Vehicle control method and vehicle controller

Abstract

The embodiment of the invention provides a vehicle control method and a vehicle controller, and relates to the technical field of automobile electronics. The method comprises the steps that the current operation state of a preset function module of a vehicle is obtained; switching the vehicle to a preset control mode in response to the condition that the current running state meets a preset switching condition; and controlling the vehicle according to the preset control mode. Compared with the prior art, by applying the scheme provided by the embodiment of the invention, the vehicle can be controlled when the function module is abnormal or the parts of the vehicle have faults, so that the safety of the vehicle in the driving process is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of automotive electronic technology, and in particular to a vehicle control method and a vehicle controller. Background Art

[0002] With the rapid development of the automotive industry, other fields closely related to the automotive industry are also developing continuously, such as automotive electronic technology, energy security, autonomous driving, and intelligent networking of automobiles. In addition, as intelligent networking of automobiles becomes more and more mature, driving safety in the field of autonomous driving has received more and more attention from the public.

[0003] When a vehicle is driving, there will be multiple vehicle actions, such as vehicle turning action, vehicle speed change action, vehicle stopping action, etc. Each vehicle action is completed by the corresponding parts of the vehicle performing corresponding actions.

[0004] For example, during the vehicle turning process, the control of various components such as the vehicle turn signal and steering axle will be involved. In the automatic driving mode, during the vehicle turning process, the vehicle controller of the vehicle controls the various components involved in the vehicle turning process through the pre-set functional modules. Therefore, it can be determined that the normal driving of an automatic driving vehicle depends on the mutual coordination between the set functional modules and the various components of the vehicle.

[0005] Therefore, during the vehicle's automatic driving process, if there is an abnormality in the vehicle's functional module, or if there is a failure in the vehicle's components, it may cause problems with the vehicle's driving safety.

[0006] Based on this, during the vehicle's automatic driving process, when there is an abnormality in the vehicle's functional module or a fault in the vehicle's components, how to control the vehicle, thereby improving the vehicle's safety during the automatic driving process, has become a problem that needs to be solved urgently. Summary of the invention

[0007] The purpose of the embodiments of the present disclosure is to provide a vehicle control method and a vehicle controller, so as to realize control of the vehicle when there is an abnormality in the functional module of the vehicle or a failure in the component of the vehicle during the automatic driving process of the vehicle, thereby improving the safety of the vehicle during driving. The specific technical solution is as follows:

[0008] According to a first aspect of an embodiment of the present disclosure, a method for controlling a vehicle is first provided. The vehicle includes a vehicle controller. The method includes:

[0009] Obtain the current operating status of the vehicle's preset functional modules;

[0010] In response to the current operating state meeting a preset switching condition, switching the vehicle to a preset control mode;

[0011] Control the vehicle according to the preset control mode.

[0012] According to a second aspect of the embodiments of the present disclosure, a vehicle controller is further provided. The vehicle controller includes: a first chip and a second chip;

[0013] The first chip is used to obtain the current operating status of the preset functional module of the vehicle;

[0014] The first chip is used to send the current running status to the second chip;

[0015] The second chip is used to switch the vehicle to a preset control mode in response to the current operating state meeting the preset switching condition;

[0016] The second chip is used to control the vehicle according to a preset control mode.

[0017] According to a third aspect of an embodiment of the present disclosure, a computer-readable storage medium is further provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the control method of any vehicle provided in the first aspect is implemented.

[0018] According to a fourth aspect of an embodiment of the present disclosure, there is also provided a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute any vehicle control method provided in the first aspect.

[0019] Beneficial effects of the embodiments of the present disclosure:

[0020] As can be seen from the above, the solution provided by the embodiment of the present disclosure can be applied to the vehicle controller included in the vehicle. In order to improve the safety of the vehicle during driving, a preset control mode can be set in advance, and in order to determine whether the control mode of the vehicle needs to be switched to the preset control mode, a preset switching condition can be set in advance, so that when the current operating state of the preset functional module of the vehicle is obtained, in response to the current operating state meeting the preset switching condition, the vehicle is switched to the preset control mode, and the vehicle is controlled according to the preset control mode switched to.

[0021] By applying the solution provided by the embodiment of the present disclosure, in order to avoid the problem of threatening driving safety due to abnormal functional modules of the vehicle or failure of vehicle components during the automatic driving process of the vehicle, a preset control mode for controlling the vehicle in the case of abnormal functional modules of the vehicle, failure of vehicle components, etc., which threaten driving safety, and a preset switching condition for determining whether to switch the vehicle to the above-mentioned preset control mode can be pre-set. In this way, when it is obtained that the current operating state of the vehicle meets the above-mentioned preset switching condition, it indicates that the vehicle is in a situation where driving safety is threatened during the automatic driving process, and the control mode of the vehicle is switched to the above-mentioned preset control mode, and the vehicle is controlled according to the above-mentioned preset control mode. Based on this, it can be achieved that when the vehicle is in a situation where driving safety is threatened during the automatic driving process, the vehicle can be controlled by switching the control mode, thereby improving the safety of the vehicle during the automatic driving process. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and for ordinary technicians in this field, other embodiments can also be obtained based on these drawings.

[0023] Figure 1 A schematic flow chart of a first vehicle control method provided by an embodiment of the present disclosure;

[0024] Figure 2 An architectural diagram of a vehicle provided with a vehicle controller provided in an embodiment of the present disclosure;

[0025] Figure 3 An architecture diagram of a vehicle provided with a vehicle controller having a dual-chip architecture based on a domain controller according to an embodiment of the present disclosure;

[0026] Figure 4 A state transition diagram of a state machine provided in an embodiment of the present disclosure;

[0027] Figure 5 A schematic flow chart of a second vehicle control method provided by an embodiment of the present disclosure;

[0028] Figure 6 A schematic flow chart of a third vehicle control method provided by an embodiment of the present disclosure;

[0029] Figure 7 A schematic flow chart of a fourth vehicle control method provided in an embodiment of the present disclosure;

[0030] Figure 8A signaling interaction diagram between a first chip and a second chip provided in an embodiment of the present disclosure;

[0031] Fig. 9 A schematic diagram of the structure of a first vehicle controller provided by an embodiment of the present disclosure;

[0032] Fig.10 A schematic diagram of the structure of a second vehicle controller provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0033] The following will be combined with the drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field based on the present disclosure belong to the scope of protection of the present disclosure.

[0034] In order to facilitate understanding of a vehicle control method and a vehicle controller provided by an embodiment of the present disclosure, various related terms involved in the embodiment of the present disclosure are first described in detail below.

[0035] Autonomous driving refers to the use of various sensors and computer systems to perceive and understand the surrounding environment and make corresponding decisions to control the vehicle without human intervention. Among them, various sensors are used to collect information about the environment around the vehicle, and the above-mentioned computer system is used to determine the corresponding vehicle control decisions to control the vehicle based on the environmental information perceived by various sensors. Usually, autonomous driving needs to rely on the vehicle controller installed on the vehicle, that is, the above-mentioned computer system includes a vehicle controller.

[0036] Car assisted driving is a semi-automated driving technology that uses various sensors, cameras and radars to help the driver control the car. Compared with autonomous driving technology, assisted driving technology requires the driver's participation and control.

[0037] A vehicle controller usually refers to an Electronic Control Unit (ECU), which is responsible for monitoring and managing various systems and subsystems of the vehicle to ensure the normal operation and safety performance of each system of the vehicle.

[0038] In the related technologies, in order to ensure the functional safety of traditional vehicle controllers, E-GAS (Standardized E-Gas Monitoring Concept for Gasoline and Diesel Engine Control Units) is the most widely used safety software architecture solution for standardized electronic and electrical control units for gasoline and diesel engine control units. With the increase in vehicle functional requirements and the increasing demand for multi-scenario intelligent driving, the traditional distributed electronic and electrical architecture is not enough. The domain controller provides a functional integration solution, which has the advantages of reducing node transmission delay, reducing wiring harness weight, improving computing efficiency, and facilitating the systematic design of vehicle software to improve vehicle dynamics, and has gradually become the focus of current vehicle research and development. Compared with the traditional on-board electronic control unit, which can design a safety architecture for each key control node separately to ensure the reliability of algorithms and functions, the current domain controller system lacks an overall functional safety architecture to cope with its integrated signal processing and multi-functional integrated control mode. Especially in the process of automatic driving or assisted automatic driving of the vehicle, when there is an abnormality in the functional module of the vehicle, or there is a fault in the component of the vehicle, how to control the vehicle, and thus how to ensure the driving safety of the vehicle in automatic driving or assisted automatic driving, and improve the safety of the vehicle during driving, has become a problem that needs to be solved urgently.

[0039] In order to solve the above technical problems, an embodiment of the present disclosure provides a method for controlling a vehicle, wherein the vehicle includes a vehicle controller, and the method is applied to the vehicle controller. The method is applicable to various application scenarios of automatic driving or assisted automatic driving of the vehicle. Moreover, the method can be applied to a vehicle controller of the vehicle. The vehicle controller can be various types of vehicle controllers for controlling the vehicle during the automatic driving process of the vehicle. Based on this, the embodiment of the present disclosure does not limit the application scenarios and execution subjects of the method.

[0040] The vehicles involved in the embodiments of the present disclosure all include a vehicle controller. The embodiments of the present disclosure provide a vehicle control method, which is applied to the vehicle controller. The control method may include the following steps:

[0041] Obtaining the current operating status of a preset functional module of the vehicle;

[0042] In response to the current operating state meeting a preset switching condition, switching the vehicle to the preset control mode;

[0043] The vehicle is controlled according to the preset control mode.

[0044] As can be seen from the above, the solution provided by the embodiment of the present disclosure can be applied to the vehicle controller included in the vehicle. In order to improve the safety of the vehicle during driving, a preset control mode can be set in advance, and in order to determine whether the control mode of the vehicle needs to be switched to the preset control mode, a preset switching condition can be set in advance, so that when the current operating state of the preset functional module of the vehicle is obtained, in response to the current operating state meeting the preset switching condition, the vehicle is switched to the preset control mode, and the vehicle is controlled according to the preset control mode switched to.

[0045] By applying the solution provided by the embodiment of the present disclosure, in order to avoid the problem of threatening driving safety due to abnormal functional modules of the vehicle or failure of vehicle components during the automatic driving process of the vehicle, a preset control mode for controlling the vehicle in the case of abnormal functional modules of the vehicle, failure of vehicle components, etc., which threaten driving safety, and a preset switching condition for determining whether to switch the vehicle to the above-mentioned preset control mode can be pre-set. In this way, when it is obtained that the current operating state of the vehicle meets the above-mentioned preset switching condition, it indicates that the vehicle is in a situation where driving safety is threatened during the automatic driving process, and the control mode of the vehicle is switched to the above-mentioned preset control mode, and the vehicle is controlled according to the above-mentioned preset control mode. Based on this, it can be achieved that when the vehicle is in a situation where driving safety is threatened during the automatic driving process, the vehicle can be controlled by switching the control mode, thereby improving the safety of the vehicle during the automatic driving process.

[0046] A vehicle control method provided by an embodiment of the present disclosure is described in detail below in conjunction with the accompanying drawings.

[0047] Figure 1 A flow chart of a vehicle control method provided in an embodiment of the present disclosure, wherein the vehicle includes a vehicle controller, and the method is applied to the vehicle controller. The method may include the following steps S101-S103:

[0048] S101: Acquire the current operating status of a preset functional module of the vehicle.

