Automatic driving redundancy control system and method

Abstract

The invention belongs to the technical field of automatic driving control, and particularly relates to an automatic driving redundancy control system and method, and the system comprises a main automatic driving controller which comprises a main processor and a main controller; the auxiliary automatic driving controller comprises an auxiliary processor and an auxiliary controller; the main processor is used for generating a planned track of a vehicle and uploading the planned track to the auxiliary processor; the auxiliary processor is used for generating a predicted track and a safe deceleration track of a road traffic participant, judging whether the vehicle generates a collision risk based on the planned track of the vehicle and the predicted track of the road traffic participant, and reporting the collision risk to the main controller when judging that the collision risk is generated; and the main controller is used for switching a current vehicle control state to a control state in which the auxiliary processor and the main controller cooperate on the basis of the collision risk, and controlling the vehicle on the basis of the safe deceleration track.

Description

Technical Field

[0001] The present invention belongs to the technical field of autonomous driving control, and particularly relates to an autonomous driving redundant control system and method. Background Art

[0002] Currently, autonomous driving systems generally adopt a single controller architecture to achieve environmental perception, decision-making and vehicle control. In this architecture, a single controller needs to integrate data from multiple types of sensors such as cameras, radars, and lidars. Through the perception algorithm module, road lane lines, obstacles, targets, and information of surrounding vehicles are identified, and the movement trajectories of traffic participants are calculated by means of a fusion prediction algorithm module. Subsequently, the planning module generates a vehicle driving path, and finally the control algorithm module converts the path instruction into specific control requests for the throttle, braking, and steering systems.

[0003] Although this solution achieves full-link coverage of autonomous driving functions through modular design, it highly depends on the stability of a single controller. Once a failure occurs in the controller hardware (such as chips, communication interfaces) or software (such as algorithm logic, data processing threads), the autonomous driving system will directly trigger a function exit mechanism, resulting in the vehicle losing control instantly during high-speed driving or in complex scenarios. Users face a collision risk due to the lack of sufficient alarm prompts and takeover time.

[0004] In addition, the existing single controller solution has significant limitations in environmental perception and fault tolerance. On the one hand, the perception algorithm is vulnerable to environmental interferences such as light, rain, and fog, resulting in missed detection or false detection of obstacles. Especially in low visibility or partial occlusion scenarios of targets, the missed recognition problem may cause braking delays or even complete failures, directly threatening driving safety. On the other hand, although the system reports the abnormal state of the controller in real time through the fault monitoring module and forces the function to exit by the function state machine, this mechanism only realizes the passive response of "fault - exit" and lacks redundant control or degradation operation strategies. For example, in a curve or emergency braking scenario, if the controller suddenly fails, the direct exit of the system will cause the vehicle to lose control, and users cannot take over in time due to sudden alarms and short reaction windows, increasing the risk of traffic accidents. Summary of the Invention

[0005] In view of the above-mentioned disadvantages of the prior art, the purpose of the present invention is to provide an autonomous driving redundant control system and method, which solves at least one of the technical problems in the above background art.

[0006] To achieve the above purpose, the present invention adopts the following technical solutions.

[0007] The first aspect of the present invention provides an autonomous driving redundant control system, including: A main autonomous driving controller, including a main processor and a main controller; The secondary autonomous driving controller includes a secondary processor; The main processor is used to generate the planned trajectory of the host vehicle and upload it to the secondary processor; The secondary processor is used to generate the predicted trajectories of road traffic participants and the safe deceleration trajectory, and to judge whether the host vehicle has a collision risk based on the planned trajectory of the host vehicle and the predicted trajectories of road traffic participants. When it is judged that a collision risk occurs, the collision risk is reported to the main controller; The main controller is used to switch the current vehicle control state to the control state in which the secondary processor and the main controller cooperate based on the collision risk, and to control the vehicle based on the safe deceleration trajectory.

[0008] As an embodiment of the present invention, the secondary autonomous driving controller further includes a secondary controller, wherein: The main processor includes a main planning module; The main controller includes a main control module and a main function state machine management and control module; The secondary processor includes a secondary fusion prediction module, a secondary planning module, a secondary collision monitoring module, and a secondary processing fault monitoring module; the main planning module is used to generate the planned trajectory of the host vehicle and transmit it to the secondary collision monitoring module; The secondary fusion prediction module is used to generate the predicted trajectories of road traffic participants and transmit them to the secondary collision monitoring module; the secondary planning module is used to generate the safe deceleration trajectory in real time and transmit it to the main control module; The secondary controller includes a secondary control module and a secondary function state machine management and control module; the secondary collision monitoring module judges whether the host vehicle has a collision risk based on the planned trajectory of the host vehicle and the predicted trajectories of road traffic participants, and when it is judged that a collision risk occurs, reports the collision risk to the main function state machine management and control module through the secondary processing fault monitoring module; The main function state machine management and control module switches the current vehicle control state to the control state in which the secondary processor and the main controller cooperate based on the collision risk, and reports the vehicle control state to the main control module. The main control module controls the vehicle based on the safe deceleration trajectory generated by the secondary planning module.

