Fault processing method, device and equipment for autonomous vehicle and storage medium

Abstract

The invention relates to the technical field of automatic driving, and discloses a fault processing method, device and equipment for an automatic driving vehicle and a storage medium, which are used for improving the safety and reliability of an automatic driving system. The fault processing method of the automatic driving vehicle comprises the steps that first monitoring information of a main control unit of the automatic driving vehicle and second monitoring information corresponding to a redundancy control unit are obtained, and the first monitoring information comprises a braking system state, a braking request value, braking response feedback and a first communication state of the main control unit; the second monitoring information comprises a second communication state of the redundancy control unit; according to the first monitoring information and the second monitoring information, whether the autonomous vehicle has a fault is judged; and if the automatic driving vehicle has a fault, selecting a corresponding processing strategy according to a fault reason to perform corresponding control on the automatic driving vehicle, and when the main control unit is completely invalid, switching to the redundancy control unit to perform corresponding vehicle control.

Description

Technical Field

[0001] The present invention relates to the field of autonomous driving technology, and in particular to a fault handling method, device, equipment and storage medium for an autonomous driving vehicle. Background Art

[0002] In the prior art, the fault handling method of autonomous driving vehicles usually relies on a single main control unit for monitoring and decision-making. The method mainly collects various operating parameters of the vehicle, such as the braking system status, braking request value, etc., through the main control unit, and makes fault judgments based on this information. However, once the main control unit fails or communication is interrupted, the entire autonomous driving system may lose effective control of the vehicle, resulting in safety hazards. Summary of the invention

[0003] The present invention provides a fault handling method, device, equipment and storage medium for an autonomous driving vehicle to solve the problem in the prior art that the system has low safety and reliability due to reliance on a single main control unit for monitoring and decision-making.

[0004] A first aspect of the present invention provides a fault handling method for an autonomous driving vehicle, comprising: obtaining first monitoring information of a main control unit of the autonomous driving vehicle and second monitoring information corresponding to a redundant control unit respectively, the first monitoring information including a braking system status, a braking request value, a braking response feedback and a first communication status of the main control unit, and the second monitoring information including a second communication status of the redundant control unit; judging whether the autonomous driving vehicle has a fault based on the first monitoring information and the second monitoring information; if the autonomous driving vehicle has a fault, selecting a corresponding processing strategy according to the cause of the fault to perform corresponding control on the autonomous driving vehicle, and when the main control unit completely fails, switching to the redundant control unit to perform corresponding vehicle control.

[0005] In a feasible implementation manner, determining whether the autonomous driving vehicle has a fault based on the first monitoring information and the second monitoring information includes: comparing the braking request value with the current capacity of the braking system in the braking system state to determine whether the braking system has a performance fault; analyzing the braking system response feedback to determine whether the braking system has a response fault; and determining whether there is a communication fault between the main control unit and the redundant control unit based on the first communication state and the second communication state.

[0006] In a feasible implementation manner, the braking request value is compared with the current capacity of the braking system in the braking system state to determine whether the braking system has a performance failure, including: comparing the braking request value with the current capacity of the braking system in the braking system state; when the braking request value is greater than the current capacity of the braking system, determining the relationship between the current capacity of the braking system and the preset braking capacity; if the current capacity of the braking system is greater than the preset braking capacity, determining it as a mild braking capacity deficiency failure; if the current capacity of the braking system is not greater than the preset braking capacity, determining it as a severe braking capacity deficiency failure.

[0007] In a feasible implementation manner, analyzing the braking system response feedback to determine whether the braking system has a response failure includes: based on the braking system response feedback, checking whether the braking system responds as expected; if the braking system does not respond as expected, determining it as a braking response failure.

[0008] In a feasible implementation manner, judging whether there is a communication fault between the main control unit and the redundant control unit based on the first communication status and the second communication status includes: determining the activities of the main control unit and the redundant control unit on the main CAN line and the redundant CAN line based on the first communication status and the second communication status, and judging whether there is a communication fault between the main control unit and the redundant control unit based on the results of the activities.

[0009] In a feasible implementation, if the autonomous driving vehicle has a fault, a corresponding processing strategy is selected according to the cause of the fault to perform corresponding control on the autonomous driving vehicle, including: when the fault cause is a minor insufficient braking capacity fault, evaluating the safety of the current driving environment, and controlling the vehicle accordingly based on the safety assessment result; when the fault cause is a severe insufficient braking capacity, initiating an emergency braking procedure; when the fault cause is a braking response failure, troubleshooting is performed, and if the fault cannot be eliminated, a conservative driving strategy is initiated; when the fault cause is a control unit communication failure, determining a corresponding processing strategy according to the fault type, and controlling the autonomous driving vehicle accordingly based on the corresponding processing strategy.

