Restarting method, device and equipment of automatic driving system and readable storage medium

Abstract

The invention relates to the technical field of automobiles, in particular to a restarting method, device and equipment of an automatic driving system and a computer readable storage medium. The automatic driving system comprises a decision-making unit and an execution unit, the method is applied to the execution unit, and the method comprises the following steps: monitoring a first heartbeat signal sent by an adaptive module in the decision-making unit, and monitoring a second heartbeat signal sent by a functional module in the decision-making unit; and when the first heartbeat signal and the second heartbeat signal indicate that the automatic driving system has a fault, exiting the automatic driving mode, and restarting the automatic driving system.

Description

Technical Field

[0001] The present disclosure relates to the field of automobile technology, and in particular to a restart method, device, equipment and computer-readable storage medium for an automatic driving system. Background Art

[0002] In the event of a fault in the autonomous driving system, the relevant technology can cause the car to exit the autonomous driving mode and resolve the fault by restarting the autonomous driving system.

[0003] The relevant technology can determine whether there is a communication blockage between the decision-making unit and the execution unit by monitoring the perception heartbeat. However, when the perception module in the decision-making unit stops outputting, the perception heartbeat will also stop. When the adaptation module that sends the perception heartbeat fails, even if the autonomous driving system can still operate normally, it will be misjudged as a failure, which will lead to exiting the autonomous driving mode or even restarting.

[0004] It can be seen that judging whether the autonomous driving system has a fault based on a single condition is not accurate enough and may lead to misjudgment. Summary of the invention

[0005] In order to overcome the problems existing in the related art, the present disclosure provides a restart method, device, equipment and computer-readable storage medium of an autonomous driving system, which can solve the above problems.

[0006] According to a first aspect of an embodiment of the present disclosure, there is provided a method for restarting an autonomous driving system, wherein the autonomous driving system comprises a decision-making unit and an execution unit, and the method is applied to the execution unit, the method comprising: monitoring a first heartbeat signal sent by an adaptation module in the decision unit, and monitoring a second heartbeat signal sent by a functional module in the decision unit; when the first heartbeat signal and the second heartbeat signal indicate that the autonomous driving system has a fault, exiting the autonomous driving mode and restarting the autonomous driving system.

[0007] According to a second aspect of an embodiment of the present disclosure, there is provided a restart device for an autonomous driving system, wherein the autonomous driving system comprises a decision-making unit and an execution unit, and the device is applied to the execution unit, and the device comprises: a monitoring module, configured to monitor a first heartbeat signal sent by an adaptation module in the decision unit, and to monitor a second heartbeat signal sent by a functional module in the decision unit; and a restart module, configured to exit the autonomous driving mode and restart the autonomous driving system when the first heartbeat signal and the second heartbeat signal indicate that the autonomous driving system has a fault.

[0008] According to a third aspect of an embodiment of the present disclosure, there is provided an electronic device, comprising: a processor and a memory; the memory is used to store a computer program; the processor is used to execute the restart method of the autonomous driving system as described in the first aspect by calling the computer program.

[0009] According to a fourth aspect of an embodiment of the present disclosure, there is provided a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the restart method of the autonomous driving system as described in the first aspect.

[0010] According to a fifth aspect of an embodiment of the present disclosure, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the method described in the first aspect is implemented.

[0011] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects:

[0012] The present disclosure can monitor the first heartbeat signal and the second heartbeat signal. The first heartbeat signal is sent by the adaptation module in the decision unit, and the second heartbeat signal is sent by the functional module in the decision unit. The execution unit can determine the communication status between the decision unit and the execution unit, and whether the decision unit is faulty, by monitoring the first heartbeat signal and the second heartbeat signal. When it is determined that the automatic driving system has a fault based on the first heartbeat signal and the second heartbeat signal, the execution unit can exit the automatic driving mode and restart the automatic driving system. Compared with the related art that only one judgment condition is used to determine whether the automatic driving system has a fault, the present disclosure can monitor the two heartbeat signals and combine the characteristics of the two heartbeat signals to determine whether the automatic driving system has a fault, so that the accuracy of fault judgment is greatly improved, and the situation of missed judgment and misjudgment is avoided.

[0013] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The accompanying drawings, which are incorporated in and constitute a part of this disclosure, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0015] Figure 1 It is a schematic diagram of the architecture of an autonomous driving system shown in the present disclosure according to an exemplary embodiment.

[0016] Figure 2 It is a schematic flowchart of a restart method of an autonomous driving system according to an exemplary embodiment of the present disclosure.

[0017] Figure 3It is a schematic diagram of the architecture of an autonomous driving system shown in the present disclosure according to an exemplary embodiment.

[0018] Figure 4 The present disclosure is a block diagram of a restart device for an autonomous driving system according to an exemplary embodiment.

