Vehicle autonomous driving redundancy system, control method and vehicle

Abstract

The application relates to the technical field of vehicle control and discloses a vehicle automatic driving redundancy system, a control method and a vehicle. The system comprises a main controller board, a redundancy controller board, a sensor system and an actuator system. In a first working mode, the main controller collects vehicle information and planned first computing power through a first sensor group, and the redundancy controller collects vehicle information and planned first computing power through a second sensor group; the main controller sends a first control instruction to a first actuator group and sends a second control instruction to a second actuator group; when a degradation condition is detected, the system is switched to a second working mode; and a controller which is not disconnected generates a third control instruction according to vehicle information and planned second computing power and sends the third control instruction to a corresponding actuator group to continue performing an automatic driving task. According to the scheme, the main controller and the redundancy controller share computing resources, sensor resources and actuator resources, a set of sensors and actuator systems arranged separately are avoided, and the system saves resources and reduces cost.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of vehicle control, in particular to a vehicle automatic driving redundancy system, a control method and a vehicle. BACKGROUND

[0002] In the intelligent networked vehicle and automatic driving system interconnection environment, the automated driving system (ADS) that needs to be taken over by the driver in some specific scenarios, needs to give the driver a response time of not less than 10s in the intervention request stage of the automated driving system, and during this period, the ADS system still needs to remain active; for the ADS system that does not need to be taken over by the driver, when the operational design condition (ODC) is about to be not met, or the ODC is suddenly not met, the ADS system needs to execute the minimal risk maneuver (MRM) in time and can make the vehicle reach a stationary state. When executing the MRM, the goal is to reduce the safety risk to an acceptable level; this requires that the sensors, controllers, communication and other systems of the vehicle (such as vehicle motion actuators, power supply) of the ADS system have redundancy design, so as to avoid the system from being unable to remain active or execute the MRM when a single point fails.

[0003] In the current ADS system, the highest cost of redundancy design is the sensor and controller part. In the current mainstream redundancy design, two completely independent sensor and controller systems are generally used to realize redundancy, which has a high design cost and will affect the popularization and expansion of the automatic driving system. SUMMARY

[0004] Therefore, the present application provides a vehicle automatic driving redundancy system, a control method and a vehicle to solve the problem of high design cost of the sensor and controller of the redundancy backup system.

[0005] In a first aspect, the present application provides a vehicle automatic driving redundancy system, which comprises a main controller board, a redundancy controller board, a sensor system and an actuator system; wherein the main controller board comprises a main controller, the redundancy controller board comprises a redundancy controller, a plurality of sensors in the sensor system are divided into a first sensor group and a second sensor group, a plurality of vehicle motion actuators in the actuator system are divided into a first actuator group and a second actuator group, and the two actuator groups are redundant to each other.

[0006] The main controller is connected to the first sensor group and the first actuator group respectively, and the redundancy controller is connected to the second sensor group and the second actuator group respectively; the main controller and the redundancy controller are connected through an inter-board connector.

[0007] The operation mode of the system includes a first working mode and a second working mode;

[0008] In the first working mode, the main controller collects vehicle information through the first sensor group, the redundant controller collects vehicle information through the second sensor group, and the two controllers jointly plan a first computing power, and the main controller sends a first control instruction to the first actuator group and a second control instruction to the second actuator group to jointly execute an automatic driving task with the two actuator groups;

[0009] When a degradation condition is detected, the first working mode is switched to the second working mode, and the connection of the failed or faulty part of the controller is disconnected;

[0010] In the second working mode, the controller that is not disconnected generates and sends a third control instruction to the corresponding actuator group according to the vehicle information collected by the corresponding sensor group and a second computing power planned by the controller, to execute a backup automatic driving task, and the second computing power is less than the first computing power.

[0011] The vehicle automatic driving redundancy system provided in the aspect has the ability to automatically detect degradation conditions. Once a performance degradation fault or failure of the main controller board, the redundant controller board, or related components is detected, the system can immediately switch to the second working mode, and the normally connected controller takes over the control authority. After degradation, any non-failed controller runs all dynamic driving tasks under MRM alone. This automatic switching mechanism greatly improves the fault tolerance and fault handling capability of the system.

[0012] In addition, in the first working mode, the main controller and the redundant controller simultaneously collect vehicle information and plan computing power, that is, in the normal operating state, the main controller and the redundant controller jointly assume all dynamic driving tasks of the ADS. Although the redundant controller does not directly control the actuator at this time, it also performs real-time data analysis and processing as a backup. This parallel processing method helps the redundant controller to quickly and accurately take over the control task when the main controller fails, thereby avoiding interruption or delay of the automatic driving task.

[0013] In addition, the main controller and the redundant controller jointly access the sensor system and the actuator system, share computing resources, sensor resources, and vehicle motion actuator resources, avoid arranging a set of sensors and actuators separately, and save resources and reduce cost overheads.

[0014] With reference to the first aspect, in a possible implementation, in the first working mode, the main controller receives vehicle information collected by the first sensor group, the redundant controller receives vehicle information collected by the second sensor group, and reports the vehicle information to the main controller through the inter-board connector;

[0015] The main controller runs the main software stack according to the vehicle information collected by itself and the vehicle information reported by the redundant controller, and sends the first control instruction to the first actuator group and the second control instruction to the second actuator group.

[0016] With reference to the first aspect, in another possible implementation, in the first working mode, the main controller and the redundant controller further detect whether a degradation condition is triggered;

[0017] If yes, degradation is started, one of the main controller and the redundant controller is selected as a target controller to continue working, and the target controller cooperates with the first actuator group or the second actuator group to independently execute an automatic driving task, and the target controller is a controller that is not disconnected.

[0018] With reference to the first aspect, in yet another possible implementation, the degradation condition includes one or more of the following:

[0019] The main controller or the redundant controller fails;

[0020] A circuit module, a connection wire or a signal transmission on the main controller board or the redundant controller board fails;

[0021] Any one or more sensors in the sensor system fail;

[0022] Any one or more actuators in the actuator system fail;

[0023] The chassis system of the vehicle fails;

[0024] The power supply unit fails.

[0025] With reference to the first aspect, in yet another possible implementation, the main controller board further includes a first microcontroller, and the redundant controller board further includes a second microcontroller;

[0026] The first microcontroller is connected to the main controller and the second microcontroller respectively, and the second microcontroller is connected to the redundant controller;

[0027] The first microcontroller sends an indication signal to the second microcontroller when detecting that the main controller is abnormal, and informs the main controller to hand over the control right to the redundant controller;

[0028] The second microcontroller informs the redundant controller to take over the control right when receiving the indication signal from the first microcontroller, so that the redundant controller executes the backup automatic driving task through the second sensor group and the second actuator group.