[0049] Since the vehicle will have many actions while driving, it is necessary to automatically control multiple actions of the vehicle during the automatic driving process of the vehicle, such as vehicle stopping action, vehicle speed changing action, vehicle turning action, etc. The essence of controlling each vehicle action is to control the vehicle components involved in each action.

[0050] In the disclosed embodiment, each component in the vehicle that generates actual actions can be regarded as a node. In practical applications, since each component needs to be controlled separately to achieve corresponding functions, each component is equivalent to a control node, and a corresponding preset function module is set for each control node. In other words, each component of the vehicle corresponds to a control node, and a control node corresponds to a preset function module. In this way, the vehicle controller can control each control node through the preset function module of the control node, so that the vehicle component corresponding to the control node performs the corresponding action.

[0051] For example, the control of turning the left turn signal on and off is a control node, and the preset function module corresponding to the control node can be called the left turn signal function module. The vehicle controller controls the left turn signal on or off by controlling the left turn signal function module; for another example, the control of turning the radio on and off is a control node, and the preset function module corresponding to the control node can be called the radio function module. The vehicle controller controls the radio light on or off by controlling the radio function module.

[0052] That is to say, the preset function modules in the embodiments of the present disclosure correspond one to one with the vehicle components that can produce actual actions, and each preset function module is used to control a vehicle component to perform a corresponding operation. For example, the left turn signal function module is used to control the left turn signal to turn on or off, the radio function module is used to control the radio light to turn on or off, and the brake pedal function module is used to control whether to brake or not.

[0053] When the vehicle controller controls the vehicle to perform a certain vehicle action, the vehicle controller can first determine the various control nodes involved in the vehicle action, and then call the preset function modules corresponding to the above-mentioned various control nodes, so that the called preset function modules send control instructions to the corresponding control nodes, that is, specific vehicle components, and the control instructions sent by each preset function module are used to control the control node corresponding to the preset function module to perform the corresponding action. In this way, the various vehicle components involved in a vehicle action can perform the action required by the vehicle component under the control of the corresponding preset function modules, so that the vehicle completes the corresponding action.

[0054] For example, the vehicle components involved in the left turn action of the vehicle may include: left turn signal, steering axle, accelerator pedal, brake pedal and other components. Taking the control of the left turn signal and steering axle as an example, the control nodes where these two components are located are respectively called: left turn signal control node and steering axle control node. When the vehicle controller controls the vehicle to perform a left turn action, the left turn signal function module corresponding to the left turn signal control node and the steering axle function module corresponding to the steering axle control node are called, so that the left turn signal function module sends an on command to the left turn signal control node, and the steering axle function module sends a left turn command to the steering axle control node. Afterwards, the left turn signal responds to the above-mentioned on command and turns on the left turn signal, and the steering axle responds to the above-mentioned left turn command and rotates to the left, so that the vehicle performs a left turn action.

[0055] For each preset function module, after issuing a control instruction, the execution result of the control node on the control instruction can be monitored, such as successful execution, failed execution, etc. In this way, after issuing a control instruction, each preset function module can judge the running state of the preset function module according to the execution result of the corresponding control node obtained. For example, receiving a successful execution result indicates that the running state of the preset function module is normal, and receiving a failed execution result indicates that the running state of the preset function module is abnormal. At the same time, the failure of the preset function module to issue instructions normally or not receiving an execution result within a preset time also indicates that the running state of the preset function module is abnormal. Therefore, whether the running state of each preset function module is normal can represent whether the control node corresponding to the preset function module can perform functions normally.

[0056] That is to say, if the operating status of a preset functional module is normal, it can indicate that the control node corresponding to the preset functional module can perform functions normally; if the operating status of a preset functional module is abnormal, it can indicate that the control node corresponding to the preset functional module cannot perform functions normally, that is, the control node is invalid.

[0057] In some cases, the failure of the control node may be due to its own failure, which makes it unable to respond to the received control instructions normally; in other cases, the failure of the control node may be due to the abnormality of the preset function module corresponding to the control node, which makes the control node unable to respond to the instruction. For example, the preset function module sends an erroneous instruction or even fails to send an instruction. Therefore, the reason for the failure of the control node can be a control node failure or an abnormality of the preset function module corresponding to the control node.

[0058] During vehicle driving, actions such as vehicle turning, vehicle braking, and vehicle speed change often have a great impact on vehicle driving safety. When the control nodes involved in the vehicle actions that have a great impact on vehicle driving safety fail, the vehicle often has a great threat to driving safety, which seriously threatens the vehicle's driving safety. For example, when the brake pedal control node fails, the vehicle may collide with an obstacle because it cannot brake; when the steering axle control node fails, the vehicle may collide because it cannot avoid obstacles. Therefore, during vehicle driving, it is necessary to focus on the control nodes involved in the vehicle actions that have a great impact on vehicle driving safety, so that when these control nodes are found to fail, timely measures can be taken to avoid danger to the vehicle and improve the driving safety of the vehicle.

[0059] Based on this, the control nodes involved in the vehicle actions that threaten the driving safety of the vehicle can be regarded as key control nodes, for example, the steering axle control node, the brake pedal control node and the accelerator pedal control node can be regarded as key control nodes. In the present disclosure, all control nodes that may threaten the driving safety of the vehicle can be regarded as key control nodes, and the specific number of key control nodes is not limited.

[0060] As can be seen from the above, in the present disclosure, the above-mentioned preset function modules are used to control various control nodes in the process of automatic driving of the vehicle. The operating status of the preset function modules corresponding to the key control nodes is an important basis for determining whether the vehicle has problems that threaten driving safety.

[0061] In the present disclosure, the vehicle controller of the vehicle can obtain the current operating status of all preset functional modules of the vehicle in real time, realize all-round real-time monitoring of the preset functional modules of the vehicle, and can also obtain the current operating status of the preset functional modules corresponding to the key control nodes of the vehicle in real time, thereby saving resources and speeding up the operation speed while ensuring the safety of vehicle driving.

[0062] S102: In response to the current operating state meeting the preset switching condition, switching the vehicle to a preset control mode;

[0063] S103: Control the vehicle according to a preset control mode.

[0064] During the vehicle's automatic driving process, in order to improve the vehicle's driving safety, different control modes can be set according to different possible operating states of the vehicle.

[0065] For example, during the process of automatic driving, the vehicle may be in a normal driving state and an abnormal driving state. If the current operating states of all preset functional modules of the vehicle are normal, the vehicle is considered to be in a normal state; if the current operating state of a preset functional module is abnormal, the vehicle is considered to be in an abnormal state. When judging vehicle abnormalities, different judgment criteria can be set as needed. One possible criterion is that as long as the current operating state of a preset functional module is abnormal, the vehicle is considered to be in an abnormal state; another possible criterion is that the current operating state of one or more preset functional modules corresponding to the key control node is abnormal, and the vehicle is considered to be in an abnormal state. The disclosed embodiment does not limit the standard for vehicle abnormalities, and can be flexibly set according to actual needs.

[0066] Since the operation state of the preset function module can be used to determine whether the vehicle is in an abnormal state, a preset switching condition can be set according to the operation state of the preset function module. When the preset switching condition is met, the vehicle is switched to the corresponding preset control mode. The preset switching condition and how to define the preset switching condition to be met are described in detail in the following embodiments.

[0067] As can be seen from the above, the solution provided by the embodiment of the present disclosure can be applied to the vehicle controller included in the vehicle. In order to improve the safety of the vehicle during driving, a preset control mode can be set in advance, and in order to determine whether the control mode of the vehicle needs to be switched to the preset control mode, a preset switching condition can be set in advance, so that when the current operating state of the preset functional module of the vehicle is obtained, in response to the current operating state meeting the preset switching condition, the vehicle is switched to the preset control mode, and the vehicle is controlled according to the preset control mode switched to.

[0068] By applying the solution provided by the embodiment of the present disclosure, in order to avoid the problem of threatening driving safety due to abnormal functional modules of the vehicle or failure of vehicle components during the automatic driving process of the vehicle, a preset control mode for controlling the vehicle in the case of abnormal functional modules of the vehicle, failure of vehicle components, etc., which threaten driving safety, and a preset switching condition for determining whether to switch the vehicle to the above-mentioned preset control mode can be pre-set. In this way, when it is obtained that the current operating state of the vehicle meets the above-mentioned preset switching condition, it indicates that the vehicle is in a situation where driving safety is threatened during the automatic driving process, and the control mode of the vehicle is switched to the above-mentioned preset control mode, and the vehicle is controlled according to the above-mentioned preset control mode. Based on this, it can be achieved that when the vehicle is in a situation where driving safety is threatened during the automatic driving process, the vehicle can be controlled by switching the control mode, thereby improving the safety of the vehicle during the automatic driving process.

[0069] exist Figure 1 In the described embodiment, in order to avoid safety issues during the vehicle's automatic driving process, the vehicle is switched to a preset control mode and controlled according to the preset control mode. In this mode, usually only functions related to safe driving of the vehicle are implemented, and entertainment functions and comfort functions are no longer implemented to reduce unnecessary energy consumption.

[0070] As mentioned above, the present disclosure provides a vehicle control method applied to a vehicle controller to improve the safety of the vehicle during driving. The present disclosure also provides an overall functional architecture for the vehicle controller to realize a vehicle controller with integrated signal processing and multi-function integrated control, thereby avoiding the problem that the domain controller in the related art, when used as a vehicle controller, lacks an overall functional safety architecture to cope with the requirements of integrated signal processing and multi-function integration.

[0071] The vehicle controller provided by the present disclosure may be a controller of a dual-chip architecture based on a domain controller. The dual-chip architecture allocates three layers to two differentiated controller chips, including a functional layer, a functional monitoring layer, and a redundant functional layer, and specifies that a state machine for managing the vehicle operating state is provided in the redundant functional layer, and the state transition of the state machine is used to characterize the switching of the vehicle operating state.

[0072] The state machine is composed of a state register and a combinational logic circuit, and can transfer states according to a preset state based on a control signal. It is a control center that coordinates related signal actions and completes specific operations. The state machine can be divided into a Moore type state machine and a Mealy type state machine.

[0073] Usually, the state machine can be represented by a state transition diagram. To facilitate understanding of the above state transition diagram, take the state transition of a person as an example. A person has three states: healthy, cold, and recovering. The triggering conditions are rain (t1), taking medicine (t2), injection (t3), and rest (t4). Therefore, the state machine includes the following state transitions: healthy-(t4)->healthy; healthy-(t1)->cold; cold-(t3)->healthy; cold-(t2)->recovering; recovering-(t4)->healthy.

[0074] In a specific implementation, a vehicle having a vehicle controller is provided as shown in the following figure: Figure 2 shown.

[0075] like Figure 2 As shown, the vehicle includes: a vehicle controller 100, an automatic driving sensor system 200, an independent perception unit 300 and a vehicle chassis bus signal system 400.

[0076] The vehicle controller 100 has a dual-chip architecture based on a domain controller, which includes a first chip 101 and a second chip 102, and the first chip 101 and the second chip 102 communicate with each other. In addition, the first chip 101 includes a function layer and a function monitoring layer, and the second chip 102 includes a redundant function and a hardware monitoring layer, which includes some functions of the first chip 101, that is, a redundant function layer equivalent to some functions of the first chip.

