Intelligent driving vehicle out-of-control protection method and system and storage medium

Abstract

The invention discloses an out-of-control protection method and system for an intelligent driving vehicle and a storage medium. The method comprises the steps that an intelligent driving control instruction of an intelligent driving control unit is verified through a protection unit, the intelligent driving control instruction with a mark is output, and then a signal processing unit decides whether intelligent driving control is switched to manual control or not according to the mark of the intelligent driving control instruction. Thus, when the protection unit verifies that the intelligent driving control instruction is wrong or large in deviation, the intelligent driving control instruction can be marked to be invalid, the signal processing unit can conveniently read the invalid mark of the intelligent driving control instruction, and intelligent driving control possibly having problems is switched to manual control in time. Therefore, dangerous intelligent driving operation triggered by wrong instructions is avoided, and driving safety in the development and debugging stage is guaranteed. Particularly, the out-of-control protection architecture does not need to change an intelligent driving control system and an original vehicle body basic architecture, and can adapt to intelligent function development and debugging of various types of electric commercial vehicles, so that the development and debugging cost is reduced, and the development and debugging efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of intelligent driving technology, specifically to technical fields such as intelligent driving mode switching and loss-of-control protection, and especially to a loss-of-control protection method, system and storage medium for an intelligent driving vehicle. Background Art

[0002] At present, autonomous driving technology has a wide range of application scenarios. The development of this technology can not only improve driving efficiency, but also help companies greatly reduce operating costs. Therefore, the safety of smart driving vehicles is a top priority for major car companies and smart driving module manufacturers to consider and research.

[0003] In particular, electric commercial vehicles on the market currently often have out-of-control problems such as functional abnormalities or errors during the development and debugging stage of intelligent driving functions. These out-of-control problems can cause the electric commercial vehicles to be in an unexpected state, which in turn causes serious driving safety problems for the electric commercial vehicles in an unexpected state. Summary of the invention

[0004] The present application provides a loss-of-control protection method, system and storage medium for an intelligent driving vehicle, so as to solve the problem of how to adapt to the development and debugging of intelligent driving functions of various types of electric commercial vehicles without changing the intelligent driving control system and the basic structure of the original vehicle body, so as to avoid the vehicle from losing control due to functional abnormalities or errors during the development and debugging process, resulting in driving safety problems in an unexpected state, and ensure that the driving mode can be switched in time to ensure driving safety.

[0005] The technical solution is as follows: In a first aspect, a method for protecting a vehicle from loss of control is provided, which is applied to a loss of control protection system of a vehicle, wherein the loss of control protection system comprises an intelligent driving control unit, a manual control unit, a vehicle body control system, a signal processing unit and a protection unit; the protection unit is connected between the intelligent driving control unit and the signal processing unit via a CAN bus or a wireless communication module reserved in the vehicle body; wherein, The intelligent driving control unit periodically outputs at least one intelligent driving control instruction capable of controlling the automatic driving of the current intelligent driving vehicle based on the real-time collected road information; The protection unit receives the at least one intelligent driving control instruction, and verifies each intelligent driving control instruction based on the real-time optimized intelligent driving model, and if the verification passes, marks the intelligent driving control instruction as valid, otherwise, marks the intelligent driving control instruction as invalid; The signal processing unit receives the at least one marked intelligent driving control instruction, and decides whether to switch from intelligent driving control to manual control according to the mark carried in the at least one intelligent driving control instruction; If it remains in the intelligent driving control, the body control system is triggered to perform corresponding driving operations according to the valid intelligent driving control instructions; If the control is switched to manual control, the manual control unit receives the manual input command from the driver to trigger the vehicle body control system to perform corresponding driving operations.

[0006] In a possible implementation, the intelligent driving model is deployed locally or in the cloud; the protection unit receives the at least one intelligent driving control instruction, and verifies each intelligent driving control instruction based on the real-time optimized intelligent driving model, specifically including: The protection unit obtains sensor information of the same period based on the sensors deployed by itself, inputs the sensor information into the trained intelligent driving model for prediction, and outputs the predicted driving decision; compares and verifies the predicted driving decision with the at least one received intelligent driving control instruction; or; The protection unit receives the at least one intelligent driving control instruction and obtains the travel road information; inputs the travel road information into the trained intelligent driving model for prediction, and outputs the predicted driving decision; and compares and verifies the predicted driving decision with the at least one intelligent driving control instruction.

[0007] In a possible implementation, comparing and verifying the predicted driving decision with the at least one intelligent driving control instruction specifically includes: Comparing and verifying whether the predicted driving decision is consistent with the signal of the corresponding intelligent driving control instruction; and / or; A comparison is performed to check whether the parameter tolerance between the predicted driving decision and the corresponding intelligent driving control instruction is within a threshold range.