[0010] In a feasible implementation, when the cause of the fault is a control unit communication failure, a corresponding processing strategy is determined according to the specific type of the fault, and the autonomous driving vehicle is controlled accordingly based on the corresponding processing strategy, including: if the cause of the fault is the complete loss of communication between the main control unit and the redundant control unit, an emergency braking procedure is executed; if the cause of the fault is the complete loss of communication with the main control unit, and the redundant control unit communicates normally, the redundant control unit is switched to control the autonomous driving vehicle; if the cause of the fault is the partial loss of communication with the main control unit, and the redundant control unit communicates normally, whether to switch to the redundant communication line is determined based on the normal communication part; if the cause of the fault is the complete loss of communication with the redundant control unit, and the main control unit is normal, the control of the autonomous driving vehicle by the main control unit is maintained; if the cause of the fault is the partial loss of communication with the redundant control unit, and the main control unit is normal, the control of the autonomous driving vehicle by the main control unit is maintained, and whether to switch to the redundant communication line is determined based on the normal communication part of the redundant control unit.

[0011] A second aspect of the present invention provides a fault handling device for an autonomous driving vehicle, comprising: an acquisition module, used to acquire first monitoring information of a main control unit of the autonomous driving vehicle and second monitoring information corresponding to a redundant control unit, respectively, the first monitoring information including a braking system status, a braking request value, a braking response feedback and a first communication status of the main control unit, and the second monitoring information including a second communication status of the redundant control unit; a judgment module, used to judge whether the autonomous driving vehicle has a fault based on the first monitoring information and the second monitoring information; a control module, used to select a corresponding processing strategy to perform corresponding control on the autonomous driving vehicle according to the cause of the fault if the autonomous driving vehicle has a fault, and switch to the redundant control unit to perform corresponding vehicle control when the main control unit completely fails.

[0012] In a feasible implementation manner, the judgment module includes: a first judgment unit, used to compare the braking request value with the current capacity of the braking system in the braking system state to determine whether there is a performance failure in the braking system; a second judgment unit, used to analyze the braking system response feedback to determine whether there is a response failure in the braking system; and a third judgment unit, used to determine whether there is a communication failure between the main control unit and the redundant control unit based on the first communication state and the second communication state.

[0013] In a feasible implementation manner, the first judgment unit is specifically used to: compare the braking request value with the current capacity of the braking system in the braking system state; when the braking request value is greater than the current capacity of the braking system, determine the relationship between the current capacity of the braking system and the preset braking capacity; if the current capacity of the braking system is greater than the preset braking capacity, determine it as a mild braking capacity deficiency fault; if the current capacity of the braking system is not greater than the preset braking capacity, determine it as a severe braking capacity deficiency fault.

[0014] In a feasible implementation manner, the second judgment unit is specifically used to: based on the brake system response feedback, check whether the brake system responds as expected; if the brake system does not respond as expected, determine it as a brake response failure.

[0015] In a feasible implementation manner, the third judgment unit is specifically used to: determine the activities of the main control unit and the redundant control unit on the main CAN line and the redundant CAN line according to the first communication status and the second communication status, and determine whether there is a communication failure between the main control unit and the redundant control unit according to the results of the activity.

[0016] In a feasible implementation, the control module includes: a first control unit, which is used to evaluate the safety of the current driving environment when the cause of the fault is a minor lack of braking capacity, and to control the vehicle accordingly based on the safety assessment result; a second control unit, which is used to start the emergency braking procedure when the cause of the fault is a severe lack of braking capacity; a third control unit, which is used to troubleshoot when the cause of the fault is a braking response failure, and if the fault cannot be troubleshooted, start a conservative driving strategy; a fourth control unit, which is used to determine the corresponding processing strategy according to the fault type when the cause of the fault is a control unit communication failure, and to control the autonomous driving vehicle accordingly based on the corresponding processing strategy.

[0017] In a feasible implementation manner, the fourth control unit is specifically used to: when the cause of the fault is a minor failure of insufficient braking capacity, evaluate the safety of the current driving environment, and control the vehicle accordingly based on the safety assessment result; when the cause of the fault is a severe failure of insufficient braking capacity, initiate an emergency braking procedure; when the cause of the fault is a braking response failure, perform troubleshooting, and if the fault cannot be eliminated, initiate a conservative driving strategy; when the cause of the fault is a control unit communication failure, determine a corresponding processing strategy based on the fault type, and control the autonomous driving vehicle accordingly based on the corresponding processing strategy.

[0018] A third aspect of the present invention provides a fault handling device for an autonomous driving vehicle, comprising: a memory and at least one processor, wherein the memory stores instructions; the at least one processor calls the instructions in the memory so that the fault handling device for the autonomous driving vehicle executes the above-mentioned fault handling method for the autonomous driving vehicle.

[0019] A fourth aspect of the present invention provides a computer-readable storage medium, which stores instructions that, when executed on a computer, enable the computer to execute the above-mentioned fault handling method for the autonomous driving vehicle.

