Dual-redundancy control system and control method of vehicle and automatic driving vehicle

Abstract

The invention relates to a dual-redundancy control system and method for a vehicle and an automatic driving vehicle. The dual-redundancy control system comprises a main control unit, an auxiliary control unit and a power system. The main control unit and the auxiliary control unit are connected with each other through a bidirectional heartbeat line, periodically exchange heartbeat signals and check signal integrity so as to monitor real-time state information of the opposite side. The power system is connected with the main control unit and the auxiliary control unit through a first power channel and a second power channel of the vehicle, and the main control unit and the auxiliary control unit are connected with an action execution system of the vehicle. When a power supply, a control unit and a sensor of the vehicle have a single-point fault, the design of the dual-redundancy control system covering the whole link can ensure normal operation of system functions, and the safety and robustness of the vehicle during driving are improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of vehicle safety technology, and in particular, to a dual redundant control system, a control method and an autonomous driving vehicle of a vehicle. Background Art

[0002] With the rapid development of autonomous driving technology, the reliability and safety of vehicle control systems have become core challenges. In the prior art, vehicle redundant systems are mostly concentrated on the backup of a single module, such as a control unit or a communication line, but lack global redundant design for key links such as power supply, sensors, and actuators, and there is a risk of single-point failure leading to system failure. For example, in the existing main and sub-system architecture of autonomous vehicles, the sub-system initiates emergency measures (such as oil cut-off and window opening) when the main system is damaged, but its design is mainly for escape scenarios after a collision, and does not cover the real-time redundant switching of key components such as power supply and computing platform, and relies on a single power supply, making it difficult to cope with complex fault scenarios. Another existing dual-controller architecture can switch to the backup controller and enter the deceleration mode when the main controller fails, but its redundancy range is limited, does not involve multiple redundancies of sensors, power supplies, and actuators, and the switching logic relies on the passive switching of communication lines, and the response speed and reliability are insufficient.

[0003] In addition, existing power redundancy solutions only cut off power supply through fuses or voltage thresholds and cannot dynamically adjust the power supply path. This may cause malfunctions due to instantaneous fluctuations, further causing the vehicle to lose control at the moment of switching. Summary of the invention

[0004] In response to the above-mentioned deficiencies or shortcomings, the present application provides a dual redundant control system, a control method and an autonomous driving vehicle for a vehicle. When a single point failure occurs in the vehicle's power supply, control unit and sensor, such a dual redundant control system design covering the entire link can ensure the normal operation of the system functions and improve the safety and robustness of the vehicle during driving.

[0005] According to the first aspect, the present application provides a dual redundant control system of a vehicle, including a main control unit, a sub-control unit and a power supply system, wherein the main control unit and the sub-control unit are controllers for controlling the driving of the vehicle and are mutually redundant. The main control unit and the sub-control unit are interconnected through a bidirectional heartbeat line, periodically exchanging heartbeat signals and verifying signal integrity to monitor each other's real-time status information. The power supply system is connected to the main control unit and the sub-control unit through the first power supply channel and the second power supply channel of the vehicle, respectively, and the main control unit and the sub-control unit are respectively connected to the vehicle's action execution system.

[0006] In some embodiments, the dual redundant control system further includes a power switching circuit, the first power channel includes a main DC-DC converter, and the second power channel includes a sub-DC converter. The first power battery of the vehicle is connected between the main DC-DC converter and the main control unit, and the second power battery is connected between the sub-DC converter and the sub-control unit. The receiving end of the power switching circuit is respectively connected to the output ends of the main DC-DC converter and the sub-DC converter.

[0007] In some embodiments, the dual redundant control system further comprises a telematics control unit, which is connected to the main control unit, the sub-control unit and the power supply system through a controller area network bus. The first power supply channel and the second power supply channel are also connected to the power supply input terminal of the telematics control unit.

[0008] In some embodiments, the dual redundant control system further comprises a main computing platform and a secondary computing platform, a platform high-speed bus is installed between the main computing platform and the secondary computing platform, and the main control unit and the secondary control unit are in a physically isolated state. The main control unit is connected to the main computing platform, and the secondary control unit is connected to the secondary computing platform.