[0029] In combination with the first aspect, in yet another possible implementation manner, in the first working mode, the main controller and the redundant controller start a second planned computing power standby software stack, and the standby software stack is used to start and execute the automatic driving task when a degradation condition is triggered.

[0030] In combination with the first aspect, in yet another possible implementation manner, the number of sensors included in the first sensor group is n1, the number of sensors included in the second sensor group is n2, and n1≥1 and n2≥1; wherein the detection range of the n1 sensors covers 360° of the vehicle, and the detection range of the n2 sensors covers 360° of the vehicle.

[0031] In combination with the first aspect, in yet another possible implementation manner, the system further includes a first CAN bus and a second CAN bus; the first CAN bus and the second CAN bus are used to connect the first actuator group and the main controller, and connect the second actuator group and the redundant controller.

[0032] Secondly, the present application provides a vehicle automatic driving redundancy control method, which is applied to the vehicle automatic driving redundancy system in the first aspect or any implementation manner of the first aspect, and the control method includes:

[0033] Detecting whether a degradation condition is triggered in the system design running under the vehicle automatic driving system;

[0034] If not, a first working mode is executed, in which the main controller collects vehicle information through the first sensor group, and the redundant controller collects vehicle information through the second sensor group and plans a computing power;

[0035] The main controller sends a first control instruction to the first actuator group and a second control instruction to the second actuator group according to the vehicle information and the first computing power planned by the two controllers, so as to cooperatively execute an automatic driving task by the two actuator groups.

[0036] With reference to the second aspect, in a possible implementation, the method further includes: if yes, switching the first working mode to a second working mode, and disconnecting the failed or malfunctioning part of the controller connection control;

[0037] In the second working mode, the controllers that are not disconnected generate and send third control instructions to the corresponding actuator groups according to the vehicle information collected by the corresponding sensor groups and the planned second computing power, to cooperatively execute a backup automatic driving task, the second computing power being less than the first computing power.

[0038] With reference to the second aspect, in another possible implementation, the method further includes: in the first working mode, the main controller and the redundant controller start a hot-standby software stack according to the planned second computing power, the hot-standby software stack being used to start and execute the automatic driving task when a degradation condition is triggered.

[0039] With reference to the second aspect, in yet another possible implementation, in the second working mode, the controllers that are not disconnected generate and send third control instructions to the corresponding actuator groups according to the vehicle information collected by the corresponding sensor groups and the planned second computing power, including:

[0040] In the second working mode, the redundant controller starts and runs the hot-standby software stack according to the vehicle information collected by the second sensor group, in combination with the normally operating modules on the main control board, sends the third control instructions, and stops the working of the first computing power.

[0041] With reference to the second aspect, in yet another possible implementation, the first computing power is a first percentage of total computing resources, used to run a main software stack in the first working mode; wherein the total computing resources include the sum of the computing resources of the main controller and the computing resources of the redundant controller; the second computing power is a second percentage of the total computing resources, used to run the hot-standby software stack in the second working mode, the first percentage being greater than the second percentage.

[0042] Thirdly, the present application provides a vehicle, the vehicle comprising a redundant system;

[0043] The redundant system is the vehicle automatic driving redundant system in the first aspect or any implementation of the first aspect;

[0044] The vehicle automatic driving redundant system is used to execute the vehicle automatic driving redundant control method in the second aspect or any implementation of the second aspect.

[0045] In a fourth aspect, the present application provides a controller, comprising a memory and a processor, the memory and the processor being communicatively connected with each other, and the memory storing computer instructions, and the processor executing the vehicle automatic driving redundancy control method of the second aspect or any of the corresponding embodiments thereof by executing the computer instructions.

[0046] Optionally, the controller can be a main controller, or can also be a redundancy controller.

[0047] In addition, the present application provides a computer readable storage medium, which stores computer instructions for causing a computer to execute the vehicle automatic driving redundancy control method of the first aspect or any of the corresponding embodiments thereof.

[0048] The vehicle automatic driving redundancy system, the control method and the vehicle provided by the present application have the following beneficial effects:

[0049] First, the reliability of the automatic driving system is improved: the system realizes the redundancy design of the key components of the system by introducing the redundancy controller, the second sensor group and the second actuator group. When the main controller or the first sensor group and the first actuator group connected thereto fails, the system can quickly switch to the redundancy controller board and the corresponding sensor group and actuator group, and continue to execute the automatic driving task, thereby ensuring the continuity and safety of the automatic driving task.

[0050] Second, the fault tolerance of the system is enhanced: the system provided by the present application has the ability to automatically detect degradation conditions. Once the performance of the main controller board or the related components is detected to be degraded or failed, the system can immediately switch to the second working mode, and the redundancy controller takes over the control authority. After degradation, any non-failed controller runs all dynamic driving tasks under MRM alone. This automatic switching mechanism greatly improves the fault tolerance and fault handling capability of the system.

[0051] In addition, in the first working mode, the main controller and the redundancy controller simultaneously collect vehicle information and plan computing power, that is, in the normal operating state, the main controller and the redundancy controller jointly undertake all dynamic driving tasks of the ADS. Although the redundancy controller does not directly control the actuator at this time, it also performs real-time data analysis and processing as a backup. This parallel processing method helps the redundancy controller to quickly and accurately take over the control task when the main controller fails, thereby avoiding the interruption or delay of the automatic driving task.

[0052] Third, save resources and cost: the system provided by the application, the main controller board and the redundant controller board are connected through the inter-board connector, and the main controller and the redundant controller are connected to the sensor system and the actuator system, share the computing resources, sensor resources, vehicle motion actuator resources, thereby avoiding arranging a set of redundant sensor resources and actuator resources alone, compared with the two sets of completely independent sensors and controller systems used at present to realize redundancy, the scheme can save a set of sensor and actuator system, thereby saving resources and reducing cost.

