Automatic driving redundancy control system and method

Abstract

The invention discloses an automatic driving redundancy control system and method. The system comprises a first main control unit, a second main control unit, a plurality of groups of first sub-control units, a plurality of groups of second sub-control units and an arbitration unit, the first main control unit and the second main control unit are redundant to each other, the first sub-control units and the second sub-control units are redundant to each other, and the first main control unit controls all the first sub-control units to form a first control link. Controlling all the second sub-control units to form a second control link; the second main control unit controls all the first sub-control units to form a third control link and controls all the second sub-control units to form a fourth control link; and the arbitration unit responds to the automatic driving instruction, determines a target control link for automatic driving from the plurality of control links according to a preset priority, and switches the target control link according to the preset priority if the target control link breaks down in the automatic driving process. According to the invention, the technical problem that a clear, safe and reliable automatic driving redundancy control scheme is lacked in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of autonomous driving technology, and more specifically, to an autonomous driving redundant control system and method. Background Art

[0002] Autonomous driving is the use of various sensors, computer vision, artificial intelligence and other technologies to enable cars to drive and navigate autonomously without human drivers. Autonomous driving technology can be achieved by sensing the surrounding environment, understanding traffic rules and behaviors, planning paths and controlling vehicles. The development of autonomous driving technology can improve traffic safety, reduce traffic accidents, and provide higher driving efficiency and comfort. It can also reduce the incidence of traffic accidents by reducing driving errors and human factors.

[0003] In recent years, new energy vehicles have gradually entered the market, and intelligent automatic driving of new energy vehicles has become more and more popular. Brake-by-wire and steer-by-wire have become research hotspots for intelligent automatic driving of new energy vehicles. However, the existing intelligent driving redundant control methods have problems such as chaotic control decision instructions, chaotic response of the control-by-wire system, high coupling degree and failure rate.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide an autonomous driving redundant control system and method to at least solve the technical problem of the lack of a logically clear, safe and reliable autonomous driving redundant control solution in the related art.

[0006] According to one aspect of an embodiment of the present application, there is provided an autonomous driving redundant control system, comprising: a mutually redundant first main control unit and a second main control unit, a plurality of mutually redundant first sub-control units and second sub-control units, and an arbitration unit; wherein the first main control unit is used to control all first sub-control units to form a first control link; the first main control unit is used to control all second sub-control units to form a second control link; the second main control unit is used to control all first sub-control units to form a third control link; the second main control unit is used to control all second sub-control units to form a fourth control link; the arbitration unit is used to respond to autonomous driving instructions, determine a target control link for autonomous driving from the first control link, the second control link, the third control link, and the fourth control link according to a preset priority, and also to switch the target control link according to a preset priority if a target control link fails during the autonomous driving process.

[0007] Optionally, the types of the first main control unit and the second main control unit include: an autonomous driving domain control unit; the types of the first sub-control unit and the second sub-control unit include at least one of the following: a vehicle control unit, an electronic braking system, an electronic steering system, a body control unit, and an electronic parking unit.

[0008] Optionally, the arbitration unit is further used to detect the status of the first control link, the second control link, the third control link and the fourth control link before determining the target control link, and reject the automatic driving instruction if a fault is detected in any control link.

[0009] Optionally, the second main control unit is a backup control unit of the first main control unit, and the second sub-control unit is a backup control unit of the first sub-control unit; the preset priorities are from high to low: first control link, second control link, third control link, fourth control link.

[0010] Optionally, the arbitration unit is used to switch the target control link to the third control link when the target control link is the first control link and the first main control unit fails; switch the target control link to the second control link when the target control link is the first control link and any first sub-control unit fails; switch the target control link to the fourth control link when the target control link is switched to the second control link and the first main control unit fails; determine to exit the automatic driving when the target control link is switched to the second control link and any second sub-control unit fails; determine to exit the automatic driving when the target control link is switched to the third control link and the second main control unit fails; switch the target control link to the fourth control link when the target control link is switched to the fourth control link and the second main control unit fails or any second sub-control unit fails.

[0011] Optionally, the first main control unit is used to send a first request enable instruction to all first sub-control units when the target control link is the first control link, and after receiving the information of entering the waiting state for automatic driving activation fed back by the first sub-control unit, send the first request activation instruction and the first arbitration success information to all first sub-control units; in response to the instruction to switch the target control link to the third control link, send the first arbitration failure information to all first sub-control units, and send the first takeover instruction for requesting the second main control unit to take over all first sub-control units to the second main control unit; in response to the instruction to switch the target control link to the second control link, send the first arbitration failure information to all first sub-control units, and send the second request enable instruction to all second sub-control units, and after receiving the feedback from the second sub-control unit The second main control unit is used to respond to the first takeover instruction, send a third request enable instruction to all first sub-control units, and after receiving the information of entering the waiting state for automatic driving activation fed back by the first sub-control unit, send the third request activation instruction and the third arbitration success information to all first sub-control units; in response to the instruction of switching the target control link to the fourth control link, send the third arbitration failure information to all first sub-control units, and send the fourth request enable instruction to all second sub-control units, and after receiving the information of entering the waiting state for automatic driving activation fed back by the second sub-control unit, send the fourth request activation instruction and the fourth arbitration success information to all second sub-control units.