[0009] In some embodiments, the main control unit is connected to the first vehicle-mounted radar and the first inertial measurement unit of the vehicle through a controller area network bus, connected to the first vehicle-mounted camera of the vehicle through a gigabit multimedia serial link, and connected to the light detection and ranging device through Ethernet. The sub-control unit is connected to the second vehicle-mounted radar and the second inertial measurement unit of the vehicle through a controller area network bus, connected to the second vehicle-mounted camera of the vehicle through a gigabit multimedia serial link, and connected to the light detection and ranging device through Ethernet. The platform high-speed bus is used to transmit real-time sensor data from the first vehicle-mounted camera, the second vehicle-mounted camera, the first vehicle-mounted radar, the second vehicle-mounted radar, the first inertial measurement unit, the light detection and ranging device, and the second inertial measurement unit, the environmental model and decision information from the main computing platform or the sub-computing platform, and the status information and control signals of the main control unit or the sub-control unit.

[0010] In some embodiments, the bidirectional heartbeat line includes a hard-line communication link and / or a redundant communication link. The hard-line communication link is used to transmit real-time status information through high and low level heartbeat pulses. The redundant communication link is used to transmit real-time status information through encrypted and verified system operation cycle and load data.

[0011] According to the second aspect, the present application provides a dual-redundancy control method for a vehicle. The method is based on the dual-redundancy control system of any of the above embodiments. The driving task of the vehicle is only performed by one of the main control unit or the auxiliary control unit at the same time. The real-time status information includes the power supply status information, communication status information and operation status information of the corresponding unit; the method includes: in response to any unit losing the heartbeat signal for a preset number of consecutive times or detecting a power supply abnormality, marking the unit as a faulty unit. Freezing the control command output of the faulty unit within the first delay threshold after marking the faulty state. Transferring the driving control right to another normal unit within the second delay threshold.

[0012] In some embodiments, the power supply abnormality detection step includes: monitoring the DC output voltage ripple of the main DC-DC converter or the auxiliary DC-DC converter through the power switching circuit. In response to the amplitude of the DC output voltage ripple exceeding a preset nominal value, determining that the power supply is abnormal.

[0013] In some embodiments, when the driving control is transferred to another normal unit, the method further includes: switching the DC output end of the DC-DC converter of the normal unit to supply power to the first power battery and the second power battery simultaneously. If the normal unit is the main control unit, the DC-DC converter is the main DC-DC converter, or if the normal unit is the secondary control unit, the DC-DC converter is the secondary DC-DC converter.

[0014] According to a third aspect, the present application provides an autonomous driving vehicle, comprising a dual redundant control system as in any of the above embodiments. The action execution system comprises a brake actuator, a steering actuator, a drive execution system, a door controller and a lamp installed in the autonomous driving vehicle. The power supply system is also used to supply power to the cooling system, the lighting system, the cleaning system and the vehicle relay of the autonomous driving vehicle.

[0015] The main control unit is also used to receive geographic location information from the GPS (Global Positioning System) antenna of the autonomous vehicle. The telematics control unit is used to receive and process control instructions from one or more ports of the Internet of Vehicles communication antenna, wireless communication antenna, 5G antenna and vehicle-mounted user interaction device of the autonomous vehicle, and send control instructions to one or more of the main control unit, sub-control unit and power supply system through the controller area network bus.

[0016] The dual redundant control system provided in the present application can be applied to the vehicle control unit (VCU, Vehicle Control Unit) of the vehicle. Among them, the sensor of the vehicle can be a light detection and ranging device sensor connected to the main control unit and the sub-control unit respectively. If the light detection and ranging device sensor connected to the main control unit fails, the main control unit will be abnormal; at this time, the sub-control unit can monitor the main control unit abnormality through the two-way heartbeat line, and instruct the vehicle control unit VCU to transfer control to the sub-control unit. Similarly, if the light detection and ranging device sensor connected to the sub-control unit fails, the vehicle control unit VCU will transfer control to the main control unit. When a single power supply failure occurs in the power supply system, since the vehicle has a first power supply channel and a second power supply channel, another normal power supply channel will continue to supply power to the power supply system without affecting its normal power supply function. Therefore, when a single point failure occurs in the power supply, control unit and sensor of the vehicle, such a dual redundant control system design covering the entire link can ensure the normal operation of the system function and improve the safety and robustness of the vehicle when driving. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 An architectural diagram of a dual redundant control system in one or more embodiments of the present application;

[0018] Figure 2 A schematic diagram of the structure of a power supply system PSU with dual power supply channels in one or more embodiments of the present application;

[0019] Figure 3 A flow chart of a control method of a dual redundant control system in one or more embodiments of the present application;

[0020] Figure 4 A flow chart of a switching method based on a power switching circuit in one or more embodiments of the present application;

[0021] Figure 5 A schematic diagram of the structure of an autonomous driving vehicle equipped with a dual redundant control system in one or more embodiments of the present application. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0023] It should be noted that when an electronic unit or module is considered to be "connected", "located", or "assembled" on another electronic unit or module, it may be directly disposed on the other electronic unit or module or there may be intermediate parts and components. The terms "left", "right", "upper", "lower" and similar expressions used herein are for illustrative purposes only.

