Intelligent driving domain controller, intelligent driving system and vehicle

Abstract

The invention provides an intelligent driving domain controller, an intelligent driving system and a vehicle, the intelligent driving domain controller comprises an on-chip system and a micro-control unit, and the on-chip system is in communication connection with the micro-control unit; wherein the system-on-chip is used for monitoring the running state of the system-on-chip and the running state of the micro-control unit, and executing a first security policy when monitoring that the running state of the system-on-chip or the running state of the micro-control unit is invalid; and the micro-control unit is used for monitoring the running state of the system-on-chip and executing a second security policy when the running state of the system-on-chip is monitored to be invalid. The system-on-chip in the intelligent driving domain controller and the micro-control unit are set to monitor each other, so that under the condition that additional hardware equipment is not added, the state monitoring and strategy execution of the intelligent driving domain controller are realized, the scheme is simple to realize, and the redundancy purpose of functional safety requirements can be met at the same time.

Description

Technical Field

[0001] The present invention relates to the field of intelligent driving, and in particular to an intelligent driving domain controller, an intelligent driving system and a vehicle. Background Art

[0002] With the development of intelligent driving applications, the driving safety of intelligent driving is also the core concern of users. In order to meet the requirements of users for intelligent driving safety, functional safety requires intelligent driving to reach ASIL B and above. In order to meet the requirements of functional safety, the traditional implementation method mainly implements redundant backup of intelligent driving functions by deploying two intelligent driving domain controllers. This method is costly and complex, and requires the two intelligent driving controllers to achieve complete time synchronization, otherwise it is easy to cause control abnormalities and is difficult to implement. Summary of the invention

[0003] The main purpose of the present invention is to propose an intelligent driving domain controller, an intelligent driving system and a vehicle, aiming to solve the problem that the solution of using two intelligent driving domain controllers to achieve redundancy in the prior art is high in cost and difficult to implement.

[0004] To achieve the above object, the present invention provides an intelligent driving domain controller, which includes a system on chip and a micro control unit, and the system on chip is communicatively connected with the micro control unit; wherein:

[0005] The system on chip is used to monitor the operating status of itself and the micro control unit, and execute the first security strategy when it is detected that the operating status of itself or the micro control unit is failed;

[0006] The micro control unit is used to monitor the operating state of the system on chip, and execute the second security strategy when it is detected that the operating state of the system on chip is invalid.

[0007] Optionally, the system on chip includes a main state machine and a functional unit; the main state machine is communicatively connected with the functional unit and the micro control unit respectively; wherein:

[0008] The main state machine is used to monitor the operating status of the functional unit and the micro control unit, and execute the first safety strategy when it is detected that the operating status of the functional unit or the micro control unit is failed;

[0009] The micro control unit is used to monitor the running state of the main state machine, and execute the second safety strategy when it is detected that the running state of the main state machine is invalid.

[0010] Optionally, the intelligent driving domain controller is connected to a cockpit domain controller; the functional unit includes a human-computer interaction module, and the human-computer interaction module is respectively connected to the main state machine and the cockpit domain controller, wherein:

[0011] The main state machine is used to send abnormal indication information to the cockpit domain controller through the human-computer interaction module when it is detected that the operating state of the functional unit or the micro control unit fails and the operating state of the human-computer interaction module is normal, so that the cockpit domain controller displays the abnormal indication information.

[0012] Optionally, the intelligent driving domain controller is connected to a vehicle control actuator; the functional unit includes a first side data service module, and the first side data service module is respectively connected to the main state machine and the vehicle control actuator; wherein:

[0013] The first-side data service module is used to send the state signal of the vehicle control actuator to the main state machine;

[0014] The main state machine is used to determine the operating state of the first-side data service module according to the heartbeat signal of the first-side data service module and the state signal.

[0015] Optionally, the functional unit includes a perception and cognition module, and the perception and cognition module is communicatively connected with the main state machine; wherein:

[0016] The perception and recognition module is used to output a sensor abnormality diagnosis code to the main state machine according to the sensor state;

[0017] The main state machine is used to determine the operating state of the perception and cognition module according to the heartbeat signal of the perception and cognition module and the sensor abnormality diagnostic code.

[0018] Optionally, the functional unit includes a decision planning module, and the decision planning module is communicatively connected to the main state machine; wherein:

[0019] The decision-making planning module is used to perform self-diagnosis to obtain a trajectory planning state, and send the trajectory planning state to the main state machine;

[0020] The main state machine is used to determine the operating state of the decision-making planning module according to the heartbeat signal of the decision-making planning module and the trajectory planning state.

[0021] Optionally, the intelligent driving domain controller is connected to a vehicle control actuator; the micro control unit includes a redundant state machine, a second-side data service module and a control module; wherein the second-side data service module is respectively communicated with the main state machine and the redundant state machine, and the control module is respectively communicated with the main state machine and the vehicle control actuator; wherein:

[0022] The main state machine is used to send a failure control strategy to the redundant state machine when it is detected that the operating state of the functional unit or the micro control unit is failed;

[0023] The redundant state machine is used to generate a deceleration signal according to the failure control strategy and send the deceleration signal to the control module;

[0024] The control module is used to send a control signal to the vehicle control actuator according to the deceleration signal, so that the vehicle control actuator controls the vehicle to decelerate;

[0025] The redundant state machine is used to send a deceleration signal to the control module when it is detected that the operating state of the main state machine fails.