[0009] As an embodiment of the present invention, the main function state machine management and control module contains a function state machine, and the function state machine is used to switch the vehicle control state.

[0010] As an embodiment of the present invention, the autonomous driving redundancy control system further includes a shared sensor group and an independent camera group; the shared sensor group includes a radar and a lidar, and is simultaneously connected to the main autonomous driving controller and the secondary autonomous driving controller through a communication interface; the independent camera group is independently connected to the main autonomous driving controller and the secondary autonomous driving controller respectively.

[0011] The second aspect of the present invention provides an autonomous driving redundancy control system, including: A main autonomous driving controller, including a main processor and a main controller; An auxiliary autonomous driving controller, including an auxiliary processor; The main processor is used to monitor software module failures on the main processor and report the software module failures on the main processor to the main controller; The auxiliary processor is used to generate a predicted trajectory and a safe deceleration trajectory of road traffic participants; The main controller is used to switch the current vehicle control state to a control state in which the auxiliary processor and the main controller cooperate based on the software module failures on the main processor, and control the vehicle based on the safe deceleration trajectory.

[0012] As an implementation manner of the present invention, the auxiliary autonomous driving controller further includes an auxiliary controller, wherein: The main processor includes a main planning module and a main processing fault monitoring module; The main controller includes a main control module and a main function state machine management and control module; The auxiliary processor includes an auxiliary planning module and an auxiliary processing fault monitoring module; The auxiliary controller includes an auxiliary control module and an auxiliary function state machine management and control module; The main planning module is used to generate a planned trajectory of the vehicle itself and transmit it to the auxiliary collision monitoring module; The main processing fault monitoring module is used to monitor software module failures on the main processor and report the software module failures on the main processor to the main function state machine management and control module; The main function state machine management and control module is used to switch the current vehicle control state to a control state in which the auxiliary processor and the main controller cooperate based on the software module failures on the main processor, and report the vehicle control state to the main control module; The auxiliary planning module is used to generate a safe deceleration trajectory in real time and transmit it to the main control module; The main control module is used to control the vehicle based on the safe deceleration trajectory.

[0013] As an implementation manner of the present invention, the main controller further includes a main control fault monitoring module, and the main control fault monitoring module is used to monitor hardware failures of the main processor and the main controller and monitor software algorithm failures on the main controller; When the main control failure monitoring module detects a failure, it reports the failure to the main function state machine control module and the auxiliary function state machine control module. The main function state machine control module and the auxiliary function state machine control module are used to jointly switch the current vehicle control state to a control state in which the auxiliary processor and the auxiliary controller cooperate based on the received failure, and report it to the main control module and the auxiliary control module respectively.

[0014] As an implementation manner of the present invention, when the main control module receives the control state in which the auxiliary processor and the auxiliary controller cooperate, it prohibits the external output of steering, braking, and / or throttle control commands; when the auxiliary control module receives the control state in which the auxiliary processor and the auxiliary controller cooperate, it controls the vehicle based on the safe deceleration trajectory output by the auxiliary controller.

[0015] As an implementation manner of the present invention, the auxiliary processing failure monitoring module is used to monitor software module failures on the auxiliary processor and report the software module failures on the auxiliary processor to the main function state machine control module; the main function state machine control module switches the current vehicle control state to a control state in which the main processor and the main controller cooperate based on the received failure, and reports it to the main control module and the main planning module.

[0016] As an implementation manner of the present invention, when the main planning module receives the control state in which the main processor and the main controller cooperate, it starts to generate a corresponding safe deceleration trajectory and uploads it to the main control module; the main control module controls the vehicle based on the safe deceleration trajectory generated by the main planning module.

[0017] As an implementation manner of the present invention, the auxiliary controller further includes an auxiliary control failure monitoring module, and the auxiliary control failure monitoring module is used to monitor hardware failures of the auxiliary processor and the auxiliary controller and monitor software algorithm failures on the auxiliary controller.

[0018] As an implementation manner of the present invention, when the auxiliary control failure monitoring module detects a software algorithm on the auxiliary controller, it reports the failure to the main function state machine control module, and the main function state machine control module switches the current vehicle control state to a control state in which the main processor and the main controller cooperate based on the received failure, and reports it to the main control module and the main planning module respectively.