[0024] According to a first aspect, the present application provides a dual redundant control system for a vehicle, such as Figure 1 As shown, the system includes a main control unit (also called Main system), a secondary control unit (also called Secondary system) and a power supply system (abbreviated as PSU, Power Supply Unit). Both the main control unit and the secondary control unit are controllers for controlling the driving of the vehicle, and are redundant with each other. The main control unit and the secondary control unit are connected to each other through a bidirectional heartbeat line, periodically exchanging heartbeat signals and verifying signal integrity to monitor each other's real-time status information. The power supply system is connected to the main control unit and the secondary control unit through the first power channel and the second power channel of the vehicle, respectively, and the main control unit and the secondary control unit are respectively connected to the vehicle's action execution system.

[0025] Specifically, the vehicle can be various vehicles suitable for road travel, including cars, trucks, buses and vans. The main control unit can provide computing power support for the vehicle when performing autonomous driving tasks. Similarly, the sub-control unit can also provide computing power support for the vehicle when performing autonomous driving tasks, but it is generally in a dormant or standby state. Among them, the power supply system is used to integrate the DC outputs of the first power channel and the second power channel of the vehicle, and then respectively connect the main control unit and the sub-control unit and output DC power to them respectively. Among them, the DC outputs of the first power channel and the second power channel can come from the vehicle's on-board battery or from an on-board DC generator. In addition, the power supply system PSU can also be used to respectively connect the vehicle's telematics control unit (abbreviated as TBOX, Telematics Box), cooling system, lighting system, cleaning system and sensor group (for example Figure 1 The cooling systems 1 and 2, the lighting systems 1 and 2, the cleaning systems 1 and 2, the sensor groups 1 and 2) are connected and DC power is output to them respectively for powering.

[0026] For example Figure 1As shown, in one embodiment, a dual redundant control system can be applied to a vehicle control unit of a vehicle, and the sensor group of the vehicle can include a sensor group of a light detection and ranging device (referred to as LiDAR, Light Detection and Ranging), and the sensor group of the light detection and ranging device can be connected to the main control unit and the sub-control unit respectively. If the sensor group fails, it will cause the main control unit to be abnormal. At this time, the sub-control unit can detect the abnormality of the main control unit through the bidirectional heartbeat line, and instruct the vehicle control unit to transfer the control right of the automatic driving task to the sub-control unit. Similarly, if the sensor group fails, the vehicle control unit will transfer the control right of the automatic driving task to the main control unit. Alternatively, since the vehicle has a first power channel and a second power channel, when a single power supply fails in the power supply system, another normal first power channel or second power channel will continue to supply power to the power supply system without affecting its normal power supply function. Therefore, when the vehicle's power supply (first power channel or second power channel), control unit (main control unit or sub-control unit) and sensor (can be Figure 2 When a single point failure occurs in sensor group 1 and sensor group 2, the dual redundant control system design covering the entire link can ensure the normal operation of the system functions and improve the safety and robustness of the vehicle during driving.

[0027] In some embodiments, Figure 2 As shown, the dual redundant control system also includes a power switching circuit, and the first power channel includes a main DC-DC converter (such as Figure 2 The second power supply channel includes a secondary DC-DC converter (such as DCDC Power1). Figure 2 The first power battery of the vehicle is connected between the main DC-DC converter and the main control unit, and the second power battery of the vehicle is connected between the auxiliary DC-DC converter and the auxiliary control unit. The receiving end of the power switching circuit is respectively connected to the output end of the main DC-DC converter and the auxiliary DC-DC converter.