[0026] Optionally, the main state machine is also used to determine whether the intelligent driving mode is currently enabled when it is detected that the operating state of the functional unit or the micro control unit is failed; if the intelligent driving mode is enabled, the failure control strategy is sent to the redundant state machine.

[0027] In addition, to achieve the above-mentioned purpose, the present invention also provides an intelligent driving system, which includes the intelligent driving domain controller as described above.

[0028] Optionally, the intelligent driving system further includes a cockpit domain controller; the cockpit domain controller is communicatively connected to a human-computer interaction module in the system on chip; wherein:

[0029] The cockpit domain controller is used to monitor the operating status of the human-computer interaction module and perform an abnormal indication operation when it is detected that the operating status of the human-computer interaction module fails.

[0030] Optionally, the intelligent driving system further includes a vehicle control actuator, which is communicatively connected to a control module of the micro control unit; wherein:

[0031] The vehicle control actuator is used to receive the control signal sent by the control module, and monitor the operating state of the micro control unit according to the control signal, and stop executing the control signal when it is detected that the operating state of the micro control unit fails.

[0032] In addition, to achieve the above objectives, the present invention also provides a vehicle, which includes the intelligent driving system as described above.

[0033] The present invention proposes an intelligent driving domain controller, an intelligent driving system and a vehicle, wherein the intelligent driving domain controller includes a system on chip and a micro control unit, wherein the system on chip is in communication connection with the micro control unit; wherein: the system on chip is used to monitor the operating status of itself and the micro control unit, and execute a first safety policy when it is detected that the operating status of itself or the micro control unit is failed; the micro control unit is used to monitor the operating status of the system on chip, and execute a second safety policy when it is detected that the operating status of the system on chip is failed. By setting the system on chip and the micro control unit in the intelligent driving domain controller to monitor each other, the state monitoring and policy execution of the intelligent driving domain controller are realized without adding additional hardware devices. The solution is simple to implement and can meet the redundancy purpose of functional safety requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0035] Figure 1 This is a functional module diagram of an embodiment of an intelligent driving domain controller of the present invention;

[0036] Figure 2 This is a detailed module diagram of the system on a chip of an embodiment of the intelligent driving domain controller of the present invention;

[0037] Figure 3 This is a schematic diagram of the overall structure of an embodiment of an intelligent driving domain controller of the present invention;

[0038] Figure 4 A detailed diagram of a human-computer interaction module of an embodiment of an intelligent driving domain controller of the present invention;

[0039] Figure 5 A detailed diagram of the failure of a human-computer interaction module of an embodiment of an intelligent driving domain controller of the present invention;

[0040] Figure 6 A detailed diagram of a first-side data service module of an embodiment of an intelligent driving domain controller of the present invention;

[0041] Figure 7 A detailed diagram of the perception and cognition module of an embodiment of an intelligent driving domain controller of the present invention;

[0042] Figure 8 A detailed diagram of a decision-making planning module of an embodiment of an intelligent driving domain controller of the present invention;

[0043] Fig. 9 This is a detailed module diagram of a micro control unit of an embodiment of an intelligent driving domain controller of the present invention.

[0044] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings.

[0045] Description of Figure Numbers:

[0046]

[0047] DETAILED DESCRIPTION

[0048] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0049] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] It should be noted that all directional indications in the embodiments of the present invention (such as up, down, left, right, front, back, etc.) are only used to explain the relative position relationship, movement status, etc. between the components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly.

[0051] In addition, the descriptions of "first", "second", etc. in the present invention are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0052] The present invention provides an intelligent driving domain controller, which is applied to an intelligent driving system. Figure 1 , Figure 1This is a functional module diagram of an embodiment of an intelligent driving domain controller of the present invention. In this embodiment, the intelligent driving domain controller includes a system on chip SoC and a microcontroller unit MCU, and the system on chip SoC is communicatively connected with the microcontroller unit MCU; wherein:

[0053] The system on chip SoC is used to monitor the operating status of itself and the micro control unit MCU, and execute the first security strategy when it is detected that the operating status of itself or the micro control unit MCU is invalid;

[0054] The micro control unit MCU is used to monitor the running state of the system on chip SoC, and execute the second security policy when it is monitored that the running state of the system on chip SoC is invalid.

[0055] SoC (System on Chip) is mainly responsible for decision-making functions such as perception and global path planning in the intelligent driving domain controller;

[0056] MCU (Micro Controller Unit) is mainly responsible for vehicle control tasks in the intelligent driving domain controller.

[0057] Generally, the system on chip SoC generates a control strategy for the whole vehicle control by acquiring relevant signals reflecting the vehicle status and planning information in intelligent driving, and sends the control strategy to the microcontroller unit MCU. The microcontroller unit MCU sends control instructions to the vehicle's whole vehicle actuators based on the control strategy sent by the system on chip SoC to control the vehicle's driving status. It should be noted that the structure or control method of the system on chip SoC and the microcontroller unit MCU applied to the specific functions of intelligent driving can be set based on actual needs.

[0058] In this embodiment, the system on chip SoC is configured to monitor the operating status of the microcontroller unit MCU, and the microcontroller unit MCU monitors the operating status of the system on chip SoC, thereby forming a state in which the system on chip SoC and the microcontroller unit MCU monitor each other; thereby, when the operating status of the system on chip SoC or the microcontroller unit MCU fails, the security policy can be executed by at least the other party, thereby achieving the purpose of redundancy.

[0059] The first security policy is a security policy executed by the system on chip SoC; the second security policy is a security policy executed by the microcontroller unit MCU.