[0077] In addition, if Figure 2 As shown, during the automatic driving process of the vehicle, the automatic driving sensor system 200, the independent sensing unit 300 and the vehicle chassis bus signal system 400 all collect the vehicle surrounding environment information through peripherals such as cameras and laser radars and send it to the vehicle controller 100. The automatic driving sensor system 200 is directly connected to the first chip 101 in the vehicle controller 100, and sends the collected information to the first chip 101. The independent sensing unit 300 is directly connected to the second chip 102 in the vehicle controller 100, and sends the collected information to the second chip 102. The vehicle chassis bus signal system 400 is connected to the first chip 101 and the second chip 102, and sends the collected information to the first chip 101 and the second chip 102.

[0078] Combination Figure 1 In the embodiment shown, in this specific implementation, the first chip and the second chip included in the vehicle controller can respectively perform the following steps:

[0079] The first chip is used to obtain the current operating status of the preset functional module of the vehicle;

[0080] The first chip is used to send the current running status to the second chip;

[0081] The second chip is used to switch the vehicle to a preset control mode in response to the current operating state meeting the preset switching condition;

[0082] The second chip is used to control the vehicle according to a preset control mode.

[0083] In this specific implementation, Figure 2As shown, the vehicle controller may include a first chip and a second chip, and the first chip and the second chip communicate with each other. Since the vehicle controller controls the automatic driving of the vehicle based on the information interaction between the first chip and the second chip, in order to improve the driving safety of the vehicle during the automatic driving process, the communication connection state between the first chip and the second chip can be monitored, thereby reducing the information interaction errors or information interaction delays caused by abnormal communication connection states, thereby reducing the driving risks caused thereby.

[0084] Based on this, when there are communication errors, long communication delays, communication interruptions, and other faults between the first chip and the second chip in the vehicle controller, the communication between the first chip and the second chip in the vehicle controller cannot be completed, resulting in the vehicle controller being unable to control the vehicle's automatic driving based on the information interaction between the first chip and the second chip, thereby causing the vehicle to enter an abnormal state of automatic driving, and then, the upper computer fails, that is, the first chip fails, and the second chip alone controls the vehicle's automatic driving process. In the disclosed embodiment, the mode in which the second chip alone controls the vehicle's automatic driving process is referred to as a preset control mode.

[0085] Based on this, the abnormal communication connection state between the first chip and the second chip in the vehicle controller can be used as a preset switching condition. Thus, when the abnormal communication connection state between the first chip and the second chip is in the abnormal state, it is considered that the preset switching condition is met. At this time, in response to the abnormal communication connection state between the first chip and the second chip in the vehicle controller, the vehicle is switched to the preset control mode.

[0086] The so-called abnormal communication connection state may include: the communication between the first chip and the second chip is interrupted, for example, the communication between the two is interrupted due to damage to the first chip and / or the second chip.

[0087] The so-called abnormal communication connection state may include: the actual response time between the first chip and the second chip is longer than the preset response time. For example, within the preset response time after the second chip sends a message to the first chip, the second chip does not receive the response message of the first chip; for another example, within the preset response time after the first chip sends a message to the second chip, the first chip does not receive the response message of the second chip.

[0088] The so-called abnormal communication connection state may also include: the number of consecutive communication errors is greater than a preset number. Generally, in order to improve the accuracy of the received information, the chip can verify whether the received information is accurate after receiving the information, and the obtained verification result is used to indicate whether the communication error occurs. When the verification result indicates that the received information is accurate, it indicates that no communication error occurs, and the communication is normal at this time, and when the verification result indicates that the received information is inaccurate, it indicates that a communication error occurs.

[0089] For example, the received information is checked for accuracy using a Checksum algorithm. Furthermore, since communication may be unstable, a preset number of times may be set in advance to improve the accuracy of the determined communication connection state. Thus, when the check result of the Checksum accuracy check indicates that the consecutive number of times the accuracy check fails is greater than the preset number, it can be considered that the consecutive number of communication errors is greater than the preset number. At this time, it can be determined that the communication connection state between the first chip and the second chip in the vehicle controller is an abnormal state.

[0090] Among them, the Checksum algorithm is a commonly used error detection and correction technology, which is usually used to verify whether the data has been tampered with during transmission. The algorithm can determine the integrity of the data between the sender and the receiver, thereby determining the source integrity of the data. The specific implementation scheme is not described here.

[0091] Of course, the above abnormal state may also include other states used to characterize a communication failure between the first chip and the second chip in the vehicle controller, and the present disclosure does not make specific limitations on this.

[0092] Furthermore, if the dual chips are: NVIDIA DRIVE Orin TM SoC (hereinafter referred to as "Orin chip") and Infineon TC397 chip (hereinafter referred to as "TC397 chip"), that is, the first chip is the Orin chip, and the second chip is the TC397 chip. Figure 2 Based on the architecture diagram of a vehicle provided with a vehicle controller as shown in FIG. , the architecture diagram of a vehicle provided with a vehicle controller including an Orin chip and a TC397 chip is as shown in FIG. Figure 3 shown.

[0093] Among them, the above-mentioned Orin chip includes a functional layer and a functional monitoring layer, and the above-mentioned TC397 chip includes a redundant function and a hardware monitoring layer. The redundant function and the hardware monitoring layer include some functions of the Orin chip, that is, a redundant function layer equivalent to some functions of the Orin chip.

[0094] The functional layers of the above-mentioned Orin chip include perception, prediction, positioning, planning and decision-making, control, diagnosis, visualization and recording.

[0095] Among them, the so-called perception refers to the perception function, which is used to realize the perception of the vehicle's surrounding environment based on the vehicle's surrounding environment information collected by the autonomous driving sensor system;

[0096] The so-called positioning refers to the vehicle positioning function, which is used to determine the current location of the vehicle;

[0097] The so-called planning decision refers to the path planning function, which is used to plan the ideal driving path according to the map, and then determine various driving behaviors according to the actual surrounding environment information;

[0098] The so-called prediction refers to the trajectory prediction function, which is used to predict the driving trajectory or behavioral intention of the target in the surrounding environment within a certain period of time in the future based on the perceived surrounding environment information.

[0099] The so-called control refers to the vehicle control function, which is used to generate control instructions for various types of vehicle hardware according to the planned path and driving behavior to achieve vehicle control;

[0100] The so-called diagnosis refers to the vehicle diagnostic function, which is used to diagnose the usability of the vehicle's software and hardware;

[0101] The so-called visualization refers to the visualization function, which is used to collect various types of vehicle information and present it through a designated display.

[0102] The display may be a vehicle dashboard or a vehicle head-up display, which is not specifically limited in the embodiments of the present disclosure.

[0103] The so-called record refers to the recording function, which is used to record various types of vehicle information, including the usage of software and hardware.

[0104] The function monitoring layer of the above-mentioned Orin chip can realize at least one of the following functions:

[0105] (1) Trajectory prediction: Based on the vehicle model and the functional layer control output trajectory prediction, the predicted trajectory can be used to verify the effectiveness of the vehicle control command;

[0106] (2) Validity monitoring: monitoring the validity of the signal, for example, testing the signal's value range, rate of change, period, etc.;

[0107] (3) Node health monitoring: including but not limited to monitoring of operation timeouts and abnormal memory usage of various vehicle components;

[0108] (4) Communication monitoring: used to monitor the communication between the Orin chip 101 and the TC397 chip 102 and the peripherals, for example, to monitor the accuracy of communication through a counter and a checksum.

[0109] The above-mentioned TC397 chip is used to implement state machine management, chip power monitoring, communication monitoring, vehicle environment perception and life-saving control.

[0110] Among them, the above-mentioned TC397 chip's perception of the vehicle environment mainly depends on the vehicle chassis signal, that is, Figure 3 The vehicle chassis bus signal collected by the vehicle chassis bus signal system 400 in the vehicle chassis bus signal system 400. In addition, the difference between the perception of the vehicle environment in the above-mentioned TC397 chip and the perception of the vehicle environment in the Orin chip is that the TC397 chip relies on an independent, robust, and simple perception unit, for example, the vehicle driving environment information collected by the vision-based obstacle sensor installed on the vehicle chassis.

[0111] Furthermore, status monitoring and management are performed in the above-mentioned TC397 chip, and redundancy of limited functions is achieved.

[0112] The so-called state monitoring and management means that the lower computer relies on the state machine to monitor and manage the upper computer. In the present disclosure, the TC397 chip is equivalent to the lower computer, and the Orin chip is equivalent to the upper computer, that is, the TC397 chip monitors and manages the Orin chip. The input of the state machine when running in the TC397 chip depends on the vehicle chassis signal and the monitoring result of the upper computer.

[0113] exist Figure 3 Based on the vehicle architecture shown, in the above-mentioned TC397 chip, the states of the state machine include: HOLD state, READY state, RUNNING state and LIFE SAVING state, that is, the vehicle operation state of the vehicle may include: HOLD state, READY state, RUNNING state and LIFE SAVING state.

[0114] The HOLD state refers to the state where the vehicle's automatic driving function is not turned on, which is the initialization state of the system. In the HOLD state, the vehicle's automatic driving function is not turned on, and the vehicle can be in a manually driven state or stationary and not started.

[0115] The READY state refers to a state in which the TC397 chip enters after monitoring the key signals of the host computer and the vehicle itself and judging that they are normal, waiting for the automatic driving function to be turned on. In the READY state, the automatic driving function of the vehicle is in a startup preparation state, and can enter a normal automatic driving state when the automatic driving function is turned on. Among them, the so-called key signal of the vehicle itself is the signal reported by the Orin chip to the TC397 chip to indicate whether the key control node has failed.

[0116] The RUNNING state refers to the normal automatic driving operation state. In the RUNNING state, the vehicle is in a normal automatic driving operation state, that is, the automatic driving function of the vehicle is operating normally.

[0117] The LIFE SAVING state refers to the operating state of the TC397 chip in the emergency mode when it starts to independently control the vehicle after the host computer fails. The emergency mode can be understood as: the vehicle's automatic driving function is abnormal, and the vehicle is in an abnormal automatic driving operation state, for example, the vehicle's preset function module fails, the vehicle component fails, etc.

[0118] Among them, since the TC397 chip is used to control the vehicle alone after the host computer fails in the emergency mode, in order to improve the safety of the vehicle driving controlled by the TC397 chip in the above emergency mode, the TC397 chip can control the control nodes involved in the vehicle actions related to the vehicle driving safety during the vehicle driving process, so that the vehicle can complete the vehicle actions related to the vehicle driving safety, such as braking action, lateral movement action, longitudinal movement action, etc. Therefore, it can be considered that the TC397 chip has the function of controlling the vehicle to complete the vehicle actions related to the vehicle driving safety.

[0119] Generally, during the driving process of a vehicle, the vehicle can perform various actions, but not every action is related to the driving safety of the vehicle. For example, the action of playing music and turning on the car radio are actions that are not related to the driving safety of the vehicle. In the case where the TC397 chip controls the vehicle alone, the TC397 chip may not have the function of controlling the vehicle to complete the above-mentioned vehicle actions that are not related to the driving safety of the vehicle, that is, the TC397 chip has limited functions. In short, the TC397 chip has all the functions corresponding to the key control nodes.

[0120] In addition, in non-emergency mode, when the host computer participates in vehicle control, the host computer also has the function of controlling the vehicle to complete vehicle actions related to vehicle driving safety.

[0121] Since both the TC397 chip and the Orin chip have all the functions corresponding to the key control nodes, that is, both have the function of controlling the vehicle to complete vehicle actions related to safe driving, the above-mentioned TC397 chip can be used as a backup of the Orin chip, which can control the key control nodes.