[0028] Exemplarily, the first power battery and the second power battery of the vehicle are both on-board batteries, and the design in which the receiving end of the power switching circuit is connected to the output end of the main DC-DC converter and the auxiliary DC-DC converter respectively can ensure that when a short circuit or overcurrent fault occurs in the first power channel, the fuse of the power switching circuit will cut off the output power supply of the main DC-DC converter. If the DC output of the main DC-DC converter is undervoltage or has other power supply abnormalities, the vehicle control unit will hand over the driving control right to the auxiliary control unit, but the power switching circuit will not cut off the power supply to the main control unit. Therefore, adopting such a design can ensure that when the main control unit fails, the auxiliary control unit can seamlessly take over the driving task of the vehicle and maintain the normal operation of the vehicle. Therefore, through such a power switching circuit design, the power supply can be flexibly switched under different fault types, further improving the stability and reliability of the dual redundant control system.

[0029] In some embodiments, the bidirectional heartbeat line includes a hard-line communication link and / or a redundant communication link. The hard-line communication link is used to transmit real-time status information through high and low level heartbeat pulses. The redundant communication link is used to transmit real-time status information through encrypted and verified system operation cycle and load data.

[0030] Specifically, in the vehicle, when the redundant communication link transmits real-time status information through the system operation cycle and load data after encryption verification, it can be carried out in the form of a high-speed serial communication protocol (also known as CAN communication, Controller Area Network). Therefore, the bidirectional heartbeat line design combining the high and low levels of the hard-wired communication link with the CAN communication can transmit high and low level signals through the hard-wired communication link to achieve fast and real-time abnormal detection, which belongs to the interrupt processing type and can detect the main control unit or the auxiliary control unit in a very short time and trigger an alarm. At the same time, the system operation cycle and load data after encryption verification are transmitted using the CAN communication line, and the heartbeat packet contains rich message content, which can characterize multiple status indicators of the main control unit or the auxiliary control unit, such as the vehicle battery power upstream of the power system, the state of the sensor group, the temperature of the dual redundant control system, etc. Therefore, through such a bidirectional heartbeat line design, system abnormalities can be quickly detected, ensuring timely response in emergency situations, and improving the driving safety of the vehicle.

[0031] In some embodiments, Figure 1 As shown, the dual redundant control system further includes a telematics control unit, which is connected to the control unit via a controller area network bus (eg Figure 1 The CAN link in the controller area network (Controller Area Network) is connected to the main control unit, the sub-control unit and the power supply system respectively. The first power supply channel and the second power supply channel are also connected to the power supply input terminal of the telematics control unit.

[0032] For example Figure 1 As shown, the telematics control unit can be TBOX v2.0, (Telematics Box v2.0), that is, telematics control unit version 2.0. Specifically, the telematics control unit receives startup or power-off instructions from the cloud through a 5G network link. After these instructions are parsed by the internal processor of the telematics control unit, they send wake-up or sleep system instructions to the main control unit through the controller area network bus CAN, thereby controlling the execution operation of the main control unit. At the same time, both the telematics control unit and the power supply system adopt a dual power supply design to ensure that their functions can still operate normally even if one of the power supplies fails. Therefore, through such a telematics control unit design, it is ensured that the power supply system can still operate normally when a single power supply fails, thereby improving the redundancy and reliability of the system. In addition, the use of the controller area network bus ensures the efficiency and reliability of the transmission of startup or power-off instructions from the cloud, further improving the overall performance of the system.

[0033] In some embodiments, Figure 1 As shown, the dual redundant control system also includes a main computing platform and a secondary computing platform, a platform high-speed bus is installed between the main computing platform and the secondary computing platform, and the main control unit and the secondary control unit are in a physically isolated state. The main control unit is connected to the main computing platform, and the secondary control unit is connected to the secondary computing platform.

[0034] Specifically, the main computing platform and the auxiliary computing platform can be systems that run based on the vehicle's SoC (System on Chip) chip or MCU (Microcontroller Unit) chip, and are used to process and calculate the core tasks required for vehicle driving. Therefore, the design of physical isolation between the main control unit and the auxiliary control unit can effectively prevent the propagation of faults and improve the reliability of the system. Secondly, the high-speed bus connection between the main computing platform and the auxiliary computing platform ensures the efficiency and real-time performance of data transmission, further improving the overall performance of the system.

