Risk management method based on autonomous driving, readable storage medium and program product

Abstract

The present invention provides a risk management method based on autonomous driving, a readable storage medium and a program product, which are applied to a vehicle, wherein the vehicle is deployed with a highly autonomous driving HAD main control system and a HAD auxiliary control system for controlling the autonomous driving of the vehicle, and the functional safety level of the HAD main control system is higher than that of the HAD auxiliary control system; the method includes: when it is determined that the current operating environment of the vehicle is in the design operating domain of the L3 conditional autonomous driving system, preventing the vehicle from changing lanes within the user reaction time after the current control system controlling the autonomous driving of the vehicle is switched from the HAD main control system to the HAD auxiliary control system; when no user takeover instruction is received, if the operating time of the HAD auxiliary control system is greater than the user reaction time, executing a minimum risk strategy matching the current operating environment.

Description

Technical Field

[0001] The present invention relates to the automotive field, and in particular to a risk management method based on autonomous driving, a readable storage medium, and a program product. Background Art

[0002] In intelligent driving scenarios, the core purpose of a minimum risk maneuver (MRM) is to use controlled maneuvers to move the vehicle from a dangerous state to a low-risk state when the vehicle's autonomous driving system fails, ensuring occupant and road safety and meeting the risk control requirements of functional safety standards such as ISO 26262. Meanwhile, for Level 3 conditional autonomous driving systems, the rational design of a Highly Automated Driving (HAD) primary and secondary control systems to implement this minimum risk strategy while maintaining safety and cost remains a difficult challenge within the industry. Summary of the Invention

[0003] In view of this, the present invention provides a risk management method based on autonomous driving, a readable storage medium and a program product to address the deficiencies in the related art.

[0004] Specifically, this specification is implemented through the following technical solutions:

[0005] According to a first aspect of the present specification, a vehicle component switching method is provided, which is applied to a vehicle, wherein the vehicle is deployed with a highly automated driving (HAD) master control system and a HAD auxiliary control system for controlling the autonomous driving of the vehicle, wherein the functional safety level of the HAD master control system is higher than that of the HAD auxiliary control system; the method comprises:

[0006] If it is determined that the current operating environment of the vehicle is within the design operating domain of the L3 conditional autonomous driving system, preventing the vehicle from changing lanes within the user reaction time after the current control system controlling the autonomous driving of the vehicle switches from the HAD primary control system to the HAD secondary control system;

[0007] In the case where no user takeover instruction is received, if the operating time of the HAD auxiliary control system is greater than the user reaction time, a minimum risk strategy matching the current operating environment is executed.

[0008] According to a second aspect of this specification, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the steps of the method described in the first aspect are implemented.

[0009] According to a third aspect of this specification, a computer program product includes a computer program / instruction, which implements the steps of the method described in the first aspect when executed by a processor.

[0010] The vehicle in the present application can be used to control the highly automated driving HAD main control system and HAD auxiliary control system of the autonomous driving of the vehicle. When it is determined that the current operating environment of the above-mentioned vehicle is in the design operational domain (Operational Design Domain, ODD) of the L3 conditional autonomous driving system, after the current control system controlling the autonomous driving of the vehicle is switched from the above-mentioned HAD main control system to the above-mentioned HAD auxiliary control system, the vehicle can be prevented from changing lanes within the user reaction time after the switch. At the same time, if the vehicle does not receive the user takeover instruction within the user reaction time, and the operating time of the HAD auxiliary control system is greater than the above-mentioned user reaction time, then the minimum risk strategy matching the above-mentioned current operating environment can be executed. Among them, since the functional safety level of the above-mentioned HAD main control system is higher than that of the above-mentioned HAD auxiliary control system, the HAD auxiliary control system can simplify the redundant design to reduce costs compared with the HAD main control system; at the same time, when the current control system of the vehicle is switched to the HAD auxiliary control system, by preventing the vehicle from changing lanes within the user's reaction time, the user can be provided with a period of preparation time sufficient to understand the situation and take over the vehicle, and it can also avoid the vehicle from arbitrarily changing lanes based on the less safe HAD auxiliary control system before the user reacts, causing additional risks. Even if the user does not react in time within the user's reaction time, the above-mentioned vehicle can also execute the minimum risk strategy that matches the above-mentioned current operating environment, thereby ensuring the safety of the vehicle to the greatest extent. In other words, this manual establishes a complete risk management mechanism for the HAD main control system and HAD auxiliary control system under the L3 conditional autonomous driving system, thereby taking into account the advantages of low cost and high safety. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] To more clearly illustrate the technical solution of the present invention, the following briefly introduces the drawings required for use in the embodiments or descriptions of the prior art. Obviously, the drawings described below are only some embodiments of the present invention, and those skilled in the art can derive other drawings based on these drawings without inventive effort.