[0122] Figure 4 Shown is a state transition diagram of the above state machine, that is, the switching relationship between the above HOLD state, READY state, RUNNING state and LIFE SAVING state.

[0123] Correspondingly, the state machine management implemented by the TC397 chip means: switching the vehicle's operating state according to the driver's input and the input of the function monitoring layer, that is, Figure 4 The state transfer process shown realizes the management of vehicle state.

[0124] When the vehicle is in the HOLD state, the TC397 chip can monitor the key signals of the host computer and the vehicle itself, and when the monitored key signals are judged to be normal, the vehicle enters the READY state.

[0125] When the vehicle's operating status is in the READY state, it waits for the automatic driving function to be turned on; if the automatic driving function of the vehicle is stopped, for example, the manual driving state is continued, or the vehicle is turned off, etc., it enters the HOLD state; if the automatic driving function of the vehicle is started, the vehicle's operating status enters the RUNNING state.

[0126] When the vehicle is in the RUNNING state, that is, the vehicle is in a normal automatic driving operation state, the automatic driving function of the vehicle can be disabled at this time, for example, switching to the manual driving state, or turning off the vehicle, etc., then the vehicle enters the HOLD state; if during the automatic driving process of the vehicle, the TC397 chip detects that the upper computer fails, the vehicle enters the LIFE SAVING state, and the TC397 chip controls the vehicle alone.

[0127] When the vehicle's operating status is in the LIFE SAVING state, the vehicle's automatic driving function can also be stopped according to the vehicle's operating conditions, for example, by switching to manual driving status, or by turning off the vehicle, so that the vehicle enters the HOLD state.

[0128] Among them, in the above-mentioned LIFE SAVING state, the operation mode when the vehicle is controlled solely by the TC397 chip is called the preset control mode, also known as the emergency mode. Therefore, the preset switching condition for entering the LIFE SAVING state can be set, so that when the current operation state of the preset function module of the vehicle meets the above-mentioned preset switching condition for entering the LIFE SAVING state, the control mode of the vehicle is switched to the preset control mode in which the vehicle is controlled solely by the TC397 chip. In this way, in response to the current operation state of the preset function module of the vehicle meeting the above-mentioned preset switching condition for entering the LIFE SAVING state, the vehicle controller can switch the vehicle to the above-mentioned preset control mode in which the vehicle is controlled solely by the TC397 chip.

[0129] The switching logic from the RUNNING state to the LIFE SAVING state may include at least one of the following logics:

[0130] The communication between the TC397 chip and the Orin chip is interrupted, the Orin chip reports that a key control node has failed, the sensor connected to the TC397 chip senses that there is a close obstacle in the vehicle's field of view in front of it, and the vehicle may collide with the obstacle, or the failure level of the vehicle's own control node exceeds the tolerable range, etc.

[0131] Among them, the judgment conditions for whether the communication between the TC397 chip and the Orin chip is interrupted may include: the actual response time between the TC397 chip and the Orin chip is greater than the preset response time, or the number of consecutive communication errors between the TC397 chip and the Orin chip is greater than the preset number.

[0132] Since the control mode of the vehicle is switched to the preset control mode of the vehicle controlled solely by the TC397 chip when the RUNNING state is switched to the LIFE SAVING state, the switching logic of switching from the RUNNING state to the LIFE SAVING state can also be used as the switching logic of switching the vehicle to the preset control mode of the vehicle controlled solely by the TC397 chip, and the corresponding switching conditions are set according to the switching logic, specifically:

[0133] 1. If the communication between the TC397 chip and the Orin chip is interrupted, it indicates that the communication connection state between the TC397 chip and the Orin chip is abnormal. Therefore, the abnormal communication connection state between the first chip and the second chip in the above-mentioned vehicle controller can be used as the switching condition for switching the vehicle to the preset control mode.

[0134] 2. If the Orin chip reports that the key control node has failed, it indicates that the Orin chip has determined that the key control node of the vehicle has failed. At this time, the operating state of the preset function module of the failed key control node is abnormal, and the abnormality in the above operating state can indicate that the preset function module of the failed key control node is abnormal. Therefore, the abnormality in the preset function module can be used as the switching condition for switching the vehicle to the preset control mode.

[0135] 3. If the sensor directly connected to the TC397 chip senses that there is a relatively close obstacle in the front field of view of the vehicle, and the vehicle may collide with the obstacle, it indicates that the vehicle has a collision risk. Generally, a safe distance can be set for the vehicle according to the road conditions, vehicle parameters, vehicle operation status, etc. When the distance between the obstacle in the front field of view of the vehicle and the vehicle is not less than the above-mentioned safe distance, it can be considered that the possibility of collision between the vehicle and the obstacle is small. In addition, for obstacles located behind the vehicle's driving direction, since there is a possibility that the rear obstacle will collide with the rear or rear side of the vehicle, for obstacles located outside the front field of view of the vehicle, the distance between the obstacle and the vehicle can also be monitored to reduce the collision risk caused by the close distance between the rear obstacle and the vehicle. Therefore, the safe distance between the vehicle and the obstacle can be set as a preset distance, and the distance between the obstacle detected by the sensor and the vehicle is less than the preset distance as the switching condition for switching the vehicle to the preset control mode. Among them, the safe distance refers to the necessary distance between the rear vehicle and the front vehicle during driving to avoid accidental collision with the front vehicle, which is usually related to the vehicle speed.

[0136] 4. If the failure degree of the vehicle's own control node exceeds the tolerable range, it indicates that the vehicle components involved in the control node of the vehicle itself fail to execute the vehicle control command normally, and the response of the above-mentioned vehicle components to the above-mentioned vehicle control command fails to achieve the preset result of the above-mentioned vehicle control command. For example, for the braking control node, the preset result of the braking control command is: the vehicle completes the braking action and stops moving. However, the vehicle components involved in the braking action, such as the brake pedal, do not respond to the above-mentioned braking control command, and the vehicle continues to travel, which may cause the vehicle to collide due to untimely braking. Therefore, the execution result of the current control command received in response to the vehicle not reaching the preset result of the current control command can be used as the switching condition for switching the vehicle to the preset control mode.

[0137] Among them, when the vehicle's operating state is in the LIFE SAVING state, it usually indicates that the vehicle's automatic driving function is abnormal, for example, the vehicle's preset function module fails, the vehicle's components fail, etc. Therefore, in order to ensure the vehicle's driving safety, the above LIFE SAVING state usually includes three stages, namely the Warning stage, the Braking stage, and the Emergency Avoidance stage. In addition, the above three stages are progressive in the order of the Warning stage, the Braking stage, and the Emergency Avoidance stage.

[0138] Specifically, when it is monitored that the vehicle is in a driving hazard, it first enters the Warning stage, that is, a warning message is issued to prompt the existence of driving hazards; then, when the issued warning message is not responded to, it enters the Braking stage, that is, the vehicle brakes are controlled to avoid driving hazards by stopping; further, when the vehicle brakes are unsuccessful, it enters the Emergency Avoidance stage, that is, the vehicle movement is controlled laterally and / or longitudinally to avoid hazards by controlling the vehicle's lateral and / or longitudinal movement.

[0139] Among them, the above-mentioned Braking stage only controls the braking of the vehicle, while the above-mentioned Emergency Avoidance stage can control the lateral and / or longitudinal movement of the vehicle. Therefore, in the above-mentioned Braking stage, the driving state of the vehicle is more stable, while in the above-mentioned Emergency Avoidance stage, the control of the vehicle is more flexible, and the driving state of the vehicle is also more unstable.

[0140] In addition, the Life-Save control implemented by the above TC397 chip means that when the preset function modules of the vehicle cannot be restored to normal and the remote driver cannot take over and remotely control the vehicle, the vehicle is controlled by the Life-Save vehicle control unit. For example, the vehicle is controlled horizontally and vertically, that is, the vehicle enters the Life Saving state, and the TC397 chip is used to independently control the vehicle.

[0141] Among them, under Life-Save control, the lateral and longitudinal control of the vehicle can be carried out in a manner different from the vehicle dynamics model, for example, lateral control based on the preview point and PID (Proportional-Integral-Differential) longitudinal control.

[0142] The vehicle environment perception achieved by the above-mentioned TC397 chip is realized through the vehicle chassis bus signal system 400, for example, by using the vehicle driving environment information collected by the vision-based obstacle sensor installed on the vehicle chassis; the above-mentioned vehicle environment perception can include at least one of road friction coefficient estimation, vehicle weight estimation, tire stiffness estimation, and rollover angular rate estimation.

[0143] Optionally, the estimated road friction coefficient can be used to determine the current maximum permissible vehicle deceleration, so that the braking time required for the vehicle to travel on different road surfaces can be determined, so that when there is an obstacle in front of the vehicle, the vehicle can be controlled to stop within a certain distance from the obstacle.

[0144] For example, the road friction coefficient of icy ground is smaller than that of dry ground. Therefore, the maximum deceleration allowed when driving on icy ground is smaller than the maximum deceleration allowed when driving on dry ground. As a result, the braking time required to control the vehicle to stop on icy ground is greater than the braking time required to control the vehicle to stop on dry ground.

[0145] Vehicle weight is one of the important factors that affect vehicle control during driving. The heavier the vehicle, the greater the inertia of the vehicle, and accordingly, the greater the power required to drive the vehicle and the resistance required to control the vehicle's brakes.

[0146] For example, when generating a vehicle control command for a vehicle, the vehicle weight can be estimated, thereby generating a control command with a corresponding execution force. For example, when the estimated vehicle weight is 1.4 tons, the execution force of the required brake command is 60% of the overall force that the brake pad can provide; when the estimated vehicle weight is 3.5 tons, the execution force of the required brake command is 90% of the overall force that the brake pad can provide.

[0147] Generally, during the driving process of a vehicle, if the vehicle turns too fast, the vehicle's grip may be reduced, thereby causing the vehicle to roll over. For example, when generating a vehicle control instruction for the vehicle, the vehicle's rollover angular rate may be estimated, so that when controlling the vehicle to turn, the value of the rollover angular rate indicated by the vehicle control instruction does not exceed the estimated value, thereby improving the driving safety of the vehicle during driving.

[0148] The chip power monitoring implemented by the above-mentioned TC397 chip refers to: monitoring the voltage and current of the Orin chip and the TC397 chip of the vehicle controller, and recording the abnormal status when there is an abnormality.

[0149] The communication monitoring implemented by the above-mentioned TC397 chip refers to: monitoring the communication connection status between the Orin chip and the TC397 chip, so that when the communication connection status is abnormal, communication is carried out using a spare communication link.

[0150] For example, the communication between the Orin chip and the TC397 chip included in the vehicle controller is configured with a main communication link and a backup communication link. When the TC397 chip detects that there is a communication blockage or communication failure in the main communication link, it automatically switches to the backup communication link for communication.

[0151] The communication modes supported by the primary communication link and the backup communication link may be different, which is not specifically limited in the embodiments of the present disclosure.

[0152] For example, the communication mode supported by the main communication link can be to use the SOME / IP (Scalable service-Oriented MiddlewarE over IP, which refers to the scalable service-oriented middleware located above the IP protocol layer) protocol to exchange information, and the communication mode supported by the backup communication link can be to use USART (Universal Synchronous / Asynchronous Receiver / Transmitter, which is a full-duplex universal synchronous / asynchronous serial transceiver module, and the interface is a highly flexible serial communication device) to exchange information.

