonomous vehicle where there are obstacles and the collision risk caused by these obstacles. The task layer uses the faults detected by the safety layer to correct the behavior of the autonomous vehicle.

[0054] Fault Handling Procedure - Design Requirement 3: For each detectable fault, logic to determine the severity of the fault.

[0055] like Figure 3 As shown, the application of the above architecture is illustrated using the object detection task as an example.

[0056] The task layer is an autonomous driving system that can perform the tasks of an autonomous vehicle, namely driving from one point to another while maintaining safety in most common scenarios.

[0057] Task Layer - Design Requirement 1: The only requirement is that the task layer exposes its perceived information to the security layer, which is achieved by subscribing to the output in the case of a publish-subscribe model (such as Apollo CyberRT).

[0058] Task Layer - Optional Design Requirement 1: Since the safety layer executes a low-latency obstacle detection algorithm, it can provide this output to the task layer for object detection, identifying areas near the autonomous vehicle where obstacles exist and the collision risks caused by such obstacles.

[0059] Task Layer - Optional Design Requirement 2: For object detection tasks, any false negatives (FNs) detected in the task layer output within the safety layer (detected by the safety layer but not by the task layer) can be used by the task layer object detector. It can prioritize regions with FNs, dedicating additional computation to them or using higher-resolution input from those regions. Here, FN stands for false negative, a perceptual metric used to describe situations where the classifier incorrectly predicts a positive sample as a negative sample, i.e., a missed detection.

[0060] Task Layer - Optional Design Requirement 3: When safety layer constraints are violated but no serious fault is detected, the autonomous vehicle may enter a degraded state. Emergency braking is an unnecessary extreme reaction in the absence of an actual fault (FN). In this case, the safety layer can change the autonomous vehicle's task, requesting a safe stop, such as pulling over to the side of the road.

[0061] When the required constraints are met, the algorithms used in the safety layer provide specific functionality. To address errors in obstacle presence detection, this embodiment uses a deep clustering algorithm, a LiDAR-based geometric algorithm.

[0062] Safety Algorithm - Design Requirement 1: This algorithm should be able to detect the presence of obstacles using LiDAR distance images as input and provide bounding boxes for the obstacles. The output can be used by the task layer to improve object detection performance.

[0063] Safety Algorithm - Design Requirement 2: Using the parameters of the LiDAR sensor in the LGSV autonomous driving simulator, derive the following detectability model. Where y is the obstacle height and x is the distance from the LiDAR sensor to the obstacle, obstacles will always be detected when the following inequality is satisfied: y ≥ 0.037x − 0.034. When this constraint is not met, objects can still be detected, but 100% detection is no longer possible.

[0064] Security Algorithm - Design Requirement 3: The deep clustering algorithm is effective under three constraints:

[0065] Obstacles must meet a minimum width requirement, which is the horizontal spacing between LiDAR beams.

[0066] The distance from the obstacle to the autonomous vehicle must be greater than the first lidar echo on the ground.

[0067] The LiDAR beam must return from the first obstacle it encounters, meaning there will be no loss of echo due to energy dissipation, and no echoes that are closer than the actual obstacle.

[0068] Fault Handling Procedure - Design Requirement 1: As mentioned above, the main dynamic constraint for target detection that needs to be monitored is the effectiveness of LiDAR echoes.

[0069] When airborne particulate obstacles (such as water droplets and dust) reflect and dissipate the LiDAR beam, causing the echo to return prematurely or not at all, constraints may be violated. Therefore, the visibility of the LiDAR under current weather conditions requires specific testing.

[0070] In this embodiment, a speed limit is imposed on the vehicle to ensure that the obstacle detection range covers the vehicle's safe stopping distance. The maximum safe speed of the autonomous vehicle under the current weather conditions is expressed as follows:

[0071] ;

[0072] in, This is the maximum safe speed for vehicles under the current weather conditions. This represents the maximum detection range of LiDAR under optimal weather conditions. and It is the attenuation coefficient of the lidar under the best weather conditions and the current weather conditions (the attenuation coefficient is 0:1 under the best weather conditions, 1 for haze, 10 for fog, etc.). It is the vehicle's maximum deceleration.

[0073] Fault Handling Procedure - Design Requirement 2: Due to the excellent performance of deep clustering algorithms under constraints, it is only necessary to evaluate whether the task layer has sufficiently detected all obstacles detected by the safety layer's safety algorithm. If no obstacles are detected or more obstacles are detected, an FN / FP fault is detected. Here, FP is a measure of false positives, used to describe situations where the classifier incorrectly predicts a negative sample as a positive sample, i.e., a false detection or misreport.

[0074] Fault Handling Procedure - Design Requirement 3: To determine the appropriate response to obstacles, the risk level of the obstacle must first be determined, i.e., whether the obstacle poses a risk of collision with the autonomous vehicle. A collision risk physical model can be used, which determines the obstacle's collision risk if the area where the obstacle exists overlaps with the area where the autonomous vehicle exists within a certain future period.

[0075] In this embodiment, the RSS model is used as a fallback collision avoidance strategy, as shown in the following expression:

[0076] ;

[0077] in, Minimum vertical distance The current speed of the vehicle in front. For reaction time, The maximum longitudinal acceleration of the vehicle. For the minimum deceleration of the vehicle, This represents the vehicle's current speed.

[0078] In this embodiment, through safety monitoring and fault handling at the corresponding task layer, the architecture ensures that while fulfilling its functions, it can also safely control the autonomous vehicle. This solves the problem of the high cost of redundant hardware in complex autonomous driving systems and fundamentally avoids safety risks caused by common-cause failures, ensuring that performance and safety are distinct.