[0012] Optionally, the target sub-control unit is used to perform self-check after power-on and enter the initialization state when there is no fault, wherein the target sub-control unit is any first sub-control unit or second sub-control unit; when in the initialization state, receiving the request enable instruction from the target main control unit, and determining that the automatic driving operation is ready, it enters the waiting automatic driving activation state, and sends the target main control unit to enter the waiting automatic driving activation state information, wherein the target main control unit is the first main control unit or the second main control unit in the target control link; when in the waiting automatic driving activation state, receiving the request activation instruction and arbitration success information from the target main control unit, it enters the automatic driving activation state; when in the waiting automatic driving activation state or the automatic driving activation state, receiving arbitration failure information from the target main control unit, it enters the arbitration failure state; when in the arbitration failure state, receiving arbitration success information from the target main control unit, it enters the waiting automatic driving activation state; when the target main control unit fails, or the communication check with the target main control unit fails, or the self-check finds a fault, or the automatic driving operation preparation cannot be ready, it enters the fault state; and when the fault is recovered, it enters the initialization state.

[0013] According to another aspect of an embodiment of the present application, a method for redundant control of autonomous driving is also provided, including: in response to an autonomous driving instruction, determining a target control link for autonomous driving from a first control link, a second control link, a third control link and a fourth control link according to a preset priority, wherein a first main control unit controls all first sub-control units to form a first control link, the first main control unit controls all second sub-control units to form a second control link, the second main control unit controls all first sub-control units to form a third control link, the second main control unit controls all second sub-control units to form a fourth control link, the first main control unit and the second main control unit are redundant with each other, and the first sub-control unit and the second sub-control unit are redundant with each other; during the autonomous driving process, if the target control link fails, the target control link is switched according to the preset priority.

[0014] According to another aspect of an embodiment of the present application, a non-volatile storage medium is also provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned automatic driving redundant control method by running the computer program.

[0015] According to another aspect of an embodiment of the present application, an electronic device is also provided, which includes: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the above-mentioned autonomous driving redundant control method through the computer program.

[0016] In an embodiment of the present application, an automatic driving redundant control system includes: a mutually redundant first main control unit and a second main control unit, a plurality of mutually redundant first sub-control units and a second sub-control unit, and an arbitration unit; wherein the first main control unit controls all first sub-control units to form a first control link, controls all second sub-control units to form a second control link, and the second main control unit controls all first sub-control units to form a third control link, and controls all second sub-control units to form a fourth control link. By setting an independent control link, it can be ensured that all active or standby sub-control units are always controlled by one main control unit when the link is switched, thereby avoiding command conflicts between different sub-control units; the arbitration unit can respond to the automatic driving command, determine the target control link for automatic driving from multiple control links according to a preset priority, and in the process of automatic driving, if the target control link fails, switch the target control link according to the preset priority, realize intelligent redundant control switching, and ensure reliable operation of automatic driving. The present application scheme effectively solves the technical problem of the lack of a logically clear, safe and reliable automatic driving redundant control scheme in the related art. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 is a schematic diagram of the structure of an optional automatic driving redundant control system according to an embodiment of the present application;

[0019] Figure 2 is a schematic diagram of the structure of an optional computer terminal according to an embodiment of the present application;

[0020] Figure 3 It is a flow chart of an optional automatic driving redundant control method according to an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0022] It should be noted that the terms "first", "second", etc. in the specification, claims and drawings of the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0023] In order to better understand the embodiments of the present application, some nouns or terms that appear in the description of the embodiments of the present application are first translated and explained as follows:

[0024] Controller Area Network (CAN): A serial communication protocol bus used for real-time applications that can use twisted pair cables to transmit signals.

[0025] Example 1

[0026] In order to achieve safe and reliable redundant control in autonomous driving, the present application embodiment first provides an autonomous driving redundant control system, such as Figure 1 As shown, the system at least includes: a mutually redundant first main control unit 11 and a second main control unit 12, a plurality of mutually redundant first sub-control units 13 (1-n) and second sub-control units 14 (1-n), and an arbitration unit 15.

[0027] Optionally, the arbitration unit may detect the status of the first control link, the second control link, the third control link and the fourth control link before determining the target control link, and reject the automatic driving instruction if a fault is detected in any control link.

[0028] Optionally, the types of the first main control unit and the second main control unit include: an autonomous driving domain control unit; the types of the first sub-control unit and the second sub-control unit include at least one of the following: a vehicle control unit, an electronic braking system, an electronic steering system, a body control unit, and an electronic parking unit.

[0029] Among them, the autonomous driving domain control unit ADU of the first control unit and the second control unit realizes redundant wire control of the vehicle control unit VCU, electronic braking system EBS, electronic steering system EPS, body control unit BCM and electronic parking unit EPB in the first sub-control unit and the second sub-control unit through two CAN channels.