[0019] Figure 5 The present invention is a schematic block diagram of a restart device for an automatic driving system according to an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0020] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0021] The terms used in this disclosure are for the purpose of describing specific embodiments only and are not intended to limit the disclosure. The singular forms of "a", "said" and "the" used in this disclosure and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0022] It should be understood that although the terms first, second, third, etc. may be used in the present disclosure to describe various information, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present disclosure, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0023] The pre-control software for autonomous driving can be distributed on the decision-making unit and execution unit of the autonomous driving system.

[0024] In an autonomous driving system, a decision unit is used to handle complex tasks. For example, it may be responsible for processing data from sensors and performing complex tasks such as environmental perception, path planning, and decision-making. The decision unit may include a system on chip (SOC).

[0025] The execution unit may be an actuator responsible for controlling the vehicle, for example, it may be responsible for controlling the motor, brake and steering system to ensure that the vehicle can be driven according to the instructions of the decision unit. The execution unit may include a microcontroller unit (MCU).

[0026] The decision-making unit needs to send instructions to the execution unit through communication so that the execution unit can control the vehicle driving according to the instructions of the decision-making unit. Therefore, if the communication is blocked or the decision-making unit crashes, the faults in these autonomous driving systems may cause the execution unit to receive abnormal instructions or be unable to receive instructions, affecting the autonomous driving function.

[0027] Therefore, certain measures are needed to ensure driving safety in the autonomous driving scenario. If it is determined that there is a fault in the autonomous driving system, the autonomous driving mode can be exited and the driver can be notified to take over the vehicle. In order to eliminate the fault, the autonomous driving system can be restarted.

[0028] In the related technology, the execution unit can determine whether the perception module in the decision unit has transmitted perception data to the execution unit by receiving the perception heartbeat, and based on the presence or absence of the perception heartbeat, determine whether the autonomous driving system has failed and needs to exit and restart.

[0029] However, this fault judgment method has low accuracy and may cause missed detection or false detection. For example, in some scenarios, the perception module may not output perception data, but this will cause the perception heartbeat to remain unchanged, leading to false detection; in other scenarios, an abnormality in the module that sends the perception heartbeat will also cause the perception heartbeat to remain unchanged, but this will not affect the vehicle's autonomous driving function.

[0030] In order to solve the above technical problems, the present disclosure proposes a restart method for an autonomous driving system.

[0031] Figure 1 It is a schematic diagram of the architecture of an autonomous driving system according to an embodiment of the present disclosure.

[0032] like Figure 1 As shown, the automatic driving system includes a decision unit 110 and an execution unit 120 .

[0033] The decision unit 110 includes an adaptation module 111 and a function module 112 .

[0034] The adaptation module 111 can link the functional modules in the decision unit 110 and send the output of the decision unit 110 to the execution unit 120. In the automatic driving mode, the adaptation module 111 can pass the driving strategy of the decision unit 110 to the execution unit 120, and specifically, can send the driving control information generated by the decision unit 110 to the execution unit 120.

[0035] In some embodiments, the adaptation module 111 may send a first heartbeat signal to the execution unit 120 .

[0036] The functional module 112 may include a module in the decision unit 110 for implementing a specific function in the automatic driving mode. For example, the functional module 112 may be a processor core (CPU), a graphics processor, a digital signal processor, etc.

[0037] The restart method of the autonomous driving system proposed in the present disclosure can be applied to the execution unit 120 in the above-mentioned autonomous driving system.

[0038] Figure 2 1 is a schematic flowchart of a method for restarting an autonomous driving system according to an embodiment of the present disclosure. The method for restarting an autonomous driving system may be executed by the execution unit 120 .

[0039] like Figure 2 As shown, the restart method of the automatic driving system includes:

[0040] In step S201, a first heartbeat signal sent by an adaptation module in the decision unit is monitored, and a second heartbeat signal sent by a functional module in the decision unit is monitored;

[0041] In step S202, when the first heartbeat signal and the second heartbeat signal indicate that there is a fault in the automatic driving system, the automatic driving mode is exited and the automatic driving system is restarted.

[0042] In some embodiments, the execution unit 120 may monitor the first heartbeat signal sent by the adaptation module 111 and the second heartbeat signal sent by the function module 112 .

[0043] It should be noted that the function module 112 may be any other function module different from the adaptation module in the decision unit 110. The second heartbeat signal is a heartbeat signal different from the first heartbeat signal.

[0044] After receiving the heartbeat signal, the execution unit 120 can determine the sequence value of the heartbeat signal. When the automatic driving system operates normally, the sequence value of the heartbeat signal changes periodically. Therefore, the execution unit 120 can determine whether the heartbeat signal is abnormal based on whether the sequence value of the received heartbeat signal changes periodically.

[0045] In some embodiments, the execution unit 120 can determine whether the autonomous driving system has a fault based on monitoring the first heartbeat signal and the second heartbeat signal.