[0020] In the technical solution provided by the present invention, the first monitoring information of the main control unit of the autonomous driving vehicle and the second monitoring information corresponding to the redundant control unit are obtained, the first monitoring information includes the braking system status, the braking request value, the braking response feedback and the first communication status of the main control unit, and the second monitoring information includes the second communication status of the redundant control unit; according to the first monitoring information and the second monitoring information, it is judged whether the autonomous driving vehicle has a fault; if the autonomous driving vehicle has a fault, the corresponding processing strategy is selected according to the cause of the fault to perform corresponding control on the autonomous driving vehicle, and when the main control unit fails completely, the redundant control unit is switched to perform corresponding vehicle control. In the embodiment of the present invention, by obtaining the monitoring information of the main control unit and the redundant control unit of the autonomous driving vehicle, the comprehensive monitoring of the running status of the autonomous driving vehicle is realized. When a fault is detected, the corresponding processing strategy can be quickly selected according to the cause of the fault, and by using the redundant control unit, it is ensured that the autonomous driving vehicle can still be effectively controlled in the case of a fault of the main control unit, thereby improving the safety and reliability of the autonomous driving. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A schematic diagram of an embodiment of a method for handling a fault of an autonomous driving vehicle in an embodiment of the present invention;

[0022] Figure 2 A schematic diagram of another embodiment of a method for handling a fault of an autonomous driving vehicle in an embodiment of the present invention;

[0023] Figure 3 A schematic diagram of an embodiment of a fault handling device for an autonomous driving vehicle in an embodiment of the present invention;

[0024] Figure 4 It is a schematic diagram of another embodiment of a fault handling device for an autonomous driving vehicle in an embodiment of the present invention;

[0025] Figure 5 Schematic diagram of an embodiment of a fault handling device for an autonomous driving vehicle in an embodiment of the present invention. DETAILED DESCRIPTION

[0026] Embodiments of the present invention provide a fault handling method, device, equipment and storage medium for an autonomous driving vehicle, which improves the safety and effective control of autonomous driving by adding redundant control methods.

[0027] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] It is understandable that the execution subject of the present invention may be a fault handling device of an autonomous driving vehicle, or may be a terminal or a server, which is not specifically limited here. The embodiment of the present invention is described by taking a server as the execution subject as an example.

[0029] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1 , an embodiment of a fault handling method for an autonomous driving vehicle in an embodiment of the present invention includes:

[0030] 101. Obtain first monitoring information of a main control unit of the automatic driving vehicle and second monitoring information corresponding to a redundant control unit, respectively, wherein the first monitoring information includes a braking system state, a braking request value, a braking response feedback, and a first communication state of the main control unit, and the second monitoring information includes a second communication state of the redundant control unit;

[0031] The braking system status includes braking pressure, braking temperature, brake disc wear, etc. These parameters can reflect the current working status of the braking system; the braking request value is the expected braking effect calculated based on driving conditions and safety requirements, which is used to compare with the actual braking effect; the braking response feedback is the feedback after the braking system actually performs the braking operation, including braking distance, braking time, etc., which is used to evaluate whether the braking effect meets the requirements; monitor the communication activities of the main control unit on the main CAN line and the redundant CAN line to obtain the first communication state.

[0032] The redundant control unit is a backup for the main control unit, and is designed to ensure that when the main control unit fails or communication is interrupted, the redundant control unit can quickly take over control and continue to maintain stable operation of the vehicle. Similar to the main control unit, the redundant control unit monitors the communication activities on the main CAN line and the redundant CAN line to obtain the second communication state.

[0033] 102. Determine whether the automatic driving vehicle has a fault according to the first monitoring information and the second monitoring information;

[0034] By comparing the braking request value with the current braking system capacity in the braking system status, it can be determined whether the braking system has a performance fault. If the braking request value is greater than the current braking system capacity, and the current braking system capacity is lower than the preset braking capacity threshold, it is determined to be a severe braking capacity failure; if the braking request value is greater than the current braking system capacity, but the current braking system capacity is not lower than the preset braking capacity threshold, it is determined to be a mild braking capacity failure.

[0035] Based on the brake system response feedback, check whether the brake system responds as expected. If the brake system does not respond as expected, it is determined to be a brake response failure. The reasons for not responding as expected may be excessive braking distance and delayed braking time, etc.

[0036] Based on the first communication state, if the main control unit has a communication abnormality on the main CAN line and can still maintain normal communication on the redundant CAN line, and if the main control unit has a communication abnormality on the redundant CAN line and still maintains normal communication on the main CAN line, it is judged that partial communication is lost; if the main control unit cannot communicate with other system components on both the main CAN line and the redundant CAN line, it is judged that all communication is lost; if the main control unit maintains normal communication on both the main CAN line and the redundant CAN line, it is judged that the communication is normal.