[0008] In a possible implementation, the signal processing unit receives the at least one marked intelligent driving control instruction, and decides whether to switch from intelligent driving control to manual control according to the mark carried in the at least one intelligent driving control instruction, specifically including: The signal processing unit receives the at least one marked intelligent driving control instruction. In the case where there is only one intelligent driving control instruction, if the mark of the intelligent driving control instruction is valid, it will be retained in the intelligent driving control, otherwise the intelligent driving control will be switched to manual control; in the case where there are multiple intelligent driving control instructions, a separate decision is made whether to switch from intelligent driving control to manual control based on the mark of each intelligent driving control instruction.

[0009] In a possible implementation, in the case of multiple intelligent driving control instructions, a separate decision is made on whether to switch from intelligent driving control to manual control based on the mark of each intelligent driving control instruction, specifically including: For the intelligent driving control instructions marked as valid, they are retained in the intelligent driving control; For intelligent driving control instructions marked as invalid, the intelligent driving control is switched to manual control.

[0010] In a possible implementation, the signal processing unit receives the at least one marked intelligent driving control instruction, and decides whether to switch from intelligent driving control to manual control according to the mark carried in the at least one intelligent driving control instruction, specifically including: The signal processing unit receives the at least one intelligent driving control instruction after being marked. If the at least one intelligent driving control instruction is marked as invalid, the intelligent driving control is switched to manual control. If the at least one intelligent driving control instruction is all marked as valid, the intelligent driving control is retained.

[0011] In a second aspect, a loss-of-control protection system for an intelligent driving vehicle is provided, comprising: an intelligent driving control unit, a manual control unit, a body control system, a signal processing unit, and a protection unit; the protection unit is connected between the intelligent driving control unit and the signal processing unit via a CAN bus or a wireless communication module reserved in the vehicle body; wherein, The intelligent driving control unit is used to periodically output at least one intelligent driving control instruction capable of controlling the automatic driving of the current intelligent driving vehicle based on the real-time collected road information; The protection unit is used to receive the at least one intelligent driving control instruction, and verify each intelligent driving control instruction based on the real-time optimized intelligent driving model, and if the verification passes, mark the intelligent driving control instruction as valid, otherwise, mark the intelligent driving control instruction as invalid; The signal processing unit is used to receive the at least one intelligent driving control instruction after being marked, and decide whether to switch from intelligent driving control to manual control according to the mark carried in the at least one intelligent driving control instruction; If it remains in the intelligent driving control, the body control system is triggered to perform corresponding driving operations according to the valid intelligent driving control instructions; If the control is switched to manual control, the manual control unit receives the manual input command from the driver to trigger the vehicle body control system to perform corresponding driving operations.

[0012] In a third aspect, an electronic device is provided, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described above.

[0013] According to a fourth aspect, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause the computer to execute the method as described above.

[0014] According to a fifth aspect, a computer program product is provided, comprising a computer program, wherein the computer program implements the method as described above when executed by a processor.

[0015] In a sixth aspect, an autonomous driving vehicle is provided, comprising the electronic device as described above.

[0016] The beneficial effects of the technical solution provided by this application include at least: It can be seen from the above technical solution that the present application adds a protection unit between the intelligent driving control unit and the signal processing unit without changing the intelligent driving control system and the basic structure of the original vehicle body. The intelligent driving control instructions of the intelligent driving control unit are verified by the protection unit, and the marked intelligent driving control instructions are output. After that, the signal processing unit decides whether to switch from intelligent driving control to manual control according to the mark of the intelligent driving control instruction. In this way, when the protection unit verifies that the intelligent driving control instruction is wrong or has a large deviation, it can be marked as invalid, so that the signal processing unit can read the invalid mark of the intelligent driving control instruction and switch from intelligent driving control that may have problems to manual control in time. Thereby avoiding dangerous intelligent driving operations triggered by erroneous instructions and ensuring driving safety during the development and debugging stage. In particular, the out-of-control protection architecture does not need to change the intelligent driving control system and the basic structure of the original vehicle body, and can be adapted to the development and debugging of intelligent functions of various types of electric commercial vehicles, reducing the development and debugging costs and improving the development and debugging efficiency.

[0017] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0019] Figure 1 Schematic diagram of the architecture of the out-of-control protection system for an intelligent driving vehicle provided in an embodiment of the present application; Figure 2 It is a flowchart of a method for protecting a smart driving vehicle from losing control provided by an embodiment of the present application; Figure 3This is one of the structural schematic diagrams of the loss-of-control protection system for an intelligent driving vehicle provided in an embodiment of the present application; Figure 4 This is the second structural diagram of the loss-of-control protection system for an intelligent driving vehicle provided in an embodiment of the present application; Figure 5 It is a block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0020] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0021] Obviously, the described embodiments are only part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0022] It should be noted that the terminal devices involved in the embodiments of the present application may include but are not limited to mobile phones, personal digital assistants (PDAs), wireless handheld devices, tablet computers and other smart devices; display devices may include but are not limited to personal computers, televisions and other devices with display functions.