[0053] Fourth, improve the flexibility and scalability of the system: the system architecture of the application is flexible and easy to extend or adjust according to actual needs. For example, more sensors or actuators can be added to improve the sensing and execution ability of the system; or the hardware and software of the controller board are upgraded to improve the computing performance and intelligent level of the system. BRIEF DESCRIPTION OF DRAWINGS

[0054] In order to more clearly illustrate the specific embodiments of the application or the technical solutions in the prior art, the drawings needed in the specific embodiments or prior art description will be briefly introduced below. Obviously, the drawings in the following description are some embodiments of the application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0055] Figure 1 is a structural schematic diagram of a vehicle automatic driving redundancy system according to an embodiment of the application;

[0056] Figure 2 is a structural schematic diagram of another vehicle automatic driving redundancy system according to an embodiment of the application;

[0057] Figure 3a is a schematic diagram of a group of sensor groups covering 360° view angle of the vehicle according to an embodiment of the application;

[0058] Figure 3b is a schematic diagram of another group of sensor groups covering 360° view angle of the vehicle according to an embodiment of the application;

[0059] Figure 4 is a structural schematic diagram of a main controller module controlling vehicle automatic driving according to an embodiment of the application;

[0060] Figure 5 is a flow chart of a vehicle automatic driving redundancy control method according to an embodiment of the application;

[0061] Figure 6 is a flow chart of another vehicle automatic driving redundancy control method according to an embodiment of the application;

[0062] Figure 7 is a schematic diagram of another software stack starting to run and occupying total computing resources according to an embodiment of the present application;

[0063] Figure 8 is a flow chart of still another vehicle automatic driving redundancy control method according to an embodiment of the present application;

[0064] Figure 9 is a hardware structure schematic diagram of a controller according to an embodiment of the present application;

[0065] Figure 10 is a structure schematic diagram of a vehicle according to an embodiment of the present application. DETAILED DESCRIPTION

[0066] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0067] In the description of the present application, it should be noted that unless otherwise explicitly specified and limited, the terms “mounting”, “connection”, “connecting” should be understood in a broad sense, for example, can be fixed connection, can also be detachable connection, or integral connection; can be mechanical connection, can also be electrical connection; can be direct connection, can also be indirect connection through an intermediate medium, can be the communication inside two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood according to the specific circumstances.

[0068] In addition, the terms “first”, “second” are only for descriptive purpose, and cannot be understood as indicating or implying relative importance.

[0069] The technical features involved in the different embodiments of the present application described below can be combined with each other as long as there is no conflict.

[0070] The technical solutions provided by the embodiments of the present application are applied to the vehicle control technical field, and are especially for the automated driving system (ADS). In the current ADS system, the sensor and controller part has a higher cost of redundancy design. In the mainstream redundancy design, two completely independent sensor and controller systems are generally used to realize redundancy. The high cost of this design will become the biggest obstacle to the popularization of the automated driving system.

[0071] In addition, the traditional redundant automatic driving perception and controller system generally only works when the main system fails. When the main system works normally, the redundant control system is generally in a hot standby or silent state, so the redundant control system has no contribution to the perception / control of the vehicle when it works normally. This design is a waste of valuable hardware resources.

[0072] To solve the above technical problems, the embodiment of the present application provides a vehicle automatic driving redundant system, which not only meets the requirements of the ADS system, designs a set of redundant controller system based on the requirements of safety redundancy and sensor grouping, but also considers the needs of the L2 assisted driving system. On the one hand, the circuit modules between the main controller board and the redundant controller board jointly constitute the controller of the ADS system, and on the other hand, the main controller board constitutes the controller of the L2 assisted driving system alone, thereby saving system resources and reducing cost overhead.

[0073] The technical solutions provided by the embodiment of the present application will be described in detail below.

[0074] Referring to Figure 1 A structure schematic diagram of a vehicle automatic driving redundant system provided by the embodiment is shown in the figure. The system includes a main controller board, a redundant controller board, a sensor system, and an actuator system. In addition, the system also includes a transmission bus, such as a first CAN (Controller Area Network) bus, a second CAN bus, a power supply unit, etc., which are not limited by the embodiment.

[0075] The CAN bus is a serial communication bus for real-time control, mainly used for communication between automotive electronic devices, as well as industrial automation and medical devices, etc. In the embodiment, the first CAN bus and the second CAN bus are used to connect the first actuator group with the main controller, and to connect the second actuator group with the redundant controller.

[0076] Among them, the main controller board includes a main controller, and the redundant controller board includes a redundant control.

[0077] Optionally, the above controller can be a SOC (System on Chip), such as SOC1 for the main controller and SOC2 for the redundant controller. It should be understood that the main controller or the redundant controller can also be other processors or processing units, which are not limited by the embodiment.

[0078] The sensor system includes a plurality of sensors, which can be divided into a first sensor group and a second sensor group, and each sensor group includes at least one sensor. The sensors in the first sensor group and the second sensor group can overlap or not overlap.

[0079] Referring toFigure 2 As shown, specifically, the plurality of sensors in the sensor system includes different architecture sensors such as a laser radar, a millimeter wave radar, a camera, a camera module, etc. The embodiments are not limited thereto.

[0080] In addition, the actuator system includes a plurality of vehicle motion actuators, which can be divided into a first actuator group and a second actuator group, and the two actuator groups are redundant. Each actuator group includes at least one vehicle motion actuator. The first actuator group and the second actuator group in the actuator system are used to jointly perform all dynamic driving tasks (DDT).

[0081] The at least one vehicle motion actuator in each actuator group includes, but is not limited to, a steering system actuator, a braking system actuator, etc. In the embodiments, the first actuator group includes a steering system 1 and a braking system 1. The second actuator group includes a steering system 2 and a braking system 2. In addition, each actuator group can also include other vehicle motion actuators, which are not limited in the embodiments.

[0082] In the embodiments, the main controller (SOC1) is connected to the first sensor group and the first actuator group, respectively, and the redundant controller (SOC2) is connected to the second sensor group and the second actuator group, respectively.

[0083] Referring to Figure 2 A specific implementation is that the main controller (SOC1) is connected to a plurality of cameras, such as a group of cameras, through at least one deserializer (such as deserializers 1-4), for monitoring a 360° view range around the vehicle, including but not limited to front and rear view mirrors, side view mirrors, surround view mirrors, in-cabin, etc. Similarly, the redundant controller (SOC2) is connected to another front view mirror through deserializer 5.

[0084] In addition, the main controller (SOC1) is also connected to a laser radar through switch 1. The SOC1 and the SOC2 can also be connected to a millimeter wave radar through a switch, a microprocessor (MCU), and a CAN bus, respectively. For example, the SOC1 is connected to the millimeter wave radar through switch 1, MCU1, and CAN_PHY (Physical Layer), CAN1, or CAN2. The SOC2 is connected to the millimeter wave radar through switch 2, MCU2, and CAN_PHY, CAN1, or CAN2.

[0085] The main controller (SOC1) and the redundant controller (SOC2) are connected through the inter-board connectors; specifically, the main controller (SOC1) is connected to the inter-board connector 1, the redundant controller (SOC2) is connected to the inter-board connector 2, and the inter-board connector 1 and the inter-board connector 2 are connected through a high-speed communication bus, which can be used to transmit high-speed communication signals such as I2C signals.