[0012] Figure 1 This is a schematic diagram of the architecture of a risk management system based on autonomous driving, as shown in an embodiment disclosed in the present invention;

[0013] Figure 2 This is a flow chart of a risk management method based on autonomous driving, shown in an embodiment disclosed in the present invention;

[0014] Figure 3 is a schematic diagram of a HAD master control system shown in an embodiment disclosed in the present invention;

[0015] Figure 4 is a schematic diagram of a HAD auxiliary control system shown in an embodiment disclosed in the present invention;

[0016] Figure 5 is a flowchart of another risk management method based on autonomous driving according to an embodiment disclosed in the present invention;

[0017] Figure 6 is a schematic structural diagram of an electronic device shown in an embodiment of the present invention;

[0018] Figure 7 4 is a block diagram of a risk management device based on autonomous driving shown in an embodiment of the present invention. DETAILED DESCRIPTION

[0019] Exemplary embodiments are described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, like numbers in different figures represent like or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all possible embodiments consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with certain aspects of the present invention.

[0020] The terms used in this invention are for the purpose of describing specific embodiments only and are not intended to limit the invention. The singular forms "a," "the," and "the" used in this invention and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0021] It should be understood that although the terms "first," "second," "third," etc. may be used in the present invention to describe various information, such information should not be limited to these terms. These terms are merely used to distinguish information of the same type from one another. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information, without departing from the scope of the present invention. Depending on the context, the term "if" as used herein may be interpreted as "when," "when," or "in response to determining."

[0022] An embodiment of the risk management method based on autonomous driving of the present invention is described in detail below with reference to the accompanying drawings.

[0023] Figure 1 This is a schematic diagram of the architecture of a vehicle component switching system shown in the embodiment disclosed in this specification. Figure 1As shown, the system may include a vehicle 10 , a HAD main control system 11 and a HAD auxiliary control system 12 .

[0024] The vehicle 10 refers to an intelligent car that integrates L3 conditional autonomous driving functions. Its core architecture includes "a full HAD main control system and a general HAD auxiliary control system", that is, a double-layer redundant design of the HAD main control system 11 and the HAD auxiliary control system 12. During normal operation, the vehicle relies on the HAD main control system 11 to achieve full-scene perception and decision-making, while the HAD auxiliary control system 12, as a degraded redundant module, only takes over basic control when the HAD main control system 11 fails. Through a collaborative mechanism, it ensures that even if the HAD main control system 11 fails, such as when the function is turned off or blocked, it can still trigger a minimum risk strategy based on the perception information of the HAD main control system 11 or its own limited capabilities, and ultimately achieve the goal of safe parking. Among them, the HAD main control system 11 and the HAD auxiliary control system 12 can establish a communication channel with each other so that relevant data can be exchanged with each other when switching the current control system; the above-mentioned vehicle 10 can be a fuel vehicle, a hybrid vehicle, an electric vehicle, etc. based on different power types and with autonomous driving capabilities, and this specification does not limit this.

[0025] As the "full HAD master control system," the HAD master control system 11 maintains full-range perception coverage even when operating independently, and can autonomously perform MRM tasks such as pull-over parking. Its single system functional safety level (ASIL) reaches ASIL B or above. Under normal circumstances, the HAD master control system 11 provides full control of the vehicle. Even if the HAD auxiliary control system 12 is suspended or fails, its built-in high-redundancy design ensures the vehicle can fully complete the functions required for autonomous driving scenarios, thereby meeting high reliability requirements. However, this also incurs higher hardware costs, such as the development of high-performance chips, multi-sensor configuration, and development and verification complexity.

[0026] Below Figure 3 For example, assuming that the running vehicle in the figure is being intelligently driven by the HAD main control system 11 in the L3 conditional automatic driving system, the HAD main control system 11 can achieve 360-degree full-range perception coverage of the driving environment through sensors in all directions, and through object recognition and analysis of targets in each direction, it can meet the driving needs of complex driving scenarios such as cities.

[0027] As a "general HAD auxiliary control system", the HAD auxiliary control system 12 has significantly weaker perception capabilities and computing power configuration than the main control system, and is unable to independently achieve full-range environmental perception with a high safety level (i.e., ASIL B and above). In other words, the functional safety level of the HAD main control system 11 in this specification is higher than that of the above-mentioned HAD auxiliary control system 12. The main function of the auxiliary control system is to take over vehicle control based on limited perception information, such as shared data from the HAD main control system 11 or its own basic sensors, when the main control fails, and to limit the execution of operations such as lane changing within the user's reaction time, while relying on its own perception results to trigger MRM; its design simplifies hardware redundancy and safety verification strength, and its cost is lower than that of the HAD main control system 11, but it needs to cooperate with the HAD main control system 11 to enable the vehicle to meet the overall ASIL level requirements.