[0030] Optionally, the second main control unit is a backup control unit of the first main control unit, and the second sub-control unit is a backup control unit of the first sub-control unit; the preset priorities are from high to low: first control link, second control link, third control link, fourth control link.

[0031] Specifically, the first control unit is the main ADU, the second control unit is the sub-ADU, the first sub-control units are respectively the main VCU, the main EBS, the main EPS, the main BCM, and the main EPB, and the second sub-control units are respectively the sub-VCU, the sub-EBS, the sub-EPS, the sub-BCM, and the sub-EPB; the main ADU and the sub-ADU realize redundant line control of the vehicle's drive through the main VCU and the sub-VCU, the main ADU and the sub-ADU realize redundant line control of the vehicle's brake through the main EBS and the sub-EBS, the main ADU and the sub-ADU realize redundant line control of the vehicle's steering through the main EPS and the sub-EPS, the main ADU and the sub-ADU realize redundant line control of the vehicle's lighting through the main BCM and the sub-BCM. Redundant wire control of wipers, doors, air conditioners and speakers. The main ADU and sub-ADU realize redundant wire control of the vehicle parking system through the main EPB and sub-EPB; the first control link is that the main ADU controls the first sub-control unit, the second control link is that the main ADU controls the second sub-control unit, the third control link is that the sub-ADU controls the first sub-control unit, and the fourth control link is that the sub-ADU controls the second sub-control unit. Accordingly, there are two switching logics in the main ADU, namely, the main ADU controls the first sub-control unit and the main ADU controls the second sub-control unit, while there are two switching logics in the sub-ADU, namely, the sub-ADU controls the first sub-control unit and the sub-ADU controls the second sub-control unit.

[0032] The first main control unit can control all the first sub-control units to form a first control link; the first main control unit can control all the second sub-control units to form a second control link; the second main control unit can control all the first sub-control units to form a third control link; the second main control unit can control all the second sub-control units to form a fourth control link; the arbitration unit can respond to the autonomous driving instruction, determine the target control link for autonomous driving from the first control link, the second control link, the third control link, and the fourth control link according to the preset priority, and can also switch the target control link according to the preset priority during the autonomous driving process if the target control link fails.

[0033] Taking VCU redundant line control as an example, there are four redundant control modes for the line control driven by the first control unit main ADU and the second control unit sub-ADU, namely, the main ADU controls the main VCU, the main ADU controls the sub-VCU, the sub-ADU controls the main VCU, and the sub-ADU controls the sub-VCU. The control priority is pre-set to reduce it. Among them, the main ADU requests the sub-ADU to take over the line control through its CAN, and the sub-ADU feeds back the control status to the main ADU through its CAN. The main ADU and the sub-ADU exchange redundant control status information through their respective CAN, namely, the main ADU controls the main VCU status signal, the main ADU controls the sub-VCU status signal, the sub-ADU controls the main VCU status signal, and the sub-ADU controls the sub-VCU status signal.

[0034] Optionally, the arbitration unit may switch the target control link to the third control link when the target control link is the first control link and the first main control unit fails; switch the target control link to the second control link when the target control link is the first control link and any first sub-control unit fails; switch the target control link to the fourth control link when the target control link is switched to the second control link and the first main control unit fails; determine to exit the automatic driving when the target control link is switched to the second control link and any second sub-control unit fails; determine to exit the automatic driving when the target control link is switched to the third control link and the second main control unit fails; switch the target control link to the fourth control link when the target control link is switched to the fourth control link and the second main control unit fails or any second sub-control unit fails.

[0035] It can be understood that when the control system is in the state of the main ADU controlling the main VCU, if the main ADU fails, the main ADU will request the secondary ADU to take over the automatic driving. At this time, according to the setting of the control link priority, the control system will switch from the state of the main ADU controlling the main VCU to the state of the secondary ADU controlling the main VCU; if the main VCU fails, the control system will switch from the state of the main ADU controlling the main VCU to the state of the main ADU controlling the secondary VCU. When the control system is in the state of the main ADU controlling the secondary VCU, if the main ADU fails, the main ADU will request the secondary ADU to take over the automatic driving. At this time, the control system will switch from the state of the main ADU controlling the secondary VCU to the state of the secondary ADU controlling the secondary VCU; if the secondary VCU fails, it will directly exit the automatic driving state. When the control system is in the state of the secondary ADU controlling the main VCU, if the secondary ADU fails, it will directly exit the automatic driving state; if the main VCU fails, the control system will switch from the state of the secondary ADU controlling the main VCU to the state of the secondary ADU controlling the secondary VCU. When the control system is in the state of sub-ADU controlling sub-VCU, the automatic driving state will be exited regardless of the sub-ADU failure or the sub-VCU failure.