[0023] In addition, the term "and / or" in this article is only a description of the association relationship between the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0024] In view of the fact that electric commercial vehicles in the current market are gradually moving towards intelligent driving, it is a relatively cost-effective and efficient R&D strategy to develop intelligent driving functions for vehicles based on the existing original vehicle framework. When faced with the development of intelligent driving functions, the vehicle model often limits the development and debugging of intelligent driving functions, especially under the premise that the intelligent driving vehicle is fixed, the development and debugging of intelligent driving functions can only be carried out for the current fixed vehicle model, thereby limiting the applicable vehicle types and scenarios. Moreover, during the development and debugging stage of the intelligent driving function, out-of-control problems such as functional abnormalities or errors often occur, and these out-of-control problems will cause the electric commercial vehicle to be in an unexpected state, which in turn causes serious driving safety problems for the electric commercial vehicle in an unexpected state.

[0025] To this end, the embodiment of the present application proposes a loss-of-control protection scheme for intelligent driving vehicles, which is mainly aimed at the problems faced by intelligent driving vehicles in the development and debugging stage of intelligent driving functions: the inability to adapt to the development and debugging of intelligent driving functions of various types of electric commercial vehicles, and the inability to avoid the vehicle from driving unsafely in an unexpected state due to loss of control problems such as functional abnormalities or errors during the development and debugging process. The inventive concept of this loss-of-control protection scheme is: without changing the intelligent driving control system and the basic architecture of the original vehicle body, a protection unit is added between the intelligent driving control unit and the signal processing unit, and the intelligent driving control instructions of the intelligent driving control unit are verified by the protection unit, and the marked intelligent driving control instructions are output. After that, the signal processing unit decides whether to switch from intelligent driving control to manual control according to the mark of the intelligent driving control instruction. In this way, when the protection unit verifies that the intelligent driving control instruction is wrong or has a large deviation, it can be marked as invalid, so that the signal processing unit can read the invalid mark of the intelligent driving control instruction and switch from the intelligent driving control that may have problems to manual control in time. Thereby avoiding dangerous intelligent driving operations triggered by erroneous instructions and ensuring driving safety in the development and debugging stage. In particular, the out-of-control protection architecture does not require changes to the intelligent driving control system and the original vehicle basic structure, and can be adapted to the development and debugging of intelligent functions of various types of electric commercial vehicles, thereby reducing development and debugging costs and improving development and debugging efficiency.

[0026] Reference Figure 1 As shown, it is a schematic diagram of the structure of the out-of-control protection system of the intelligent driving vehicle provided in the embodiment of the present application. The out-of-control protection system includes an intelligent driving control unit 101, a manual control unit 102, a body control system 103, a signal processing unit 104 and a protection unit 105. Among them, the intelligent driving control unit 101, as the main control end of the intelligent driving function, can be used as a development end by developers to develop and debug functions. Specifically, a sensor data receiving module, an algorithm module for processing sensor data, such as an intelligent driving model or other intelligent driving algorithms, and an intelligent driving instruction output module can be deployed on the intelligent driving control unit 101. In short, the intelligent driving control unit 101 can be flexibly defined and deployed according to the needs of users or developers to realize related intelligent driving functions. This application does not limit this part. Any intelligent driving control system or related intelligent driving functions that can be transferred or deployed on the vehicle are covered within the scope of this application.

[0027] In general, the intelligent driving control unit can be directly connected to the signal processing unit, so that the signal processing unit can receive the intelligent driving control instructions of the intelligent driving control unit to perform intelligent driving control. The difference of this application is that a protection unit 105 is added. The protection unit 105 can be connected between the intelligent driving control unit 101 and the signal processing unit 104 through the CAN bus or wireless communication module reserved in the vehicle body. The protection unit 105 has the function of verifying the intelligent driving control instructions output by the intelligent driving control unit 101, so as to accurately determine whether the intelligent driving control unit 101 is in an unexpected state or whether the output intelligent driving control instructions are wrong. Furthermore, the signal processing unit 104 can make a timely decision on whether to switch from the current intelligent driving control to manual control based on the verification result of the intelligent driving control instructions by the protection unit 105.

[0028] Reference Figure 2 As shown, it is a schematic diagram of the steps of the fail-safe protection method for an intelligent driving vehicle provided in an embodiment of the present application. It should be understood that in the present application scheme, the execution subject of the fail-safe protection method can be the fail-safe protection system of the intelligent driving vehicle.

[0029] like Figure 2 As shown, the out-of-control protection method of the intelligent driving vehicle may include the following steps: Step 202: The intelligent driving control unit periodically outputs at least one intelligent driving control instruction that can control the automatic driving of the current intelligent driving vehicle based on the road information collected in real time.

[0030] In the present application scheme, the intelligent driving control unit can be deployed with an intelligent driving processing module locally or in the cloud. The intelligent driving processing module can use a series of intelligent driving algorithms to process the road information and vehicle driving information received by the intelligent driving control unit, and periodically output one or more intelligent driving control instructions.