[0079] The above content discloses the technical solution of the present invention, which has the following advantages compared with the prior art:

[0080] 1. This invention improves the safety and reliability of autonomous vehicles through the cooperation of the task layer and the security layer;

[0081] 2. The safety layer component of the present invention is designed to perform only the tasks required by autonomous vehicles, which helps to reduce the size of the safety layer software and simplify software verification;

[0082] 3. This invention limits functionality through algorithms in the security layer, rather than limiting the redundant architecture. As the security algorithm is expanded, constraints are reduced while maintaining deterministic guarantees against false alarms and eliminating dependence on obstacle attributes. This part can be integrated into the redundant architecture without increasing hardware and at a low cost.

[0083] 4. The security layer of this invention simplifies the testing work and reduces costs of the task layer. Unlike expensive task layer redundancy, it can make a single task layer secure and protect the task layer through a highly redundant security layer running on a low-cost embedded platform.

[0084] The above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Any other modifications or equivalent substitutions made by those skilled in the art to the technical solutions of the present invention, as long as they do not depart from the spirit and scope of the technical solutions of the present invention, should be covered within the scope of the claims of the present invention.

Claims

1. A safety redundancy architecture for autonomous vehicles, characterized in that: The architecture includes a task layer and a security layer, wherein the task layer and the security layer respectively receive input and output through the security layer; The task layer, including the autonomous driving algorithm, completes the tasks required by the autonomous vehicle based on the input information. The required tasks include one or more of perception, prediction, planning, and control. In the process of completing the required tasks, the task layer discloses its internal state and output results to the safety layer, and adjusts the behavior of the task layer through corrective and optimization measures based on the safety judgments and optimization prompts output by the safety layer. The security layer, including security algorithms and fault handling procedures, is used for security monitoring and fault handling of the task layer. The security algorithm includes calculating and storing basic results based on input information. The basic results include the results of security calculations for the tasks required by the vehicle. The algorithm receives the output results of the task layer and compares them with the basic results. The algorithm also includes security verification, which judges whether the internal state and output results of the tasks required by the task layer are reasonable based on the comparison. The fault handling procedure analyzes and judges the results of the comparison of the safety algorithm. When the output results of each task in the task layer are consistent with the basic results stored in the safety layer, the output of the architecture is executed. When the output results of each task in the task layer are inconsistent with the basic results stored in the safety layer, the severity of the fault is determined and a fault code is reported. The autonomous vehicle degrades its overall vehicle function to the minimum risk state based on the fault code and transmits the optimization measure trigger flag and / or corrective measure flag to the task layer.

2. The safety redundancy architecture for an autonomous vehicle according to claim 1, characterized in that: The task layer includes an autonomous driving algorithm comprising a perception module, a prediction module, a localization module, a planning module, and a control module, which has undergone testing based on SIL / HIL / vehicle. Based on the task requirements of autonomous vehicles, the output results of each module are calculated through the autonomous driving algorithm of the task layer. At the same time, the safety layer stores the calculation results of the same input and compares them with the output of each module of the autonomous driving task layer. Based on the mission requirements of autonomous vehicles, the basic results are calculated and stored through the safety algorithm of the safety layer.

3. The safety redundancy architecture for an autonomous vehicle according to claim 1, characterized in that: The task layer uses the optimized prompts from the safety layer to identify areas near autonomous vehicles where obstacles exist and the collision risks caused by these obstacles. The task layer uses faults detected by the security layer to correct the behavior of the autonomous vehicle; The task layer provides functional interfaces for the security layer to request corrective actions.

4. The safety redundancy architecture for an autonomous vehicle according to claim 2, characterized in that: The security algorithm of the security layer is a deep clustering algorithm. This algorithm is verifiable and logically analyzable, meets the verification requirements of the input information of the task layer calculation results, provides the corresponding task functions under the corresponding constraints of the autonomous vehicle, and ensures the reliability of the architecture of the autonomous vehicle when a single sensor fails.

5. The safety redundancy architecture for an autonomous vehicle according to claim 4, characterized in that: The safety algorithm of the safety layer compares the output of the task layer with the basic results of the safety layer to determine whether their outputs are consistent. It includes a function list and a constraint list. The function list includes all the interfaces required for input and output by the autonomous vehicle, and the constraint list imposes constraints on some or all of the functions in the function list.

6. The safety redundancy architecture for an autonomous vehicle according to claim 4, characterized in that: The safety algorithm of the safety layer is used to verify the accuracy and robustness of the autonomous driving algorithm in the task layer. It judges the internal state and output results of each module in the task layer and determines whether the state of the target is within the set threshold for safety verification. The state of the target includes speed and position.

7. The safety redundancy architecture for an autonomous vehicle according to claim 1, characterized in that: The fault handling procedure is a low-latency obstacle detection algorithm, which is used to provide the detected obstacle output to the target detection of the task layer, and transmit it to the task layer as an optimization prompt.

8. The safety redundancy architecture for an autonomous vehicle according to claim 1, characterized in that: The aforementioned fault handling procedure is used to detect faults in each task function in the security layer, compare the output results of the same function in the task layer, and output a safe result.

9. The safety redundancy architecture for an autonomous vehicle according to claim 8, characterized in that: The aforementioned fault handling procedure is used to determine the severity of each detected fault.

10. The safety redundancy architecture for an autonomous vehicle according to claim 5, characterized in that: The fault handling procedure is used to monitor the task layer's compliance with the constraints output by the security layer, and to take corrective measures to restore compliance with the constraints or restore the processing function in the event of a violation of the constraints.

Images