[0036] The first main control unit may send a first request enable instruction to all first sub-control units when the target control link is the first control link, and after receiving the information of entering the waiting state for automatic driving activation fed back by the first sub-control unit, send a first request activation instruction and a first arbitration success information to all first sub-control units; in response to the instruction of switching the target control link to the third control link, send a first arbitration failure information to all first sub-control units, and send a first takeover instruction for requesting the second main control unit to take over all first sub-control units to the second main control unit; in response to the instruction of switching the target control link to the second control link, send a first arbitration failure information to all first sub-control units, and send a second request enable instruction to all second sub-control units, and after receiving the information of entering the waiting state for automatic driving activation fed back by the second sub-control unit, send a first arbitration failure information to all first sub-control units, and send a first takeover instruction for requesting the second main control unit to take over all first sub-control units to the second main control unit; After entering the waiting state for automatic driving activation information, a second request activation instruction and a second arbitration success information are sent to all second sub-control units; a second main control unit is used to respond to the first takeover instruction, send a third request enable instruction to all first sub-control units, and after receiving the information of entering the waiting state for automatic driving activation fed back by the first sub-control unit, send the third request activation instruction and the third arbitration success information to all first sub-control units; in response to the instruction to switch the target control link to the fourth control link, send the third arbitration failure information to all first sub-control units, and send the fourth request enable instruction to all second sub-control units, and after receiving the information of entering the waiting state for automatic driving activation fed back by the second sub-control unit, send the fourth request activation instruction and the fourth arbitration success information to all second sub-control units.

[0037] Specifically, when the control system is in the state of main ADU controlling main VCU, this state has the highest priority. If both main ADU and main VCU are in good condition, the automatic driving instructions can be directly executed. When receiving the state of control system switching to the state of secondary ADU controlling main VCU, main ADU will send arbitration failure information of main ADU controlling main VCU state and main ADU controlling secondary VCU state to main VCU and secondary VCU, and send a first takeover instruction to secondary ADU requesting secondary ADU to take over automatic driving. When receiving the state of control system switching to the state of main ADU controlling secondary VCU, main ADU will send arbitration failure information of main ADU controlling main VCU state to main VCU and secondary VCU, and send a second enable instruction to secondary VCU. If secondary VCU is in good condition, it will enter the state of waiting for automatic driving activation. Then main ADU will send a request to secondary VCU. The secondary ADU sends a takeover instruction to the secondary ADU when a fault occurs, and the secondary ADU controls the automatic driving state at this time. The secondary ADU sends a third request enable instruction to the main VCU. If the main VCU has no fault, it enters the waiting state for automatic driving activation, and then the secondary ADU sends the third request activation instruction and the information on the successful arbitration of the secondary ADU controlling the main VCU state to the main VCU; when receiving the control system state switching to the secondary ADU controlling the secondary VCU state, the secondary ADU first sends the information on the failure of the arbitration of the secondary ADU controlling the main VCU state to the main VCU, and sends the fourth request enable instruction to the secondary VCU. If the secondary VCU has no fault, it enters the waiting state for automatic driving activation, and then the secondary ADU sends the fourth request activation instruction and the message on the successful arbitration of the secondary ADU controlling the secondary VCU state to the secondary VCU.

[0038] The target sub-control unit can perform self-check after power-on and enter the initialization state when there is no fault, wherein the target sub-control unit is any first sub-control unit or second sub-control unit; when in the initialization state, receiving the request enable instruction from the target main control unit, and determining that the automatic driving operation is ready, it enters the waiting automatic driving activation state, and sends the information of entering the waiting automatic driving activation state to the target main control unit, wherein the target main control unit is the first main control unit or the second main control unit in the target control link; when in the waiting automatic driving activation state, receiving the request activation instruction and arbitration success information from the target main control unit, it enters the automatic driving activation state; when in the waiting automatic driving activation state or the automatic driving activation state, receiving the arbitration failure information from the target main control unit, it enters the arbitration failure state; when in the arbitration failure state, receiving the arbitration success information from the target main control unit, it enters the waiting automatic driving activation state; when the target main control unit fails, or the communication check with the target main control unit fails, or the self-check finds a fault, or the automatic driving operation preparation cannot be ready, it enters the fault state; and when the fault is recovered, it enters the initialization state.

[0039] In an embodiment of the present application, an automatic driving redundant control system includes: a mutually redundant first main control unit and a second main control unit, a plurality of mutually redundant first sub-control units and a second sub-control unit, and an arbitration unit; wherein the first main control unit controls all first sub-control units to form a first control link, controls all second sub-control units to form a second control link, and the second main control unit controls all first sub-control units to form a third control link, and controls all second sub-control units to form a fourth control link. By setting an independent control link, it can be ensured that all active or standby sub-control units are always controlled by one main control unit when the link is switched, thereby avoiding command conflicts between different sub-control units; the arbitration unit can respond to the automatic driving command, determine the target control link for automatic driving from multiple control links according to a preset priority, and in the process of automatic driving, if the target control link fails, switch the target control link according to the preset priority, realize intelligent redundant control switching, and ensure reliable operation of automatic driving. The present application scheme effectively solves the technical problem of the lack of a logically clear, safe and reliable automatic driving redundant control scheme in the related art.