[0046] The execution unit 120 can preset multiple fault conditions. When the conditions of the first heartbeat signal and the second heartbeat signal meet the preset fault conditions, it can be determined that there is a fault in the automatic driving system.

[0047] In some embodiments, the conditions of the heartbeat signal include: receiving a heartbeat signal and the heartbeat signal is normal, receiving a heartbeat signal but the heartbeat signal is abnormal, and not receiving a heartbeat signal.

[0048] Since the sequence value of the heartbeat signal changes periodically, the execution unit can determine the sequence value of the heartbeat signal received in the absence of a fault.

[0049] It should be noted that, according to actual needs, in some scenarios, receiving a heartbeat signal but the heartbeat signal is abnormal and not receiving a heartbeat signal can both be regarded as an abnormal heartbeat signal.

[0050] In some embodiments, receiving a heartbeat signal but the heartbeat signal is abnormal includes receiving a heartbeat signal but the sequence value of the heartbeat signal does not change, or the sequence value of the heartbeat signal does not conform to periodic changes.

[0051] For example, the heartbeat signal sequence value can be a set of natural numbers from 1-50. If the sequence value of the last normal heartbeat signal received is 15, then the sequence value of the next heartbeat signal should be 16. In this case, if no heartbeat signal is received, or the sequence value of the received heartbeat signal does not conform to the periodic change (not 16), it can be determined that the heartbeat signal is abnormal.

[0052] When the first heartbeat signal and the second heartbeat signal indicate that the autonomous driving system has a fault, exit the autonomous driving mode and restart the autonomous driving system

[0053] According to the first heartbeat signal and the second heartbeat signal, in case a fault occurs in the automatic driving system, the automatic driving mode is exited and the automatic driving system is restarted.

[0054] Since the decision-making unit may crash and the communication between the decision-making unit and the execution unit may be blocked, these non-organic failures can be recovered by restarting the autonomous driving system.

[0055] The present disclosure can determine whether there is a fault in the autonomous driving system based on the first heartbeat signal sent by the adaptation module and the second heartbeat signal sent by the functional module, and if there is a fault, exit the autonomous driving mode and restart the autonomous driving system.

[0056] Since the adaptation module is used to send the output of the decision unit to the execution unit, the first heartbeat signal can be used to indicate whether the decision unit has output to the execution unit. However, in some scenarios, the decision unit may not output data to the execution unit itself. Therefore, based on the first heartbeat signal alone, it is difficult for the execution unit to accurately determine whether the failure to receive the output of the decision unit is due to a fault in the autonomous driving system, or whether the decision unit itself does not output data.

[0057] Therefore, in the solution of the present disclosure, the execution unit can also monitor the second heartbeat signal of the functional module. When the decision unit is running in the automatic driving mode, there must be information flow between the functional modules inside the decision unit, and the functional modules can use heartbeat signals to inform other modules that they are in working state. In the technical solution of the present disclosure, the functional module can not only send a heartbeat signal to other functional modules in the decision unit to indicate that it is in working state, but also send a second heartbeat signal to the execution unit, so that the execution unit can judge whether the functional module in the decision unit is in normal operation based on the second heartbeat signal, and then combine the first heartbeat signal sent by the adaptation module to make a more accurate judgment on whether there is a fault in the automatic driving system, improve accuracy, and reduce the possibility of missed detection and false detection.

[0058] In some embodiments, the number of restarts of the autonomous driving system is counted within one ignition cycle of the vehicle, and if the number of restarts is 1, no restart is performed.

[0059] This embodiment can avoid repeated restarts of the vehicle's automatic driving system. The ignition cycle refers to the entire process from ignition to shutdown of the vehicle (for electric vehicles, it is equivalent to powering on).

[0060] Normally, the autopilot system will not fail repeatedly, so the autopilot system will only restart once in one ignition cycle. If the autopilot system fails multiple times in one ignition cycle, it means that one restart does not solve the autopilot system failure. In this case, even if the autopilot system is restarted multiple times, the corresponding failure may not be solved.

[0061] In some embodiments, when the car is in an autonomous driving state, the restart method of the autonomous driving system proposed in the present disclosure is used.

[0062] In order to avoid unnecessary restart of the autonomous driving system in the manual driving mode, the monitoring of the first heartbeat signal and the second heartbeat signal can be stopped in the manual driving mode, and the restart method of the autonomous driving system proposed in the present invention is executed only when the vehicle starts the autonomous driving mode.

[0063] In some embodiments, the first heartbeat signal and the second heartbeat signal indicate that there is a fault in the autonomous driving system, including at least one of the following: the first heartbeat signal and the second heartbeat signal are abnormal, indicating that there is a fault in the autonomous driving system; the second heartbeat signal is normal and the first heartbeat signal is abnormal, indicating that the adaptation module is abnormal.