[0019] The third aspect of the present invention provides an autonomous driving redundancy control method, including: Configuring dual controllers as a main autonomous driving controller and an auxiliary autonomous driving controller, the main autonomous driving controller includes a main processor and a main controller; the auxiliary autonomous driving controller includes an auxiliary processor; Making the main processor generate a planned trajectory of the vehicle itself and upload it to the main controller; Cause the auxiliary processor to generate a predicted trajectory and a safe deceleration trajectory of road traffic participants, and determine whether the host vehicle has a collision risk based on the planned trajectory of the host vehicle and the predicted trajectory of the road traffic participants. When it is determined that there is a collision risk, report the collision risk to the main controller; Cause the main controller to switch the current vehicle control state to a control state in which the auxiliary processor and the main controller cooperate based on the collision risk, and control the vehicle based on the safe deceleration trajectory.

[0020] A fourth aspect of the present invention provides an autonomous driving redundancy control method, including: Configure a dual controller as a main autonomous driving controller and an auxiliary autonomous driving controller. The main autonomous driving controller includes a main processor and a main controller; the auxiliary autonomous driving controller includes an auxiliary processor; Cause the main processor to monitor software module failures on the main processor and report the software module failures on the main processor to the main controller; Cause the auxiliary processor to generate a predicted trajectory and a safe deceleration trajectory of road traffic participants; Cause the main controller to switch the current vehicle control state to a control state in which the auxiliary processor and the main controller cooperate based on the software module failures on the main processor, and control the vehicle based on the safe deceleration trajectory.

[0021] A fifth aspect of the present invention provides an electronic device, including: At least one processor; and at least one memory communicatively connected to the processor, wherein: the memory stores program instructions executable by the processor, and the processor can execute the steps of the method described in the third aspect or the fourth aspect of the present invention by invoking the program instructions.

[0022] A sixth aspect of the present invention provides a readable storage medium storing a computer program, and the computer program is executed by a processor to perform the steps of the method described in the third aspect or the fourth aspect of the present invention.

[0023] In summary, compared with the prior art, through the redundant cooperation of the main and auxiliary dual controllers, on the basis that the main controller generates the planned trajectory of the host vehicle, the auxiliary controller real-time verifies the trajectory collision risk and generates a safe deceleration trajectory. The main controller switches the vehicle control state accordingly to ensure active downgrading of vehicle control in case of missed detection or failure, effectively avoiding the collision risk caused by perception failure or abnormal planning. At the same time, it provides sufficient takeover response time for users, and improves the situation of missed detection in single controller perception in the prior art. Once there is a missed detection, it will cause a safety collision risk problem. By adding an auxiliary controller to check whether there is a safety collision risk in the autonomous driving control trajectory of the main controller, the problem of missed detection in single control perception is further avoided, and the collision risk is avoided. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application. For those skilled in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0025] Figure 1 It is a schematic diagram of the operation scheme of single - controller autonomous driving control in the prior art.

[0026] Figure 2 It is a schematic diagram of the modules of the autonomous driving redundant control system according to a specific embodiment of the present invention.

[0027] Figure 3 It is a schematic diagram of the operation principle of the autonomous driving redundant control system in Scenario 1 according to a specific embodiment of the present invention.

[0028] Figure 4 It is a schematic diagram of the operation principle of the autonomous driving redundant control system in Scenario 2 according to a specific embodiment of the present invention.

[0029] Figure 5 It is a schematic diagram of the structure of the electronic device according to the embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0030] The following will clearly and completely describe the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, rather than all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative efforts belong to the scope of protection of the present application. In addition, it should be understood that the specific embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application.

[0031] It should be noted that the description order of the following embodiments does not limit the preferred order of the embodiments of the present application. And in the following embodiments, each embodiment is described with its own emphasis. For the parts not detailed in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0032] Such as Figure 1As shown in the figure, the current mainstream autonomous driving adopts a single controller solution. By accessing sensors such as cameras, Radars, and Lidars, the perception algorithm module is used to identify information such as road lane lines, targets, and vehicles. Then, the fusion prediction algorithm module is used to predict the movement trajectories of road traffic vehicles. The planning module outputs the automatic movement trajectory, and finally, the control algorithm module converts it into requests for vehicle deceleration, throttle, and steering to achieve the control of autonomous driving.

[0033] When a hardware or software algorithm module of the autonomous driving system controller module fails, through the fault monitoring module, the fault is reported to the functional state machine for monitoring, and the functional state machine controls the function to exit. When a sudden fault occurs in the system, the function directly exits without giving the user enough alarm reminder reaction time, and there is a risk of traffic accidents during emergency braking or on curves; affected by the environment, there are problems of missed recognition in perception. Once a missed recognition object is perceived, it will cause risks such as too late braking or missed braking resulting in traffic accidents.