[0035] In some embodiments, Figure 1As shown, the main control unit is connected to the first vehicle-mounted radar (Radar) and the first inertial measurement unit (also known as IMU, Inertial Measurement Unit) of the vehicle through the controller area network bus, connected to the first vehicle-mounted camera of the vehicle through the Gigabit Multimedia Serial Link (also known as GMSL, Gigabit Multimedia Serial Links), and connected to the light detection and ranging device through Ethernet (also known as ETH, Ethernet). The sub-control unit is connected to the second vehicle-mounted radar Radar and the second inertial measurement unit of the vehicle through the controller area network bus, connected to the second vehicle-mounted camera of the vehicle through the Gigabit Multimedia Serial Link, and connected to the light detection and ranging device through Ethernet. The platform high-speed bus is used to transmit real-time sensor data from the first vehicle-mounted camera, the second vehicle-mounted camera, the first vehicle-mounted radar, the second vehicle-mounted radar, the first inertial measurement unit, the light detection and ranging device, and the second inertial measurement unit, the environmental model and decision information from the main computing platform or the sub-computing platform, and the status information and control signals of the main control unit or the sub-control unit.

[0036] Therefore, the vehicle adopts a redundant design of the main and auxiliary control units. The main control unit and the auxiliary control unit are connected to their respective sensors, and data transmission is achieved through a variety of high-speed communication links (such as high-speed serial communication protocols, gigabit multimedia serial links, and Ethernet), which ensures the reliability and safety of the system to the greatest extent. Even if the main control unit fails, the auxiliary control unit can quickly take over to ensure the stable operation of the vehicle, and multi-link communication improves the efficiency and real-time performance of data transmission.

[0037] According to a second aspect, the present application provides a dual-redundancy control method for a vehicle. The method is based on a dual-redundancy control system of any of the above embodiments. The driving task of the vehicle is only performed by one of the main control unit or the auxiliary control unit at the same time. The real-time status information includes power supply status information, communication status information and operation status information of the corresponding unit; Figure 3 As shown, the method can be applied to a vehicle control unit of a vehicle, comprising the following steps:

[0038] S310: In response to any unit losing the heartbeat signal for a preset number of consecutive times or detecting a power supply abnormality, marking the unit as a faulty unit.

[0039] The preset number of consecutive losses of the heartbeat signal can be set according to the actual driving task safety requirements. For example, assuming that the control of the current vehicle driving task is in the main control unit, the main control unit is in working state, and the sub-control unit is in standby state. Then, as long as either the main control unit or the sub-control unit loses the heartbeat signal for a preset number of consecutive times or detects power supply abnormality, it will be marked as a faulty unit by the vehicle control unit.

[0040] S320: Freeze the control instruction output of the faulty unit within a first delay threshold after marking the faulty state.

[0041] The first delay threshold can be set according to the actual driving task safety requirements. For example, assuming that the main control unit is marked as a faulty unit, the VCU will freeze the control command output of the main control unit within the first delay threshold. Or, assuming that both the main control unit and the sub-control unit are marked as faulty units, the vehicle control unit will freeze the control command output of the main control unit and the sub-control unit within the first delay threshold.

[0042] S330: Transferring the driving control right to another normal unit within the second delay threshold.

[0043] The second delay threshold can be set according to the actual driving task safety requirements. Generally, the second delay threshold will be greater than the first delay threshold. The other normal unit refers to the unmarked main control unit or sub-control unit. Generally, at the same time, the main control unit is a faulty unit and the sub-control unit is a normal unit, or the sub-control unit is a faulty unit and the main control unit is a normal unit.

[0044] For example, assuming that the main control unit is marked as a faulty unit and the sub-control unit is not marked, the vehicle control unit will transfer the driving control right to the sub-control unit within the second delay threshold. Alternatively, assuming that both the main control unit and the sub-control unit are marked as faulty units, the vehicle control unit can send an error report instruction to the vehicle-mounted user interaction device HMI through the telematics control unit, or transfer the driving control right to another normal unit other than the main control unit and the sub-control unit within the second delay threshold. Therefore, such a method can ensure the normal operation of the system functions when a single point failure occurs in the vehicle's power supply, control unit, and sensor, thereby improving the safety and robustness of the vehicle during driving.

[0045] In some embodiments, when handing over driving control to another normal unit, the method may be applied to a vehicle control unit of a vehicle, and further includes:

[0046] The DC output end of the DC-DC converter of the normal unit is switched to supply power to the first power battery and the second power battery simultaneously. If the normal unit is the main control unit, the DC-DC converter is the main DC-DC converter, or if the normal unit is the auxiliary control unit, the DC-DC converter is the auxiliary DC-DC converter.