[0031] In specific implementation, a trained intelligent driving control model can be deployed in the intelligent driving control unit. The intelligent driving control model is based on sample data such as driving road information and vehicle history information. The initial model is repeatedly trained to obtain a converged intelligent driving control model, which is used to predict reliable intelligent driving control instructions for the vehicle. Or, Multiple intelligent driving judgment algorithms can also be deployed in the intelligent driving control unit to calculate and determine accurate intelligent driving control instructions in real time based on the current road information and vehicle history information received. These driving control instructions can analyze driving decisions.

[0032] In the present application, the intelligent driving control instructions can be output through the CAN bus. These intelligent control instructions can include five types of control instructions, including power and gear control instructions such as torque control, speed control, and gear control of the vehicle; braking control instructions such as braking deceleration signal, braking form, and braking urgency; parking related instructions such as parking enable switch signal and parking depth signal of the vehicle; steering system control instructions such as steering positive and negative angle control signal, steering control form signal, and steering torque signal of the vehicle; and body control instructions such as lighting control signal, electric horn control signal, wiper and washing control signal of the vehicle. That is, the five types of control instructions are power and gear control instructions, braking control instructions, parking related instructions, steering system control instructions, and body control instructions. In addition, with the continuous development and improvement of the intelligent driving control function, some corresponding control instructions can be added accordingly, so this application does not limit the types of intelligent driving control instructions.

[0033] It should be noted that verification signals, heartbeat signals, and intelligent driving enable switch signals can be added to the intelligent driving control instructions involved in this application to ensure the effectiveness and safety of control.

[0034] Step 204: The protection unit receives the at least one intelligent driving control instruction, and verifies each intelligent driving control instruction based on the real-time optimized intelligent driving model.

[0035] In the present application, the protection unit is located between the intelligent driving control unit and the signal processing unit, and is used to receive the intelligent driving control instructions output by the intelligent driving control unit, and to reasonably verify the intelligent driving control instructions according to the real-time optimized intelligent driving model, so as to determine whether the intelligent driving control instructions determined by the intelligent driving control unit are correct. Moreover, the protection unit can be flexibly connected between the intelligent driving control unit and the signal processing unit to adapt to the development and debugging of various types of vehicles.

[0036] The intelligent driving model used by the protection unit is deployed locally in the protection unit or in the cloud; accordingly: A feasible solution, the protection unit obtains sensor information of the same period based on the sensors deployed by itself, inputs the sensor information into the trained intelligent driving model for prediction, and outputs the predicted driving decision; the predicted driving decision is compared and verified with the at least one received intelligent driving control instruction. In other words, the protection unit is locally deployed with multiple sensors to obtain sensor information of the same period as the local sensors of the vehicle, and then determines the vehicle's path road information and vehicle driving information based on the sensor information. Afterwards, the protection unit inputs the sensor information or the path road information and vehicle driving information determined by the sensor information into the trained intelligent driving model for intelligent driving prediction, and outputs the driving decision. Then the predicted driving decision is compared and verified with the driving decision parsed by the received intelligent driving control instruction. It can be seen that the protection unit here uses its own intelligent driving model deployed locally or in the cloud to perform intelligent driving prediction processing similar to that in parallel with the intelligent driving control unit. Since the input parameters (i.e., sensor information) used are all obtained by its own sensors, which are different from the sensor information obtained by the intelligent driving control unit, the predicted intelligent driving decision more objectively evaluates the intelligent driving decision of the intelligent driving control unit.

[0037] Another feasible solution is that the protection unit receives the at least one intelligent driving control instruction and obtains the route information; inputs the route information into the trained intelligent driving model for prediction and outputs the predicted driving decision; and compares and verifies the predicted driving decision with the at least one intelligent driving control instruction. In other words, the protection unit does not deploy sensors locally, but borrows the route information and other sensor information of the intelligent driving control unit and inputs it into the intelligent driving model deployed by the protection unit itself for prediction.

[0038] It should be understood that in the present application, the intelligent driving model deployed by the protection unit should have computing power and prediction accuracy comparable to that of the intelligent driving model deployed by the intelligent driving control unit, but the intelligent driving model deployed by the protection unit should be distinguished from the intelligent driving model deployed by the intelligent driving control unit. Moreover, it should be noted that the intelligent driving model deployed by the protection unit is optimized in real time, that is, each prediction can be regarded as an optimization, or training optimization of new sample data can be received when there is no prediction task.

[0039] Furthermore, when the protection unit compares and verifies the predicted driving decision with the at least one intelligent driving control instruction, it may compare and verify whether the signal in the predicted driving decision is consistent with the corresponding intelligent driving control instruction; and / or; compare and verify whether the parameter tolerance between the predicted driving decision and the corresponding intelligent driving control instruction is within the threshold range. For example, it is determined whether the braking control signals calculated by the protection unit and the intelligent driving control unit are consistent, whether the steering control angle is within the tolerance range, whether the torque control value is within the tolerance range, etc.