[0040] Example 2

[0041] Based on the autonomous driving redundant control system provided in Example 1, an embodiment of the present application provides an autonomous driving redundant control method. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0042] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 2 FIG. 1 shows a hardware structure block diagram of a computer terminal (or mobile device) for implementing an automatic driving redundant control method. Figure 2 As shown, the computer terminal 20 (or mobile device 20) may include one or more (202a, 202b, ..., 202n are used to illustrate) processors 202 (the processor 202 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 204 for storing data, and a transmission device 206 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 2 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 2 More or fewer components as shown, or with Figure 2 Different configurations are shown.

[0043] It should be noted that the one or more processors 202 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 20 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0044] The memory 204 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the automatic driving redundant control method in the embodiment of the present application. The processor 202 executes various functional applications and data processing by running the software programs and modules stored in the memory 204, that is, to implement the vulnerability detection method of the above-mentioned application. The memory 204 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 204 may further include a memory remotely arranged relative to the processor 202, and these remote memories may be connected to the computer terminal 20 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0045] The transmission device 206 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 20. In one example, the transmission device 206 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 206 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0046] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 20 (or mobile device).

[0047] In the above operating environment, the embodiment of the present application provides an automatic driving redundant control method, such as Figure 3 As shown, the method comprises the following steps:

[0048] Step S302, in response to the automatic driving instruction, determining a target control link for automatic driving from the first control link, the second control link, the third control link and the fourth control link according to a preset priority, wherein the first main control unit controls all the first sub-control units to form a first control link, the first main control unit controls all the second sub-control units to form a second control link, the second main control unit controls all the first sub-control units to form a third control link, the second main control unit controls all the second sub-control units to form a fourth control link, the first main control unit and the second main control unit are redundant with each other, and the first sub-control unit and the second sub-control unit are redundant with each other;

[0049] Step S304: During the automatic driving process, if a target control link fails, the target control link is switched according to a preset priority.

[0050] The following describes each step of the automatic driving redundant control method in conjunction with a specific implementation process.

[0051] As an optional implementation, before determining the target control link, the status of the first control link, the second control link, the third control link and the fourth control link are detected. If a fault is detected in any control link, the automatic driving instruction is rejected.

[0052] Optionally, the types of the first main control unit and the second main control unit include: an autonomous driving domain control unit; the types of the first sub-control unit and the second sub-control unit include at least one of the following: a vehicle control unit, an electronic braking system, an electronic steering system, a body control unit, and an electronic parking unit.

[0053] Among them, the autonomous driving domain control unit ADU of the first control unit and the second control unit realizes redundant wire control of the vehicle control unit VCU, electronic braking system EBS, electronic steering system EPS, body control unit BCM and electronic parking unit EPB in the first sub-control unit and the second sub-control unit through two CAN channels.

[0054] Optionally, the second main control unit is a backup control unit of the first main control unit, and the second sub-control unit is a backup control unit of the first sub-control unit; the preset priorities are from high to low: first control link, second control link, third control link, fourth control link.

[0055] Specifically, the first control unit is the main ADU, the second control unit is the sub-ADU, the first sub-control units are respectively the main VCU, the main EBS, the main EPS, the main BCM, and the main EPB, and the second sub-control units are respectively the sub-VCU, the sub-EBS, the sub-EPS, the sub-BCM, and the sub-EPB; the main ADU and the sub-ADU realize redundant line control of the vehicle's drive through the main VCU and the sub-VCU, the main ADU and the sub-ADU realize redundant line control of the vehicle's brake through the main EBS and the sub-EBS, the main ADU and the sub-ADU realize redundant line control of the vehicle's steering through the main EPS and the sub-EPS, the main ADU and the sub-ADU realize redundant line control of the vehicle's lighting through the main BCM and the sub-BCM. Redundant wire control of wipers, doors, air conditioners and speakers. The main ADU and sub-ADU realize redundant wire control of the vehicle parking system through the main EPB and sub-EPB; the first control link is that the main ADU controls the first sub-control unit, the second control link is that the main ADU controls the second sub-control unit, the third control link is that the sub-ADU controls the first sub-control unit, and the fourth control link is that the sub-ADU controls the second sub-control unit. Accordingly, there are two switching logics in the main ADU, namely, the main ADU controls the first sub-control unit and the main ADU controls the second sub-control unit, while there are two switching logics in the sub-ADU, namely, the sub-ADU controls the first sub-control unit and the sub-ADU controls the second sub-control unit.

[0056] The first main control unit can control all first sub-control units to form a first control link; the first main control unit can control all second sub-control units to form a second control link; the second main control unit can control all first sub-control units to form a third control link; the second main control unit can control all second sub-control units to form a fourth control link.

[0057] Taking VCU redundant line control as an example, there are four redundant control modes for the line control driven by the first control unit main ADU and the second control unit sub-ADU, namely, the main ADU controls the main VCU, the main ADU controls the sub-VCU, the sub-ADU controls the main VCU, and the sub-ADU controls the sub-VCU. The control priority is pre-set to reduce it. Among them, the main ADU requests the sub-ADU to take over the line control through its CAN, and the sub-ADU feeds back the control status to the main ADU through its CAN. The main ADU and the sub-ADU exchange redundant control status information through their respective CAN, namely, the main ADU controls the main VCU status signal, the main ADU controls the sub-VCU status signal, the sub-ADU controls the main VCU status signal, and the sub-ADU controls the sub-VCU status signal.

