Redundant system of multiple controllers

Abstract

The invention discloses a multi-controller redundant system, which adopts three sets of identical automatic driving controllers to work simultaneously regardless of primary and secondary, takes two groups of data with closest results as a correct judgment principle in each link, selects one of the two groups of data with the closest results to be jointly executed by people, and performs next-step operation according to the selected two groups of data. And in the final result, one of two closest groups of data is still selected as a common decision. During working, three sets of same automatic driving controllers work at the same time, the principle that minority obeys majority is always adopted for three groups of data, the rule penetrates through each link, errors are continuously eliminated, and the data in each step are unified on a correct road. The method has the beneficial effects that three sets of same automatic driving controllers are used for working at the same time, the difficulty of judging which part the fault comes when the automatic driving system breaks down is solved, the redundancy reliability is improved, and the method is also suitable for various devices such as airplanes and steamships.

Description

Technical Field

[0001] The invention relates to a redundant system of multiple controllers. Background Art

[0002] At present, autonomous driving cars have started to hit the road, but the technology is still immature. In particular, we cannot avoid the safety issues caused by failures in the autonomous driving system. Although redundant technology is used in the autonomous driving system to improve the reliability of the system, this redundant technology uses a double insurance solution with two sets of hardware. In this mode, if one set crashes, the other will quickly take over. However, failures do not always occur in this way. If the failure is simply a deviation in data calculation, both parties will think that it is the other party's fault and will not be able to complete the replacement correctly, thus posing a threat to the lives of passengers and passers-by. Summary of the invention

[0003] In order to overcome the shortcomings of the prior art, the present invention provides a redundant system of multiple controllers, in which three equal sets of automatic driving controllers work simultaneously and supervise each other, and the data of the two controllers with the closest calculation results are selected as the correct judgment principle to avoid difficulties in judging faults.

[0004] The technical solution adopted by the present invention to solve its technical problem is: three sets of identical automatic driving controllers are used without distinction of primary and secondary and work simultaneously, and each set of automatic driving controllers is connected to the other two sets of automatic driving controllers through data lines, and all driving decisions and driving control data are transmitted to each other. In each link, the two sets of data with the closest results are used as the correct judgment principle, and one of the two closest sets of data is selected for everyone to execute together, and the next step of calculation is performed accordingly, and the final result still selects one of the two closest sets of data as everyone's common decision, and sends a unified instruction to the steering wheel, throttle and brake electronic controllers of the car respectively. Among them, the three sets of automatic driving controllers can be connected to their own independent detectors through data lines, and through comparison, one of the two closest sets of data is selected for common use by the three parties. The three sets of automatic driving controllers can be connected to their own independent electronic controllers through data lines, and the electronic controllers are connected to the steering wheel, throttle and brake of the car to avoid failure of the electronic controller and inability to control the car. The power line of each autopilot controller is connected to two parallel switches. The two electronic controllers on the parallel switches are connected to and controlled by the other two autopilot controllers. When the calculated data of the faulty autopilot controller exceeds the allowable error range, the other two autopilot controllers will disconnect its power parallel switch through the electronic controller to avoid the faulty autopilot controller from issuing erroneous instructions. When working, three identical autopilot controllers work at the same time, regardless of priority. The principle of minority obeys majority is always adopted for the three sets of data, because usually only one of the three sets of hardware fails, so two sets of similar data can always be found. As long as one of the two sets of approximate data is arbitrarily selected, the pace of the three controllers can be unified. This rule runs through every link, constantly eliminating errors and unifying the data at every step on the right path. The steps are to first select three sets of detector data, and use the data to uniformly calculate the car path plan, and then select a plan for everyone to calculate the subsequent electronic controller data. Similarly, the three sets of electronic controller data are screened again to obtain a correct data for the three sets of automatic driving controllers to pass to the electronic controllers respectively, so that the three systems can move forward at the correct and unified pace to avoid conflicts. If an automatic driving controller fails, its calculation result differs from the results of the other two automatic driving controllers by more than the allowable range. The other two automatic driving controllers immediately turn off their two parallel power switches, forcing the faulty automatic driving controller to stop running, to avoid the faulty automatic driving controller sending erroneous electronic controller signals and interfering with the normal operation of the car.