[0028] Below Figure 4 As described above, it is assumed that the running vehicle in part (a) of the figure is being intelligently driven by the HAD auxiliary control system 12 in the L3 conditional autonomous driving system, and a limited perception coverage is achieved through a combination of sensors in five directions around the vehicle (such as the front, left front, right front, left rear, and right rear directions), such as the 5R1V (5Radar + 1Vision, i.e., 5 radars + 1 camera) system. The functional safety level ASIL B requirements are met independently only in each direction. The core of its design lies in the redundant perception and independent control capabilities for key directions, such as the main direction of vehicle travel and adjacent lanes. For example, by cross-verifying the target position and motion state through multiple radars, it is ensured that even if the main HAD system fails, the HAD auxiliary control system 12 can still perform lane change avoidance or emergency braking based on local high-confidence data. It is suitable for scenarios where multi-directional risks such as pedestrians crossing urban roads and blind spots at intersections need to be taken into account. Of course, the HAD auxiliary control system 12 can be further streamlined to the system architecture shown in the operating vehicle in part (b) of the figure. In this case, the HAD auxiliary control system 12 focuses on the vehicle's core driving directions, such as the sensor combination of the three target directions: front, left rear, and right rear. For example, a streamlined sensor configuration 3R1V (3Radar + 1Vision, i.e., three radars + one camera) system is used to achieve limited perception coverage, meeting the ASIL B safety level only in special scenarios such as highways. Specifically, the forward radar and camera fusion can perceive vehicles in the main lane and adjacent lanes, and the lateral radar monitors blind spots, ensuring redundant control capabilities for high-speed following and lane changes. However, its perception range and direction are significantly limited, and it cannot cope with complex risks such as sudden pedestrian crossings in urban conditions and multi-directional interactions on unstructured roads. Therefore, it is limited to closed roads such as highways, relying on the single road conditions and low pedestrian probability to avoid safety vulnerabilities caused by perception blind spots.

[0029] Those skilled in the art will understand that the solution of this specification is not applicable to the L4 highly automated driving system corresponding to the L3 conditional automated driving system. The reason is that the latter is strictly limited to operating within a preset design operating domain and is required to achieve full autonomous control within the design operating domain without human takeover. Its system redundancy design and functional safety level have covered the fault response capabilities of all expected scenarios. Therefore, even if the HAD main control system in the L4 highly automated driving system fails, the HAD auxiliary control system with the same performance as the HAD main control system can directly complete safe parking without relying on the driver to take over. As a result, there is no so-called user reaction time and MRM and other related concepts and requirements.

[0030] Figure 2 This is a flow chart of a risk management method based on autonomous driving, shown in an exemplary embodiment disclosed in the present invention. The method is applied to a vehicle, wherein the vehicle is equipped with a highly autonomous driving HAD main control system and a HAD auxiliary control system for controlling the autonomous driving of the vehicle. The functional safety level of the HAD main control system is higher than that of the HAD auxiliary control system. Specifically, the method may include the following steps:

[0031] Step 202: When it is determined that the current operating environment of the vehicle is in the design operating domain of the L3 conditional autonomous driving system, the vehicle is prevented from changing lanes within the user reaction time after the current control system controlling the autonomous driving of the vehicle is switched from the HAD main control system to the HAD auxiliary control system.

[0032] The prerequisite for the operation of the L3 conditional autonomous driving system of the above-mentioned vehicle is that the vehicle is within the corresponding design operating domain. When the L3 conditional autonomous driving system is running, the above-mentioned HAD main control system or the above-mentioned HAD auxiliary control system can be selected as the current control system for controlling the autonomous driving of the above-mentioned vehicle. Here, in the case where the current control system is switched from the above-mentioned HAD main control system to the above-mentioned HAD auxiliary control system, the timing starts from the switching. Within the preset user reaction time, for example, 10 seconds, the above-mentioned HAD auxiliary control system can control and prevent the above-mentioned vehicle from changing lanes.

[0033] Among them, the above-mentioned design operation domain may include at least any of the following constraints: 1. The above-mentioned vehicle is traveling in a low-risk urban area that meets the low-risk conditions. The low-risk conditions may include whether the city where the vehicle is located meets the characteristics of "low pedestrian interference", such as the pedestrian intrusion path probability of the roundabout or intersection in the city is lower than the preset probability threshold. Of course, the pedestrian intrusion path probability depends on the data measurement and summary of the operation demonstration area of ​​the corresponding city, that is, the corresponding city shall liberate the accessible L3 level autonomous driving operation area according to the conditions; 2. The driving speed of the above-mentioned vehicle is lower than the safety speed threshold corresponding to the current road scene type, forcing Require vehicles to travel at a low speed no higher than the maximum speed of the corresponding scenario at urban intersections or highway merging scenarios, that is, to reduce the impact energy of sudden situations such as pedestrians crossing and collisions with vehicles in adjacent lanes by limiting the speed, while leaving redundant time for the limited perception and decision-making of the above-mentioned HAD auxiliary control system to avoid accidents due to response delays; 3. The key driving scene positions in the navigation map of the above-mentioned vehicle meet the first functional safety level, which requires the vehicle to operate on roads equipped with high-precision maps or perception fusion navigation, ensuring that the data integrity and reliability of key driving scene position information in the map, such as lane change points, intersection features, etc., meet ASIL Level B, in which, through the coordination of maps and real-time perception, the insufficient local perception capabilities of the HAD auxiliary control system can be compensated to ensure the safety of path planning; 4. The signal light detection capability of the above-mentioned vehicles meets the second functional safety level, which requires the HAD auxiliary control system to have the ability to recognize traffic lights to reach ASIL B, such as cross-verifying the signal light timing stored in the map with the real-time perception results of the vehicle. For example, the map prompts the remaining time of the green light, and the HAD auxiliary control system improves the image captured by the camera to verify the actual light color, ultimately ensuring that it can still reliably respond to traffic signals when the sensor is limited to avoid running red lights by mistake.