[0058] Optionally, when the target control link is the first control link and the first main control unit fails, the target control link is switched to the third control link; when the target control link is the first control link and any first sub-control unit fails, the target control link is switched to the second control link; when the target control link is switched to the second control link and the first main control unit fails, the target control link is switched to the fourth control link; when the target control link is switched to the second control link and any second sub-control unit fails, it is determined to exit the automatic driving; when the target control link is switched to the third control link and the second main control unit fails, it is determined to exit the automatic driving; when the target control link is switched to the third control link and any first sub-control unit fails, the target control link is switched to the fourth control link; when the target control link is switched to the fourth control link and the second main control unit fails or any second sub-control unit fails, it is determined to exit the automatic driving.

[0059] It can be understood that when the control system is in the state of the main ADU controlling the main VCU, if the main ADU fails, the main ADU will request the secondary ADU to take over the automatic driving. At this time, according to the setting of the control link priority, the control system will switch from the state of the main ADU controlling the main VCU to the state of the secondary ADU controlling the main VCU; if the main VCU fails, the control system will switch from the state of the main ADU controlling the main VCU to the state of the main ADU controlling the secondary VCU. When the control system is in the state of the main ADU controlling the secondary VCU, if the main ADU fails, the main ADU will request the secondary ADU to take over the automatic driving. At this time, the control system will switch from the state of the main ADU controlling the secondary VCU to the state of the secondary ADU controlling the secondary VCU; if the secondary VCU fails, it will directly exit the automatic driving state. When the control system is in the state of the secondary ADU controlling the main VCU, if the secondary ADU fails, it will directly exit the automatic driving state; if the main VCU fails, the control system will switch from the state of the secondary ADU controlling the main VCU to the state of the secondary ADU controlling the secondary VCU. When the control system is in the state of sub-ADU controlling sub-VCU, the automatic driving state will be exited regardless of the sub-ADU failure or the sub-VCU failure.

[0060] The first main control unit may send a first request enable instruction to all first sub-control units when the target control link is the first control link, and after receiving the information of entering the waiting state for automatic driving activation fed back by the first sub-control unit, send the first request activation instruction and the first arbitration success information to all first sub-control units; in response to the instruction of switching the target control link to the third control link, send the first arbitration failure information to all first sub-control units, and send the first takeover instruction for requesting the second main control unit to take over all first sub-control units to the second main control unit; in response to the instruction of switching the target control link to the second control link, send the first arbitration failure information to all first sub-control units, and send the second request enable instruction to all second sub-control units, and after receiving the information fed back by the second sub-control unit After entering the waiting state for automatic driving activation information, a second request activation instruction and a second arbitration success information are sent to all second sub-control units; a second main control unit is used to respond to the first takeover instruction, send a third request enable instruction to all first sub-control units, and after receiving the information of entering the waiting state for automatic driving activation feedback from the first sub-control unit, send the third request activation instruction and the third arbitration success information to all first sub-control units; in response to the instruction to switch the target control link to the fourth control link, send the third arbitration failure information to all first sub-control units, and send the fourth request enable instruction to all second sub-control units, and after receiving the information of entering the waiting state for automatic driving activation feedback from the second sub-control unit, send the fourth request activation instruction and the fourth arbitration success information to all second sub-control units.

[0061] Specifically, when the control system is in the state of main ADU controlling main VCU, this state has the highest priority. If both main ADU and main VCU are in good condition, the automatic driving instructions can be directly executed. When receiving the state of control system switching to the state of secondary ADU controlling main VCU, main ADU will send arbitration failure information of main ADU controlling main VCU state and main ADU controlling secondary VCU state to main VCU and secondary VCU, and send a first takeover instruction to secondary ADU requesting secondary ADU to take over automatic driving. When receiving the state of control system switching to the state of main ADU controlling secondary VCU, main ADU will send arbitration failure information of main ADU controlling main VCU state to main VCU and secondary VCU, and send a second enable instruction to secondary VCU. If secondary VCU is in good condition, it will enter the state of waiting for automatic driving activation. Then main ADU will send a request to secondary VCU. The secondary ADU sends a takeover instruction to the secondary ADU when a fault occurs, and the secondary ADU controls the automatic driving state at this time. The secondary ADU sends a third request enable instruction to the main VCU. If the main VCU has no fault, it enters the waiting state for automatic driving activation, and then the secondary ADU sends the third request activation instruction and the information on the successful arbitration of the secondary ADU controlling the main VCU state to the main VCU; when receiving the control system state switching to the secondary ADU controlling the secondary VCU state, the secondary ADU first sends the information on the failure of the arbitration of the secondary ADU controlling the main VCU state to the main VCU, and sends the fourth request enable instruction to the secondary VCU. If the secondary VCU has no fault, it enters the waiting state for automatic driving activation, and then the secondary ADU sends the fourth request activation instruction and the message on the successful arbitration of the secondary ADU controlling the secondary VCU state to the secondary VCU.