[0037] Based on the second communication state, if the redundant control unit has a communication abnormality on the main CAN line and can still maintain normal communication on the redundant CAN line, and if the redundant control unit has a communication abnormality on the redundant CAN line and still maintains normal communication on the main CAN line, it is judged that partial communication is lost; if the redundant control unit cannot communicate with other system components on both the main CAN line and the redundant CAN line, it is judged that all communication is lost; if the redundant control unit maintains normal communication on both the main CAN line and the redundant CAN line, it is judged that the communication is normal.

[0038] 103. If there is a fault in the autonomous driving vehicle, a corresponding processing strategy is selected according to the cause of the fault to control the autonomous driving vehicle accordingly. When the main control unit fails completely, the redundant control unit is switched to perform corresponding vehicle control.

[0039] A total loss of communication with the Master Control Unit indicates a complete failure of the Master Control Unit.

[0040] If the fault is caused by a serious or minor insufficient braking capacity fault in the braking system, the driving strategy will be adjusted immediately, such as reducing the speed, increasing the safe distance from the vehicle in front, and issuing an alarm to remind the driver to pay attention to the problem with the braking system; if the fault is caused by a brake system response failure, such as a long braking distance or a delayed braking time, the system will attempt to perform emergency braking or take other obstacle avoidance measures, and notify the driver to take over control; if the fault is caused by a communication failure, if the main control unit loses some communication on the main CAN line or the redundant CAN line, it will try to re-establish communication or switch to a line with normal communication; if the main control unit loses all communication, it will immediately switch to the redundant control unit for vehicle control. The redundant control unit will take over all necessary vehicle control functions, such as acceleration, braking and steering, and the system will continue to monitor the working status of the redundant control unit to ensure stable operation of the vehicle. This fault handling strategy is designed to minimize the impact of faults on the safety and reliability of autonomous vehicles.

[0041] In the embodiment of the present invention, by acquiring monitoring information of the main control unit and the redundant control unit of the autonomous driving vehicle, comprehensive monitoring of the operating status of the autonomous driving vehicle is achieved. When a fault is detected, the corresponding processing strategy can be quickly selected according to the cause of the fault, and by utilizing the redundant control unit, it is ensured that the autonomous driving vehicle can still be effectively controlled in the event of a main control unit failure, thereby improving the safety and reliability of autonomous driving.

[0042] See also Figure 2 Another embodiment of the fault handling method of the autonomous driving vehicle in the embodiment of the present invention includes:

[0043] 201. Obtain first monitoring information of a main control unit of the automatic driving vehicle and second monitoring information corresponding to a redundant control unit, respectively, wherein the first monitoring information includes a braking system state, a braking request value, a braking response feedback, and a first communication state of the main control unit, and the second monitoring information includes a second communication state of the redundant control unit;

[0044] 202. Compare the braking request value with the current braking system capacity in the braking system state to determine whether the braking system has a performance fault, where the performance fault includes a slight braking capacity insufficiency fault or a severe braking capacity insufficiency fault;

[0045] Compare the braking request value with the current capacity of the braking system in the braking system status; when the braking request value is greater than the current capacity of the braking system, determine the relationship between the current capacity of the braking system and the preset braking capacity; if the current capacity of the braking system is greater than the preset braking capacity, it is determined to be a mild braking capacity deficiency fault; if the current capacity of the braking system is not greater than the preset braking capacity, it is determined to be a severe braking capacity deficiency fault.

[0046] 203. Analyze the response feedback of the braking system to determine whether there is a response failure in the braking system;

[0047] Based on the brake system response feedback, check whether the brake system responds as expected; if the brake system does not respond as expected, it is determined to be a brake response failure.

[0048] The brake system response feedback is input into the preset brake response model, which is built based on vehicle dynamics principles, brake system characteristics and current driving conditions (such as vehicle speed and road conditions) to simulate the expected brake response. By comparing the difference between the actual brake response and the expected brake response, it is evaluated whether the brake system responds as expected.

[0049] 204. Determine whether there is a communication failure between the main control unit and the redundant control unit according to the first communication state and the second communication state;

[0050] The activities of the main control unit and the redundant control unit on the main CAN line and the redundant CAN line are determined according to the first communication state and the second communication state, and whether there is a communication failure between the main control unit and the redundant control unit is determined according to the results of the activities.

[0051] Analyze the data transmission and reception of the main control unit and redundant control unit during the active cycle, including key indicators such as data packet integrity, transmission delay, and communication frequency. If the main control unit and redundant control unit can send and receive data normally on their respective CAN lines, and the data packet verification is correct, the transmission delay is within a reasonable range, and the communication frequency is stable, then the communication is judged to be normal; on the contrary, if any control unit has data packet loss, too long transmission delay, abnormal communication frequency, or complete loss of communication, then according to the preset fault judgment logic, after comprehensive evaluation, it is determined that the corresponding control unit has a communication fault.