[0040] Since the intelligent driving decision may include one or more intelligent driving control instructions, each intelligent driving control instruction needs to be compared and verified. If the verification passes, step 206 is executed, otherwise, step 208 is executed.

[0041] Step 206: Mark the intelligent driving control instruction as valid.

[0042] Step 208: Mark the intelligent driving control instruction as invalid.

[0043] Specifically, a mark field may be added to the intelligent driving control instruction, and if it is valid, the mark field is recorded as 1, and if it is invalid, the mark field is recorded as 0. The mark field here is only used as an example, and in addition, other methods may be used for distinguishing marks.

[0044] Step 210: The signal processing unit receives the at least one marked intelligent driving control instruction, and decides whether to switch from intelligent driving control to manual control based on the mark carried in the at least one intelligent driving control instruction.

[0045] After the signal processing unit receives at least one marked intelligent driving control instruction, it can flexibly decide the vehicle control mode according to the local decision algorithm based on the mark carried in the intelligent driving control instruction. Since the body control system mainly includes the power and gear control system, the braking system, the parking system, the steering system and the body system, the above five types of intelligent driving control instructions can correspond to the corresponding five control systems, and the signal processing unit can be connected to these five control systems respectively through 5 separate CAN buses, that is, the signal is transmitted independently. In view of this, the signal processing unit can uniformly trigger the corresponding control system for vehicle control through the same vehicle control mode, or it can trigger the corresponding control system for vehicle control through different vehicle control modes. As described below: A feasible solution is that the signal processing unit receives at least one intelligent driving control instruction after being marked. For the case where there is only one intelligent driving control instruction, if the mark of the intelligent driving control instruction is valid, it is retained in the intelligent driving control, otherwise it is switched from the intelligent driving control to the manual control; for the case where there are multiple intelligent driving control instructions, a separate decision is made on whether to switch from the intelligent driving control to the manual control according to the mark of each intelligent driving control instruction. Among them, for the intelligent driving control instructions marked as valid, they are retained in the intelligent driving control; for the intelligent driving control instructions marked as invalid, they are switched from the intelligent driving control to the manual control. Thus, the signal processing unit processes each intelligent driving control instruction separately. For example, if the power and gear control instructions are marked as invalid, the manual control unit will be triggered to prepare to receive manual input instructions. Specifically, after the signal processing unit recognizes that the power and gear control instructions are invalid, it notifies the driver to switch to the manual driving state through voice output, and the manual control unit receives the input instructions of the manual driving operation. After that, the signal processing unit transmits the input instructions to the power and gear control system of the body control system through the corresponding CAN bus to perform the corresponding driving operation. For another example, if the parking control command is marked as valid, the manual control unit will not be triggered, but will remain in the intelligent driving control, and the parking system of the body control system will be directly transmitted through the corresponding CAN bus according to the parking control command to perform corresponding driving operations, such as parking-related control operations. In this way, the separate control switching of different control systems of the body control system can be realized, and the development and debugging of the entire intelligent driving function does not need to be affected by the error of a certain intelligent driving function. On the basis of ensuring safe driving, the efficient testing and development of the intelligent driving function is guaranteed.

[0046] Another feasible solution is that the signal processing unit receives the at least one intelligent driving control instruction after marking, and if the at least one intelligent driving control instruction is marked as invalid, the intelligent driving control is switched to manual control, and if the at least one intelligent driving control instruction is all marked as valid, the intelligent driving control is retained. It can be seen that no matter how the intelligent driving control instruction received by the signal processing unit is marked, as long as one of the intelligent driving control instructions is marked as invalid, the intelligent driving control can be switched to manual control, so that driving safety can be guaranteed to the greatest extent.

[0047] Based on the above driving decision, if the intelligent driving control is retained, step 212 is executed; if the control is switched to manual control, step 214 is executed.

[0048] Step 212: Trigger the body control system to perform corresponding driving operations according to valid intelligent driving control instructions.

[0049] Step 214: The manual control unit receives the manual input command from the driver to trigger the vehicle body control system to perform corresponding driving operations.

[0050] Therefore, through the above technical solution, without changing the intelligent driving control system and the basic structure of the original vehicle body, a protection unit is added between the intelligent driving control unit and the signal processing unit, and the intelligent driving control instructions of the intelligent driving control unit are verified by the protection unit, and the marked intelligent driving control instructions are output. After that, the signal processing unit decides whether to switch from intelligent driving control to manual control according to the mark of the intelligent driving control instruction. In this way, when the protection unit verifies that the intelligent driving control instruction is wrong or has a large deviation, it can be marked as invalid, so that the signal processing unit can read the invalid mark of the intelligent driving control instruction and switch from intelligent driving control that may have problems to manual control in time. Thereby avoiding dangerous intelligent driving operations triggered by erroneous instructions and ensuring driving safety during the development and debugging stage. In particular, the out-of-control protection architecture does not need to change the intelligent driving control system and the basic structure of the original vehicle body, and can be adapted to the development and debugging of intelligent functions of various types of electric commercial vehicles, reducing the development and debugging costs and improving the development and debugging efficiency.