[0064] If the first heartbeat signal and the second heartbeat signal are abnormal, there are two possible faults. On the one hand, it may be due to communication blockage between the decision unit and the execution unit, resulting in the adaptation module and the functional module being able to send heartbeat signals, but the execution unit cannot accept them. In this case, it can be considered that there is a fault in the autonomous driving system. On the other hand, it may be due to the crash of the decision unit, resulting in the adaptation module and the functional module not sending heartbeat signals. This situation can also be considered that there is a fault in the autonomous driving system.

[0065] If the second heartbeat signal is normal and the first heartbeat signal is abnormal, it can be considered that there is an abnormality in the adapter module. As to whether the abnormality of the adapter module constitutes an abnormality in the autonomous driving system and whether the system needs to be restarted, it is necessary to further analyze the abnormal cause of the adapter module. For example, if the adapter module has no heartbeat signal because the decision unit does not have the data that needs to be output to the execution unit, it does not constitute an abnormality in the autonomous driving system and there is no need to restart the system. If the decision unit needs to output data to the execution unit and the adapter module does not send a heartbeat signal, it may be that the adapter module is offline. In this case, the autonomous driving system is abnormal and the system needs to be restarted to try to restore the adapter module.

[0066] Figure 3 It is a schematic diagram of the architecture of an autonomous driving system according to an embodiment of the present disclosure.

[0067] like Figure 3 As shown, the execution unit 120 may include a handshake module 121 , a fault detection module 122 , and a restart module 123 .

[0068] The handshake module 121 is used to shake hands with the decision unit 110, and can receive information sent by the decision unit 110, including the first heartbeat signal sent by the adaptation module 111 and the second heartbeat signal sent by the function module 112, and can send an abnormal setting signal to the fault detection module 122 to inform the heartbeat signal of abnormality when the heartbeat signal is abnormal;

[0069] The fault detection module 122 may receive the abnormal setting signal sent by the handshake module 121, and determine whether the autonomous driving system has a fault in combination with other information (such as information sent by the perception state machine 114 in the decision unit 110). If it is determined that a fault exists, the fault detection module 122 may send a signal to the restart module 123 to notify the restart module 123 to restart the autonomous driving system.

[0070] The restart module 123 is responsible for restarting the autonomous driving system. For example, the restart module 123 may be a power management module that implements restart by powering off and then powering on again.

[0071] In some embodiments, the decision unit 110 further includes a perception module 113 .

[0072] The perception module 113 can process sensor data and integrate the sensor data into environmental data required for the decision-making unit to plan autonomous driving control, such as lane line data, road boundaries, obstacle information, etc.

[0073] In some embodiments, the first heartbeat signal includes a perception heartbeat output by a perception module, and the method further includes: receiving status information sent by a perception state machine in the decision unit, wherein the perception state machine sends the status information without receiving the output of the perception module; the first heartbeat signal and the second heartbeat signal indicate that there is a fault in the autonomous driving system, including: the received second heartbeat signal is normal, the first heartbeat signal is abnormal, but the status information is received, indicating that the perception module has no output and there is no fault in the autonomous driving system.

[0074] Whether the perception module 113 outputs data depends on whether the environment in which the vehicle is located has changed and whether the sensor has acquired new data. Therefore, in some scenarios, the perception module 113 may not output data.

[0075] When the sensing module 113 has output, the adaption module 111 can output the sensing heartbeat signal (first heartbeat signal). When the sensing module 113 has no output, the adaption module 111 stops outputting the sensing heartbeat signal, and the handshake module 121 considers that the sensing heartbeat signal is abnormal.

[0076] Therefore, in order to eliminate the abnormal heartbeat caused by the lack of output of the sensing module 113 itself, the decision unit 110 may include a sensing state machine 114 .

[0077] The perception state machine 114 can determine whether the perception module 113 outputs data. When it is determined that the perception module 113 does not output data, the perception state machine 114 can send status information to the execution unit 120 to inform the execution unit 120 that the perception module 113 has no output.

[0078] Since the perception module 113 has no output, the adaptation module 111 stops outputting the perception heartbeat signal (first heartbeat signal), and the execution unit 120 can determine that the first heartbeat signal is abnormal. If in this case, the second heartbeat signal is normal and the status information is received, it indicates that the abnormality of the first heartbeat signal is caused by the lack of output of the perception module 113, and there is no fault in the autonomous driving system and no restart is required.

[0079] In some embodiments, when the duration of not receiving the first heartbeat signal is greater than a first duration threshold, the first heartbeat signal is determined to be abnormal; when the duration of not receiving the second heartbeat signal is greater than a second duration threshold, the second heartbeat signal is determined to be abnormal.