[0153] In addition, in order to ensure the accuracy of the control instructions sent by the TC397 chip to the vehicle chassis, the communication content (data stream) between the TC397 chip and the Orin chip includes the verification results of the communication information, for example, the results used to characterize the validity of the information collected by the sensor, the control instructions, etc. Therefore, when the vehicle controller sends the control instruction to the vehicle chassis, the control instruction can be verified by the TC397 chip. If the verification result indicates that the control instruction can be executed, it will be sent to the vehicle chassis by the TC397 chip.

[0154] Among them, during the process of the vehicle controller controlling the automatic driving of the vehicle, the vehicle controller can adopt a control method based on the vehicle dynamics model.

[0155] For example, the vehicle's lateral and longitudinal integrated control, or lateral and longitudinal decoupling control is performed using control algorithms such as LQR (Linear Quadratic Regulator) and MPC (Model Predictive Control).

[0156] In this specific implementation, usually, the vehicle has multiple control nodes, each of which corresponds to a preset functional module. The vehicle controller based on the dual-chip architecture of the domain controller can not only realize the switching of the vehicle control mode based on the monitoring of the current operating status of the preset functional modules corresponding to each control node, but also can set up an overall functional safety architecture with the help of the functional integration solution provided by the dual-chip architecture of the domain controller, so as to realize the integrated signal processing and multi-functional integrated control through the above-mentioned overall safety functional architecture for multiple preset functional modules of the vehicle.

[0157] That is to say, in this specific implementation, the dual-chip architecture based on the domain controller can be used to guide the design and implementation of a vehicle controller that realizes integrated signal processing and multi-functional integrated control through an overall functional safety architecture. Accordingly, when designing related autonomous driving software with vehicle control, the above-mentioned dual-chip architecture based on the domain controller can also guide the design and implementation of autonomous driving software with functional safety.

[0158] As mentioned above, when the vehicle controller switches the vehicle to the preset control mode in response to the current operating state of the preset functional module of the vehicle meeting the preset switching condition, the vehicle can be controlled according to the above preset control mode. Furthermore, in order to ensure the driving safety of the vehicle in the preset control mode, the vehicle controller needs to continue to detect whether the vehicle has a driving risk, so that when it is detected that the vehicle has a driving risk, a corresponding control instruction is generated to adjust the vehicle. For example, in the preset control mode, whether the distance between the vehicle and the obstacle is less than the specified distance, if it is less than, it can be determined that the vehicle has a driving risk.

[0159] Based on this, optionally, in a specific implementation, as shown in Figure 5 As shown, a vehicle control method provided in an embodiment of the present disclosure may further include steps S501-S503:

[0160] S501: In response to detecting that the vehicle has a driving risk, outputting a preset alarm message;

[0161] The driving risks include: the distance between the vehicle and the second obstacle is less than a specified distance;

[0162] S502: In response to not receiving a control instruction for the preset alarm information within the first specified time period, controlling the vehicle to brake according to a preset braking instruction;

[0163] S503: In response to the vehicle failing to brake successfully within the second specified time period, controlling the vehicle according to the lateral and longitudinal control instructions determined based on the second type of environmental information;

[0164] The lateral and longitudinal control instructions include instructions for controlling the lateral or longitudinal travel of the vehicle.

[0165] In this specific implementation, after the vehicle controller switches the vehicle to the preset control mode, the vehicle controller determines whether the distance between the vehicle and the second obstacle in the received environmental information is less than the specified distance. If the distance between the vehicle and the second obstacle is less than the specified distance, it can be determined that the vehicle has a driving risk of possible collision. At this time, in order to prompt the vehicle that there is a collision risk, the vehicle controller can output a preset alarm message in response to detecting that the vehicle has a driving risk.

[0166] In addition, in order to improve the driving safety of the vehicle during automatic driving, a first specified time period can be set in advance. If the vehicle controller does not receive a control instruction for the above-mentioned preset alarm information within the above-mentioned first specified time period, the vehicle brakes can be controlled according to the preset braking instruction.

[0167] If the vehicle fails to brake successfully within the second specified time period, the vehicle can be controlled to travel laterally or longitudinally according to the lateral and longitudinal control instructions determined based on the second type of environmental information.

[0168] For example, when the vehicle controller is in a preset control mode, if there is a driving risk for the vehicle, in order to improve the driving safety of the vehicle, a preset alarm message can be output to the remote driver, so that the remote driver can remotely control the vehicle using control instructions for the preset alarm message.

[0169] However, considering that the remote driver may not be able to send remote control instructions in time to control the vehicle, if the control instruction for the preset alarm information is not received within the preset first specified time, the vehicle controller can try to control the vehicle to brake according to the preset brake instruction. Further, if the vehicle fails to brake successfully within the second specified time, the second chip can continue to control the vehicle according to the lateral and longitudinal control instructions determined based on the second type of environmental information, so that the vehicle can move horizontally or longitudinally.

[0170] In some cases, in order to control the vehicle to avoid the second obstacle, the lateral and longitudinal control instructions may include lateral instructions and longitudinal instructions at the same time, thereby controlling the vehicle to achieve lateral travel and longitudinal travel at the same time.

[0171] Optionally, when the vehicle controller controls the vehicle according to the lateral and longitudinal control instructions, it can adopt lateral control or longitudinal control based on the preview point, which does not rely on the control method of the vehicle dynamics model, thereby preventing common mode failure.

[0172] Among them, the so-called common mode failure is the failure of different products characterized by the same failure mode.

[0173] For example, Figure 3-4 As shown, when the vehicle's operating state is in the LIFE SAVING state, in order to ensure the vehicle's driving safety, the above-mentioned LIFE SAVING state usually includes three stages, namely, the Warning stage, the Braking stage and the Emergency Avoidance stage, and the above-mentioned three stages are progressive in the order of the Warning stage, the Braking stage and the Emergency Avoidance stage.

[0174] Specifically, when the vehicle controller detects that the vehicle is in a driving hazard, it first enters the Warning stage, that is, it issues a warning message to indicate the existence of driving hazards; then, when the issued warning message is not responded to, it enters the Braking stage, that is, it controls the vehicle to brake to avoid driving hazards by stopping; then, when the vehicle braking control is unsuccessful, it enters the Emergency Avoidance stage, that is, it controls the vehicle to move laterally and / or longitudinally to avoid hazards by controlling the vehicle to move laterally and / or longitudinally.

[0175] Optionally, in a specific implementation, such as Figure 6 As shown, a vehicle control method provided by an embodiment of the present disclosure may further include the following step S601:

[0176] S601: After the vehicle stops running or the vehicle is powered off, switch the vehicle to an initial control mode.

[0177] When the vehicle stops running or the vehicle is powered off, the vehicle controller can switch the control mode of the vehicle to the initial control mode.

[0178] As can be seen from the above, the solution provided by the embodiment of the present disclosure can be applied to the vehicle controller included in the vehicle. In order to improve the safety of the vehicle during driving, a preset control mode can be set in advance, and in order to determine whether the control mode of the vehicle needs to be switched to the preset control mode, a preset switching condition can be set in advance. Thus, when the current operating state of the preset functional module of the vehicle is obtained, in response to the current operating state meeting the preset switching condition, the vehicle is switched to the preset control mode, and the vehicle is controlled according to the preset control mode switched to.

[0179] By applying the solution provided by the embodiment of the present disclosure, in order to avoid the problem of threatening driving safety due to abnormal functional modules of the vehicle or failure of vehicle components during the automatic driving process of the vehicle, a preset control mode for controlling the vehicle in the case of abnormal functional modules of the vehicle, failure of vehicle components, etc., which threaten driving safety, and a preset switching condition for determining whether to switch the vehicle to the above-mentioned preset control mode can be pre-set. In this way, when it is obtained that the current operating state of the vehicle meets the above-mentioned preset switching condition, it indicates that the vehicle is in a situation where driving safety is threatened during the automatic driving process, and the control mode of the vehicle is switched to the above-mentioned preset control mode, and the vehicle is controlled according to the above-mentioned preset control mode. Based on this, it can be achieved that when the vehicle is in a situation where driving safety is threatened during the automatic driving process, the vehicle can be controlled by switching the control mode, thereby improving the safety of the vehicle during the automatic driving process.

[0180] The following is a detailed description of the above-mentioned preset switching conditions.

[0181] Optionally, in a specific implementation, a vehicle control method provided by an embodiment of the present disclosure may further include the following step 11:

[0182] Step 11: In response to the current operating state indicating that a preset functional module is abnormal, determining that the current operating state meets a preset switching condition.

[0183] In this specific implementation, when the control node of the vehicle fails, the operation state of the preset function module of the failed control node is abnormal, and the abnormal operation state can indicate that the preset function module of the failed control node is abnormal. Therefore, the abnormality of the preset function module can be used as a switching condition for the vehicle controller to switch the vehicle to the preset control mode.

[0184] Thus, the above-mentioned preset switching conditions may include: there is an abnormality in the preset function module. In this way, if the current operating states of all preset function modules of the vehicle are normal, it is considered that the vehicle is currently in a normal state; if the current operating state of a preset function module is abnormal, it is considered that the vehicle is currently in an abnormal state, and thus, there is a driving risk in the driving process of the vehicle in this abnormal state. Therefore, when making a vehicle abnormality judgment, different judgment criteria can be set as needed. One possible criterion is that as long as the current operating state of a preset function module is abnormal, it is considered that the vehicle is currently in an abnormal state; another possible criterion is that if the current operating state of one or more preset function modules corresponding to the key control node is abnormal, it can be considered that the vehicle is currently in an abnormal state. The embodiment of the present disclosure does not limit the standard of vehicle abnormality, and can be flexibly set according to actual needs.

[0185] Therefore, when the vehicle controller determines that there is an abnormality in the preset function module of the vehicle, since the abnormal preset function module may affect the driving safety of the vehicle, it can determine that the current operating state of the preset function module meets the switching condition of the preset control mode. In this way, the vehicle can be switched to the preset control mode, in which only functions related to safe driving of the vehicle are usually realized, and entertainment functions and comfort functions are not realized, so as to reduce unnecessary energy consumption.

[0186] Optionally, for each preset functional module, a criterion for determining whether the preset functional module is abnormal may be preset according to the status of vehicle components involved in the preset functional module during normal driving of the vehicle.

[0187] For example, in a dark scene, when the headlights of a vehicle cannot be turned on normally, it can be determined that there is an abnormality in the headlight on / off function module of the vehicle.

[0188] In some cases, when an abnormality exists in a preset function module, the abnormal state of the preset function module can be eliminated through the reset operation corresponding to the preset function module, thereby restoring the preset function module to normal, thereby extending the service life of the preset function module and improving the continuity of vehicle driving.

[0189] Based on this, optionally, in a specific implementation, in a vehicle control method provided in an embodiment of the present disclosure, the following step 111 may be further included:

[0190] Step 111: in response to a preset functional module being abnormal, resetting the preset functional module that is abnormal;

[0191] The reset operation includes: a restart operation, or a restore operation to an initial state.

[0192] In this specific implementation, when the vehicle controller determines that a preset function module of the vehicle has an abnormality, it can reset the preset function module with the abnormality, thereby restoring the preset function module with the abnormality to normal operation.

[0193] The above reset operation may include: restart operation. For example, when there is an abnormality in the preset function module, the vehicle controller may restart the preset function module, thereby restoring the abnormal preset function module to normal operation. The above reset operation may also include: restore initial state operation. For example, when there is an abnormality in the preset function module, the vehicle controller may restore the preset function module to an initial state, thereby restoring the abnormal preset function module to normal operation.