[0051] Reference Figure 3 As shown, it is a schematic diagram of the structure of the loss-of-control protection system of the intelligent driving vehicle provided in the embodiment of the present application. In the loss-of-control protection system, the body control system may specifically include a power and gear system, a braking system, a parking system, a steering system and a body system. Among them, the power and gear system is connected to the signal processing unit through CAN1, the braking system is connected to the signal processing unit through CAN2, the parking system is connected to the signal processing unit through CAN3, the steering system is connected to the signal processing unit through CAN4, and the body system is connected to the signal processing unit through CAN5.

[0052] Assume that a certain type of intelligent driving vehicle is formed by adding a protection unit. Figure 3 Then, during the development and debugging of the intelligent driving function of the intelligent driving vehicle, the intelligent driving vehicle can be switched from intelligent driving control to manual control with the help of the failure protection system, thereby ensuring the driving safety of the intelligent driving vehicle during the testing phase.

[0053] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0054] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0055] Figure 4 The structure block diagram of the out-of-control protection system of the intelligent driving vehicle provided by one embodiment of the present application is shown as follows: Figure 4 As shown. The out-of-control protection system 400 of the intelligent driving vehicle of this embodiment may include an intelligent driving control unit 401, a manual control unit 402, a body control system 403, a signal processing unit 404 and a protection unit 405. The protection unit 405 is connected between the intelligent driving control unit 401 and the signal processing unit 404 through a CAN bus or a wireless communication module reserved in the vehicle body; wherein, the intelligent driving control unit 401 is used to periodically output at least one intelligent driving control instruction that can control the automatic driving of the current intelligent driving vehicle based on the real-time collected road information. The protection unit 405 is used to receive the at least one intelligent driving control instruction, and verify each intelligent driving control instruction based on the real-time optimized intelligent driving model. If the verification passes, the intelligent driving control instruction is marked as valid, otherwise, the intelligent driving control instruction is marked as invalid. The signal processing unit 404 is used to receive the at least one intelligent driving control instruction after the mark, and decide whether to switch from intelligent driving control to manual control according to the mark carried in the at least one intelligent driving control instruction. If it remains in intelligent driving control, the body control system 403 is triggered to perform corresponding driving operations according to valid intelligent driving control instructions; if it is switched to manual control, the manual control unit 402 receives the driver's manual input instructions to trigger the body control system 403 to perform corresponding driving operations.

[0056] It should be noted that part or all of the loss-of-control protection system of the intelligent driving vehicle of this embodiment may be an application located in the local terminal, or may also be a functional unit such as a plug-in or software development kit (SDK) set in the application located in the local terminal, or may also be a processing engine located in a network-side server, or may also be a distributed system located on the network side, for example, a processing engine or distributed system in an autonomous driving platform on the network side, etc. This embodiment does not specifically limit this.

[0057] It is understandable that the application may be a local program (nativeApp) installed on the local terminal, or may also be a webpage program (webApp) of a browser on the local terminal, which is not limited in this embodiment.

[0058] Optionally, in a possible implementation of this embodiment, the intelligent driving model is deployed locally or in the cloud; when the protection unit 405 receives the at least one intelligent driving control instruction and verifies each intelligent driving control instruction based on the real-time optimized intelligent driving model, it is specifically used to: obtain sensor information of the same time period based on the sensors deployed by itself, input the sensor information into the trained intelligent driving model for prediction, and output a predicted driving decision; compare and verify the predicted driving decision with the at least one intelligent driving control instruction received; or; receive the at least one intelligent driving control instruction and obtain the travel road information; input the travel road information into the trained intelligent driving model for prediction, and output a predicted driving decision; compare and verify the predicted driving decision with the at least one intelligent driving control instruction.

[0059] Optionally, in a possible implementation of this embodiment, when comparing and verifying the predicted driving decision with the at least one intelligent driving control instruction, the protection unit 405 is specifically used to: compare and verify whether the signal in the predicted driving decision is consistent with that of the corresponding intelligent driving control instruction; and / or; compare and verify whether the parameter tolerance in the predicted driving decision is within a threshold range with that of the corresponding intelligent driving control instruction.

[0060] Optionally, in a possible implementation of this embodiment, when the signal processing unit 404 receives the at least one marked intelligent driving control instruction and decides whether to switch from intelligent driving control to manual control according to the mark carried in the at least one intelligent driving control instruction, it is specifically used to: receive the at least one marked intelligent driving control instruction, for the case where there is only one intelligent driving control instruction, if the mark of the intelligent driving control instruction is valid, retain the intelligent driving control, otherwise switch from intelligent driving control to manual control; for the case where there are multiple intelligent driving control instructions, decide whether to switch from intelligent driving control to manual control separately according to the mark of each intelligent driving control instruction.