[0060] It is understandable that the types of hardware contained in the intelligent driving domain controller are different and play different roles in intelligent driving. Therefore, when the operating status of the corresponding hardware fails, the specific security policy to be executed can be determined based on the specific failed hardware, thereby avoiding safety issues caused by intelligent driving in the hardware failure state.

[0061] For example, when the operating state of the microcontroller unit MCU fails, since the microcontroller unit MCU plays the role of realizing the whole vehicle control in intelligent driving, therefore, in the case of its failure, the whole vehicle control cannot be realized or cannot be realized accurately; and when the whole vehicle control cannot be realized or cannot be realized accurately, intelligent driving is obviously dangerous, so the corresponding safety policy can be set as the system on chip SoC to remind the user to take over the vehicle and exit intelligent driving;

[0062] For another example, when the operating status of the system on chip SoC fails, since the role of the system on chip SoC in intelligent driving is to realize decision-making functions, when it fails, the specific decisions of intelligent driving cannot be realized or cannot be accurately planned; and when the specific decisions of intelligent driving cannot be realized or cannot be accurately planned, the microcontroller unit MCU cannot receive the control strategy or the received control strategy is wrong. Therefore, the corresponding safety strategy can be set for the microcontroller unit MCU to control the vehicle to gradually stop to exit intelligent driving.

[0063] It is understandable that when the operating states of the system on chip SoC and the microcontroller are both normal, the security policy is not executed.

[0064] This embodiment realizes status monitoring and policy execution of the intelligent driving domain controller without adding additional hardware devices by setting the system on chip SoC and the microcontroller unit MCU in the intelligent driving domain controller to monitor each other. The solution is simple to implement and can meet the redundancy requirements of functional safety.

[0065] Further, see Figure 2 , the system on chip SoC includes a main state machine 110 and a functional unit 120; the main state machine 110 is respectively connected to the functional unit 120 and the micro control unit MCU for communication; wherein:

[0066] The main state machine 110 is used to monitor the operating status of the functional unit 120 and the micro control unit MCU, and execute the first security strategy when it is detected that the operating status of the functional unit 120 or the micro control unit MCU is invalid;

[0067] The micro control unit MCU is used to monitor the running state of the main state machine 110, and execute the second safety strategy when it is detected that the running state of the main state machine 110 is invalid.

[0068] The main state machine 110 performs a monitoring function of the system on chip SoC; specifically, the main state machine 110 monitors the operating status of other hardware in the system on chip SoC except itself, and at the same time, also monitors the operating status of the micro control unit MCU.

[0069] The functional unit 120 is hardware that executes specific functions of the intelligent driving system in the system-on-chip SoC; the functional unit 120 includes a human-computer interaction module 121, a first-side data service module 122, a perception and cognition module 123, and a decision-making and planning module 124.

[0070] The main state machine 110 monitors the operating status of the functional unit 120, and when it is detected that the operating status of the functional unit 120 is abnormal, it executes the first safety strategy based on the specific type of the functional unit 120. It can be understood that different functional units 120 play different roles in intelligent driving. Therefore, when the operating status of a specific functional unit 120 fails, it is necessary to determine the specific operation of the first safety strategy based on the specific functional unit 120, so as to eliminate the impact of the failure of the functional unit 120 on the intelligent driving.

[0071] The main state machine 110 communicates with the microcontroller unit MCU. The main state machine 110 determines the control strategy through the relevant data sent by the functional unit 120, and sends the control strategy to the microcontroller unit MCU. The main state machine 110 monitors the operating status of the microcontroller unit MCU, and executes the relevant first safety strategy when it is detected that the operating status of the microcontroller unit MCU fails.

[0072] The micro control unit MCU monitors the running state of the main state machine 110, and executes the relevant second safety strategy when it is detected that the running state of the main state machine 110 fails.

[0073] In this embodiment, the main state machine 110 implements the operating status monitoring of the functional unit 120 in the system on chip SoC and the operating status monitoring of the microcontroller unit MCU; and the microcontroller unit MCU implements the operating status monitoring of the main state machine 110, realizing full coverage monitoring of the hardware in the intelligent driving domain controller.

[0074] Furthermore, the intelligent driving domain controller is connected to the cockpit domain controller 200; the functional unit 120 includes a human-computer interaction module 121, and the human-computer interaction module 121 is connected to the main state machine 110 and the cockpit domain controller 200, respectively, wherein:

[0075] The main state machine 110 is used to send abnormal indication information to the cockpit domain controller 200 through the human-computer interaction module 121 when it is detected that the operating status of the functional unit 120 or the micro control unit MCU fails and the operating status of the human-computer interaction module 121 is normal, so that the cockpit domain controller 200 displays the abnormal indication information.

[0076] The cockpit domain controller 200 is used to control relevant equipment inside and outside the vehicle, such as the central control screen, air conditioning, seats, instruments, etc.; the human-computer interaction module 121 can communicate with the cockpit domain controller 200 through the gateway 500.

[0077] The main state machine 110 communicates with the cockpit domain controller 200 through the human-computer interaction module 121; the main state machine 110 forwards the operating status of the intelligent driving function and the road scene reconstruction information to the cockpit domain controller 200 through the human-computer interaction module 121, so that the cockpit domain controller 200 displays the operating status of the intelligent driving function and the road scene reconstruction information.