[0047] For example Figure 1As shown, the DC-DC converter of a normal unit refers to the main DC-DC converter or the auxiliary DC-DC converter under the main control unit or the auxiliary control unit that is not marked as a faulty unit. When the main DC-DC converter is the DC-DC converter of a normal unit, the vehicle control unit switches the DC output end of the main DC-DC converter to supply power to the first power battery and the second power battery at the same time. Therefore, by adopting such a method, the power supply can be flexibly switched under different fault types, further improving the stability and reliability of the dual redundant control system.

[0048] In some embodiments, Figure 4 As shown, the steps of detecting power supply anomaly include:

[0049] S410: Monitor the DC output voltage ripple of the main DC-DC converter or the auxiliary DC-DC converter through the power switching circuit.

[0050] Generally, when the main DC-DC converter and the sub-DC-DC converter operate normally, their DC output voltage ripples are stable and smooth.

[0051] S420: In response to the amplitude of the DC output voltage ripple exceeding a preset nominal value, determining that power supply is abnormal.

[0052] Among them, the preset nominal value can be set according to the actual driving mission safety requirements.

[0053] For example, if the DC output of the main DC-DC converter is undervoltage or has other power supply anomalies, the DC output voltage ripple of the main DC-DC converter will drop suddenly, causing the amplitude of the DC output voltage ripple to exceed the preset nominal value. The vehicle control unit will determine that the power supply of the main DC-DC converter is abnormal and hand over the driving control to the auxiliary control unit, but the power switching circuit will not cut off the power supply to the main control unit. Therefore, in this way, it can be ensured that when the main control unit fails, the auxiliary control unit can seamlessly take over the vehicle's driving task, maintain the normal operation of the vehicle, and further improve the stability and reliability of the dual redundant control system.

[0054] According to a third aspect, the present application provides an autonomous driving vehicle, such as Figure 5 As shown, it includes a dual redundant control system as in any of the above embodiments. The action execution system includes a brake actuator, a steering actuator, a drive execution system, a door controller and a lamp installed in the autonomous driving vehicle. The power supply system is also used to power the cooling system, the lighting system, the cleaning system and the on-board relays (such as Figure 5The main control unit is also used to receive geographic location information from the GPS antenna of the autonomous vehicle. The telematics control unit is used to receive and process control instructions from one or more ports of the Internet of Vehicles communication antenna (also known as V2X ANT, Vehicle to Everything Antenna), wireless communication antenna (also known as WIFI / BTANT), 5G antenna and on-board user interaction device (abbreviated as HMI, Human Machine Interface) of the autonomous vehicle, and send control instructions to one or more of the main control unit, sub-control unit and power supply system through the controller area network bus CAN.

[0055] Among them, Figure 1 As shown, the driving execution system of the autonomous driving vehicle may include a vehicle secondary drive-by-wire system (also called vehicle Secondary DBW, Vehicle Secondary Drive-by-Wire) and a vehicle primary drive-by-wire system (also called vehicle Primary DBW, Vehicle Primary Drive-by-Wire). The vehicle secondary drive-by-wire system and the vehicle primary drive-by-wire system are connected to the auxiliary control unit and the main control unit respectively.

[0056] Therefore, the autonomous driving vehicle adopts a redundant design of the main and auxiliary control units. The main control unit and the auxiliary control unit are connected to independent sensors and actuators respectively, and data interaction is achieved through a variety of communication links (such as high-speed serial communication protocol, gigabit multimedia serial link, Ethernet). The power supply system supplies power to key systems to ensure the normal operation of the system in the event of a single failure. At the same time, the main control unit receives GPS information, and the telematics control unit receives and processes vehicle networking communication instructions, which enhances the reliability and safety of the autonomous driving vehicle.

[0057] Among them, any reference to memory, storage, database or other media used in the embodiments provided in the present application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (RamCUs), direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0058] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0059] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

[0060] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

Claims

1. A dual redundant control system for a vehicle, characterized in that: It includes a main control unit, a sub-control unit and a power supply system, wherein the main control unit and the sub-control unit are controllers for controlling the driving of the vehicle and are mutually redundant; The main control unit and the auxiliary control unit are connected to each other via a bidirectional heartbeat line, periodically exchanging heartbeat signals and verifying signal integrity to monitor the real-time status information of the other party; The power supply system is connected to the main control unit and the auxiliary control unit through the first power supply channel and the second power supply channel of the vehicle respectively, and the main control unit and the auxiliary control unit are connected to the action execution system of the vehicle respectively.