[0052] Based on the first communication state, if the main control unit has a communication abnormality on the main CAN line and can still maintain normal communication on the redundant CAN line, and if the main control unit has a communication abnormality on the redundant CAN line and still maintains normal communication on the main CAN line, it is judged that partial communication is lost; if the main control unit cannot communicate with other system components on both the main CAN line and the redundant CAN line, it is judged that all communication is lost; if the main control unit maintains normal communication on both the main CAN line and the redundant CAN line, it is judged that the communication is normal.

[0053] Based on the second communication state, if the redundant control unit has a communication abnormality on the main CAN line and can still maintain normal communication on the redundant CAN line, and if the redundant control unit has a communication abnormality on the redundant CAN line and still maintains normal communication on the main CAN line, it is judged that partial communication is lost; if the redundant control unit cannot communicate with other system components on both the main CAN line and the redundant CAN line, it is judged that all communication is lost; if the redundant control unit maintains normal communication on both the main CAN line and the redundant CAN line, it is judged that the communication is normal.

[0054] 205. When the fault is caused by a minor insufficient braking capacity fault, assess the safety of the current driving environment and control the vehicle accordingly based on the safety assessment result;

[0055] When the cause of the fault is a minor failure of insufficient braking capacity, first evaluate the safety of the current driving environment, including analyzing factors such as the speed of the autonomous driving vehicle, the conditions of the surrounding roads, and the distance to other vehicles. Based on the safety assessment results, take corresponding control measures, such as reducing the speed, increasing the safe distance from the vehicle in front, etc., to ensure that the vehicle can continue to drive without endangering safety. At the same time, continuously monitor the status of the braking system and be prepared to take further measures when necessary.

[0056] 206. When the cause of the fault is severe lack of braking capacity, the emergency braking procedure is initiated;

[0057] When the fault is caused by severe insufficient braking capacity, the emergency braking procedure is immediately activated. This is because severe insufficient braking capacity may cause the vehicle to be unable to effectively slow down or stop in a short period of time, thereby increasing the risk of collision. The emergency braking procedure will quickly control the vehicle's braking system to slow down and stop the vehicle with the maximum braking force. At the same time, an alarm is issued to the driver, and the driver is advised to take additional safety measures, such as holding the steering wheel tightly and preparing for possible emergencies.

[0058] 207. When the fault is caused by a brake response failure, troubleshoot the fault. If the fault cannot be eliminated, initiate a conservative driving strategy;

[0059] When the fault is caused by a brake response failure, first try to troubleshoot, which may include checking whether the sensors and actuators of the brake system are working properly, checking whether the communication lines are unobstructed, etc. If the troubleshooting is successful, the system will resume normal operation. However, if the fault cannot be eliminated, the conservative driving strategy is immediately activated. The conservative driving strategy aims to reduce the speed and acceleration of the vehicle and reduce the interaction with other vehicles, thereby reducing the risk of collision. At the same time, the status of the brake system is continuously monitored and further measures are prepared to be taken when necessary.

[0060] 208. When the cause of the fault is a control unit communication failure, the corresponding processing strategy is determined according to the fault type, and the automatic driving vehicle is controlled accordingly based on the corresponding processing strategy. When the main control unit fails completely, switch to the redundant control unit to perform corresponding vehicle control.

[0061] If the cause of the fault is the complete loss of communication between the main control unit and the redundant control unit, the emergency braking procedure will be executed; if the cause of the fault is the complete loss of communication with the main control unit, and the redundant control unit is communicating normally, the control of the autonomous driving vehicle will be switched to the redundant control unit; if the cause of the fault is the partial loss of communication with the main control unit, and the redundant control unit is communicating normally, whether to switch to the redundant communication line will be determined based on the normal communication part; if the cause of the fault is the complete loss of communication with the redundant control unit, and the main control unit is normal, the control of the autonomous driving vehicle by the main control unit will be maintained; if the cause of the fault is the partial loss of communication with the redundant control unit, and the main control unit is normal, the control of the autonomous driving vehicle by the main control unit will be maintained, and whether to switch to the redundant communication line will be determined based on the normal communication part of the redundant control unit.

[0062] When an autonomous vehicle encounters a control unit communication failure, a corresponding handling strategy is quickly formulated and executed based on the specific type of failure. If the communication between the main control unit and the redundant control unit is completely interrupted, for safety reasons, the emergency braking procedure will be immediately initiated to ensure driving safety; if only the communication of the main control unit is completely lost and the communication of the redundant control unit is unimpeded, it will seamlessly switch to the redundant control unit to ensure the continuous operation of the autonomous driving function; if only part of the communication of the main control unit fails and the redundant control unit communicates normally, it will evaluate whether to switch to the redundant communication line to maintain the optimal control state based on the remaining valid communication information; if it is determined based on the remaining valid communication information that the main control unit communicates normally on the main CAN line, but the communication on the redundant CAN line is abnormal, the current control will continue to be maintained; if it is determined that the main control unit communicates normally on the redundant CAN line, but the communication on the main CAN line is abnormal, it will switch to the redundant CAN line for communication to control the vehicle; conversely, if the redundant control unit communication is completely lost and the main control unit remains normal, the vehicle will continue to rely on the main control unit for control; if only part of the communication of the redundant control unit fails and the main control unit operates normally, the dominant position of the main control unit is maintained, and whether to switch the communication line is considered based on the valid communication information of the redundant control unit. The judgment method is consistent with that of the main control unit and will not be repeated here. Through this control logic, the safe and stable operation of the autonomous driving vehicle is ensured.