[0080] For example, the handshake module 121 in the execution unit 120 may determine whether the heartbeat signal is normal. To avoid frequent jumps and temporary accidental fluctuations, the handshake module 121 may determine that the first heartbeat signal is abnormal when the duration of not receiving the first heartbeat signal is greater than the first duration threshold, and determine that the second heartbeat signal is abnormal when the duration of not receiving the second heartbeat signal is greater than the second duration threshold. In other words, the heartbeat is lost only when the heartbeat signal continues to lose frames for a period of time.

[0081] It should be noted that, in the solution of the present disclosure, not receiving a heartbeat signal may include not receiving a normal heartbeat signal, and a normal heartbeat signal refers to a heartbeat signal whose sequence value conforms to a periodic variation rule.

[0082] When the handshake module 121 determines that there is an abnormality in the first heartbeat signal and / or the second heartbeat signal, an abnormal setting signal can be sent to the fault detection module 122, so that the fault detection module 122 can determine whether the automatic driving system is faulty based at least on the abnormal setting signal.

[0083] In some embodiments, when the first heartbeat signal is abnormal, the handshake module 121 sends a first abnormal set signal; when the second heartbeat signal is abnormal, the handshake module 121 sends a second abnormal set signal; when both the first heartbeat signal and the second heartbeat signal are abnormal, the handshake module 121 sends a third abnormal set signal.

[0084] The fault detection module 122 can determine whether the automatic driving system has a fault based on the type of abnormal setting signal and other information. Further, the cause and type of the fault can be determined and recorded to facilitate subsequent maintenance.

[0085] In some embodiments, the functional module 112 includes a vehicle status module, which is used to characterize the driving mode of the vehicle.

[0086] The vehicle state module may include a state machine, which may characterize the driving mode of the vehicle, for example, whether the vehicle is currently in manual driving or automatic driving, and further subdivided into a first automatic driving mode and a second automatic driving mode. The first automatic driving mode may be that the vehicle's steering wheel, throttle, and brakes are all automatically controlled, and the second automatic driving mode may be that the throttle and brakes are automatically controlled, and the steering wheel is manually controlled by the driver.

[0087] Compared with other functional modules, the heartbeat signal period of the vehicle status module is shorter. Therefore, this embodiment monitors the second heartbeat signal of the vehicle status module. The heartbeat signal changes more frequently and faster, and the execution unit can also respond more quickly to the abnormality of the heartbeat signal.

[0088] In some embodiments, the method also includes: determining the power-on time of the decision unit; when the power-on time of the decision unit is greater than a third time threshold, determining whether the automatic driving system has a fault based on the first heartbeat signal and the second heartbeat signal.

[0089] Since the heartbeat signal is relatively unstable in the initial stage of power-on of the decision unit and may easily mistakenly trigger the fault judgment of the execution unit, it is possible to determine whether the automatic driving system has a fault based on the first heartbeat signal and the second heartbeat signal when it is determined that the power-on time of the decision unit is greater than the third time threshold.

[0090] For example, if the fault judgment is performed by the fault detection module 122, the fault detection module 122 can determine the power-on time of the decision unit 110, and when the power-on time is less than a third time threshold (for example, 2 minutes), ignore the abnormal set signal sent by the handshake module 121 within the time.

[0091] In some embodiments, the fault detection module 122 may determine that a fault exists in the autonomous driving system based on the first heartbeat signal and the second heartbeat signal when the abnormal setting signal is received continuously for a fifth period of time.

[0092] To avoid occasional communication fluctuations or other reasons that cause abnormal heartbeat signals and thus trigger a restart of the autonomous driving system, the fault detection module 122 can determine that there is a fault in the autonomous driving system based on the first heartbeat signal and the second heartbeat signal after receiving the abnormal set signal and the abnormal set signal continues for a fifth period of time.

[0093] In some embodiments, when the fault detection module 122 determines that there is a fault in the autonomous driving system, it can send a restart signal to the restart module 123 to control the restart module 123 to restart.

[0094] In some embodiments, exiting the autonomous driving mode includes: when it is determined that the autonomous driving system is faulty, after a fourth time period, exiting the autonomous driving mode and restarting the autonomous driving system, wherein, within the fourth time period, a takeover prompt is issued to the driver.

[0095] If the automatic driving system is determined to have a fault, the automatic driving module is immediately exited and the automatic driving system is restarted, which may cause the driver to take over the vehicle in time, thereby causing driving danger. Therefore, in this embodiment, when it is determined that the automatic driving system has a fault, the automatic driving mode can be exited after a fourth time delay, and the automatic driving system can be restarted. In this fourth time period, a takeover prompt can be issued to the driver so that the driver can manually operate the vehicle to avoid risks.

[0096] Furthermore, in some embodiments, after a takeover prompt is issued to the driver, the autonomous driving mode can be exited and the autonomous driving system can be restarted after receiving a response instruction.