[0062] The first sub-control unit and the second sub-control unit in the target control link can perform self-check after power-on, and enter the initialization state when there is no fault; when in the initialization state, receiving the request enable instruction from the target main control unit, and determining that the automatic driving operation is ready, they enter the waiting automatic driving activation state, and send the information of entering the waiting automatic driving activation state to the target main control unit, wherein the target main control unit is the first main control unit or the second main control unit in the target control link; when in the waiting automatic driving activation state, receiving the request activation instruction and arbitration success information from the target main control unit, they enter the automatic driving activation state; when in the waiting automatic driving activation state or the automatic driving activation state, receiving the arbitration failure information from the target main control unit, they enter the arbitration failure state; when in the arbitration failure state, receiving the arbitration success information from the target main control unit, they enter the waiting automatic driving activation state; when the target main control unit fails, or the communication check with the target main control unit fails, or the self-check finds a fault, or the automatic driving operation preparation cannot be ready, they enter the fault state; and when the fault is recovered, they enter the initialization state.

[0063] In an embodiment of the present application, in response to an automatic driving instruction, a target control link for automatic driving is determined from the first control link, the second control link, the third control link and the fourth control link according to a preset priority, wherein the first main control unit controls all first sub-control units to form a first control link, the first main control unit controls all second sub-control units to form a second control link, the second main control unit controls all first sub-control units to form a third control link, the second main control unit controls all second sub-control units to form a fourth control link, the first main control unit and the second main control unit are redundant to each other, and the first sub-control unit and the second sub-control unit are redundant to each other. By setting an independent control link, it can be ensured that all active or standby sub-control units are always controlled by one main control unit when the link is switched, avoiding command conflicts between different sub-control units; in the process of automatic driving, if the target control link fails, the target control link is switched according to the preset priority, realizing intelligent redundant control switching, and ensuring reliable operation of automatic driving. The present application scheme effectively solves the technical problem of the lack of a logically clear, safe and reliable automatic driving redundant control scheme in the related art.

[0064] Example 3

[0065] According to an embodiment of the present application, a non-volatile storage medium is also provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the automatic driving redundant control method in Example 1 by running the computer program.

[0066] Specifically, the device where the non-volatile storage medium is located implements the following steps by running the computer program: in response to the autonomous driving instruction, determine the target control link for autonomous driving from the first control link, the second control link, the third control link and the fourth control link according to the preset priority, wherein the first main control unit controls all the first sub-control units to form the first control link, the first main control unit controls all the second sub-control units to form the second control link, the second main control unit controls all the first sub-control units to form the third control link, the second main control unit controls all the second sub-control units to form the fourth control link, the first main control unit and the second main control unit are redundant with each other, and the first sub-control unit and the second sub-control unit are redundant with each other; during the autonomous driving process, if the target control link fails, switch the target control link according to the preset priority.

[0067] According to an embodiment of the present application, a processor is also provided, which is used to run a computer program, wherein the automatic driving redundant control method in Example 1 is executed when the computer program is running.

[0068] Specifically, the computer program executes the following steps when it is running: in response to the autonomous driving instruction, determine the target control link for autonomous driving from the first control link, the second control link, the third control link and the fourth control link according to the preset priority, wherein the first main control unit controls all the first sub-control units to form the first control link, the first main control unit controls all the second sub-control units to form the second control link, the second main control unit controls all the first sub-control units to form the third control link, the second main control unit controls all the second sub-control units to form the fourth control link, the first main control unit and the second main control unit are redundant with each other, and the first sub-control unit and the second sub-control unit are redundant with each other; during the autonomous driving process, if the target control link fails, switch the target control link according to the preset priority.

[0069] According to an embodiment of the present application, an electronic device is also provided, which includes: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the automatic driving redundant control method in Example 1 through the computer program.

[0070] Specifically, the processor is configured to execute the following steps through a computer program: in response to an autonomous driving instruction, determine a target control link for autonomous driving from the first control link, the second control link, the third control link and the fourth control link according to a preset priority, wherein the first main control unit controls all first sub-control units to form a first control link, the first main control unit controls all second sub-control units to form a second control link, the second main control unit controls all first sub-control units to form a third control link, the second main control unit controls all second sub-control units to form a fourth control link, the first main control unit and the second main control unit are redundant with each other, and the first sub-control unit and the second sub-control unit are redundant with each other; during the autonomous driving process, if the target control link fails, switch the target control link according to the preset priority.

[0071] The serial numbers of the above embodiments are only for description and do not represent the advantages or disadvantages of the embodiments.

[0072] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0073] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0074] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0075] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0076] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0077] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. An automatic driving redundant control system, characterized in that: include: A first main control unit and a second main control unit which are mutually redundant, a plurality of groups of first sub-control units and second sub-control units which are mutually redundant, and an arbitration unit, wherein: The first main control unit is used to control all the first sub-control units to form a first control link; The first main control unit is used to control all the second sub-control units to form a second control link; The second main control unit is used to control all the first sub-control units to form a third control link; The second main control unit is used to control all the second sub-control units to form a fourth control link; The arbitration unit is used to respond to the autonomous driving instruction and determine the target control link for autonomous driving from the first control link, the second control link, the third control link, and the fourth control link according to a preset priority; and is also used to switch the target control link according to the preset priority if the target control link fails during the autonomous driving process.