[0063] In the embodiment of the present invention, by comprehensively monitoring the main control unit and redundant control units of the autonomous driving vehicle, braking system performance failures, response failures and communication failures are discovered in a timely manner, and corresponding vehicle control measures are taken according to the type and severity of the failure, including evaluating the safety of the driving environment, initiating emergency braking procedures, troubleshooting and switching control units, etc., thereby effectively improving the safety and reliability of the autonomous driving vehicle.

[0064] The above describes the fault handling method of the autonomous driving vehicle in the embodiment of the present invention. The following describes the fault handling device of the autonomous driving vehicle in the embodiment of the present invention. Figure 3 , an embodiment of a fault handling device for an autonomous driving vehicle in an embodiment of the present invention includes:

[0065] An acquisition module 301 is used to acquire first monitoring information of a main control unit of the autonomous driving vehicle and second monitoring information corresponding to the redundant control unit, respectively, wherein the first monitoring information includes a braking system state, a braking request value, a braking response feedback, and a first communication state of the main control unit, and the second monitoring information includes a second communication state of the redundant control unit;

[0066] A determination module 302, configured to determine whether the autonomous driving vehicle has a fault according to the first monitoring information and the second monitoring information;

[0067] The control module 303 is used to select a corresponding processing strategy to control the autonomous driving vehicle according to the cause of the fault if there is a fault in the autonomous driving vehicle, and switch to the redundant control unit to perform corresponding vehicle control when the main control unit fails completely.

[0068] In the embodiment of the present invention, by acquiring monitoring information of the main control unit and the redundant control unit of the autonomous driving vehicle, comprehensive monitoring of the operating status of the autonomous driving vehicle is achieved. When a fault is detected, the corresponding processing strategy can be quickly selected according to the cause of the fault, and by utilizing the redundant control unit, it is ensured that the autonomous driving vehicle can still be effectively controlled in the event of a main control unit failure, thereby improving the safety and reliability of autonomous driving.

[0069] See also Figure 4 Another embodiment of the fault handling device for the autonomous driving vehicle in the embodiment of the present invention includes:

[0070] An acquisition module 301 is used to acquire first monitoring information of a main control unit of the autonomous driving vehicle and second monitoring information corresponding to the redundant control unit, respectively, wherein the first monitoring information includes a braking system state, a braking request value, a braking response feedback, and a first communication state of the main control unit, and the second monitoring information includes a second communication state of the redundant control unit;

[0071] A determination module 302, configured to determine whether the autonomous driving vehicle has a fault according to the first monitoring information and the second monitoring information;

[0072] The control module 303 is used to select a corresponding processing strategy to control the autonomous driving vehicle according to the cause of the fault if there is a fault in the autonomous driving vehicle, and switch to the redundant control unit to perform corresponding vehicle control when the main control unit fails completely.

[0073] Optionally, the determination module 302 includes:

[0074] The first judgment unit 3021 is used to compare the braking request value with the current capacity of the braking system in the braking system state to determine whether there is a performance fault in the braking system;

[0075] The second judgment unit 3022 is used to analyze the brake system response feedback and judge whether there is a response failure of the brake system;

[0076] The third judgment unit 3023 is used to judge whether there is a communication failure between the main control unit and the redundant control unit according to the first communication status and the second communication status.

[0077] Optionally, the first determining unit 3021 may be specifically configured to:

[0078] The braking request value is compared with the current capacity of the braking system in the braking system status to determine whether the braking system has a performance failure; the second judgment unit is used to analyze the braking system response feedback to determine whether the braking system has a response failure; the third judgment unit is used to determine whether the main control unit and the redundant control unit have a communication failure based on the first communication status and the second communication status.

[0079] Optionally, the second determining unit 3022 may be specifically configured to:

[0080] Based on the brake system response feedback, check whether the brake system responds as expected; if the brake system does not respond as expected, it is determined to be a brake response failure.

[0081] Optionally, the third determination unit 3023 may also be specifically configured to:

[0082] The activities of the main control unit and the redundant control unit on the main CAN line and the redundant CAN line are determined according to the first communication state and the second communication state, and whether there is a communication fault between the main control unit and the redundant control unit is determined according to the results of the activities.