[0194] In some cases, in order to improve the driving safety of the vehicle during automatic driving, an alternative backup functional module may be pre-set for the preset functional module.

[0195] Based on this, optionally, when there is an abnormality in the preset functional module, the above-mentioned backup functional module can be used to continue to support the vehicle's automatic driving to improve the continuity and driving efficiency of the vehicle.

[0196] Further, optionally, in the case where a replaceable spare function module is pre-set for the preset function module, when an abnormality occurs in the preset function module, a reset operation can be first performed on the preset function module with the abnormality; if the abnormality still occurs in the preset function module after the reset operation, the preset function module can be replaced by a corresponding spare function module.

[0197] In this way, through the self-recovery operation in the vehicle controller which is similar to the purpose of the above-mentioned reset operation and replacement operation, when there is an abnormality in the preset function module of the vehicle, the preset function module can be restored to normal operation, thereby supporting the vehicle to continue automatic driving.

[0198] In some cases, in order to improve the driving safety of the vehicle during the autonomous driving process, an obstacle sensor can usually be installed in the vehicle, and the obstacle sensor includes: a sensor system independent of the vehicle installed to complete the autonomous driving function and used to perceive the vehicle's surrounding environment information. Specifically, the obstacle sensor can be a visual sensor set on the vehicle chassis, such as a camera.

[0199] Thus, when the obstacle sensor senses that the distance between the vehicle and the obstacle is too small, it indicates that the vehicle has entered the risk area and needs to switch to the preset control mode. In addition, in order to optimize the timing of switching to the preset control mode to further improve the driving safety of the vehicle, the distance that the vehicle and the obstacle need to maintain, that is, the preset distance, can be set in advance. Thus, by comparing the relationship between the above-mentioned distance and the above-mentioned preset distance, it is determined whether the vehicle controller needs to switch to the preset control mode.

[0200] Based on this, the distance between the vehicle and the obstacle sensed by the obstacle sensor being less than a preset distance may be used as a preset switching condition.

[0201] Optionally, in a specific implementation, a vehicle control method provided by an embodiment of the present disclosure may include the following step 12:

[0202] Step 12: In response to the distance between the vehicle and the first obstacle being less than a preset distance, determining that the vehicle meets a preset switching condition.

[0203] In this specific implementation, a safe distance can be set for the vehicle based on road conditions, vehicle parameters, vehicle operating status, etc. When the distance between an obstacle in the surrounding environment of the vehicle and the vehicle is not less than the above-mentioned safe distance, it can be considered that the possibility of collision between the vehicle and the obstacle is small. Therefore, the safe distance between the vehicle and the obstacle can be set as a preset distance, and the interval distance between the vehicle and the obstacle detected by the obstacle sensor is less than the preset distance as the switching condition for switching the vehicle to the preset control mode.

[0204] Therefore, the above-mentioned preset switching condition may include: the obstacle sensor of the vehicle senses that the distance between the vehicle and the first obstacle is less than a preset distance.

[0205] Among them, the obstacle sensor is a sensor used to monitor the surrounding environment of the vehicle when it is running. Through the obstacle sensor, the surrounding environment of the vehicle and the environment when the vehicle is running are monitored to prevent the vehicle from colliding under incorrect control instructions. For example, Figure 2 As shown, the above-mentioned independent perception unit 300 is the obstacle sensor in the embodiment of the present disclosure. Exemplarily, the above-mentioned obstacle sensor may include a visual sensor arranged on the vehicle body, such as a camera.

[0206] As mentioned above, the operating status of the above-mentioned preset functional module may include: the distance between the vehicle and the above-mentioned first obstacle. Therefore, after the vehicle controller obtains the distance between the vehicle and the first obstacle, it can determine whether the vehicle enters the risk area by comparing the size relationship between the above-mentioned distance and the preset distance, and then determine whether the vehicle meets the preset switching conditions.

[0207] Among them, if the above-mentioned interval distance is less than the above-mentioned preset distance, it indicates that the vehicle has entered the risk area. At this time, it can be determined that the vehicle meets the preset switching conditions, and the vehicle can be further switched to the preset control mode.

[0208] Correspondingly, if the above interval distance is not less than the above preset distance, it indicates that the vehicle has not entered the risk area. At this time, it can be determined that the vehicle does not meet the preset switching conditions and the control mode of the vehicle may not be switched temporarily.

[0209] For example, the preset distance is 10 meters. If the perception result of the obstacle sensor shows that there is a first obstacle around the vehicle and the distance between the vehicle and the first obstacle is 5 meters, at this time, since 5<10, it indicates that the vehicle has entered the risk area, and the vehicle controller needs to immediately switch the vehicle to the preset control mode to control the vehicle.

[0210] Generally, an obstacle sensor is a sensor used to monitor the surrounding environment of a vehicle when it is running, and the acquisition range of the obstacle sensor may be within the 180-degree field of view of the vehicle. Therefore, the first obstacle may refer to an obstacle that is within the 180-degree field of view of the vehicle and may collide with the vehicle. For the driving safety of the vehicle, a safety distance may be set for the vehicle according to the road conditions, vehicle parameters, the running status of the vehicle, etc. When the distance between the obstacle within the 180-degree field of view of the vehicle and the vehicle is not less than the above safety distance, it can be considered that the possibility of collision between the vehicle and the obstacle is small.

[0211] In addition, for obstacles located behind the vehicle in the direction of travel, since there is a possibility that the rear obstacle will collide with the rear or rear side of the vehicle, for obstacles located outside the 180-degree forward field of view of the vehicle, the distance between the obstacle and the vehicle can also be monitored to reduce the risk of collision caused by the close distance between the rear obstacle and the vehicle. Therefore, the safe distance between the vehicle and the obstacle can be set as the preset distance, and the interval distance between the vehicle and the obstacle is less than the preset distance as the switching condition for switching the vehicle to the preset control mode.

[0212] In some cases, when the vehicle controller controls the vehicle components involved in the corresponding control node to perform the action indicated by the current control instruction according to the current control instruction, there may be execution deviations when the vehicle components perform the above actions, thereby causing errors in the vehicle controller's control of the vehicle, and even causing risks to the vehicle. Therefore, the current operating state of the above-mentioned preset functional module may include the execution result of the current control instruction received by the vehicle in response, so as to determine whether the current operating state meets the preset switching condition through the above-mentioned execution result.

[0213] Based on this, optionally, in a specific implementation, the current operating state includes: the execution result of the current control instruction received in response to the vehicle, and the vehicle control method provided by the embodiment of the present disclosure may further include step 13:

[0214] Step 13: If the execution result does not reach the preset result of the current control instruction, it is determined that the current operating state meets the preset switching condition.

[0215] In this specific implementation, after the vehicle controller sends the corresponding current control instruction to each control node through the preset function module, it can monitor the execution result of the control node on the current control instruction, such as execution success, execution failure, etc. In this way, after each preset function module sends the current control instruction, it can obtain the execution result of the corresponding control node, and then use the execution result as the running state of the preset function module.

[0216] Furthermore, when the failure degree of the vehicle's own control node exceeds the tolerable range, it indicates that the vehicle components involved in the vehicle's own control node fail to execute the vehicle control command normally, and the response result of the above-mentioned vehicle components to the above-mentioned vehicle control command indicates that the vehicle components fail to achieve the preset result of the above-mentioned vehicle control command. For example, for the braking control node, the preset result of the braking control command is: the vehicle completes the braking action and stops moving. However, the vehicle components involved in the braking action, such as the brake pedal, do not respond to the above-mentioned braking control command, and the vehicle continues to travel, which may cause the vehicle to collide due to untimely braking. Therefore, the execution result of the vehicle in response to the received current control command that does not reach the preset result of the current control command can be used as the switching condition for switching the vehicle to the preset control mode.

[0217] Thus, the above-mentioned preset switching condition may include: the execution result of the current control instruction received by the vehicle does not reach the preset result of the current control instruction. Therefore, after the vehicle controller receives the execution result of the current control instruction, it can determine whether the execution result reaches the preset result of the current control instruction.

[0218] If the above execution result does not match the preset result, it indicates that when the vehicle controller controls the vehicle components involved in the corresponding control node to perform the action indicated by the current control instruction according to the current control instruction, there is an execution deviation in the vehicle components, which leads to errors in the vehicle controller's control of the vehicle, and even causes risks to the vehicle. Therefore, it can be determined that the current operating state of the preset functional module meets the preset switching condition.

[0219] For example, the vehicle component involved in the corresponding control node indicated by the current control instruction is a brake component, and the braking force is 80%. However, the braking force of the brake component when performing the braking action is 50%. At this time, 50%<80%, indicating that the execution result of the current control instruction does not reach the preset result of the current control instruction. It can be determined that the current operating state meets the preset switching conditions.

[0220] If the above execution results meet the preset results, it indicates that when the vehicle controller controls the vehicle components involved in the corresponding control node to perform the action indicated by the current control instruction in accordance with the current control instruction, there is no execution deviation in the vehicle components, that is, there is no error in the control of the vehicle by the vehicle controller. At this time, the possibility of risk to the vehicle is low.

[0221] In order to improve the driving safety of the vehicle during the automatic driving process, the vehicle controller can determine the vehicle's driving trajectory during the driving process and the vehicle control instructions when driving on the road indicated by the driving trajectory based on the current vehicle position information obtained in real time and the environmental information collected by various sensors. In other words, during the automatic driving process of the vehicle, Figure 7 The various steps shown in the figure can realize the automatic driving of the vehicle.

[0222] Optionally, in a specific implementation, Figure 7 The following is a flow chart of a vehicle control method provided by an embodiment of the present disclosure. Figure 7 As shown, a vehicle control method provided by an embodiment of the present disclosure may further include the following steps S701-S705:

[0223] S701: Acquire the current location information of the vehicle and the first type of environmental information;

[0224] Among them, the first type of environmental information is the information collected by the vehicle's main sensor;

[0225] S702: generating a first driving trajectory of the vehicle and an initial control instruction corresponding to the first driving trajectory based on the current position information and the first type of environmental information;

[0226] S703: predicting a second driving trajectory of the vehicle within a target duration starting from the current moment based on the current position information, the first type of environmental information, the first driving trajectory, and the initial control instruction;

[0227] S704: Acquire the second type of environmental information of the vehicle, and determine whether the second type of environmental information meets the environmental information requirement corresponding to the target operating state indicated by the initial control instruction based on the second driving trajectory and the second type of environmental information;

[0228] The second type of environmental information is information collected by redundant sensors of the vehicle; the target operating state is the vehicle operating state that the vehicle is expected to enter when driving along the second driving trajectory, including the target vehicle speed, etc.;

[0229] S705: If the second type of environmental information meets the environmental information requirement, determine the initial control instruction as a driving control instruction of the vehicle, so as to control the vehicle to drive along a second driving trajectory according to the driving control instruction.

[0230] In addition, in order to be able to switch to the preset control mode in which the vehicle is controlled solely by the second chip in a timely manner when there is an abnormality in the preset functional module of the vehicle or a fault in a component of the vehicle, after the first chip of the vehicle controller executes the above step S705 and determines the driving control instructions for controlling the vehicle and the second driving trajectory required for the vehicle to travel, the determined driving control instructions, as well as various types of information such as current position information, first type of environmental information, and second type of environmental information can be sent to the second chip, thereby enabling the second chip to monitor the first chip. In this way, when the vehicle is in a situation where driving safety is threatened during the automatic driving process, the vehicle controller can switch to the preset control mode in which the vehicle is controlled solely by the above second chip in a timely manner, thereby controlling the vehicle through control mode switching and improving the safety of the vehicle during the automatic driving process.