[0086] Optionally, the inter-board connector 1 and the inter-board connector 2 can each be a BTB (Board-to-Board) connector, which is a component used to connect different circuit boards (PCBs) in electronic devices. It can be used to provide reliable electrical connections, allowing signals, power or data to be transmitted between one circuit board and another. It is a transmitter of signals, power and data, with super-strong transmission capability. In this embodiment, it is used to transmit high-speed signals such as PCIe signals between the main controller board and the redundant controller board.

[0087] Referring to Figure 2 The system can also include other more or fewer modules, such as a power supply unit, an MCU (Microcontroller Unit) power supply, an IMU (Inertial Measurement Unit), etc.

[0088] Specifically, the main controller board includes a first microprocessor (MCU1), an IMU1, a power supply 1, an MCU power supply, an SOC power supply, a switch 1 and a plurality of CAN_PHY. The power supply 1 is the main power supply of the main controller board, used to transmit electrical energy to the MCU power supply and the SOC power supply, the MCU power supply supplies power to the MCU1 and the IMU1, and the SOC power supply supplies power to the SOC1 and the deserializers 1-4.

[0089] Similarly, the redundant controller board includes a second microprocessor (MCU2), an IMU2, a power supply 2, another MCU power supply, another SOC power supply, a switch 2 and a plurality of CAN_PHY. The redundant controller is connected to the actuator system through the switch 2, the MCU2 and the plurality of CAN_PHY. The power supply 2 is the backup power supply of the redundant controller board, used to supply power to the MCU power supply and the SOC power supply on the redundant controller board. The MCU power supply supplies power to the MCU2 and the IMU2, and the SOC power supply supplies power to the SOC2 and the deserializer 5.

[0090] In addition, the IMU is a sensor used to measure and track the attitude (such as direction, angle and speed) of an object.

[0091] It should be understood that the vehicle automatic driving redundancy system in the embodiment can also include more or fewer units or modules, and the embodiment is not limited in this regard.

[0092] The scheme provided by the embodiment can be applied to a typical ADS system including the above-mentioned sensor system including a plurality of heterogeneous sensors, and the sensor types include but are not limited to front and rear view cameras, side view cameras, surround view cameras, millimeter wave radars, and laser radars. These sensors are divided into a first sensor group and a second sensor group, and both of the two sensor groups cover the 360° detection range of the vehicle body. And different sensor groups can take into account the required sensing accuracy and sensing distance under different weather, different environment and different vehicle speed conditions according to the characteristics.

[0093] For example Figure 3a Fig. 1 shows a schematic diagram of the 360° range of the vehicle body detected by the sensors included in the first sensor group; Figure 3b Fig. 2 shows a schematic diagram of the 360° range of the vehicle body detected by the sensors included in the second sensor group.

[0094] Optionally, the number of sensors included in the first sensor group is n1, and the number of sensors included in the second sensor group is n2, and n1≥1 and n2≥1; wherein the detection range of the n1 sensors covers the 360° view angle of the vehicle, and the detection range of the n2 sensors covers the 360° view angle of the vehicle, so as to ensure that the 360° view angle range of the vehicle can be detected by using either of the two sensor groups.

[0095] Under the ADS system, the embodiment provides two operating modes, which are respectively a first working mode and a second working mode.

[0096] In the first working mode, the controllers on the main control board and the redundancy control board are simultaneously started to work, the main controller SOC1 collects vehicle information through the first sensor group, the redundancy controller SOC2 collects vehicle information through the second sensor group, and the first computing power planned by the two controllers is shared, such as the first computing power required by the demand, and the first computing power is used to execute the main software stack. And the main controller SOC1 sends a first control instruction to the first actuator group and a second control instruction to the second actuator group to cooperatively execute the automatic driving task with the two actuator groups.

[0097] In the first working mode, the main controller SOC1 performs the control right of the vehicle redundancy system according to the first computing power, on the one hand, receives the vehicle information collected by the first sensor group, such as the photographed photos, images, collected driving speed, acceleration and the like; on the other hand, the redundancy controller SOC2 collects the vehicle information through the second sensor group, such as the photographed photos, images, collected driving speed, acceleration and the like, and reports the information to the main controller SOC1 through the inter-board connector, and then the main controller SOC1 receives the vehicle information collected by the second sensor group.

[0098] The main controller SOC1 generates and sends the first control instruction to the first actuator group and the second control instruction to the second actuator group according to the vehicle information collected by itself, the vehicle information reported by the redundancy controller SOC2 and the first computing power.

[0099] Specifically, the first control instruction can be sent to the first actuator group through the MCU1 of the main controller SOC1 and the first CAN bus, and the second control instruction can be sent to the second actuator group through the MCU1 and the second CAN bus. The number of the first control instruction and the second control instruction can be one or more, such as n3 first control instructions sent to n3 vehicle motion actuators of the first actuator group, and n4 second control instructions sent to n4 vehicle motion actuators of the second actuator group.

[0100] When the trigger degradation condition is detected, the first working mode is switched to the second working mode, and the connection control of the failed or faulty part of the controller is disconnected. The part of the controller can be the main controller, the redundancy controller, or any module or circuit on the controller board that fails or fails.

[0101] Among them, one of the trigger degradation conditions is that the main controller board fails, such as the main controller SOC1 fails, the MCU1 fails, or a certain circuit module, connection wire or signal transmission on the main controller board fails. Trigger degradation condition, at this time, the first working mode is switched to the second working mode.

[0102] In the second working mode, the controller not disconnected according to the vehicle information collected by the corresponding sensor group and the planned second computing power generates and sends the third control instruction to the corresponding actuator group to execute the backup automatic driving task, wherein the second computing power is less than the first computing power. In addition, the execution of the backup automatic driving task can continue to execute the self-driving task of the aforementioned main controller.

[0103] In one embodiment, the redundant controller SOC2 runs the hot-standby software stack in combination with the second set of sensors and the normally connected part of the circuit or module in the main controller board to generate and send the third control instructions to the second set of actuators to continue the autonomous driving task in cooperation with the second set of actuators. At this time, the failed or failed circuit in the main controller board is cut off, and the control right is transferred to the redundant controller. In this embodiment, in the case of failure or failure of the main controller or part of the circuit on the main controller board, the degradation operation is triggered, and the system starts the hot-standby software stack to execute MRM to continue the autonomous driving task.