[0034] Those skilled in the art will understand that, when determining the specific content of the above-mentioned design operating domain, the vehicle needs to meet each constraint condition to determine that its current operating environment is within the design operating domain of the L3 conditional autonomous driving system. For the L3 operating scenario, the above-mentioned collaborative constraint method can reduce the capacity burden of the auxiliary control system in complex environments and ensure the safety boundary.

[0035] In addition, the triggering condition for the current control system to switch from the HAD main control system to the HAD auxiliary control system can be determined by the actual situation of the HAD main control system, thereby ensuring the flexibility of the control system switching operation.

[0036] In one embodiment, when it is determined that the working state of the above-mentioned HAD main control system is abnormal, the current control system of the above-mentioned vehicle automatic driving can be controlled to switch from the above-mentioned HAD main control system to the above-mentioned HAD auxiliary control system. Among them, the HAD main control system can confirm the fault type and impact range based on its own self-test unit or independent safety monitor. If it is determined that the safety-critical function is degraded due to irrecoverable errors such as hardware damage or the perception coverage rate is lower than the threshold, it can be determined that the working state of the HAD main control system is abnormal, and a switching request is sent to the vehicle controller or the HAD auxiliary control system; or, the built-in diagnostic module of the vehicle controller or the HAD auxiliary control system monitors the operating health of the main control system in real time, and once an abnormal signal is detected, the control system switching process is immediately triggered. During the switching process, the HAD main control system can freeze the current control instructions and synchronize status information such as vehicle speed and heading angle to the HAD auxiliary control system, and then the HAD auxiliary control system takes over the vehicle based on the preloaded degradation control algorithm and prevents the vehicle from changing lanes to maintain the basic control capability of the vehicle and prevent the risk of loss of control.

[0037] In the above-mentioned degradation control algorithm, the so-called effect of preventing the vehicle from changing lanes can be achieved by combining one or more strategies among a variety of means. For example: 1. Dynamically set the steering wheel angle limit threshold according to the current vehicle speed and lane curvature, that is, calculate the maximum allowable steering wheel angle threshold in real time based on the current vehicle speed and lane curvature. For example, on a high-speed straight road section with low curvature, limit the steering angle change rate to prevent sudden lane changes; on a curve with high curvature, appropriately relax the threshold to maintain trajectory tracking; 2. Determine the lateral acceleration safety threshold of the vehicle according to the current vehicle speed, that is, set the lateral acceleration upper limit according to the vehicle speed. If the control instruction of the HAD auxiliary control system causes the actual acceleration to approach the threshold, intervention can be triggered, such as torque superposition of reverse torque or forced deceleration, to avoid the risk of skidding due to aggressive steering; 3. Generate a virtual lane boundary of the current lane so that the vehicle can trigger an out-of-bounds correction operation when it deviates from the current lane. That is, using the limited perception data of the auxiliary control system, such as the image data of the lane line recognized by the monocular camera, or the high-precision map information, a virtual boundary is generated in the current lane of the above-mentioned vehicle, such as a line segment of ±0.5 meters from the lane center line, and the lateral deviation between the vehicle heading and the boundary is calculated in real time through the preset model predictive control. If the deviation exceeds the preset tolerance, the correction logic is activated, and the steering wheel is automatically fine-tuned to return the vehicle to the center of the lane, while suppressing the lane change request initiated by the system.

[0038] It is understandable that the core purpose of the above-mentioned prevention of vehicle lane changes is to balance the path stability and flexibility under degraded control, avoid instability caused by the aggressive operation of the HAD auxiliary control system, and ultimately ensure the safety of the vehicle. However, for emergency targets that need to be avoided immediately, such as obstacles, pedestrians or out-of-control vehicles that suddenly appear on the driving path, this specification scheme can introduce an emergency obstacle avoidance mechanism in a targeted manner, that is, after the HAD auxiliary control system takes over, it is allowed to temporarily lift the lane change restriction and perform emergency lane change operations. Specifically, through the limited perception capabilities of the HAD auxiliary control system, such as forward radar and cameras, or the effective data remaining in the HAD main control system, such as the pre-fault fusion perception results, the collision risk target in the lane can be detected in real time. When the collision risk target meets the preset emergency obstacle avoidance conditions, it can be used as an emergency obstacle avoidance target, and the vehicle is temporarily allowed to change lanes to avoid the emergency obstacle avoidance target. Among them, the above-mentioned emergency obstacle avoidance conditions may include but are not limited to: 1. The collision risk target is a dynamic obstacle such as a pedestrian or vehicle or a static obstacle such as a fallen rock, and the expected collision time with the vehicle is less than the minimum collision threshold; 2. It is judged through the side radar or camera that there is sufficient space in the adjacent lane and there is no continuous high-speed approaching vehicle; 3. The lateral control capability of the HAD auxiliary control system has been verified and available, for example, the steering actuator corresponding to the HAD auxiliary control system is in normal status and the lane line recognition confidence meets the standard.