2. The dual redundant control system according to claim 1, characterized in that: Also included is a power switching circuit, wherein the first power channel includes a main DC-DC converter, and the second power channel includes a secondary DC-DC converter; A first power battery of the vehicle is connected between the main DC-DC converter and the main control unit, and a second power battery is connected between the auxiliary DC-DC converter and the auxiliary control unit; The receiving end of the power switching circuit is connected to the output ends of the main DC-DC converter and the auxiliary DC-DC converter respectively.

3. The dual redundant control system according to claim 2, characterized in that: It also includes a telematics control unit, which is connected to the main control unit, the sub-control unit and the power supply system through a controller area network bus; The first power supply channel and the second power supply channel are also connected to the power supply input terminal of the telematics control unit.

4. The dual redundant control system according to claim 2, characterized in that: It also includes a main computing platform and a secondary computing platform, a platform high-speed bus is installed between the main computing platform and the secondary computing platform, and the main control unit and the secondary control unit are in a physically isolated state; The main control unit is connected to the main computing platform, and the sub-control unit is connected to the sub-computing platform.

5. The dual redundant control system according to claim 4, characterized in that: The main control unit is connected to the first vehicle-mounted radar and the first inertial measurement unit of the vehicle through the controller area network bus, connected to the first vehicle-mounted camera of the vehicle through a gigabit multimedia serial link, and connected to the light detection and ranging device through Ethernet; The sub-control unit is connected to the second on-board radar and the second inertial measurement unit of the vehicle via the controller area network bus, connected to the second on-board camera of the vehicle via a gigabit multimedia serial link, and connected to the light detection and ranging device via Ethernet; The platform high-speed bus is used to transmit real-time sensor data from the first vehicle-mounted camera, the second vehicle-mounted camera, the first vehicle-mounted radar, the second vehicle-mounted radar, the first inertial measurement unit, the light detection and ranging device, and the second inertial measurement unit, the environmental model and decision information from the main computing platform or the secondary computing platform, and the status information and control signals of the main control unit or the secondary control unit.

6. The dual redundant control system according to claim 1, characterized in that: The bidirectional heartbeat line includes a hard-wired communication link and / or a redundant communication link; The hardwire communication link is used to transmit the real-time status information via high and low level heartbeat pulses; The redundant communication link is used to transmit the real-time status information through the encrypted and verified system operation cycle and load data.

7. A dual redundant control method for a vehicle, characterized in that: The method is based on the dual redundant control system according to any one of claims 1 to 6, wherein the driving task of the vehicle is performed by only one of the main control unit or the auxiliary control unit at the same time, and the real-time status information includes power supply status information, communication status information and operation status information of the corresponding unit; the method comprises: In response to any unit losing heartbeat signals for a preset number of consecutive times or detecting power supply anomalies, marking the unit as a faulty unit; Freezing the control instruction output of the faulty unit within a first delay threshold after marking the faulty state; The driving control right is transferred to another normal unit within a second delay threshold.

8. The control method according to claim 7, characterized in that: The power supply abnormality detection step comprises: Monitoring the DC output voltage ripple of the main DC-DC converter or the auxiliary DC-DC converter through the power switching circuit; In response to the amplitude of the DC output voltage ripple exceeding a preset nominal value, it is determined that the power supply is abnormal.

9. The control method according to claim 8, characterized in that: When the driving control right is transferred to another normal unit, the method further includes: Switching the DC output end of the DC-DC converter of the normal unit to supply power to the first power battery and the second power battery simultaneously; If the normal unit is a main control unit, the DC-DC converter is the main DC-DC converter; or, if the normal unit is a sub-control unit, the DC-DC converter is the sub-DC converter.

10. An autonomous driving vehicle, characterized in that: comprising a dual redundant control system as claimed in any one of claims 1 to 6; The action execution system includes a brake actuator, a steering actuator, a drive execution system, a door controller and a lamp installed in the autonomous driving vehicle; The power supply system is also used to supply power to the cooling system, lighting system, cleaning system and on-board relays of the autonomous driving vehicle; The main control unit is also used to receive geographic location information from the GPS antenna of the autonomous driving vehicle; The telematics control unit is used to receive and process control instructions from one or more ports of the Internet of Vehicles communication antenna, wireless communication antenna, 5G antenna and on-board user interaction device of the autonomous driving vehicle, and send control instructions to one or more of the main control unit, the sub-control unit and the power supply system through the controller area network bus.

Images