[0061] Optionally, in a possible implementation of the present embodiment, in the case where there are multiple intelligent driving control instructions, the signal processing unit 404, when deciding whether to switch from intelligent driving control to manual control based on the mark of each intelligent driving control instruction, is specifically used to: retain the intelligent driving control instructions marked as valid; and switch from intelligent driving control to manual control for the intelligent driving control instructions marked as invalid.

[0062] Optionally, in a possible implementation of this embodiment, when the signal processing unit 404 receives the at least one intelligent driving control instruction after being marked and decides whether to switch from intelligent driving control to manual control based on the mark carried in the at least one intelligent driving control instruction, it is specifically used to: receive the at least one intelligent driving control instruction after being marked, if the at least one intelligent driving control instruction is marked as invalid, switch from intelligent driving control to manual control; if the at least one intelligent driving control instruction is all marked as valid, retain the intelligent driving control.

[0063] In this embodiment, a protection unit can be added between the intelligent driving control unit and the signal processing unit without changing the intelligent driving control system and the basic structure of the original vehicle body. The intelligent driving control instructions of the intelligent driving control unit are verified by the protection unit, and the marked intelligent driving control instructions are output. After that, the signal processing unit decides whether to switch from intelligent driving control to manual control according to the mark of the intelligent driving control instruction. In this way, when the protection unit verifies that the intelligent driving control instruction is wrong or has a large deviation, it can be marked as invalid, so that the signal processing unit can read the invalid mark of the intelligent driving control instruction and switch from intelligent driving control that may have problems to manual control in time. Thereby avoiding dangerous intelligent driving operations triggered by erroneous instructions and ensuring driving safety during the development and debugging stage. In particular, the out-of-control protection architecture does not need to change the intelligent driving control system and the basic structure of the original vehicle body, and can be adapted to the development and debugging of intelligent functions of various types of electric commercial vehicles, reducing the development and debugging costs and improving the development and debugging efficiency.

[0064] An embodiment of the present application provides a computer-readable storage medium, in which at least one instruction is stored. The at least one instruction is loaded and executed by a processor to implement the loss-of-control protection method for an intelligent driving vehicle as described above.

[0065] An embodiment of the present application provides an electronic device, which includes a processor and a memory, wherein the memory stores at least one instruction, and the instruction is loaded and executed by the processor to implement the loss-of-control protection method for an intelligent driving vehicle as described above.

[0066] An embodiment of the present application provides an autonomous driving vehicle, comprising the electronic device as described above. Specifically, the autonomous driving vehicle may be a vehicle of level L2 or above.

[0067] In the technical solution of this application, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the relevant laws and regulations and do not violate public order and good morals.

[0068] Figure 5A schematic block diagram of an example electronic device 500 that can be used to implement an embodiment of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0069] like Figure 5 As shown, the electronic device 500 includes a computing unit 501, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 502 or a computer program loaded from a storage unit 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the electronic device 500 can also be stored. The computing unit 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0070] Multiple components in the electronic device 500 are connected to the I / O interface 505, including: an input unit 506, such as a keyboard, a mouse, etc.; an output unit 507, such as various types of displays, speakers, etc.; a storage unit 508, such as a disk, an optical disk, etc.; and a communication unit 509, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 509 allows the electronic device 500 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0071] The computing unit 501 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 501 performs the various methods and processes described above, such as the out-of-control protection method of the intelligent driving vehicle. For example, in some embodiments, the out-of-control protection method of the intelligent driving vehicle may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 508. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 500 via the ROM 502 and / or the communication unit 509. When the computer program is loaded into the RAM 503 and executed by the computing unit 501, one or more steps of the out-of-control protection method of the intelligent driving vehicle described above may be performed. Alternatively, in other embodiments, the computing unit 501 may be configured to execute the loss-of-control protection method for the intelligent driving vehicle in any other appropriate manner (for example, by means of firmware).

[0072] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0073] The program code for implementing the method of the present application can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, implements the functions / operations specified in the flow chart and / or block diagram. The program code can be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0074] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0075] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0076] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0077] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0078] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps disclosed in this application can be performed in parallel, sequentially or in different orders, as long as the desired results of the technical solution disclosed in this application can be achieved, and this document does not limit this.