[0104] Optionally, in a specific embodiment, in the first working mode, MCU2 runs the same control software as MCU1, which includes the main software stack and the hot-standby software stack. However, in the first working mode, the hot-standby software stack is started but does not output control instructions to the vehicle motion actuators. Only when the system fails or fails, the degradation condition is triggered, the second working mode is switched, the hot-standby software stack is started and executed, the minimum risk strategy MRM is executed, and the third control instructions are output to the second set of actuators to continue the autonomous driving task in cooperation with the vehicle motion actuators of the second set of actuators.

[0105] The vehicle motion actuators in the above-mentioned second set of actuators include horizontal and vertical actuators, such as brake systems, steering systems, etc.

[0106] In this embodiment, the main controller, the redundant controller, the sensor system and the actuator system in the ADS system are respectively grouped and accessed to the main controller board and the redundant controller board. The main controller and the redundant controller are connected through the high-speed BTB connector. The sensor data received by the two controller boards can be shared with each other through the high-speed bus. The SOC1 and SOC2 in the two controller boards can also interact the intermediate state and result through the high-speed communication bus, so as to realize the expansion of computing power.

[0107] In the ADS system, according to the regulation requirements, when the design operation condition (ODC) does not meet the trigger degradation condition, which includes: detecting that the state of the ADS system is not normal, such as controller failure (such as main controller SOC1 or redundant controller SOC2 failure), sensor failure (such as failure of any one or more sensors in the sensor system), failure of the circuit module, connection wire or signal transmission on the main controller board or the redundant controller board, or failure or abnormality of any one or more vehicle motion actuators in the actuator system, such as chassis system, power supply system failure (such as power supply unit failure), the ADS system can perform working mode degradation operation and execute the minimum risk strategy MRM.

[0108] To avoid the entire ADS system from exiting and being unable to perform MRM after multiple point failures, when a single point failure occurs in the above system (including the main controller, redundant controller, sensors, and other systems of the vehicle), the ADS system should enter a degraded mode, and in the degraded mode, the MRM can be performed by the non-failed controller module (main controller or redundant controller) and the sensors and actuators connected thereto.

[0109] One implementation is that, in the first working mode, the main controller and the redundant controller also detect whether a degradation condition is triggered; if so, degradation is started, the second working mode is switched to, one of the main controller and the redundant controller is selected as a target controller to continue to work, the controller that has failed or failed is disconnected, and the first actuator group or the second actuator group is used to perform the automatic driving task alone in cooperation with the target controller. In this embodiment, the target controller is the redundant controller.

[0110] In the ADS system, generally two actuator groups are included, and the two actuator groups are redundant to each other; communication is performed with the main controller board and the redundant controller board through two CAN buses, control instructions from the main controller board are received when the main controller is working normally, and control instructions from the redundant controller are received when the main controller fails.

[0111] In addition, the main controller and the redundant controller also detect whether a degradation condition is triggered, which can be implemented by the first MCU (MCU1) and the second MCU (MCU2). Specifically, when the first MCU detects that the main controller SOC1 has an abnormality, the first MCU sends an indication signal to the second MCU and informs the main controller SOC1 to transfer control authority to the redundant controller SOC2. When the second MCU receives the indication signal from the first MCU, the second MCU informs the redundant controller SOC2 to take over the control authority, so that the redundant controller SOC2 performs the automatic driving task MRM alone through the second sensor group and the second actuator group.

[0112] In this embodiment, the redundant controller SOC2 takes over the control authority and performs MRM alone in the second working mode, and the target controller is SOC2. Similarly, when the redundant controller SOC2 fails, the main controller SOC1 can continue to control the first sensor group and the first actuator group, and cut off or not receive the measurement data reported from the redundant controller board, so that the main controller SOC1 performs MRM alone. At this time, the target controller is SOC1.

[0113] In this embodiment, in the above Figure 3a It is shown that the detection range of the first sensor group covers 360° of the vehicle, Figure 3b It is shown that the detection range of the second sensor group covers 360° of the vehicle.

[0114] It should be noted that sensor grouping of multiple sensors in the sensor system is only one implementation, and the grouping can be reasonably adjusted according to the needs in specific products; the key to adjusting the grouping is to ensure that the visual angle range of two sensor groups detected alone can cover the 360° visual angle of the whole vehicle, and there are two or more heterogeneous sensors, and there are front and rear key directions with long distance detection capability (at least more than 100 meters) at the same time, so as to ensure the safety of the MRM task in high-speed scene or bad weather conditions.

[0115] In addition, in the ADS system, two power supplies are included, in which the main power supply supplies power to each circuit or module in the main controller board, and the backup power supply supplies power to each circuit or module on the redundant controller board.

[0116] The vehicle automatic driving redundancy system provided by the application has the following beneficial effects:

[0117] First, improve the reliability of the automatic driving system: the system realizes the redundancy design of the key components of the system by introducing the redundant controller, the second sensor group and the second actuator group. When the main controller or the first sensor group and the first actuator group connected thereto fails, the system can quickly switch to the redundant controller board and the corresponding sensor group and actuator group, and continue to perform the automatic driving task, thereby ensuring the continuity and safety of the automatic driving task.

[0118] Second, enhance the fault tolerance of the system: the system provided by the application has the ability to automatically detect degradation conditions. Once the performance of the main controller board or related components is detected to be degraded or failed, the system can immediately switch to the second working mode, and the redundant controller takes over the control authority. After degradation, any non-failed controller runs all dynamic driving tasks under MRM alone. This automatic switching mechanism greatly improves the fault tolerance and fault handling capability of the system.

[0119] In addition, in the first working mode, the main controller and the redundant controller simultaneously collect vehicle information and plan computing power, that is, in the normal operating state, the main controller and the redundant controller jointly undertake all dynamic driving tasks of the ADS. Although the redundant controller does not directly control the actuator at this time, it also performs real-time data analysis and processing as a backup. This parallel processing method helps the redundant controller to quickly and accurately take over the control task when the main controller fails, thereby avoiding interruption or delay of the automatic driving task.

[0120] Third, save resources and cost: the system provided by the application, the main controller board and the redundant controller board are connected through the inter-board connector, and the main controller and the redundant controller are connected to the sensor system and the actuator system, share computing resources, sensor resources, vehicle motion actuator resources, thereby avoiding arranging a set of redundant sensor resources and actuator resources alone, compared with the two sets of completely independent sensors and controller systems currently used to realize redundancy, the scheme can save a set of sensor and actuator system, thereby saving resources and reducing cost.