[0083] Optionally, the control module 303 includes:

[0084] The first control unit 3031 is used to evaluate the safety of the current driving environment when the fault cause is a slight insufficient braking capacity fault, and to perform corresponding control on the vehicle based on the safety evaluation result;

[0085] The second control unit 3032 is used to start the emergency braking procedure when the fault cause is severe insufficient braking capacity;

[0086] The third control unit 3033 is used to perform troubleshooting when the fault cause is a brake response fault, and if the fault cannot be eliminated, initiate a conservative driving strategy;

[0087] The fourth control unit 3034 is used to determine a corresponding processing strategy according to the type of fault when the cause of the fault is a control unit communication failure, and to perform corresponding control on the automatic driving vehicle based on the corresponding processing strategy.

[0088] Optionally, the fourth control unit 3034 may be specifically configured to:

[0089] When the cause of the fault is a minor lack of braking capacity, evaluate the safety of the current driving environment and control the vehicle accordingly based on the safety assessment results; when the cause of the fault is a severe lack of braking capacity, initiate the emergency braking procedure; when the cause of the fault is a braking response failure, perform troubleshooting, and if the fault cannot be eliminated, initiate a conservative driving strategy; when the cause of the fault is a control unit communication failure, determine the corresponding processing strategy based on the fault type, and control the autonomous driving vehicle accordingly based on the corresponding processing strategy.

[0090] In the embodiment of the present invention, by comprehensively monitoring the main control unit and redundant control units of the autonomous driving vehicle, braking system performance failures, response failures and communication failures are discovered in a timely manner, and corresponding vehicle control measures are taken according to the type and severity of the failure, including evaluating the safety of the driving environment, initiating emergency braking procedures, troubleshooting and switching control units, etc., thereby effectively improving the safety and reliability of the autonomous driving vehicle.

[0091] above Figure 3 and Figure 4 The fault handling device of the autonomous driving vehicle in the embodiment of the present invention is described in detail from the perspective of modular functional entities. The fault handling device of the autonomous driving vehicle in the embodiment of the present invention is described in detail from the perspective of hardware processing.

[0092] See also Figure 5 As shown, the fault handling device of the autonomous driving vehicle includes a processor 500 and a memory 501. The memory 501 stores machine executable instructions that can be executed by the processor 500. The processor 500 executes the machine executable instructions to implement the above-mentioned fault handling method of the autonomous driving vehicle.

[0093] Further, Figure 5 The fault handling device of the autonomous driving vehicle shown also includes a bus 502 and a communication interface 503 , and the processor 500 , the communication interface 503 and the memory 501 are connected via the bus 502 .

[0094] Among them, the memory 501 may include a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), for example, at least one disk storage. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 503 (which can be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. can be used. The bus 502 can be an ISA bus, a PCI bus or an EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0095] The processor 500 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 500. The above processor 500 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The disclosed methods, steps and logic block diagrams in the embodiments of the present disclosure can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present disclosure can be directly embodied as a hardware decoding processor to be executed, or a combination of hardware and software modules in the decoding processor can be executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 501 , and the processor 500 reads the information in the memory 501 and completes the method steps of the above-mentioned embodiment in combination with its hardware.

[0096] The present invention also provides a fault handling device for an autonomous driving vehicle, wherein the computer device includes a memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the steps of the fault handling method for the autonomous driving vehicle in the above-mentioned embodiments.

[0097] The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. Instructions are stored in the computer-readable storage medium. When the instructions are executed on a computer, the computer executes the steps of the fault handling method for the autonomous driving vehicle.

[0098] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0099] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program codes.

[0100] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for troubleshooting an autonomous driving vehicle, characterized in that: The fault handling method of the autonomous driving vehicle includes: Obtaining first monitoring information of a main control unit of the autonomous driving vehicle and second monitoring information corresponding to a redundant control unit, respectively, wherein the first monitoring information includes a braking system state, a braking request value, a braking response feedback, and a first communication state of the main control unit, and the second monitoring information includes a second communication state of the redundant control unit; Determining whether the autonomous driving vehicle has a fault according to the first monitoring information and the second monitoring information; If there is a fault in the autonomous driving vehicle, a corresponding processing strategy is selected according to the cause of the fault to perform corresponding control on the autonomous driving vehicle. When the main control unit fails completely, the redundant control unit is switched to perform corresponding vehicle control.

2. The fault handling method for an autonomous driving vehicle according to claim 1, characterized in that: The determining whether the automatic driving vehicle has a fault according to the first monitoring information and the second monitoring information includes: Comparing the braking request value with the current braking system capacity in the braking system state to determine whether the braking system has a performance fault, wherein the performance fault includes a slight braking capacity insufficient fault or a severe braking capacity insufficient fault; Analyzing the braking system response feedback to determine whether there is a response failure in the braking system; According to the first communication status and the second communication status, it is determined whether there is a communication failure between the main control unit and the redundant control unit.