[0078] See also Figure 4 In this embodiment, if the main state machine 110 detects that the operating state of the functional unit 120 or the micro control unit MCU fails, and at the same time, the human-computer interaction module 121 in the functional unit 120 operates normally, the main state machine 110 can still communicate with the cockpit domain controller 200 through the human-computer interaction module 121. Therefore, the main state machine 110 sends an abnormal indication signal to the cockpit domain controller 200 through the human-computer interaction module 121, so that the cockpit domain controller 200 displays the abnormal indication signal to let the user know the failure of the functional unit 120 or the micro control unit MCU. The abnormal indication signal can be set based on actual needs, such as the abnormal indication signal can include but is not limited to the type of failed hardware and whether user takeover is required.

[0079] See also Figure 5 If the main state machine 110 detects that the operating status of the human-computer interaction module 121 fails, the main state machine 110 cannot communicate with the cockpit domain controller 200 through the human-computer interaction module 121. At this time, the main state machine 110 does not send an abnormal indication signal to the human-computer interaction module 121; however, since the cockpit domain controller 200 is communicatively connected with the human-computer interaction module 121, the cockpit domain controller 200 can be set to monitor the operating status of the human-computer interaction module 121. When it is detected that the operating status of the human-computer interaction module 121 fails, the cockpit domain controller 200 displays relevant indication information to remind the user of the failure status of the human-computer interaction module 121, the system on chip SoC or the intelligent driving domain controller.

[0080] Specifically, the monitoring of the operating status of the human-computer interaction module 121 can be set based on actual needs. For example, the human-computer interaction module 121 is set to send a heartbeat signal, and the heartbeat signal changes periodically, such as the heartbeat signal is increased by 1 every cycle from 0 to 255 until 255 and then sent in a cycle starting from 0; the main state machine 110 and the cockpit domain controller 200 that have a communication connection relationship with the human-computer interaction module 121 receive the heartbeat signal sent by the human-computer interaction module 121. When the heartbeat signal of the human-computer interaction module 121 does not change within a certain period of time, such as the main state machine 110 detects that the heartbeat signal of the human-computer interaction module 121 has not changed within 500ms, or the cockpit domain controller 200 detects that the heartbeat signal of the human-computer interaction module 121 has not changed within 1s, it is considered that the operating status of the human-computer interaction module 121 has failed.

[0081] This embodiment enables the main state machine 110 within the domain and the cockpit domain controller 200 outside the domain to monitor the operating status of the human-computer interaction module 121.

[0082] Further, see Figure 6 , the intelligent driving domain controller is connected to the vehicle control actuator 300; the functional unit 120 includes a first side data service module 122, and the first side data service module 122 is respectively connected to the main state machine 110 and the vehicle control actuator 300; wherein:

[0083] The first-side data service module 122 is used to send the state signal of the vehicle control actuator 300 to the main state machine 110;

[0084] The main state machine 110 is used to determine the operating state of the first-side data service module 122 according to the heartbeat signal of the first-side data service module 122 and the state signal.

[0085] The first side data service module 122 communicates with the vehicle control actuator 300 and the main state machine 110 respectively; the first side data service module 122 can communicate with the vehicle control actuator 300 through the gateway 500; the first side data service module 122 is used to parse the status signal of the vehicle control actuator 300 and forward it to the main state machine 110 in intelligent driving. The status signal of the vehicle control actuator 300 mainly includes vehicle information, such as steering system 320 information, power system 310 information, braking system 330 fault status and vehicle body status, door status such as door, seat belt, driver status, etc.

[0086] The vehicle control actuator 300 is used to control the steering system 320 , the power system 310 , the braking system 330 and the body system 340 and send relevant status signals to the first-side data service module 122 .

[0087] It can be understood that the first side data service module 122 is used to parse and forward the status signal of the vehicle control actuator 300 to the main state machine 110. Therefore, when the operating state of the first side data service module 122 fails, the related signal forwarded by the first side data service module 122 will be abnormal. Therefore, the main state machine 110 can determine the operating state of the first side data service module 122 through the status signal forwarded by the first side data service module 122; specifically, after the main state machine 110 receives the status signal forwarded by the first side data service module 122, it determines Whether the state of the whole vehicle indicated by the certain state signal meets the requirements for starting the intelligent driving, such as determining whether the steering system 320, the power system 310, the braking system 330 and the body system 340 are faulty based on the relevant signals of the steering system 320, the power system 310, the braking system 330 or the body system 340 indicated by the state signal. When the steering system 320, the power system 310, the braking system 330 or the body system 340 fails, it is considered that the state of the whole vehicle does not meet the requirements for starting the intelligent driving, and then determining that the operating state of the first-side data service module 122 is invalid.

[0088] Similarly, a heartbeat signal can also be set for the first side data service module 122, and the operating status of the first side data service module 122 can be determined based on the heartbeat signal; the specific setting of the heartbeat signal and the determination of the operating status can be analogous to the setting and execution of the aforementioned human-computer interaction module 121, and will not be repeated here; it can be understood that the judgment of the operating status through the status signal and the heartbeat signal can be set at the same time, so that when any signal determines that the operating status is invalid, the operating status of the first side data service module 122 is considered to be invalid.

[0089] This embodiment can realize the monitoring of the operating status of the first-side data service module 122 .

[0090] Further, see Figure 7 , the functional unit 120 includes a perception and cognition module 123, and the perception and cognition module 123 is communicatively connected with the main state machine 110; wherein:

[0091] The perception and recognition module 123 is used to output a sensor abnormality diagnosis code to the main state machine 110 according to the sensor state;

[0092] The main state machine 110 is used to determine the operating state of the perception and cognition module 123 according to the heartbeat signal of the perception and cognition module 123 and the sensor abnormality diagnosis code.