[0231] In order to facilitate understanding of the signaling interaction process between the first chip and the second chip in the vehicle controller when the vehicle controller executes the above steps S701-S705, the following is combined with Figure 8 The signaling interaction diagram between the first chip and the second chip shown in FIG. Figure 2 Based on the vehicle controller architecture shown, Figure 7 The signaling interaction process between a first chip and a second chip in a vehicle controller shown is illustrated by way of example.

[0232] The vehicle controller includes a first chip 101 and a second chip 102. The first chip 101 includes a function layer 1011 and a function monitoring layer 1012, and the second chip 102 includes a redundant function layer 1021.

[0233] The signaling interaction process between the first chip 101 and the second chip 102 in the above vehicle controller specifically includes the following steps S801-S808:

[0234] S801: The functional layer 1011 in the first chip 101 obtains the current position information of the vehicle and the first type of environmental information;

[0235] S802: The functional layer 1011 in the first chip 101 generates a first driving trajectory of the vehicle and an initial control instruction corresponding to the first driving trajectory based on the current position information and the first type of environmental information;

[0236] S803: The function layer 1011 in the first chip 101 sends the current position information, the first type of environmental information, the first driving trajectory and the initial control instruction to the function monitoring layer 1012 in the first chip 101;

[0237] S804: The function monitoring layer 1012 in the first chip 101 predicts a second driving trajectory of the vehicle within a target duration starting from the current moment based on the current position information, the first type of environmental information, the first driving trajectory, and the initial control instruction;

[0238] S805: The function monitoring layer 1012 in the first chip 101 obtains the second type of environmental information of the vehicle, and determines whether the second type of environmental information meets the environmental information requirement corresponding to the target operating state represented by the initial control instruction based on the second driving trajectory and the second type of environmental information; if the second type of environmental information meets the environmental information requirement, the initial control instruction is determined as the driving control instruction of the vehicle, so as to control the vehicle to drive according to the second driving trajectory according to the driving control instruction;

[0239] S806: The function monitoring layer 1012 in the first chip 101 sends the current position information, the first type of environmental information, the second type of environmental information and the driving control instruction to the redundant function layer 1021 in the second chip 102;

[0240] S807 : The redundant function layer 1021 in the second chip 102 monitors the first chip 101 based on the current position information, the first type of environmental information, the second type of environmental information and the driving control instruction sent by the function monitoring layer 1012 .

[0241] Combined with the above Figure 2 , Figure 7 and Figure 8 As shown, the function layer 1011 in the first chip 101 in the vehicle controller is used to obtain the current position information and the first type of environmental information of the vehicle. Then, the function layer 1011 can generate the first driving trajectory of the vehicle and the initial control instruction corresponding to the first driving trajectory based on the current position information and the first type of environmental information, and send the current position information, the first type of environmental information, the first driving trajectory and the initial control instruction to the function monitoring layer 1012 in the first chip 101.

[0242] The first type of environmental information is the information collected by the vehicle's main sensor, for example Figure 2 As shown, the above-mentioned autonomous driving sensor system 200 can be used as the main sensor described in the present disclosure.

[0243] The main sensor is used to collect environmental information around the vehicle, for example, whether there are obstacles around the vehicle, whether there are vehicles or pedestrians on the road ahead of the vehicle, etc. Exemplarily, the vehicle controller can obtain the first type of environmental information and the current position information of the vehicle itself through main sensors such as cameras and laser radars. In this way, after collecting the environmental information around the vehicle, the main sensor sends the collected environmental information to the first chip in the vehicle controller.

[0244] The first driving trajectory refers to a rough trajectory obtained by planning the driving trajectory of the vehicle based on the current position information and the first type of environmental information, and is not necessarily the actual driving trajectory of the vehicle.

[0245] Optionally, the control instructions may include any of various instructions for controlling the vehicle, such as a lateral control instruction for controlling the vehicle to turn left or right, a longitudinal control instruction for controlling the vehicle to move forward or backward, a braking instruction for controlling the vehicle to brake, an acceleration instruction for controlling the vehicle to accelerate, and in some cases, may also include both lateral control instructions and longitudinal control instructions. In this regard, the present disclosure does not limit the specific content of the control instructions.

[0246] In this way, after receiving the current position information, the first type of environmental information, the first driving trajectory and the initial control instructions sent by the above-mentioned functional layer 1011, the functional monitoring layer 1012 in the first chip 101 can predict the driving trajectory of the vehicle within the target time length starting from the current moment based on the current position information, the first type of environmental information, the first driving trajectory and the initial control instructions, and obtain the second driving trajectory.

[0247] The second driving trajectory can be used as the correction result of the trajectory correction of the first driving trajectory, which is the actual running trajectory of the vehicle, and the target duration is the preset duration during which the vehicle can drive safely without the risk of collision. Therefore, when the second driving trajectory is obtained, it can be expected that the vehicle will not collide during the driving process of the second driving trajectory, thereby improving the driving safety of the vehicle during the automatic driving process.

[0248] It should be noted that the second type of environmental information is information collected by the redundant sensors of the vehicle; the target operating state is the vehicle operating state that the vehicle is expected to enter when driving along the second driving trajectory, including the expected vehicle speed, etc.

[0249] For example, the above-mentioned vehicle chassis bus signal is the second type of environmental information collected by the redundant sensor in the embodiment of the present disclosure.

[0250] Thus, the function monitoring layer 1012 in the first chip 101 can obtain the second type of environmental information of the vehicle, and determine whether the second type of environmental information meets the environmental information requirements corresponding to the target operating state represented by the initial control instruction based on the second driving trajectory and the second type of environmental information. If the function monitoring layer 1012 in the first chip 101 determines that the second type of environmental information meets the environmental information requirements, it responds and determines the initial control instruction as the driving control instruction of the vehicle, so that the vehicle drives according to the driving control instruction using the second driving trajectory.

[0251] In this way, when the function monitoring layer 1012 in the first chip 101 in the vehicle controller plans to obtain the second driving trajectory of the vehicle within the target duration starting from the current moment, it can determine the vehicle operation state that the vehicle is expected to enter when driving along the second driving trajectory, and then use the vehicle operation state as the target operation state represented by the initial control instruction. After obtaining the second type of environmental information collected by the redundant sensor of the vehicle, it can be determined whether the second type of environmental information meets the environmental information requirements corresponding to the target operation state, and thus, based on the above determination result, it is determined whether the vehicle can be controlled to drive along the second driving trajectory according to the initial control instruction.

[0252] Among them, if the above-mentioned second type of environmental information meets the above-mentioned environmental information requirements, it indicates that there will be no risk to the vehicle when the vehicle follows the above-mentioned initial control instruction to control the vehicle to travel along the second driving trajectory. At this time, the above-mentioned initial control instruction can be determined as a driving control instruction to control the vehicle to travel along the second driving trajectory according to the driving control instruction, and continue to return to the above-mentioned step S801 to predict the second driving trajectory within the next target time length, thereby controlling the vehicle to complete the automatic driving process.

[0253] If the second type of environmental information does not meet the environmental information requirements, it indicates that there is a risk when the vehicle follows the initial control instructions to control the vehicle to travel along the second driving trajectory. At this time, it is necessary to return to step S801 to readjust the driving trajectory of the vehicle and the control instructions corresponding to the driving trajectory.

[0254] In addition, in order to be able to switch to the preset control mode in which the vehicle is controlled solely by the second chip in a timely manner when there is an abnormality in the preset functional module of the vehicle or a fault in a component of the vehicle, the vehicle controller, in the process of the functional layer 1011 and the functional monitoring layer 1012 in the first chip 101 in the above-mentioned vehicle controller repeatedly executing the above-mentioned steps S801-S805 to realize the automatic control of the vehicle, the functional monitoring layer 1012 in the first chip 101 will send the determined various types of information including but not limited to the current position information, the first type of environmental information, the second type of environmental information and the driving control instructions to the redundant functional layer 1021 in the second chip 102, so as to realize that the redundant functional layer 1021 in the second chip 102 monitors the first chip 101 based on the various types of information sent by the above-mentioned functional monitoring layer 1012.

[0255] In this way, when the second chip 102 of the vehicle controller finds, based on the above-mentioned various types of information, that the vehicle is in a situation where driving safety is threatened during the automatic driving process, it can promptly switch to the preset control mode of automatic driving in which the vehicle is controlled solely by the second chip. Thereby, the vehicle can be controlled by switching the control mode to improve the safety of the vehicle during the automatic driving process.

[0256] Optionally, during the control process of the above steps S801-S807, the vehicle controller can communicate with a designated display, thereby using the above designated display to output various types of vehicle information about the vehicle, such as the first type of environmental information, current position information, the second type of environmental information, the first driving trajectory and the second driving trajectory.

[0257] Corresponding to the vehicle control method provided by the above-mentioned embodiment of the present disclosure, the embodiment of the present disclosure also provides a vehicle controller, Fig. 9 A schematic diagram of the structure of a vehicle controller provided by an embodiment of the present disclosure is shown in FIG. Fig. 9 As shown, the vehicle controller includes: a first chip 901 and a second chip 902 .

[0258] The first chip 901 is used to obtain the current operating status of the preset functional module of the vehicle;

[0259] The first chip 901 is used to send the current running status to the second chip 902;

[0260] The second chip 902 is used to switch the vehicle to a preset control mode in response to the current operating state meeting the preset switching condition;

[0261] The second chip 902 is used to control the vehicle according to a preset control mode.

[0262] As can be seen from the above, the solution provided by the embodiment of the present disclosure can be applied to the vehicle controller included in the vehicle. In order to improve the safety of the vehicle during driving, a preset control mode can be set in advance, and in order to determine whether the control mode of the vehicle needs to be switched to the preset control mode, a preset switching condition can be set in advance, so that when the current operating state of the preset functional module of the vehicle is obtained, in response to the current operating state meeting the preset switching condition, the vehicle is switched to the preset control mode, and the vehicle is controlled according to the preset control mode switched to.

[0263] By applying the solution provided by the embodiment of the present disclosure, in order to avoid the problem of threatening driving safety due to abnormal functional modules of the vehicle or failure of vehicle components during the automatic driving process of the vehicle, a preset control mode for controlling the vehicle in the case of abnormal functional modules of the vehicle, failure of vehicle components, etc., which threaten driving safety, and a preset switching condition for determining whether to switch the vehicle to the above-mentioned preset control mode can be pre-set. In this way, when it is obtained that the current operating state of the vehicle meets the above-mentioned preset switching condition, it indicates that the vehicle is in a situation where driving safety is threatened during the automatic driving process, and the control mode of the vehicle is switched to the above-mentioned preset control mode, and the vehicle is controlled according to the above-mentioned preset control mode. Based on this, it can be achieved that when the vehicle is in a situation where driving safety is threatened during the automatic driving process, the vehicle can be controlled by switching the control mode, thereby improving the safety of the vehicle during the automatic driving process.

[0264] Optionally, in a specific implementation, the first chip 901 is used to monitor the communication connection status between the first chip 901 and the second chip 902; the second chip 902 is used to determine that the current operating status meets the preset switching condition in response to the communication connection status being an abnormal state; wherein the abnormal state includes: the actual response time is greater than the preset response time, or the number of consecutive communication errors is greater than the preset number.