[0121] Fourth, improve the flexibility and scalability of the system: the system architecture of the application is flexible and easy to extend or adjust according to actual needs. For example, more sensors or actuators can be added to improve the sensing and execution capabilities of the system; or the hardware and software of the controller board are upgraded to improve the computing performance and intelligent level of the system.

[0122] In another embodiment, the vehicle automatic driving redundant system provided by the application also supports L2 assisted driving control. Specifically, under the L2 assisted driving control system, the system only includes a main controller board, the sensors and actuators are connected to the main controller SOC1 on the main controller board, and the DDT is completed by the main controller SOC1 alone.

[0123] Specifically, the system block diagram is as shown in Figure 4 Under the L2 assisted driving control system (referred to as "L2 system"), the main controller is connected to at least one sensor of the sensor system, and is connected to at least one vehicle motion actuator of the actuator system through the first MCU; the main controller controls at least one vehicle motion actuator to execute the automatic driving task according to the sensing result of at least one sensor and the planning computing power, at this time, the redundant controller on the redundant controller board and the second MCU are standby and do not start working, that is, the redundant controller board does not need to start working.

[0124] In the L2 system, the main controller SOC1 is connected to all sensors in the sensor system and all vehicle motion actuators in the actuator system, and performs path planning and vehicle operation control according to the sensing results reported by all connected sensors. In this working mode, the sensing and planning software is mainly run by SOC1, and the control software is run by MCU1. And a plurality of deserializers are connected to the camera or sensor, and at least one actuator in the actuator system and the millimeter wave radar are connected through the CAN_PHY (CAN bus physical layer).

[0125] In the L2 system, a group of vehicle motion actuators are generally provided to communicate with the main controller SOC1 through 1-2 CAN buses. And only one main power output is needed to supply power to the main controller SOC1 and MCU1 on the main controller board.

[0126] In this embodiment, self-driving control is realized in the dual system of the ADS system and the L2 assisted driving system, so that the functionality of the vehicle automatic driving redundant control system is stronger and the adaptation range is more extensive.

[0127] In another embodiment of the present application, a vehicle automatic driving redundant control method is also provided, which is applied to the vehicle automatic driving redundant system shown in the foregoing Figure 1 or Figure 2 , and a flowchart of a vehicle automatic driving redundant control method of an embodiment of the present application is shown in Figure 5 , which includes the following steps.

[0128] Step S101: In the vehicle automatic driving system, it is detected whether a system design operation triggers a degradation condition.

[0129] Specifically, in the ADS system, whether the design operation condition ODC triggers the degradation condition can be determined by the mutual detection of MCU1 and MCU2, or determined by the main controller SOC1 and the redundant controller SOC2 in the communication process.

[0130] Further, the determination of whether the degradation condition is triggered includes one or more of the following: failure of the main controller or the redundant controller; failure of the circuit modules, connection wires or signal transmission on the main controller board or the redundant controller board; failure of any one or more sensors in the sensor system; failure of any one or more vehicle motion actuators in the actuator system; failure of the chassis system of the vehicle; failure of the power supply unit in the system.

[0131] Step S102: If no, i.e. no system failure or failure is detected, a first working mode is executed, in which the main controller collects vehicle information through the first sensor group and the redundant controller collects vehicle information through the second sensor group.

[0132] Step S103: The main controller sends a first control instruction to the first actuator group and a second control instruction to the second actuator group according to the vehicle information and the first computing power jointly planned by the two controllers, so as to jointly execute the automatic driving task by the two actuator groups.

[0133] The specific implementation process is the same as the description of the "first working mode" in the foregoing embodiment, and reference can be made to the foregoing embodiment, which will not be described here.

[0134] Optionally, as shown in Figure 6 , after the above steps S101-S103, it further includes: in the first working mode, MCU1 and MCU2 mutually detect in real time whether the ODC triggers the degradation condition, i.e. step S101 is executed.

[0135] Step S104: If yes, switch the first working mode to the second working mode, and disconnect the failed or malfunctioning part of the controller connection control.

[0136] Step S105: In the second working mode, the controller that is not disconnected generates and sends a third control instruction to the corresponding actuator group according to the vehicle information collected by the corresponding sensor group and the planned second computing power, to execute the backup automatic driving task.

[0137] Wherein, the second computing power is less than the first computing power. In addition, the backup automatic driving task is a continuation of the automatic driving task in the aforementioned step S103.

[0138] In a specific example, when SOC1 is disconnected due to failure, the second working mode is switched to, and the redundant controller SCO2 takes over the control authority, and the redundant controller SCO2 generates and sends a third control instruction to the second actuator group according to the vehicle information collected by the second sensor group and the planned second computing power, to continue to execute the automatic driving task with the second execution group.

[0139] Similarly, in step S101, if the degradation condition is detected, but it is determined that the failure or failure occurs on the redundant controller board, such as SOC2 failure or MCU2 failure, then the degradation operation is still performed, and the main controller SOC1 and MCU1 control the execution of MRM according to the planned second computing power, while the circuit on the redundant controller board is cut off or closed to control the execution of the actuator and collection of sensor data, etc.

[0140] Wherein, in the control method of the embodiment, the controllers in the L2 auxiliary driving system can completely reuse the main controller modules in the ADS system, except that the number of sensors and actuators accessed is different. Therefore, complete modular and platform design can be achieved.

[0141] Specifically, in the above software control aspect, the use and allocation process of the computing resource specifically includes:

[0142] In the first working mode, the main controller and the redundant controller jointly run the main software stack according to the planned first computing power to execute the first working mode, and at the same time, the second computing power is used to start the hot standby software stack. The hot standby software stack is used to start and execute the automatic driving task when the degradation condition is triggered. When the degradation condition is triggered, the first working mode is degraded to the second working mode, and in the second working mode, the controller that is not disconnected starts and runs the hot standby software stack according to the vehicle information collected by the corresponding sensor group and the planned second computing power, sends the third control instruction, and stops the work of the first computing power, i.e. stop running the main software stack.

[0143] For example Figure 7As shown, when the main software stack is started to run, the first computing power is a first percentage of the total computing resources, such as 80%; wherein the total computing resources include the sum of the computing resources of the main controller SOC1 and the computing resources of the redundant controller SOC2. When the hot-standby software stack is started to run, the second computing power is a second percentage of the total computing resources, such as 20%, and the first percentage is greater than the second percentage, such as 80%>20%.

[0144] In this embodiment, the computing resources are partitioned in the two SOCs of the main controller and the redundant controller:

[0145] Most of the computing resources (for example, 80%, which can be dynamically adjusted as needed) in the two SOCs are used to run the normal task software stack (the main software stack) to support complete automatic driving DDT of the vehicle. A small part of the computing resources (for example, 20%, which can be dynamically adjusted as needed) in the two SOCs are respectively used to run a hot-standby task software stack in the background to support degraded automatic driving DDT under MRM.