[0093] The perception and recognition module 123 is used to obtain signals from sensors installed on the vehicle and generate sensor abnormality diagnostic codes to the main state machine 110; the sensors include but are not limited to visual sensors and radar sensors; visual sensors such as front cameras, surrounding cameras, and fisheye cameras; radar sensors such as lidars, millimeter-wave radars, and ultrasonic radars; in actual applications, sensors can also be divided into main sensors and auxiliary sensors, and the specific division criteria can be set based on actual system needs.

[0094] It can be understood that the perception and cognition module 123 is used to send the sensor abnormality diagnostic code to the main state machine 110. Therefore, when the operating state of the perception and cognition module 123 fails, the sensor abnormality diagnostic code forwarded by the perception and cognition module 123 will be abnormal. Therefore, the main state machine 110 can determine the operating state of the perception and cognition module 123 through the sensor abnormality diagnostic code forwarded by the perception and cognition module 123; specifically, after the main state machine 110 receives the sensor abnormality diagnostic code forwarded by the perception and cognition module 123, it determines whether the sensor state indicated by the sensor abnormality diagnostic code is abnormal. If the sensor state indicated by the sensor abnormality diagnostic code is abnormal, it is determined that the operating state of the perception and cognition module 123 is invalid.

[0095] Similarly, a heartbeat signal can also be set for the perception and cognition module 123, and the operating status of the perception and cognition module 123 can be determined based on the heartbeat signal; the specific setting of the heartbeat signal and the determination of the operating status can be analogous to the setting and execution of the aforementioned human-computer interaction module 121, and will not be repeated here; it can be understood that the judgment of the operating status of the sensor abnormality diagnostic code and the heartbeat signal can be set at the same time, so that when any signal determines that the operating status is invalid, the operating status of the perception and cognition module 123 is considered to be invalid.

[0096] This embodiment can realize the monitoring of the operating status of the perception and recognition module 123.

[0097] Further, see Figure 8 , the functional unit 120 includes a decision planning module 124, and the decision planning module 124 is communicatively connected to the main state machine 110; wherein:

[0098] The decision-making planning module 124 is used to perform self-diagnosis to obtain a trajectory planning state, and send the trajectory planning state to the main state machine 110;

[0099] The main state machine 110 is used to determine the operating state of the decision-making and planning module 124 according to the heartbeat signal of the decision-making and planning module 124 and the trajectory planning state.

[0100] The decision planning module 124 is used to perform self-diagnosis to generate a trajectory planning state, and send the trajectory planning state to the main state machine 110; the trajectory planning state is used to indicate the validity of the trajectory planning.

[0101] It can be understood that the decision planning module 124 is used to send the trajectory planning status to the main state machine 110. Therefore, when the operating status of the decision planning module 124 is invalid, the trajectory planning status sent by the decision planning module 124 will indicate invalid. Therefore, the main state machine 110 can determine the operating status of the decision planning module 124 through the trajectory planning status sent by the decision planning module 124; specifically, after the main state machine 110 receives the trajectory planning status forwarded by the decision planning module 124, it determines whether the trajectory planning status indication is valid. If the trajectory planning status indication is invalid, it is determined that the operating status of the decision planning module 124 is invalid.

[0102] Similarly, a heartbeat signal can also be set for the decision-making planning module 124, and the operating status of the decision-making planning module 124 can be determined based on the heartbeat signal; the specific setting of the heartbeat signal and the determination of the operating status can be analogous to the setting and execution of the aforementioned human-computer interaction module 121, and will not be repeated; it can be understood that the judgment of the operating status of the trajectory planning status and the heartbeat signal can be set at the same time, so that when any signal determines that the operating status is invalid, the operating status of the decision-making planning module 124 is considered to be invalid.

[0103] This embodiment can realize the monitoring of the operating status of the decision-making planning module 124.

[0104] Further, see Fig. 9 , the intelligent driving domain controller is connected to the vehicle control actuator 300; the micro control unit MCU includes a redundant state machine 410, a second side data service module 420 and a control module 430; wherein the second side data service module 420 is respectively communicated with the main state machine 110 and the redundant state machine 410, and the control module 430 is respectively communicated with the main state machine 110 and the vehicle control actuator 300; wherein:

[0105] The main state machine 110 is used to send a failure control strategy to the redundant state machine 410 when it is detected that the operating state of the functional unit 120 or the micro control unit MCU is failed;

[0106] The redundant state machine 410 is used to generate a deceleration signal according to the failure control strategy, and send the deceleration signal to the control module 430;

[0107] The control module 430 is used to send a control signal to the vehicle control actuator 300 according to the deceleration signal, so that the vehicle control actuator 300 controls the vehicle to decelerate;

[0108] The redundant state machine 410 is used to send a deceleration signal to the control module 430 when detecting that the operating state of the main state machine 110 fails.

[0109] The main state machine 110 communicates with the redundant state machine 410 . The main state machine 110 determines a control strategy through relevant data sent by the functional unit 120 , and sends the control strategy to the redundant state machine 410 .

[0110] The main state machine 110 monitors the running status of the redundant state machine 410, and executes the relevant first safety policy when it is detected that the running status of the redundant state machine 410 fails. It can be understood that since the microcontroller unit MCU is different from the inheritance method of the system on chip SoC, when there is a module abnormality in the microcontroller unit MCU, the microcontroller unit MCU as a whole cannot work normally. Therefore, when the main state machine 110 monitors the running status of the microcontroller unit MCU, it only needs to monitor the running status of the redundant state machine 410 set therein.