[0039] Once the emergency obstacle avoidance conditions are met, the HAD auxiliary control system can immediately activate the corresponding module, temporarily cancel the lane change prevention strategy, and generate an emergency lane change trajectory, thereby giving the HAD auxiliary control system the risk avoidance capability in key scenarios and reducing preventable collisions. If the risk is eliminated after the lane change, the lane change prevention strategy can be reactivated until the user's reaction time ends or the subsequent MRM is triggered. Of course, in special circumstances, if the emergency lane change fails, such as a vehicle suddenly appears in the adjacent lane, the lane change can be immediately terminated and a combination strategy of emergency braking and lane keeping can be triggered to minimize the collision energy and maintain the safety of the above vehicles. In short, regardless of whether the obstacle avoidance is successful or not, the HAD auxiliary control system can re-time the user's reaction time after the emergency operation. If it still does not take over after the timeout, the MRM that matches the current operating environment will be executed.

[0040] Step 204 : When no user takeover instruction is received, if the operating time of the HAD auxiliary control system is greater than the user reaction time, a minimum risk strategy matching the current operating environment is executed.

[0041] If the driver fails to take control of the vehicle within the aforementioned user response time, and the HAD auxiliary control system continues to operate for longer than that time, an MRM adapted to the current environment is triggered. This step bridges the gap between the auxiliary control system's functional safety level and the primary control system by dynamically matching the MRM to the current operating environment's constraints, ensuring safe driving even with limited redundant system capabilities.

[0042] The triggering conditions and judgment logic of the above-mentioned user takeover command can be further refined to introduce multi-modal takeover signal sources and verification rules to improve the reliability and response efficiency of driver intervention and reduce the probability of false triggering or missed detection. Specifically, it is divided into a continuous torque exceeding threshold signal detected by the vehicle's steering wheel torque sensor, and an emergency takeover trigger signal received by the vehicle's on-board human-computer interaction device. For the former, assuming that the torque value applied by the driver to the steering wheel continuously exceeds the preset torque threshold, for example, ≥2 N·m and the duration is greater than the debounce period, for example, 0.5 seconds, then the HAD auxiliary control system can determine that the driver actively intends to take over; for the latter, assuming that the driver generates a signal through a physical button with an anti-mistouch design, a voice command (such as) or a touch screen control, then the HAD auxiliary control system can also determine that the driver actively intends to take over. In short, the HAD auxiliary control system 12 can respond to the user's takeover command and allow the above-mentioned vehicle to change lanes. The driver can directly control the vehicle's heading through the steering wheel, and the system maintains longitudinal control until it is fully taken over. It is worth mentioning that all the above takeover commands can be verified to ensure legitimacy through multiple levels of verification such as signal source authentication and timing consistency analysis. Alternatively, if the two signals are triggered at the same time, the HAD auxiliary control system can give the emergency takeover signal the highest priority and force the vehicle into manual driving mode.

[0043] At the same time, when the user takeover command is received, the HAD auxiliary control system will transfer the vehicle control to the user. At the same time, it can also display the triggering reason of the current control system switch through the central control screen, voice broadcast, etc., so that the driver can understand the current situation as soon as possible after taking over the vehicle and deal with it in a targeted manner.

[0044] Regarding the above-mentioned minimum risk strategy, as a fallback strategy for the HAD auxiliary control system when the user fails to take over the vehicle in time within the user's reaction time, it can be combined with scenario adaptability. The following multi-level collaborative strategy is defined to ensure safe state transfer within the current operating environment and the capabilities of the HAD auxiliary control system:

[0045] 1. Slow down and stop the vehicle in the current lane based on the deceleration strategy. The HAD auxiliary control system can reduce the speed in stages through the longitudinal control module to maintain continuous deceleration. If the current lane is a high-speed overtaking lane or a no-parking zone, it can give priority to gradually shifting to the right lane.

[0046] 2. Identify and locate emergency parking lanes or compliant shoulder areas and replan the path for pullover parking. Based on pre-stored shoulder information on high-precision maps or real-time vehicle perception data, such as camera recognition of shoulder markings and radar detection of obstacles, the nearest parking area with ample space can be selected. In particular, if a local path was generated before the HAD main control system failed, the HAD auxiliary control system can directly call it and downgrade the execution, such as reducing trajectory tracking accuracy requirements. Otherwise, a simplified pullover path can be generated, and strategies such as lateral control bandwidth limitation can be used to ensure the smoothness of the pullover process.

[0047] 3. Exchange a collaborative parking agreement with surrounding traffic participants, including the vehicle's position, motion state, and expected parking trajectory. The HAD auxiliary control system can broadcast a collaborative parking request, including the vehicle's position, speed, target parking coordinates, and a countdown, via an onboard communication unit such as C-V2X, requesting adjacent vehicles to yield or reduce speed. If a confirmation response is received from surrounding vehicles, the above trajectory can be executed. If there is no response after a timeout, the system can degenerate to an independent conservative strategy, such as the first lane parking strategy.