[0097] After confirming that the driver has taken over the operation of the vehicle, the automatic driving mode is exited to avoid the driver failing to respond to the takeover prompt in time. Correspondingly, if no response command is received, the exit from the automatic driving mode is aborted and the automatic driving system is not restarted.

[0098] In some embodiments, the fault detection module 122 may send a restart signal to the restart module 123 to control the restart module to restart.

[0099] After the fault detection module 122 sends a restart signal, the restart module 123 may delay for a fourth period of time before restarting the automatic driving system.

[0100] It should be noted that before the restart module 123 performs the restart operation, the fault detection module 122 may also send an instruction to the handshake module 121 to exit the automatic driving mode. Based on the abnormal setting signal and the instruction to exit the automatic driving mode, the handshake module 121 may release the handshake communication with the decision unit 110 before the restart module 123 performs the restart operation, thereby exiting the automatic driving mode. In addition, the handshake module 121 (or the fault detection module 122) may also notify the human-computer interaction module so that the human-computer interaction module prompts the driver to manually take over the vehicle.

[0101] In some embodiments, the method further includes: when there is a fault in the autonomous driving system, when it is monitored that the first heartbeat signal and the second heartbeat signal return to normal, it indicates that the fault of the autonomous driving system is cleared.

[0102] When it is determined that there is a fault in the automatic driving system, if it is monitored that the first heartbeat signal and the second heartbeat signal return to normal, it can be considered that the fault has been cleared.

[0103] Specifically, if the heartbeat signal returns to normal before restarting the autonomous driving system, the restart of the autonomous driving system can be stopped. If the heartbeat signal returns to normal after the autonomous driving system is restarted, the abnormal setting signal can be initialized to avoid repeated restarts.

[0104] For example, after the handshake module 121 detects that the heartbeat signal returns to normal and lasts for a period of time, it can clear the abnormal setting signal sent, exit the handshake release state, and clear the notification information to the human-computer interaction module.

[0105] In some embodiments, the method further includes: determining whether there is a driver in the driving seat of the vehicle; and if there is no driver, stopping the determination of whether there is a fault in the automatic driving system.

[0106] Some automated driving modes can be performed without a person in the vehicle, such as Parking Remote Assist (PRA) and Remote Assist System (RAS).

[0107] When using these autonomous driving functions, since there is no driver in the vehicle, the driver cannot take over the vehicle. In this case, the judgment on whether the autonomous driving system has a fault can be stopped, thereby avoiding no one taking over the vehicle operation after the autonomous driving system restarts.

[0108] For example, under the PRA function and RAS function, if the autonomous driving system restarts, the vehicle cannot be powered off remotely, and the driver needs to get in the vehicle to recover. Therefore, it is necessary to avoid system restart in these two autonomous driving modes.

[0109] In some embodiments, in the absence of a driver and a determination is made that the autonomous driving system is faulty, a remote notification may be issued to the vehicle owner.

[0110] A remote notification is sent to the car owner to indicate that the autonomous driving system may have a fault and needs to be restarted, requiring the driver to manually take over the vehicle.

[0111] In some embodiments, log information may be saved before the autonomous driving system is restarted.

[0112] The saved log information can be used by technicians to determine the cause of failure of the autonomous driving system, and can also be used for subsequent technical optimization.

[0113] If the state information sent by the state machine 114 to the fault detection module 122 is saved in the log information, it indicates that the perception module has no data output and the autonomous driving system has no fault; if there is only an abnormal setting signal in the log information, it can be considered that there is a communication fault between the decision unit and the execution unit. The cause of the communication fault may be communication congestion or the decision unit crashes.

[0114] In some embodiments, after the autonomous driving system is restarted, the autonomous driving function can be enabled if both the first heartbeat signal and the second heartbeat signal are normal.

[0115] After the autonomous driving system restarts and returns to normal, the user can be notified that the fault has been eliminated and the autonomous driving function can be used.

[0116] In the solution disclosed in the present invention, by restarting the autonomous driving system, the crashed decision-making unit returns to normal after restarting, and the communication blockage between the decision-making unit and the execution unit can be eliminated, thereby restoring the communication between the decision-making unit and the execution unit, ensuring that the autonomous driving function can be re-entered within this power-on cycle, thereby improving the user's driving experience.

[0117] Corresponding to the embodiment of the restart method of the autonomous driving system disclosed in the present invention, the present invention also provides an embodiment of a corresponding restart device of the autonomous driving system.

[0118] See also Figure 4 , Figure 4 is a block diagram of a restart device of an automatic driving system in one embodiment of the present disclosure. The automatic driving system includes a decision unit and an execution unit, and the device is applied to the execution unit, such as Figure 4 As shown, the restart device of the automatic driving system includes:

[0119] A monitoring module 410, configured to monitor a first heartbeat signal sent by an adaptation module in the decision unit, and to monitor a second heartbeat signal sent by a functional module in the decision unit;

[0120] The restart module 420 is configured to exit the automatic driving mode and restart the automatic driving system when the first heartbeat signal and the second heartbeat signal indicate that there is a fault in the automatic driving system.