[0111] The second-side data service module 420 is used to transmit information between the main state machine 110 and the redundant state machine 410 .

[0112] When the main state machine 110 monitors the operating status of the redundant state machine 410, it can be determined by the heartbeat signal of the redundant state machine 410; the specific setting of the heartbeat signal and the determination of the operating status can be analogous to the setting and execution of the aforementioned human-computer interaction module 121, and will not be repeated here; it can be understood that when the microcontroller fails in its operating status, it will greatly affect the safety of intelligent driving. Therefore, the failure determination period of the heartbeat signal can be set shorter. If it does not change within 200ms, it is considered that the microcontroller's operating status has failed.

[0113] When the redundant state machine 410 monitors the running status of the main state machine 110, it can be determined by the heartbeat signal of the redundant state machine 410; the specific setting of the heartbeat signal and the determination of the running status can be analogous to the setting and execution of the aforementioned human-computer interaction module 121, and will not be repeated here; it can also be determined based on the communication status with the main state machine 110; if the main state machine 110 periodically sends a control strategy to the redundant state machine 410, when the redundant state machine 410 does not receive the control strategy for several consecutive cycles, it is considered that the communication with the main state machine 110 is disconnected, and the running status of the main state machine 110 is determined to be invalid; the hardware and software failures of the system on chip SoC can also be monitored through the microcontroller bottom-level diagnostic module, such as software monitoring, communication interface monitoring, power management, etc.

[0114] After receiving the control strategy sent by the main state machine 110, the redundant state machine 410 sends an activation signal to the control module 430 through the control strategy, so that the control module 430 sends a control signal corresponding to the control strategy to the vehicle control actuator 300, so that the vehicle control actuator 300 controls the states of the power system 310, the steering system 320, the braking system 330, and the body system 340 based on the control signal.

[0115] The control module 430 can communicate with the vehicle control actuator 300 through the gateway 500 .

[0116] The failure control strategy is a control strategy sent by the main state machine 110 when it detects that the operating state of the functional unit 120 fails; it is understandable that when the operating state of the functional unit 120 fails, the function of the intelligent driving needs to be limited to avoid danger; therefore, the failure control strategy instructs the vehicle to decelerate.

[0117] Furthermore, different failure control strategies may be implemented based on different types of failed functional units 120; for example, four failure levels are set in this embodiment;

[0118] Level 1 failures are failures that do not directly affect the vehicle control effect but will bring general driving safety risks, such as doors not being closed, seat belts not being fastened, or the system not meeting the eye-off and hand-off requirements according to the intelligent driving classification standards but the driver is eye-off or hand-off driving. Under level 1 failures, the corresponding failure control strategy can be to prompt the user and suppress longitudinal acceleration.

[0119] Level 2 failure is a failure that does not directly affect the vehicle control effect but will bring greater safety risks, such as failure of the human-computer interaction module 121, or failure of the output auxiliary sensor of the perception and cognition module 123; or after a certain period of time, such as 15 seconds, if the user does not restore the state after the level 1 failure is triggered, it will be upgraded to level 2 failure; under level 2 failure, the corresponding failure control strategy can be to take over the alarm, delay exit in the lateral direction, trigger comfortable deceleration in the longitudinal direction, and if the driver still does not take over when the vehicle decelerates to a standstill, the handbrake will be automatically pulled up and the lateral and longitudinal functions will be exited;

[0120] Level 3 failure is when the user does not take over the vehicle after a certain period of time, such as 20 seconds, after the level 2 failure is triggered, it is upgraded to level 3 failure; under level 3 failure, the corresponding failure control strategy can be to issue a takeover alarm, exit the lateral function, trigger emergency deceleration longitudinally, and if the driver still does not take over when the vehicle decelerates to a standstill, the handbrake is automatically pulled up and the longitudinal function is exited;

[0121] Level 4 failure refers to the failure of the module that affects the vehicle control effect, such as the failure of the data service, perception and cognition, decision-making and planning module 124 or the microcontroller unit MCU; or the decision-making and planning output trajectory planning status is invalid; or the main sensor of the perception and cognition output fails; or the steering system 320, power system 310, and braking system 330 forwarded by the data service are faulty; under level 4 failure, the corresponding failure control strategy can be to take over the alarm and exit the lateral and longitudinal functions.

[0122] It should be noted that the above classification of failure levels and setting of corresponding failure control strategies are only for illustration. In practical applications, corresponding failure control strategies can be set for different hardware failures based on actual needs.

[0123] The vehicle control actuator 300 may specifically include a power actuator controller, a steering actuator controller, and a braking actuator controller; the vehicle control actuator 300 is the final actuator for control instructions in intelligent driving, such as lateral and longitudinal vehicle control instructions; since the vehicle control actuator 300 is communicated with the microcontroller unit MCU, the vehicle control actuator 300 may be set to monitor the operating status of the microcontroller unit MCU. When it is detected that the operating status of the microcontroller unit MCU fails, the vehicle control actuator 300 stops executing the received control instructions and reports a fault code.

[0124] When the vehicle control actuator 300 monitors the operating status of the microcontroller, it can be determined by verifying the received control signal; when the operating status of the microcontroller MCU fails, the control signal output by the microcontroller MCU will fail the verification. Therefore, when the vehicle control actuator 300 monitors that the control signal verification fails, it can be determined that the operating status of the microcontroller MCU fails.