[0048] 4. Send an alert to a pre-set rescue platform, including at least the vehicle's location, fault code, and environmental information. The HAD auxiliary control system can send alerts in standard formats, such as SAE J2735, to the cloud rescue platform, including fault codes, location data, environmental risk levels, and vehicle status. The system can also provide guidance based on the platform's feedback, such as the nearest rescue vehicle and recommended waiting locations, and update the vehicle's computer via Over-The-Air (OTA) technology. The HAD auxiliary control system then optimizes the MRM accordingly.

[0049] 5. Activate vehicle warning systems to alert surrounding vehicles. The HAD auxiliary control system can simultaneously activate the double flash lights, hazard warning lights, and rear LED warning screen, and additionally activate laser projection at night to maximize visibility and collision warning.

[0050] The above strategy can be dynamically optimized according to actual conditions, that is, based on environmental data such as lane type and traffic density and the health status shown by the HAD auxiliary control system, for example, including the remaining perception capability, the optimal MRM combination is selected through the decision tree model to obtain an MRM comprehensive strategy such as priority pulling over + warning on urban roads and priority deceleration + collaborative protocol on highways.

[0051] The following combination Figure 5 A flowchart of another risk management method based on autonomous driving is provided, which includes the following steps:

[0052] Step 502: HAD master control system abnormality detection and degradation triggering.

[0053] In one embodiment, assuming that a vehicle is traveling at 60 km / h on an urban expressway, the HAD main control system complies with the full ASIL B. Due to overheating of the computing unit, the system is downgraded and switches to the HAD auxiliary control system, where the structure of the HAD auxiliary control system is not 5R1V and belongs to ASIL B limited perception. Specifically, when the built-in temperature sensor of the HAD main control system detects that the temperature of the computing unit exceeds the limit, for example, >95°C, its own safety monitor determines it as an ASIL B fault and sends a downgrade request to the vehicle controller. At the same time, the HAD main control system freezes the current control instruction of "maintaining the current vehicle speed of 60 km / h", synchronizes the high-precision map data and lane keeping status to the HAD auxiliary control system, and activates the fault warning light.

[0054] In step 504 , control is switched to the HAD auxiliary control system and lane change restriction is activated.

[0055] In one embodiment, the HAD auxiliary control system is based on 5R1V sensors, such as front / left front / right front / left rear / right rear radar + forward camera, to take over the vehicle, start a 10-second user reaction time countdown, and dynamically set the steering wheel angle threshold to generate a virtual lane boundary of ±0.4 meters from the center of the current lane, prohibiting lane change operations.

[0056] Step 506: The HAD auxiliary control system determines whether a user takeover instruction is detected.

[0057] In one embodiment, the HAD auxiliary control system can set the torque threshold to 2 N·m. If a continuous super-threshold input is detected, such as the driver turning the steering wheel for more than 0.5 seconds, it can be determined as a takeover intention, that is, step 508 is executed. If the operating time of the HAD auxiliary control system is greater than the above-mentioned user reaction time, step 510 is executed.

[0058] Step 508: Switch from the automatic driving system to the manual driving state.

[0059] In one embodiment, if a user takeover command is received within 10 seconds, the HAD auxiliary control system can gradually release lateral control authority and maintain longitudinal control speed until the driver fully takes over. At the same time, the central control screen will display "Control has been transferred. Fault cause: Main control system overheating" and a voice prompt will be given to remind the driver to take full control.

[0060] Step 510, HAD auxiliary control system MRM.

[0061] In one embodiment, if no user takeover command is received within 10 seconds, the system selects an MRM combination based on urban road scenarios. For example, the system decelerates at -2 m / s² to 20 km / h, then slowly stops, activates the electronic parking brake, turns on the hazard lights, and sends a fault code and location data to the cloud, awaiting rescue instructions. Finally, the auxiliary control system enters a low-power mode, maintaining only the communication module online and awaiting external commands.

[0062] Figure 6 This is a schematic structural diagram of an electronic device in an exemplary embodiment. Figure 6 At the hardware level, the electronic device includes a processor 602, an internal bus 610, a network interface 604, a memory 606, and a non-volatile storage 608, and may also include other necessary hardware. The processor reads the corresponding computer program from the non-volatile storage into the internal memory and then runs it, forming a risk code detection device at the logical level. Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware. In other words, the execution of the following processing flow is not limited to individual logic units and can also be hardware or logic devices.

[0063] Figure 7 The embodiment of the present invention shows a block diagram of a risk management device based on autonomous driving. Figure 7 , the device can be used for Figure 6 In the device shown, in order to implement the technical solution of the present invention, the device is applied to a vehicle, wherein the vehicle is deployed with a highly automated driving HAD main control system and a HAD auxiliary control system for controlling the automatic driving of the vehicle, and the functional safety level of the HAD main control system is higher than that of the HAD auxiliary control system; the device includes:

[0064] a vehicle lane change preventing unit 702 configured to, upon determining that the current operating environment of the vehicle is within the design operating domain of the L3 conditional autonomous driving system, prevent the vehicle from changing lanes within a user reaction time after the current control system controlling the autonomous driving of the vehicle switches from the HAD primary control system to the HAD secondary control system;

[0065] The minimum risk strategy execution unit 704 is configured to execute a minimum risk strategy that matches the current operating environment if the operating time of the HAD auxiliary control system is greater than the user reaction time when no user takeover instruction is received.