[0121] In some embodiments, the first heartbeat signal and the second heartbeat signal indicate that there is a fault in the autonomous driving system, including at least one of the following: the first heartbeat signal and the second heartbeat signal are abnormal, indicating that there is a fault in the autonomous driving system; the second heartbeat signal is normal and the first heartbeat signal is abnormal, indicating that the adaptation module is abnormal.

[0122] In some embodiments, the first heartbeat signal includes a perception heartbeat output by a perception module, and the device is further configured to: receive status information sent by a perception state machine in the decision unit, wherein the perception state machine sends the status information without receiving the output of the perception module; the first heartbeat signal and the second heartbeat signal indicate that there is a fault in the autonomous driving system, including: the received second heartbeat signal is normal, the first heartbeat signal is abnormal, but the status information is received, indicating that the perception module has no output and there is no fault in the autonomous driving system.

[0123] In some embodiments, when the duration of not receiving the first heartbeat signal is greater than a first duration threshold, the first heartbeat signal is determined to be abnormal; when the duration of not receiving the second heartbeat signal is greater than a second duration threshold, the second heartbeat signal is determined to be abnormal.

[0124] In some embodiments, the device is further configured to: determine the power-on time of the decision unit; and when the power-on time of the decision unit is greater than a third time threshold, determine whether the autonomous driving system has a fault based on the first heartbeat signal and the second heartbeat signal.

[0125] In some embodiments, exiting the autonomous driving mode includes: when it is determined that the autonomous driving system is faulty, after a fourth time period, exiting the autonomous driving mode and restarting the autonomous driving system, wherein, within the fourth time period, a takeover prompt is issued to the driver.

[0126] In some embodiments, the device is further configured to: when there is a fault in the autonomous driving system, when it is monitored that the first heartbeat signal and the second heartbeat signal have returned to normal, indicate that the fault in the autonomous driving system has been cleared.

[0127] In some embodiments, the functional module includes a vehicle status module, and the vehicle status module is used to characterize the driving mode of the vehicle.

[0128] In some embodiments, the device is further configured to: determine whether there is a driver in the driving seat of the vehicle; and if there is no driver, stop judging whether there is a fault in the automatic driving system.

[0129] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0130] An embodiment of the present disclosure further proposes an electronic device, comprising: a processor and a memory; the memory is used to store a computer program; and the processor is used to execute a restart method of an autonomous driving system as in any of the above embodiments by calling the computer program.

[0131] An embodiment of the present disclosure further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a restart method for an autonomous driving system as described in any of the above embodiments.

[0132] An embodiment of the present disclosure further provides a computer program product, including a computer program, wherein when the computer program is executed by a processor, the method described in any of the above embodiments is implemented.

[0133] Figure 5 1 is a schematic block diagram of a restart device 500 for an autonomous driving system according to an embodiment of the present disclosure. For example, the device 500 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0134] Reference Figure 5 , the device 500 may include one or more of the following components: a processing component 502 , a memory 504 , a power component 506 , a multimedia component 508 , an audio component 510 , an input / output (I / O) interface 512 , a sensor component 514 , and a communication component 516 .

[0135] The processing component 502 generally controls the overall operation of the device 500, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 502 may include one or more processors 520 to execute instructions to complete all or part of the steps of the restart method of the autonomous driving system described above. In addition, the processing component 502 may include one or more modules to facilitate the interaction between the processing component 502 and other components. For example, the processing component 502 may include a multimedia module to facilitate the interaction between the multimedia component 508 and the processing component 502.

[0136] The memory 504 is configured to store various types of data to support operations on the device 500. Examples of such data include instructions for any application or method operating on the device 500, contact data, phone book data, messages, pictures, videos, etc. The memory 504 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk, or optical disk.

[0137] The power supply component 506 provides power to the various components of the device 500. The power supply component 506 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the device 500.

[0138] The multimedia component 508 includes a screen that provides an output interface between the device 500 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 508 includes a front camera and / or a rear camera. When the device 500 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0139] The audio component 510 is configured to output and / or input audio signals. For example, the audio component 510 includes a microphone (MIC), and when the device 500 is in an operating mode, such as a call mode, a recording mode, and a speech recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 504 or sent via the communication component 516. In some embodiments, the audio component 510 also includes a speaker for outputting audio signals.

[0140] I / O interface 512 provides an interface between processing component 502 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to, a home button, a volume button, a start button, and a lock button.