[0125] Furthermore, the main state machine 110 is also used to determine whether the intelligent driving mode is currently enabled when it is detected that the operating status of the functional unit 120 or the microcontroller unit MCU is failed; if the intelligent driving mode is enabled, the failure control strategy is sent to the redundant state machine 410.

[0126] It can be understood that the intelligent driving domain controller is used to perform intelligent driving operations. Therefore, when the intelligent driving mode is not started, the failure state of the hardware in the intelligent driving domain controller will not affect the current vehicle driving. Therefore, when it is monitored that the operating state of the functional unit 120 or the microcontroller unit MCU is failed, it is only necessary to suppress the activation of the intelligent driving mode, that is, when the functional unit 120 or the microcontroller unit MCU fails, the intelligent driving mode cannot be enabled; and when the intelligent driving mode is started, the failure state of the hardware in the intelligent driving domain controller will affect the current vehicle driving. Therefore, it is necessary to send a failure control strategy to the redundant state machine 410, and based on the above description, the vehicle will be decelerated and gradually exit the intelligent driving mode.

[0127] Similarly, when the redundant state machine 410 detects that the operating status of the main state machine 110 fails, it is also necessary to judge the activation status of the intelligent driving mode. When the intelligent driving mode is not activated, the failure status is sent to the main state machine 110 to inhibit the activation of the intelligent driving mode; when the intelligent driving mode is activated, the control module 430 is activated so that the control module 430 sends a control signal indicating deceleration to the cockpit domain controller 200; after receiving the control signal, the cockpit domain controller 200 will exit the lateral function and decelerate, which can be specifically performed in an analogous manner to the operation of the aforementioned failure level.

[0128] In this embodiment, the safety strategy is specifically executed by distinguishing whether the intelligent driving mode is enabled or not, so as to disable the operation of the intelligent driving mode.

[0129] The present invention also protects an intelligent driving system, which includes an intelligent driving domain controller. The structure of the intelligent driving domain controller can refer to the above embodiment and will not be repeated here. As a matter of course, since the intelligent driving system of this embodiment adopts the technical solution of the above intelligent driving domain controller, the intelligent driving system has all the beneficial effects of the above intelligent driving domain controller.

[0130] Further, see Figure 5 , the intelligent driving system further includes a cockpit domain controller 200; the cockpit domain controller 200 is communicatively connected with the human-computer interaction module 121 in the system-on-chip SoC; wherein:

[0131] The cockpit domain controller 200 is used to monitor the operating status of the human-computer interaction module 121 and perform an abnormal indication operation when it is detected that the operating status of the human-computer interaction module 121 fails.

[0132] Since the cockpit domain controller 200 is communicatively connected with the human-computer interaction module 121, the cockpit domain controller 200 can be configured to monitor the operating status of the human-computer interaction module 121. When it is detected that the operating status of the human-computer interaction module 121 fails, the cockpit domain controller 200 displays relevant indication information to remind the user of the failure status of the human-computer interaction module 121, the system on chip SoC or the intelligent driving domain controller.

[0133] Specifically, the monitoring of the operating status of the human-computer interaction module 121 can be set based on actual needs. For example, the human-computer interaction module 121 is set to send a heartbeat signal, and the heartbeat signal changes periodically, such as the heartbeat signal is incremented by 1 per cycle from 0 to 255 until 255 and then sent in a cycle starting from 0; the cockpit domain controller 200 that has a communication connection relationship with the human-computer interaction module 121 receives the heartbeat signal sent by the human-computer interaction module 121. When the heartbeat signal of the human-computer interaction module 121 does not change within a certain period of time, if the cockpit domain controller 200 detects that the heartbeat signal of the human-computer interaction module 121 does not change within 1s, it is considered that the operating status of the human-computer interaction module 121 is invalid.

[0134] This embodiment enables the cockpit domain controller 200 outside the domain to monitor the operating status of the human-computer interaction module 121.

[0135] Further, see Fig. 9 , the intelligent driving system further includes a vehicle control actuator 300, the vehicle control actuator 300 is communicatively connected with the control module 430 of the microcontroller unit MCU; wherein:

[0136] The vehicle control actuator 300 is used to receive the control signal sent by the control module 430, and monitor the operating state of the micro control unit MCU according to the control signal, and stop executing the control signal when it is detected that the operating state of the micro control unit MCU fails.

[0137] The vehicle control actuator 300 may specifically include a power actuator controller, a steering actuator controller, and a braking actuator controller; the vehicle control actuator 300 is the final actuator for control instructions in intelligent driving, such as lateral and longitudinal vehicle control instructions; since the vehicle control actuator 300 is communicated with the microcontroller unit MCU, the vehicle control actuator 300 may be set to monitor the operating status of the microcontroller unit MCU. When it is detected that the operating status of the microcontroller unit MCU fails, the vehicle control actuator 300 stops executing the received control instructions and reports a fault code.

[0138] When the vehicle control actuator 300 monitors the operating status of the microcontroller, it can be determined by verifying the received control signal; when the operating status of the microcontroller MCU fails, the control signal output by the microcontroller MCU will fail the verification. Therefore, when the vehicle control actuator 300 monitors that the control signal verification fails, it can be determined that the operating status of the microcontroller MCU fails.

[0139] This embodiment enables the vehicle control actuator 300 outside the domain to monitor the operating status of the microcontroller unit MCU.