[0066] Optionally, the vehicle lane change preventing unit 702 is specifically configured to:

[0067] When it is determined that the working state of the HAD main control system is abnormal, the current control system for controlling the automatic driving of the vehicle is switched from the HAD main control system to the HAD auxiliary control system.

[0068] Optionally, the design operation domain includes at least any one of the following constraints:

[0069] The vehicle is traveling in a low-risk urban area that meets the low-risk conditions;

[0070] The vehicle's driving speed is lower than the safety speed threshold corresponding to the current road scene type;

[0071] The key driving scene locations in the navigation map of the vehicle comply with the first functional safety level;

[0072] The signal light detection capability of the vehicle complies with the second functional safety level.

[0073] Optionally, the vehicle lane change preventing unit 702 is specifically configured to:

[0074] Dynamically set the steering wheel angle limit threshold based on the current vehicle speed and lane curvature; and / or,

[0075] Determining a lateral acceleration safety threshold of the vehicle according to the current vehicle speed; and / or,

[0076] A virtual lane boundary of a current lane is generated so that the vehicle performs a triggered lane deviation correction operation when it deviates from the current lane.

[0077] Optionally, the device further includes:

[0078] A temporary lane-changing unit is configured to temporarily allow the vehicle to change lanes if it is determined that an emergency obstacle avoidance target exists in the vehicle's driving path, in the case where the vehicle is prevented from changing lanes, so as to avoid the emergency obstacle avoidance target.

[0079] Optionally, the user takeover instruction includes:

[0080] A continuous torque exceeding threshold signal detected by the vehicle's steering wheel torque sensor; and / or,

[0081] An emergency takeover trigger signal received by the vehicle-mounted human-computer interaction device of the vehicle.

[0082] Optionally, the minimum risk strategy includes at least any one of the following:

[0083] Slow down in the current lane until it stops based on the deceleration strategy;

[0084] Identify and locate emergency stop strips or acceptable shoulder areas to perform route replanning for pull-over parking;

[0085] exchanging a cooperative parking agreement with surrounding traffic participants, the parking agreement including the vehicle position, motion state, and expected parking trajectory of the vehicle;

[0086] Sending an alarm message to a preset rescue platform, wherein the alarm message includes at least the vehicle location, fault code, and environmental information of the vehicle;

[0087] Activate vehicle warning systems to alert surrounding vehicles.

[0088] Optionally, the method further includes:

[0089] The user takeover unit is used to transfer the vehicle control to the user when a user takeover instruction has been received, and to display the triggering reason for the current control system switch.

[0090] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0091] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the partial description of the method embodiments. The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this specification. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0092] Based on the same concept as the above method, this specification also provides an electronic device, including: a processor; a memory for storing processor-executable instructions; wherein the processor implements the steps of the method described in any of the above embodiments by running the executable instructions.

[0093] Based on the same concept as the above method, this specification also provides a computer-readable storage medium on which computer instructions are stored. When the instructions are executed by a processor, the steps of the method described in any of the above embodiments are implemented.

[0094] Based on the same concept as the above method, this specification also provides a computer program product, including a computer program / instruction, which implements the steps of the method described in any of the above embodiments when executed by a processor.

[0095] Embodiments of the subject matter and functional operations described in this specification may be implemented in the following: digital electronic circuits, tangibly embodied computer software or firmware, computer hardware including the structures disclosed in this specification and their structural equivalents, or a combination of one or more of them. Embodiments of the subject matter described in this specification may be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a tangible, non-transitory program carrier to be executed by a data processing device or to control the operation of the data processing device. Alternatively or additionally, the program instructions may be encoded on an artificially generated propagation signal, such as a machine-generated electrical, optical, or electromagnetic signal, which is generated to encode information and transmit it to a suitable receiver device for execution by the data processing device. The computer storage medium may be a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or a combination of one or more of them.

[0096] The processes and logic flows described in this specification can be performed by one or more programmable computers executing one or more computer programs to perform the corresponding functions by operating on input data and generating output. The processes and logic flows can also be performed by, and apparatus can be implemented as, special-purpose logic circuitry, such as an FPGA (field programmable gate array) or an ASIC (application-specific integrated circuit).

[0097] Computers suitable for executing computer programs include, for example, general-purpose and / or special-purpose microprocessors, or any other type of central processing unit. Typically, the central processing unit will receive instructions and data from a read-only memory and / or random access memory. The basic components of a computer include a central processing unit for implementing or executing instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include one or more mass storage devices for storing data, such as magnetic disks, magneto-optical disks, or optical disks, or the computer will be operably coupled to such mass storage devices to receive data from them or to transmit data to them, or both. However, a computer does not necessarily have such devices. In addition, a computer can be embedded in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device such as a universal serial bus (USB) flash drive, to name a few.