3. The fault handling method for an autonomous driving vehicle according to claim 2, characterized in that: The comparing the braking request value with the current capacity of the braking system in the braking system state to determine whether the braking system has a performance fault includes: comparing the braking request value with a current capability of the braking system in the braking system state; When the braking request value is greater than the current capacity of the braking system, determining a relationship between the current capacity of the braking system and a preset braking capacity; If the current capacity of the braking system is greater than the preset braking capacity, it is determined to be a slight insufficient braking capacity fault; If the current capacity of the braking system is not greater than the preset braking capacity, it is determined to be a severe braking capacity deficiency fault.

4. The fault handling method for an autonomous driving vehicle according to claim 2, characterized in that: The analyzing the brake system response feedback to determine whether the brake system has a response fault includes: Based on the brake system response feedback, checking whether the brake system responds as expected; If the brake system does not respond as expected, it is determined to be a brake response failure.

5. The fault handling method for an autonomous driving vehicle according to claim 2, characterized in that: The determining, according to the first communication state and the second communication state, whether there is a communication failure between the main control unit and the redundant control unit includes: The activities of the main control unit and the redundant control unit on the main CAN line and the redundant CAN line are determined according to the first communication state and the second communication state, and whether there is a communication failure between the main control unit and the redundant control unit is determined according to the results of the activities.

6. The fault handling method for an autonomous driving vehicle according to claim 1, characterized in that: If the autonomous driving vehicle has a fault, a corresponding processing strategy is selected according to the fault cause to control the autonomous driving vehicle accordingly, and when the main control unit fails completely, the redundant control unit is switched to perform corresponding vehicle control, including: When the fault is caused by a minor insufficient braking capacity fault, the safety of the current driving environment is evaluated, and the vehicle is controlled accordingly based on the safety evaluation result; When the fault is caused by severe lack of braking capacity, the emergency braking procedure is initiated; When the fault is caused by a brake response failure, troubleshoot the fault. If the fault cannot be eliminated, activate the conservative driving strategy. When the cause of the fault is a control unit communication failure, the corresponding processing strategy is determined according to the fault type, and the autonomous driving vehicle is controlled accordingly based on the corresponding processing strategy. When the main control unit completely fails, the redundant control unit is switched to perform corresponding vehicle control.

7. The method for troubleshooting an automatic driving vehicle according to claim 6, characterized in that: When the cause of the fault is a control unit communication fault, a corresponding processing strategy is determined according to the fault type, and the autonomous driving vehicle is controlled accordingly based on the corresponding processing strategy, and when the main control unit completely fails, the redundant control unit is switched to perform corresponding vehicle control, including: If the cause of the fault is the complete loss of communication between the main control unit and the redundant control unit, the emergency braking procedure is executed; If the fault is caused by the loss of all communications with the main control unit and the redundant control unit is communicating normally, then switching to the redundant control unit to control the autonomous driving vehicle; If the fault is caused by partial communication loss of the main control unit, and the redundant control unit is communicating normally, it is determined whether to switch to the redundant communication line based on the normally communicating part; If the fault is caused by the loss of all communications of the redundant control units and the main control unit is normal, the main control unit maintains control over the autonomous driving vehicle; If the cause of the fault is the partial loss of communication of the redundant control unit and the main control unit is normal, the main control unit maintains control over the autonomous driving vehicle, and determines whether to switch to the redundant communication line based on the part of the redundant control unit that communicates normally.

8. A fault handling device for an autonomous driving vehicle, characterized in that: The fault handling device of the autonomous driving vehicle comprises: an acquisition module, configured to acquire first monitoring information of a main control unit of the autonomous driving vehicle and second monitoring information corresponding to the redundant control unit, respectively, wherein the first monitoring information includes a braking system state, a braking request value, a braking response feedback, and a first communication state of the main control unit, and the second monitoring information includes a second communication state of the redundant control unit; a judgment module, configured to judge whether the autonomous driving vehicle has a fault according to the first monitoring information and the second monitoring information; A control module is used to select a corresponding processing strategy to control the autonomous driving vehicle accordingly according to the cause of the fault if the autonomous driving vehicle has a fault, and to switch to the redundant control unit to perform corresponding vehicle control when the main control unit completely fails.

9. A fault handling device for an autonomous driving vehicle, characterized in that: The fault handling device of the autonomous driving vehicle comprises: a memory and at least one processor, wherein the memory stores instructions; The at least one processor calls the instructions in the memory so that the fault handling device of the autonomous driving vehicle executes the fault handling method of the autonomous driving vehicle as described in any one of claims 1-7.

10. A computer-readable storage medium having instructions stored thereon, characterized in that: When the instructions are executed by the processor, a fault handling method for an autonomous driving vehicle as described in any one of claims 1-7 is implemented.

Images