[0141] The sensor assembly 514 includes one or more sensors for providing various aspects of status assessment for the device 500. For example, the sensor assembly 514 can detect the open / closed state of the device 500, the relative positioning of components, such as the display and keypad of the device 500, and the sensor assembly 514 can also detect the position change of the device 500 or a component of the device 500, the presence or absence of user contact with the device 500, the orientation or acceleration / deceleration of the device 500, and the temperature change of the device 500. The sensor assembly 514 may include a proximity sensor configured to detect the presence of a nearby object without any physical contact. The sensor assembly 514 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 514 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0142] The communication component 516 is configured to facilitate wired or wireless communication between the device 500 and other devices. The device 500 can access a wireless network based on a communication standard, such as WiFi, 2G, 3G, 4G LTE, 5G NR, or a combination thereof. In an exemplary embodiment, the communication component 516 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 516 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0143] In an exemplary embodiment, the device 500 can be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to execute the above-mentioned restart method of the autonomous driving system.

[0144] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 504 including instructions, and the instructions can be executed by the processor 520 of the device 500 to complete the restart method of the above-mentioned automatic driving system. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0145] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the disclosure disclosed herein. The present disclosure is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0146] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

[0147] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprises a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0148] The method and device provided in the embodiments of the present disclosure are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present disclosure. The description of the above embodiments is only used to help understand the method of the present disclosure and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present disclosure, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on the present disclosure.

Claims

1. A method for restarting an automatic driving system, characterized in that: The automatic driving system includes a decision unit and an execution unit, and the method is applied to the execution unit. The method includes: Monitoring a first heartbeat signal sent by an adaptation module in the decision unit, and monitoring a second heartbeat signal sent by a functional module in the decision unit; When the first heartbeat signal and the second heartbeat signal indicate that there is a fault in the automatic driving system, exit the automatic driving mode and restart the automatic driving system.

2. The method according to claim 1, characterized in that: The first heartbeat signal and the second heartbeat signal indicate that the automatic driving system has a fault, including at least one of the following: The first heartbeat signal and the second heartbeat signal are abnormal, indicating that there is a fault in the automatic driving system; The second heartbeat signal is normal and the first heartbeat signal is abnormal, indicating that the adapter module is abnormal.

3. The method according to claim 1, characterized in that The first heartbeat signal includes a sensed heartbeat output by a sensing module, The method further comprises: receiving state information sent by a perception state machine in the decision unit, wherein the perception state machine sends the state information without receiving an output of the perception module; The first heartbeat signal and the second heartbeat signal indicate that there is a fault in the autonomous driving system, including: the received second heartbeat signal is normal, the first heartbeat signal is abnormal, but the status information is received, indicating that the perception module has no output and there is no fault in the autonomous driving system.

4. The method according to claim 1, characterized in that: In a case where the duration of not receiving the first heartbeat signal is greater than a first duration threshold, determining that the first heartbeat signal is abnormal; When the duration during which the second heartbeat signal is not received is greater than a second duration threshold, it is determined that the second heartbeat signal is abnormal.

5. The method according to claim 1, characterized in that The method further comprises: determining a power-on duration of the decision unit; When the power-on duration of the decision unit is greater than a third duration threshold, it is determined whether the automatic driving system has a fault according to the first heartbeat signal and the second heartbeat signal.

6. The method according to claim 1, characterized in that The exiting the automatic driving mode includes: When it is determined that there is a fault in the automatic driving system, the automatic driving mode is exited after a fourth time period, and the automatic driving system is restarted, wherein a takeover prompt is issued to the driver during the fourth time period.

7. The method according to claim 1, characterized in that The method further comprises: In the case that there is a fault in the automatic driving system, when it is monitored that the first heartbeat signal and the second heartbeat signal return to normal, it indicates that the fault of the automatic driving system is cleared.

8. The method according to claim 1, characterized in that The functional module includes a vehicle status module, and the vehicle status module is used to characterize the driving mode of the vehicle.

9. The method according to claim 1, characterized in that: The method further comprises: Determine whether there is a driver in the driving seat of the vehicle; In the absence of a driver, the determination of whether the automatic driving system is faulty is stopped.

10. A restart device for an automatic driving system, characterized in that: The automatic driving system includes a decision unit and an execution unit, and the device is applied to the execution unit, and the device includes: A monitoring module configured to monitor a first heartbeat signal sent by the adaptation module in the decision unit, and to monitor a second heartbeat signal sent by the function module in the decision unit; The restart module is configured to exit the automatic driving mode and restart the automatic driving system when the first heartbeat signal and the second heartbeat signal indicate that there is a fault in the automatic driving system.

11. An electronic device, characterized in that: include: Processor, memory; The memory is used to store computer programs; The processor is used to execute the restart method of the automatic driving system as described in any one of claims 1-9 by calling the computer program.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the restart method of the automatic driving system described in any one of claims 1 to 9 is implemented.

Images