2. The system according to claim 1, characterized in that The types of the first main control unit and the second main control unit include: an autonomous driving domain control unit; The types of the first sub-control unit and the second sub-control unit include at least one of the following: a vehicle control unit, an electronic braking system, an electronic steering system, a body control unit, and an electronic parking unit.

3. The system according to claim 1, characterized in that The arbitration unit is further used to detect the status of the first control link, the second control link, the third control link and the fourth control link before determining the target control link, and reject the automatic driving instruction if a fault is detected in any control link.

4. The system according to claim 1, characterized in that The second main control unit is a backup control unit of the first main control unit, and the second sub-control unit is a backup control unit of the first sub-control unit; The preset priorities are, from high to low, the first control link, the second control link, the third control link, and the fourth control link.

5. The system according to claim 4, characterized in that The arbitration unit is used for switching the target control link to the third control link when the target control link is the first control link and the first main control unit fails; switching the target control link to the second control link when the target control link is the first control link and any of the first sub-control units fails; switching the target control link to the fourth control link when the target control link is switched to the second control link and the first main control unit fails; determining to exit the automatic driving when the target control link is switched to the second control link and any of the second sub-control units fails; determining to exit the automatic driving when the target control link is switched to the third control link and the second main control unit fails; switching the target control link to the fourth control link when the target control link is switched to the third control link and any of the first sub-control units fails; determining to exit the automatic driving when the target control link is switched to the fourth control link and the second main control unit fails or any of the second sub-control units fails.

6. The system according to claim 4, characterized in that the first main control unit is configured to send a first request enable instruction to all the first sub-control units when the target control link is the first control link, and after receiving information of entering a waiting state for automatic driving activation fed back by the first sub-control unit, send a first request activation instruction and first arbitration success information to all the first sub-control units; In response to the instruction to switch the target control link to the third control link, first arbitration failure information is sent to all the first sub-control units, and a first takeover instruction for requesting the second main control unit to take over all the first sub-control units is sent to the second main control unit; in response to the instruction to switch the target control link to the second control link, first arbitration failure information is sent to all the first sub-control units, and a second request enable instruction is sent to all the second sub-control units, and after receiving the information of entering the waiting state for automatic driving activation fed back by the second sub-control unit, a second request activation instruction and a second arbitration success information are sent to all the second sub-control units; the second main control unit is configured to respond to the first takeover instruction, send a third request enable instruction to all the first sub-control units, and after receiving information of entering a waiting state for automatic driving activation fed back by the first sub-control unit, send a third request activation instruction and third arbitration success information to all the first sub-control units; In response to the instruction to switch the target control link to the fourth control link, a third arbitration failure message is sent to all the first sub-control units, and a fourth request enable message is sent to all the second sub-control units; after receiving the information of entering the waiting state for automatic driving activation fed back by the second sub-control unit, a fourth request activation message and a fourth arbitration success message are sent to all the second sub-control units.

7. The system according to claim 6, characterized in that A target sub-control unit, configured to perform self-check after power-on and enter an initialization state when there is no fault, wherein the target sub-control unit is any of the first sub-control unit or the second sub-control unit; when in the initialization state, receiving a request enable instruction from a target main control unit, and determining that the automatic driving operation is ready, entering a waiting automatic driving activation state, and sending information of entering the waiting automatic driving activation state to the target main control unit, wherein the target main control unit is the first main control unit or the second main control unit in the target control link; when in the waiting automatic driving activation state, receiving a request activation instruction and arbitration success information from the target main control unit, entering an automatic driving activation state; when in the waiting automatic driving activation state or the automatic driving activation state, receiving arbitration failure information from the target main control unit, entering an arbitration failure state; when in the arbitration failure state, receiving arbitration success information from the target main control unit, entering a waiting automatic driving activation state; when the target main control unit fails, or the communication check with the target main control unit fails, or the self-check finds a fault, or the automatic driving operation preparation cannot be ready, entering a fault state; and when the fault is recovered, entering an initialization state.

8. An automatic driving redundant control method, characterized in that: include: In response to an automatic driving instruction, a target control link for automatic driving is determined from a first control link, a second control link, a third control link and a fourth control link according to a preset priority, wherein a first main control unit controls all first sub-control units to form a first control link, the first main control unit controls all second sub-control units to form a second control link, the second main control unit controls all first sub-control units to form a third control link, the second main control unit controls all second sub-control units to form a fourth control link, the first main control unit and the second main control unit are redundant to each other, and the first sub-control unit and the second sub-control unit are redundant to each other; During the automatic driving process, if the target control link fails, the target control link is switched according to the preset priority.

9. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the automatic driving redundant control method described in claim 8 by running the computer program.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the automatic driving redundant control method of claim 8 through the computer program.

Images