[0079] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A method for protecting a vehicle from losing control, characterized in that: A loss-of-control protection system applied to an intelligent driving vehicle, the loss-of-control protection system comprises an intelligent driving control unit, a manual control unit, a body control system, a signal processing unit and a protection unit; the protection unit is connected between the intelligent driving control unit and the signal processing unit via a CAN bus or a wireless communication module reserved in the vehicle body; wherein, The intelligent driving control unit periodically outputs at least one intelligent driving control instruction capable of controlling the automatic driving of the current intelligent driving vehicle based on the real-time collected road information; The protection unit receives the at least one intelligent driving control instruction, and verifies each intelligent driving control instruction based on the real-time optimized intelligent driving model, and if the verification passes, marks the intelligent driving control instruction as valid, otherwise, marks the intelligent driving control instruction as invalid; The signal processing unit receives the at least one marked intelligent driving control instruction, and decides whether to switch from intelligent driving control to manual control according to the mark carried in the at least one intelligent driving control instruction; If it remains in the intelligent driving control, the body control system is triggered to perform corresponding driving operations according to the valid intelligent driving control instructions; If the control is switched to manual control, the manual control unit receives the manual input command from the driver to trigger the vehicle body control system to perform corresponding driving operations.

2. The method according to claim 1, characterized in that The intelligent driving model is deployed locally or in the cloud; the protection unit receives the at least one intelligent driving control instruction, and verifies each intelligent driving control instruction based on the real-time optimized intelligent driving model, specifically including: The protection unit obtains sensor information of the same period based on the sensors deployed by itself, inputs the sensor information into the trained intelligent driving model for prediction, and outputs the predicted driving decision; compares and verifies the predicted driving decision with the at least one received intelligent driving control instruction; or; The protection unit receives the at least one intelligent driving control instruction and obtains the travel road information; inputs the travel road information into the trained intelligent driving model for prediction, and outputs the predicted driving decision; and compares and verifies the predicted driving decision with the at least one intelligent driving control instruction.

3. The method according to claim 2, characterized in that Comparing and verifying the predicted driving decision with the at least one intelligent driving control instruction specifically includes: Comparing and verifying whether the predicted driving decision is consistent with the signal of the corresponding intelligent driving control instruction; and / or; A comparison is performed to check whether the parameter tolerance between the predicted driving decision and the corresponding intelligent driving control instruction is within a threshold range.

4. The method according to any one of claims 1 to 3, characterized in that: The signal processing unit receives the at least one marked intelligent driving control instruction, and decides whether to switch from intelligent driving control to manual control according to the mark carried in the at least one intelligent driving control instruction, specifically including: The signal processing unit receives the at least one marked intelligent driving control instruction. In the case where there is only one intelligent driving control instruction, if the mark of the intelligent driving control instruction is valid, it will be retained in the intelligent driving control, otherwise the intelligent driving control will be switched to manual control; in the case where there are multiple intelligent driving control instructions, a separate decision is made whether to switch from intelligent driving control to manual control based on the mark of each intelligent driving control instruction.

5. The method according to claim 4, characterized in that In the case of multiple intelligent driving control instructions, a separate decision is made on whether to switch from intelligent driving control to manual control based on the mark of each intelligent driving control instruction, including: For the intelligent driving control instructions marked as valid, they are retained in the intelligent driving control; For intelligent driving control instructions marked as invalid, the intelligent driving control is switched to manual control.

6. The method according to any one of claims 1 to 3, characterized in that: The signal processing unit receives the at least one marked intelligent driving control instruction, and decides whether to switch from intelligent driving control to manual control according to the mark carried in the at least one intelligent driving control instruction, specifically including: The signal processing unit receives the at least one intelligent driving control instruction after being marked. If the at least one intelligent driving control instruction is marked as invalid, the intelligent driving control is switched to manual control. If the at least one intelligent driving control instruction is all marked as valid, the intelligent driving control is retained.

7. A loss-of-control protection system for an intelligent driving vehicle, characterized in that: include: An intelligent driving control unit, a manual control unit, a body control system, a signal processing unit and a protection unit; the protection unit is connected between the intelligent driving control unit and the signal processing unit through a CAN bus or a wireless communication module reserved in the vehicle body; wherein, The intelligent driving control unit is used to periodically output at least one intelligent driving control instruction capable of controlling the automatic driving of the current intelligent driving vehicle based on the real-time collected road information; The protection unit is used to receive the at least one intelligent driving control instruction, and verify each intelligent driving control instruction based on the real-time optimized intelligent driving model, and if the verification passes, mark the intelligent driving control instruction as valid, otherwise, mark the intelligent driving control instruction as invalid; The signal processing unit is used to receive the at least one intelligent driving control instruction after being marked, and decide whether to switch from intelligent driving control to manual control according to the mark carried in the at least one intelligent driving control instruction; If it remains in the intelligent driving control, the body control system is triggered to perform corresponding driving operations according to the valid intelligent driving control instructions; If the control is switched to manual control, the manual control unit receives the manual input command from the driver to trigger the vehicle body control system to perform corresponding driving operations.

8. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-6.

10. A computer program product, characterized in that The invention comprises a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 6.

11. An autonomous driving vehicle, characterized in that: Comprising the electronic device as claimed in claim 8.

Images