[0005] The beneficial effect of the present invention is that by using three sets of identical automatic driving controllers to work simultaneously, the difficulty of judging which side the fault comes from when the automatic driving system fails is solved, the reliability of redundancy is improved, and it is also suitable for various equipment such as aircraft and ships. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] Figure 1 It is a schematic diagram of an embodiment of the present invention.

[0007] Figure 2 It is a schematic diagram of power control of an automatic driving controller according to an embodiment of the present invention.

[0008] In the figure, 1. automatic driving controller, 2. detector, 3. brake pedal, 4. steering wheel, 5. electronic controller, 6. parallel switch. DETAILED DESCRIPTION

[0009] The present invention is further described below in conjunction with the accompanying drawings and embodiments.

[0010] exist Figure 1 In the embodiment, three sets of automatic driving controllers (1) are connected to each other through data lines, and the three sets of automatic driving controllers (1) are connected to their own independent detectors (2) and electric controllers (5) through data lines. When working, the three sets of automatic driving controllers (1) work simultaneously, compare the environmental data obtained by their own detectors (2), obtain the two closest sets of data, select one of them as the unified external environmental data of the three sets of automatic driving controllers (1), and calculate the vehicle trajectory plan based on the data. Similarly, one of the two closest sets of data is selected from the three plans as the future running direction of the vehicle, and the specific operation data of the electric controller (5) is calculated respectively. The data of the three sets of electric controllers (5) still have two closest data selected, and are transmitted to the connected electric controllers (5) as the standard of unified pace, so as to synchronously control the brake pedal (3) and the steering wheel (4) at the same time. Even if one or two electric controllers fail, it will not affect the normal driving of the vehicle.

[0011] exist Figure 2 In the embodiment, each set of the automatic driving controller (1) is connected to the power supply through two parallel switches (6). If one of the automatic driving controllers (1) fails and its calculation result is different from the data of the other two automatic driving controllers (1) and exceeds the allowable error range, the other two automatic driving controllers (1) disconnect the parallel switches (6) on the faulty automatic driving controller (1) through the electronic controller (5) to prevent the faulty automatic driving controller (1) from issuing erroneous control instructions and interfering with the normal driving of the car. Even if the faulty automatic driving controller (1) insists that it is correct and turns off the parallel switches (6) on the other two sets of automatic driving controllers (1), it can only turn off one of the parallel switches and cannot completely turn off the power supply of the other.

Claims

1. A redundant system of multiple controllers, characterized in that: Three identical sets of autonomous driving controllers are used without priority and work simultaneously. Each set of autonomous driving controllers is connected to the other two sets of autonomous driving controllers through data cables, and all driving decision-making and driving control data are transmitted to each other. In each link, the two sets of data with the closest results are used as the correct judgment principle, and one of the two closest sets of data is selected for everyone to execute together, and the next step of calculation is carried out based on this. The final result still selects one of the two closest sets of data as the common decision of everyone, and sends unified instructions to the car's steering wheel, accelerator and brake electronic controllers respectively.

2. A redundant system of multiple controllers according to claim 1, characterized in that: The three sets of autonomous driving controllers can connect to their own independent detectors via data cables, and through comparison, select one of the two closest sets of data for common use by the three parties.

3. The redundant system of multiple controllers according to claim 1, characterized in that: The three sets of automatic driving controllers can be connected to their own independent electronic controllers via data cables, and the electronic controllers are connected to the car's steering wheel, accelerator, and brake to avoid failure of the electronic controller and the inability to control the car.

4. The redundant system of multiple controllers according to claim 1, characterized in that: The power cord of each autopilot controller is connected to two parallel switches. The two electronic controllers on the parallel switches are respectively connected to and controlled by the other two autopilot controllers. When the calculated data of the faulty autopilot controller exceeds the allowable error range, the other two autopilot controllers will disconnect its power parallel switch through the electronic controller to avoid the faulty autopilot controller from issuing erroneous instructions.

Images