[0265] In this specific implementation, the first chip 901 is used to monitor the communication connection status between the first chip 901 and the second chip 902 .

[0266] The above abnormal state includes: the actual response time is longer than the preset response time.

[0267] The second chip 902 can determine whether there is an abnormality in the communication connection status between the first chip 901 and the second chip 902 by determining the relationship between the actual response time and the preset response time during communication between the first chip 901 or the second chip 902. If so, the second chip 902 can respond to the communication connection status being an abnormal state and determine that the current operating state meets the preset switching condition.

[0268] The abnormal state includes: the number of consecutive communication errors occurring is greater than a preset number.

[0269] The second chip 902 can determine whether there is an abnormality in the communication connection status between the first chip 901 and the second chip 902 by determining whether the number of consecutive times that the first chip 901 or the second chip 902 has information errors in the information sent to the other party is greater than a preset number. If so, the second chip 902 can determine that the current operating status meets the preset switching condition in response to the communication connection status being an abnormal state.

[0270] Optionally, in a specific implementation, the second chip 902 is further configured to determine that the current operating state meets a preset switching condition in response to the current operating state indicating that an abnormality exists in a preset functional module.

[0271] Optionally, in a specific implementation, the first chip 901 is further used to perform a reset operation on the preset functional module with the abnormality in response to the preset functional module having the abnormality; wherein the reset operation includes: a restart operation, or a restore operation to an initial state.

[0272] Optionally, in a specific implementation, the current operating state includes: the execution result of the current control instruction received in response to the vehicle; the second chip 902 is also used to determine that the current operating state meets the preset switching conditions if the execution result does not reach the preset result of the current control instruction.

[0273] Optionally, in a specific implementation, the second chip 902 is further used to determine that the vehicle meets a preset switching condition in response to the distance between the vehicle and the first obstacle being less than a preset distance.

[0274] Optionally, in a specific implementation, the first chip 901 is further used for:

[0275] Acquire the current location information and first type of environmental information of the vehicle; wherein the first type of environmental information is information collected by the main sensor of the vehicle;

[0276] Based on the current position information and the first type of environmental information, generate a first driving trajectory of the vehicle and an initial control instruction corresponding to the first driving trajectory;

[0277] Based on the current position information, the first type of environmental information, the first driving trajectory and the initial control instruction, predicting a second driving trajectory of the vehicle within a target time length starting from the current moment;

[0278] Acquire the second type of environmental information of the vehicle, and determine whether the second type of environmental information meets the environmental information requirement corresponding to the target operating state indicated by the initial control instruction based on the second driving trajectory and the second type of environmental information; wherein the second type of environmental information is information collected by redundant sensors of the vehicle; and the target operating state is the vehicle operating state entered when the vehicle travels along the second driving trajectory;

[0279] If the second type of environmental information meets the environmental information requirement, the initial control instruction is determined as a driving control instruction of the vehicle, so as to control the vehicle to drive along the second driving trajectory according to the driving control instruction.

[0280] Optionally, in a specific implementation, the second chip 902 is further used for:

[0281] In response to detecting that the vehicle has a driving risk, outputting a preset alarm message; wherein the driving risk includes: the distance between the vehicle and the second obstacle is less than a specified distance;

[0282] In response to not receiving a control instruction for the preset alarm information within the first specified time period, controlling the vehicle to brake according to the preset braking instruction;

[0283] In response to the vehicle failing to brake successfully within the second specified time period, the vehicle is controlled according to the lateral and longitudinal control instructions determined based on the second type of environmental information; wherein the lateral and longitudinal control instructions include instructions for controlling the vehicle to travel lateral or longitudinally.

[0284] Optionally, in a specific implementation, the second chip 902 is further used for:

[0285] When the vehicle stops running or the vehicle is powered off, the vehicle is switched to the initial control mode.

[0286] Corresponding to a vehicle control method provided by an embodiment of the present disclosure, an embodiment of the present disclosure also provides another vehicle controller, such as Fig.10 As shown, it includes a processor 1001, a communication interface 1002, a memory 1003 and a communication bus 1004, wherein the processor 1001, the communication interface 1002, and the memory 1003 communicate with each other through the communication bus 1004.

[0287] Memory 1003, used for storing computer programs;

[0288] The processor 1001 is used to implement the steps of any vehicle control method provided by the above-mentioned embodiments of the present disclosure when executing the program stored in the memory 1003.

[0289] The communication bus mentioned in the above vehicle controller can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0290] The communication interface is used for communication between the above vehicle controller and other devices.

[0291] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0292] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0293] In another embodiment provided by the present disclosure, a computer-readable storage medium is also provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned vehicle control methods are implemented.

[0294] In another embodiment provided by the present disclosure, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute any vehicle control method in the above embodiments.

[0295] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present disclosure is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

[0296] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0297] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the vehicle controller embodiment, the vehicle controller embodiment, the computer-readable storage medium embodiment, and the computer program product embodiment, since they are basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0298] The above description is only a preferred embodiment of the present disclosure and is not intended to limit the protection scope of the present disclosure. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure are included in the protection scope of the present disclosure.

Claims

1. A method for controlling a vehicle, wherein the vehicle comprises a vehicle controller, characterized in that: The method comprises: Obtaining the current operating status of a preset functional module of the vehicle; In response to the current operating state meeting a preset switching condition, switching the vehicle to the preset control mode; The vehicle is controlled according to the preset control mode.

2. The method according to claim 1, characterized in that The method further comprises: In response to the current operating state indicating that the preset functional module is abnormal, it is determined that the current operating state meets the preset switching condition.

3. The method according to claim 2, characterized in that The method further comprises: In response to the abnormality of the preset functional module, a reset operation is performed on the preset functional module with the abnormality; wherein the reset operation includes: a restart operation, or an initial state restoration operation.

4. The method according to claim 1, characterized in that The current operating state includes: the execution result of the vehicle in response to the received current control instruction; the method also includes: If the execution result does not reach the preset result of the current control instruction, it is determined that the current operating state meets the preset switching condition.

5. The method according to claim 1, characterized in that: The method further comprises: In response to a distance between the vehicle and the first obstacle being less than a preset distance, it is determined that the vehicle meets a preset switching condition.

6. The method according to claim 1, characterized in that The method further comprises: Acquire the current location information and first type of environmental information of the vehicle; wherein the first type of environmental information is information collected by the main sensor of the vehicle; Based on the current position information and the first type of environmental information, generating a first driving trajectory of the vehicle and an initial control instruction corresponding to the first driving trajectory; Predicting a second driving trajectory of the vehicle within a target duration starting from a current moment based on the current position information, the first type of environmental information, the first driving trajectory, and the initial control instruction; Acquire the second type of environmental information of the vehicle, and determine whether the second type of environmental information meets the environmental information requirement corresponding to the target operating state indicated by the initial control instruction based on the second driving trajectory and the second type of environmental information; wherein the second type of environmental information is information collected by redundant sensors of the vehicle; and the target operating state is the vehicle operating state entered when the vehicle travels according to the second driving trajectory; If the second type of environmental information meets the environmental information requirement, the initial control instruction is determined as a driving control instruction of the vehicle, so as to control the vehicle to travel along the second driving trajectory according to the driving control instruction.

7. The method according to any one of claims 2 to 6, characterized in that: The method further comprises: In response to detecting that the vehicle has a driving risk, outputting a preset alarm message; wherein the driving risk includes: the distance between the vehicle and the second obstacle is less than a specified distance; In response to not receiving a control instruction for the preset alarm information within a first specified time period, controlling the vehicle to brake according to a preset braking instruction; or In response to the vehicle failing to brake successfully within a second specified time period, the vehicle is controlled according to lateral and longitudinal control instructions determined based on the second type of environmental information; wherein the lateral and longitudinal control instructions include instructions for controlling the vehicle to travel lateral or longitudinally.

8. The method according to any one of claims 2 to 6, characterized in that: The method further comprises: After the vehicle stops running or the vehicle is powered off, the vehicle is switched to an initial control mode.

9. A vehicle controller, characterized in that: The vehicle controller includes: a first chip and a second chip; The first chip is used to obtain the current operating status of a preset functional module of the vehicle; The first chip is used to send the current running status to the second chip; The second chip is used to switch the vehicle to the preset control mode in response to the current operating state meeting the preset switching condition; The second chip is used to control the vehicle according to the preset control mode.

10. The vehicle controller according to claim 9, characterized in that: The first chip is used to monitor the communication connection status between the first chip and the second chip; The second chip is used to determine that the current operating state meets the preset switching condition in response to the communication connection state being an abnormal state; wherein the abnormal state includes: the actual response time is greater than the preset response time, or the number of consecutive communication errors is greater than the preset number.

11. The vehicle controller according to claim 9, characterized in that: The second chip is further configured to determine that the current operating state meets a preset switching condition in response to the current operating state indicating that the preset functional module is abnormal.

12. The vehicle controller according to claim 11, characterized in that: The first chip is further used for performing a reset operation on the preset functional module with the abnormality in response to the preset functional module with the abnormality; wherein the reset operation includes: a restart operation, or an initial state restoration operation.

13. The vehicle controller according to claim 9, characterized in that: The current operating state includes: the execution result of the vehicle in response to the received current control instruction; The second chip is further configured to determine whether the current operating state meets a preset switching condition if the execution result does not reach a preset result of the current control instruction.

14. The vehicle controller according to claim 9, characterized in that: The second chip is further used to determine that the vehicle meets a preset switching condition in response to the distance between the vehicle and the first obstacle being less than a preset distance.

15. The vehicle controller according to claim 9, characterized in that: The first chip is further used for: Acquire the current location information and first type of environmental information of the vehicle; wherein the first type of environmental information is information collected by the main sensor of the vehicle; Based on the current position information and the first type of environmental information, generating a first driving trajectory of the vehicle and an initial control instruction corresponding to the first driving trajectory; Predicting a second driving trajectory of the vehicle within a target duration starting from a current moment based on the current position information, the first type of environmental information, the first driving trajectory, and the initial control instruction; Acquire the second type of environmental information of the vehicle, and determine whether the second type of environmental information meets the environmental information requirement corresponding to the target operating state indicated by the initial control instruction based on the second driving trajectory and the second type of environmental information; wherein the second type of environmental information is information collected by redundant sensors of the vehicle; and the target operating state is the vehicle operating state entered when the vehicle travels according to the second driving trajectory; If the second type of environmental information meets the environmental information requirement, the initial control instruction is determined as a driving control instruction of the vehicle, so as to control the vehicle to travel along the second driving trajectory according to the driving control instruction.

16. The vehicle controller according to any one of claims 9 to 15, characterized in that: The second chip is further used for: In response to detecting that the vehicle has a driving risk, outputting a preset alarm message; wherein the driving risk includes: the distance between the vehicle and the second obstacle is less than a specified distance; In response to not receiving a control instruction for the preset alarm information within a first specified time period, controlling the vehicle to brake according to a preset braking instruction; In response to the vehicle failing to brake successfully within a second specified time period, the vehicle is controlled according to lateral and longitudinal control instructions determined based on the second type of environmental information; wherein the lateral and longitudinal control instructions include instructions for controlling the vehicle to travel lateral or longitudinally.

17. The vehicle controller according to any one of claims 9 to 15, characterized in that: The second chip is further used for: After the vehicle stops running or the vehicle is powered off, the vehicle is switched to an initial control mode.

18. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, any one of the methods described in claims 1-8 is implemented.

Images