[0140] The present invention also protects a vehicle, which includes an intelligent driving system. The structure of the intelligent driving system can refer to the above embodiment and will not be described in detail here. As a matter of course, since the vehicle of this embodiment adopts the technical solution of the above intelligent driving system, the vehicle has all the beneficial effects of the above intelligent driving system.

[0141] It should be noted that, in this article, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "includes a..." does not exclude the presence of other identical elements in the process, method, article or system including the element. The serial numbers of the above-mentioned embodiments of the present invention are for description only and do not represent the advantages and disadvantages of the embodiments.

[0142] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. An intelligent driving domain controller, characterized in that: The intelligent driving domain controller includes a system on chip and a micro control unit, and the system on chip is communicatively connected with the micro control unit; wherein: The system on chip is used to monitor the operating status of itself and the micro control unit, and execute the first security strategy when it is detected that the operating status of itself or the micro control unit is failed; The micro control unit is used to monitor the operating state of the system on chip, and execute the second security strategy when it is detected that the operating state of the system on chip is invalid.

2. The intelligent driving domain controller according to claim 1, characterized in that: The system on chip includes a main state machine and a functional unit; the main state machine is respectively connected to the functional unit and the micro control unit in communication; wherein: The main state machine is used to monitor the operating status of the functional unit and the micro control unit, and execute the first safety strategy when it is detected that the operating status of the functional unit or the micro control unit is failed; The micro control unit is specifically used to monitor the running state of the main state machine, and execute the second safety strategy when it is detected that the running state of the main state machine is invalid.

3. The intelligent driving domain controller according to claim 2, characterized in that: The intelligent driving domain controller is connected to the cockpit domain controller; the functional unit includes a human-computer interaction module, and the human-computer interaction module is connected to the main state machine and the cockpit domain controller respectively, wherein: The main state machine is used to send abnormal indication information to the cockpit domain controller through the human-computer interaction module when it is detected that the operating state of the functional unit or the micro control unit fails and the operating state of the human-computer interaction module is normal, so that the cockpit domain controller displays the abnormal indication information.

4. The intelligent driving domain controller according to claim 2, characterized in that: The intelligent driving domain controller is connected to the vehicle control actuator; the functional unit includes a first side data service module, and the first side data service module is respectively connected to the main state machine and the vehicle control actuator; wherein: The first-side data service module is used to send the state signal of the vehicle control actuator to the main state machine; The main state machine is used to determine the operating state of the first-side data service module according to the heartbeat signal of the first-side data service module and the state signal.

5. The intelligent driving domain controller according to claim 2, characterized in that: The functional unit includes a perception and cognition module, and the perception and cognition module is communicatively connected with the main state machine; wherein: The perception and recognition module is used to output a sensor abnormality diagnosis code to the main state machine according to the sensor state; The main state machine is used to determine the operating state of the perception and cognition module according to the heartbeat signal of the perception and cognition module and the sensor abnormality diagnostic code.

6. The intelligent driving domain controller according to claim 2, characterized in that: The functional unit includes a decision-making planning module, which is communicatively connected to the main state machine; wherein: The decision-making planning module is used to perform self-diagnosis to obtain a trajectory planning state, and send the trajectory planning state to the main state machine; The main state machine is used to determine the operating state of the decision-making planning module according to the heartbeat signal of the decision-making planning module and the trajectory planning state.

7. The intelligent driving domain controller according to claim 2, characterized in that: The intelligent driving domain controller is connected to the vehicle control actuator; the micro control unit includes a redundant state machine, a second side data service module and a control module; wherein the second side data service module is respectively connected to the main state machine and the redundant state machine in communication, and the control module is respectively connected to the main state machine and the vehicle control actuator in communication; wherein: The main state machine is used to send a failure control strategy to the redundant state machine when it is detected that the operating state of the functional unit or the micro control unit is failed; The redundant state machine is used to generate a deceleration signal according to the failure control strategy and send the deceleration signal to the control module; The control module is used to send a control signal to the vehicle control actuator according to the deceleration signal, so that the vehicle control actuator controls the vehicle to decelerate; The redundant state machine is used to send a deceleration signal to the control module when it is detected that the operating state of the main state machine fails.

8. The intelligent driving domain controller according to claim 7, characterized in that: The main state machine is further used to determine whether the intelligent driving mode is currently enabled when it is detected that the operating state of the functional unit or the micro control unit is failed; If the intelligent driving mode is enabled, the failure control strategy is sent to the redundant state machine.

9. An intelligent driving system, characterized in that: The intelligent driving system includes the intelligent driving domain controller according to any one of claims 1 to 8.

10. The intelligent driving system according to claim 9, characterized in that: The intelligent driving system further includes a cockpit domain controller; the cockpit domain controller is communicatively connected with the human-computer interaction module of the system on chip; wherein: The cockpit domain controller is used to monitor the operating status of the human-computer interaction module and perform an abnormal indication operation when it is detected that the operating status of the human-computer interaction module fails.

11. The intelligent driving system according to claim 9, characterized in that: The intelligent driving system further includes a vehicle control actuator, which is communicatively connected to the control module of the micro control unit; wherein: The vehicle control actuator is used to receive the control signal sent by the control module, and monitor the operating state of the micro control unit according to the control signal, and stop executing the control signal when it is detected that the operating state of the micro control unit fails.

12. A vehicle, characterized in that: The vehicle includes the intelligent driving system according to any one of claims 9 to 11.

Images