[0146] When the entire system is working normally, such as in the first working mode, the main software stack is run by using the first computing power to control the driving of the vehicle; when any of the main controller board, the redundant controller board, the sensor, the actuator, the power supply unit, the communication unit, the line, etc. has a single point failure, the main software stack is stopped, the hot-standby task in the subsystem without failure is switched to, that is, the hot-standby software stack is started and run by using the second computing power, the vehicle continues to be controlled to complete the MRM degraded DDT, and finally the vehicle is safely parked.

[0147] In this embodiment, in the hot-standby software stack, since it is necessary to ensure the lateral and longitudinal control of the vehicle, it actually realizes the function of a complete L2 system, or can reuse the intelligent driving software developed for the L2 system without re-development, and reuses the original software, thereby effectively reducing the BOM cost and development cost of the ADS system.

[0148] Optionally, in another specific embodiment, as shown in Figure 8 The method further includes:

[0149] Step S201: Under the L2 assisted driving system, the main controller turns on at least one sensor of the sensor system, and turns on at least one vehicle motion actuator in the actuator system through the first MCU.

[0150] Step S202: The main controller controls the at least one vehicle motion actuator to perform an automatic driving task according to the perception result of the at least one sensor and a planned third computing power. The third computing power can be a third percentage of the total computing resources, such as 70% to 90%.

[0151] At this time, the redundant controller SOC2 on the redundant controller board and the second MCU are standby ready.

[0152] The method provided by the embodiment realizes the sharing of computing resources and the multiplexing of sensors in software, and when the main controller and the redundant controller are both working normally, all computing resources and sensor resources are completely available for DDT, and all resources are maximally utilized to achieve the best performance index. In the traditional scheme, the redundant controller and the sensor are usually completely silent or in a hot standby state during normal dynamic driving tasks, and their resources cannot be completely used by normal DDT, so part of the computing resources is wasted.

[0153] In hardware implementation, the system provided by the above-mentioned embodiments of the application can further include one or more processors 10, memories 20 in the main controller SOC1 or the redundant controller SOC2. As shown in the following Figure 9 In addition, the controller can further include at least one communication interface 30.

[0154] The at least one communication interface 30 includes a high-speed interface and a low-speed interface. The various components are communicatively connected to each other by different buses, and can be installed on a common mainboard or in other ways as needed. The processor can process instructions executed in the controller SOC1 or SOC2, including instructions stored in the memory or on the memory to display GUI on an external input / output device (such as a display device coupled to the interface).

[0155] In some optional embodiments, multiple processors and / or multiple buses can be used with multiple memories and multiple memories if needed. Similarly, multiple modules or circuits can be connected, and each device provides part of the necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 9 The processor 10 is taken as an example in the following.

[0156] The processor 10 can be a central processing unit (CPU), a network processor, or a combination thereof. The processor 10 can be an application-specific integrated circuit, a programmable logic device, or a combination thereof. The programmable logic device can be a complex programmable logic device, a field programmable logic gate array, a general array logic, or any combination thereof.

[0157] The memory 20 stores instructions executable by the at least one processor 10, so that the at least one processor 10 executes the vehicle automatic driving redundancy control method shown in the above-mentioned embodiments.

[0158] The memory 20 can include a program storage area and a data storage area. The program storage area can store an operating system and application programs required by at least one function. The data storage area can store data created according to the use of the primary controller or the redundant controller, and the like. In addition, the memory 20 can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some alternative embodiments, the memory 20 can include a memory disposed remotely relative to the processor 10, and these remote memories can be connected to the autonomous driving redundant system through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0159] The memory 20 can include a volatile memory, such as a random access memory. The memory can also include a non-volatile memory, such as a flash memory, a hard disk, or a solid-state disk. The memory 20 can also include a combination of the above-mentioned types of memories. In addition, the at least one communication interface 30 is used for communication between the controller and other devices or controller modules.

[0160] It should be noted that the internal modules or circuit compositions of the primary controller board and the redundant controller board can have different schemes, including but not limited to a single SOC, a single MCU, a single switch, and the like. In addition, the sensor and vehicle motion actuator access methods are not limited to deserializers, CAN PHY, Ethernet, and the like.

[0161] In addition, the sensor grouping access schemes of the primary controller and the redundant controller can also be different, and are customized by the system.

[0162] In addition, the vehicle autonomous driving redundant system can further include other systems of the vehicle in addition to the actuator system, including but not limited to a chassis system (a steering system, a braking system), and a power supply system, and can also include a vehicle body system, a DSSAD (Data Storage System for Automated Driving), a networking system, and the like. The present embodiment does not limit this.

[0163] In addition, the present embodiment also provides a vehicle, as shown in the accompanying drawings. Figure 10 The vehicle includes a redundant system. Specifically, the redundant system is the vehicle autonomous driving redundant system as shown in the accompanying drawings. Figure 1 or Figure 2 In addition, the vehicle can further include other systems or devices.

[0164] The vehicle autonomous driving redundant system is used to perform the above-mentioned Figure 5 , Figure 6 orFigure 8 The vehicle automatic driving redundancy control method is shown.

[0165] The vehicle automatic driving redundancy system provided by the embodiment is used in a vehicle, the main controller board and the redundancy controller board jointly constitute the controller of the ADS system, and the main controller board alone constitutes the controller of the L2 auxiliary driving system. In the normal operation state, the main controller and the redundancy controller jointly take charge of the DDT of the ADS, when triggering the degradation adjustment, degrading to the second working mode, any non-failed controller can run the DDT in the MRM alone, and continue to execute the automatic driving task.

[0166] The embodiment of the application further provides a computer readable storage medium, and the method according to the embodiment of the application can be implemented in hardware, firmware, or recorded in a storage medium, or stored in a remote storage medium or a non-transient machine readable storage medium and stored in a local storage medium through network downloading of computer code, so that the method described herein can be stored in the storage medium of a general computer, a special processor or programmable or special hardware through such software processing.

[0167] The storage medium can be a magnetic disk, an optical disk, a read-only memory, a random access memory, a flash memory, a hard disk or a solid state disk, etc. Further, the storage medium can also include a combination of the above-mentioned memories. It can be understood that the computer, the processor, the microprocessor controller or the programmable hardware include a storage component that can store or receive software or computer code, when the software or computer code is accessed and executed by the computer, the processor or the hardware, the redundancy control method shown in the above embodiment is realized.