[0098] Computer-readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and storage devices, including, for example, semiconductor memory devices (e.g., EPROM, EEPROM, and flash memory devices), magnetic disks (e.g., internal hard disks or removable disks), magneto-optical disks, and CD ROM and DVD-ROM disks. The processor and memory can be supplemented by, or incorporated in, special purpose logic circuitry.

[0099] Although this specification includes many specific implementation details, these should not be interpreted as limiting the scope of any invention or the scope of protection claimed, but are mainly used to describe the features of specific embodiments of specific inventions. Certain features described in multiple embodiments within this specification may also be implemented in combination in a single embodiment. On the other hand, the various features described in a single embodiment may also be implemented separately in multiple embodiments or in any suitable sub-combination. In addition, although features may work in certain combinations as described above and even initially claimed as such, one or more features from the claimed combination may be removed from the combination in some cases, and the claimed combination may point to a sub-combination or a variation of the sub-combination.

[0100] Similarly, although operations are depicted in a particular order in the accompanying drawings, this should not be understood as requiring that these operations be performed in the particular order shown or performed sequentially, or that all illustrated operations be performed to achieve the desired results. In some cases, multitasking and parallel processing may be advantageous. In addition, the separation of various system modules and components in the above-described embodiments should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product, or packaged into multiple software products.

[0101] Thus, specific embodiments of the subject matter have been described. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the particular order shown or sequential order to achieve the desired results. In some implementations, multitasking and parallel processing may be advantageous.

[0102] The above description is only a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of this specification should be included in the scope of protection of this specification.

Claims

1. A risk management method based on autonomous driving, characterized in that: Applied to a vehicle, the vehicle being deployed with a highly automated driving (HAD) master control system and a HAD auxiliary control system for controlling the vehicle's automated driving, the HAD master control system having a higher functional safety level than the HAD auxiliary control system; the method comprising: If it is determined that the current operating environment of the vehicle is within the design operating domain of the L3 conditional autonomous driving system, preventing the vehicle from changing lanes within the user reaction time after the current control system controlling the autonomous driving of the vehicle switches from the HAD primary control system to the HAD secondary control system; In the case where no user takeover instruction is received, if the operating time of the HAD auxiliary control system is greater than the user reaction time, a minimum risk strategy matching the current operating environment is executed; The method further comprises: In the case where the vehicle is prevented from changing lanes, if it is determined that there is an emergency obstacle avoidance target in the vehicle's driving path, temporarily allowing the vehicle to change lanes to avoid the emergency obstacle avoidance target; If the vehicle is temporarily allowed to change lanes and there is no emergency obstacle avoidance target in the driving path of the vehicle, re-preventing the vehicle from changing lanes; When the vehicle is temporarily allowed to change lanes and the lane change fails, the vehicle is controlled to perform emergency braking and lane keeping.

2. The method according to claim 1, characterized in that The current control system for controlling the automatic driving of the vehicle is switched from the HAD main control system to the HAD auxiliary control system, including: When it is determined that the working state of the HAD main control system is abnormal, the current control system for controlling the automatic driving of the vehicle is switched from the HAD main control system to the HAD auxiliary control system.

3. The method according to claim 1, characterized in that The design operation domain includes at least one of the following constraints: The vehicle is traveling in a low-risk urban area that meets the low-risk conditions; The vehicle's driving speed is lower than the safety speed threshold corresponding to the current road scene type; The key driving scene locations in the navigation map of the vehicle comply with the first functional safety level; The signal light detection capability of the vehicle complies with the second functional safety level.

4. The method according to claim 1, wherein The preventing the vehicle from changing lanes comprises: Dynamically set the steering wheel angle limit threshold based on the current vehicle speed and lane curvature; and / or, Determining a lateral acceleration safety threshold of the vehicle according to the current vehicle speed; and / or, A virtual lane boundary of a current lane is generated so that the vehicle performs a triggered lane deviation correction operation when it deviates from the current lane.

5. The method according to claim 1, wherein The user takeover instruction includes: A continuous torque exceeding threshold signal detected by the vehicle's steering wheel torque sensor; and / or, An emergency takeover trigger signal received by the vehicle-mounted human-computer interaction device of the vehicle.

6. The method according to claim 1, wherein The minimum risk strategy includes at least one of the following: Slow down in the current lane until it stops based on the deceleration strategy; Identify and locate emergency stop strips or acceptable shoulder areas to perform route replanning for pull-over parking; exchanging a cooperative parking agreement with surrounding traffic participants, the parking agreement including the vehicle position, motion state, and expected parking trajectory of the vehicle; Sending an alarm message to a preset rescue platform, wherein the alarm message includes at least the vehicle location, fault code, and environmental information of the vehicle; Activate vehicle warning systems to alert surrounding vehicles.

7. The method according to claim 1, characterized in that The method further comprises: If a user takeover instruction has been received, the vehicle control will be transferred to the user, and the trigger reason for the current control system switch will be displayed.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

9. A computer program product, characterized in that The method comprises a computer program / instruction, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 7.

Images