[0168] The embodiment of the application further provides a computer program product, including computer program instructions, when the computer program instructions are run by the processor, the processor executes the steps in the above method. The computer program product can be written in one or more program design languages in any combination to execute the program code of the operation of the embodiment of the disclosure, the program design language includes an object-oriented program design language, such as Java, C++, etc., and also includes a conventional procedural program design language, such as a "C" language or a similar program design language. The program code can be completely executed on the user computing device, partially executed on the user device, executed as an independent software package, partially executed on the user computing device and partially executed on the remote computing device, or completely executed on the remote computing device or server.

[0169] The above examples are only used to illustrate the technical solutions of the embodiments of the present application, but not to limit them; although the embodiments of the present application are described in detail with reference to the foregoing examples, those of ordinary skill in the art should understand that the technical solutions recorded in the foregoing examples can be modified, or some technical features thereof can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A vehicle automated driving redundancy system, characterized by, The system comprises a main controller board, a redundant controller board, a sensor system, and an actuator system; wherein the main controller board comprises a main controller, the redundant controller board comprises a redundant controller, the plurality of sensors in the sensor system are divided into a first sensor group and a second sensor group, the plurality of vehicle motion actuators in the actuator system are divided into a first actuator group and a second actuator group, and the two actuator groups are redundant to each other; The main controller is connected to the first sensor group and the first actuator group, and the redundant controller is connected to the second sensor group and the second actuator group; the main controller and the redundant controller are connected through an inter-board connector; The system has a first working mode and a second working mode; In the first working mode, the main controller collects vehicle information through the first sensor group, the redundant controller collects vehicle information through the second sensor group, and the two controllers jointly plan a first computing power; the main controller sends a first control instruction to the first actuator group and a second control instruction to the second actuator group to jointly execute an automatic driving task with the two actuator groups; When a degradation condition is detected, the first working mode is switched to the second working mode, and the failed or faulty controller is disconnected from the control; In the second working mode, the controller that is not disconnected generates and sends a third control instruction to the corresponding actuator group based on the vehicle information collected by the corresponding sensor group and a second computing power to execute a backup automatic driving task, and the second computing power is less than the first computing power.

2. The system of claim 1, wherein In the first working mode, the main controller receives vehicle information collected by the first sensor group, and the redundant controller receives vehicle information collected by the second sensor group and reports the vehicle information to the main controller through the inter-board connector; The main controller runs a main software stack according to the vehicle information collected by itself and the vehicle information reported by the redundant controller according to the first computing power, and sends the first control instruction to the first actuator group and the second control instruction to the second actuator group.

3. The system of claim 2, wherein, In the first working mode, the main controller and the redundant controller also detect whether a degradation condition is triggered; If so, start degradation, select one of the main controller and the redundant controller as a target controller to continue working, and jointly execute an automatic driving task with the first actuator group or the second actuator group, and the target controller is the controller that is not disconnected.

4. The system of claim 3, wherein, The degradation condition includes one or more of the following: The main controller or the redundant controller fails; The circuit module, connection wire, or signal transmission on the main controller board or the redundant controller board fails; Any one or more sensors in the sensor system fail; Any one or more vehicle motion actuators in the actuator system fail; The chassis system of the vehicle fails; The power supply unit in the system fails.

5. The system of claim 4, wherein, The first microcontroller is connected to the main controller and the second microcontroller, and the second microcontroller is connected to the redundant controller. The first microcontroller sends an indication signal to the second microcontroller when detecting an abnormality of the main controller, and notifies the main controller to transfer control authority to the redundant controller. The second microcontroller informs the redundant controller to take over control authority when receiving the indication signal from the first microcontroller, so that the redundant controller executes the backup automatic driving task through the second sensor group and the second actuator group.

6. The system of claim 1, wherein, In the first working mode, the main controller and the redundant controller start a hot standby software stack according to a planned second computing power, and the hot standby software stack is used to start and execute the automatic driving task when a degradation condition is triggered. The number of sensors in the first sensor group is n1, and the number of sensors in the second sensor group is n2, and n1≥1, n2≥1.

7. The system according to any of claims 1-6, characterized in that, The detection range of the n1 sensors covers 360° of the vehicle, and the detection range of the n2 sensors covers 360° of the vehicle. The system further comprises a first CAN bus and a second CAN bus.

8. The system of claim 5, wherein, The first CAN bus and the second CAN bus are used to connect the first actuator group and the main controller, and connect the second actuator group and the redundant controller. The method comprises:

9. A vehicle automatic driving redundancy control method characterized by comprising: In the vehicle automatic driving system, detecting whether the system design operation triggers a degradation condition; If not, a first working mode is executed, in which the main controller collects vehicle information through a first sensor group, and the redundant controller collects vehicle information through a second sensor group. The main controller sends a first control instruction to a first actuator group and a second control instruction to a second actuator group according to the vehicle information and a first computing power planned by the two controllers, to cooperatively execute an automatic driving task with the two actuator groups. The method further comprises:

10. The method of claim 9, wherein, If yes, the first working mode is switched to a second working mode, and the failed or faulty controller is disconnected from control. In the second working mode, the controller that is not disconnected from control generates and sends a third control instruction to the corresponding actuator group according to the vehicle information collected by the corresponding sensor group and a second computing power planned by the controller, to execute a backup automatic driving task, and the second computing power is less than the first computing power. The method further comprises:

11. The method of claim 9, wherein, In the first working mode, the main controller and the redundant controller start a hot standby software stack according to a planned second computing power, and the hot standby software stack is used to start and execute the automatic driving task when a degradation condition is triggered. ​ 12. The method of claim 10, wherein, In the second working mode, the controller not disconnected according to the corresponding sensor group collected vehicle information and the planned second computing power, generate and send the third control instruction to the corresponding actuator group, including: In the second working mode, the redundant controller starts and runs the hot backup software stack according to the vehicle information collected by the second sensor group, in combination with the normally operating modules on the main controller board, sends the third control instruction, and stops the work of the first computing power.

13. The method of claim 12, wherein: the first computing power is a first percentage of total computing resources for running a main software stack in a first working mode; wherein the total computing resources include the sum of the computing resources of the main controller and the computing resources of the redundant controller; the second computing power is a second percentage of the total computing resources for running the hot backup software stack in a second working mode, the first percentage being greater than the second percentage.

14. A vehicle characterized by comprising: The vehicle includes a redundant system; The redundant system is the vehicle automatic driving redundant system according to any one of claims 1 to 8; The vehicle automatic driving redundant system is used to perform the vehicle automatic driving redundant control method according to any one of claims 9 to 13.

Images