[0034] As Figure 2 As shown in the figure, the first aspect of the present invention provides a redundant control system for autonomous driving, including a main autonomous driving controller, a secondary autonomous driving controller, a shared sensor group, and an independent camera group. The shared sensor group includes a radar and a lidar, and is connected to the main autonomous driving controller and the secondary autonomous driving controller through a communication interface at the same time; the independent camera group is independently connected to the main autonomous driving controller and the secondary autonomous driving controller respectively. Among them, the shared sensing group includes a radar and a lidar, and the independent camera group specifically includes camera group 1 and camera group 2. Among them, the main autonomous driving control is independently connected to camera group 1, and the secondary autonomous driving control is independently connected to camera group 2. The number of cameras can be determined according to the actual situation; the radar and the lidar are jointly connected to the main and secondary autonomous driving controllers through CAN or Ethernet communication methods.

[0035] Here, the CAN / Ethernet communication of the shared radar and lidar ensures data synchronization between the main and secondary controllers, and the independent camera group (the main control accesses group 1, and the secondary control accesses group 2) provides redundant perception; the main and secondary controllers automatically switch control rights based on collision risks or faults, and combined with the configurable number of cameras and dual communication links, high-reliability redundant control and safe takeover are achieved.

[0036] Specifically, the main autonomous driving controller includes a main processor and a main controller; The secondary autonomous driving controller includes a secondary processor; The main processor is used to generate the planned trajectory of the vehicle itself and upload it to the secondary processor; The auxiliary processor is used to generate the predicted trajectory and the safe deceleration trajectory of road traffic participants, and to determine whether the host vehicle has a collision risk based on the planned trajectory of the host vehicle and the predicted trajectory of the road traffic participants. When it is determined that there is a collision risk, the collision risk is reported to the main controller; The main controller is used to switch the current vehicle control state to the control state in which the auxiliary processor and the main controller cooperate based on the collision risk, and control the vehicle based on the safe deceleration trajectory.

[0037] Specifically, the main processor can generate the planned trajectory of the host vehicle according to the perception data (such as lane lines and obstacle positions), and the auxiliary processor can generate the predicted trajectory for road traffic participants by obtaining the positions, speeds, and accelerations of surrounding vehicles and pedestrians through the sensing module. When the auxiliary processor determines that the host vehicle has a collision risk, for example, when TTC≤1s, the collision risk is reported to the main controller.

[0038] Specifically, the auxiliary processor calculates a safe deceleration trajectory in real time, and the trajectory calculation strategy is as follows: a: When no road traffic participants are recognized, it is default to plan the trajectory with a fixed deceleration of -3m / s while keeping the vehicle centered in the lane. 2 Fixed deceleration planned trajectory; b: When road traffic participants are recognized, plan the trajectory according to the braking and collision avoidance strategy; Finally, select the one with the larger absolute value of deceleration between strategies a and b.

[0039] Here, through the redundant cooperation of the main and auxiliary dual controllers, on the basis of the main controller generating the planned trajectory of the host vehicle, the auxiliary controller real-time checks the trajectory collision risk (such as TTC≤1 second) and generates a safe deceleration trajectory. The main controller switches the vehicle control state accordingly to ensure active degradation of vehicle control in case of missed detection or failure, effectively avoiding the collision risk caused by perception failure or abnormal planning, and at the same time providing sufficient takeover response time for the user.

[0040] In an embodiment of the present invention, the auxiliary automatic driving controller further includes an auxiliary controller, wherein: The main processor includes a main perception module, a main fusion and prediction module, a main planning module, and a main processing fault monitoring module; The main perception module is used to detect road lane line information based on the independent camera group 1, and use camera group 1, Lidar, and Radar to detect traffic participants such as vehicles and objects such as obstacles, and transmit them to the main fusion and prediction module. The main fusion and prediction module is used to fuse the speeds and positions of the targets recognized by different sensors such as camera group 1, Lidar, and Radar, and predict the motion trajectories of the targets, and transmit them to the main planning module. The main planning module is used to generate the planned trajectory of the host vehicle and transmit it to the auxiliary collision monitoring module; The main controller includes a main control module and a main function state machine management and control module; The auxiliary processor includes an auxiliary perception module, an auxiliary fusion and prediction module, an auxiliary planning module, an auxiliary collision monitoring module, and an auxiliary processing fault monitoring module; The auxiliary perception module is used to detect road lane line information based on the independent camera group 2, and use the camera group 2, Lidar, and Radar to detect traffic participants such as vehicles and objects such as obstacles, and transmit them to the auxiliary fusion and prediction module. The auxiliary fusion and prediction module is used to generate the predicted trajectory of road traffic participants and transmit it to the auxiliary collision monitoring module; The auxiliary planning module is used to generate a safe deceleration trajectory in real time and transmit it to the main control module; The auxiliary controller includes an auxiliary control module and an auxiliary function state machine management and control module; The auxiliary control module is used to, when the main controller fails, the auxiliary controller module receives the content of the auxiliary planning module and externally controls the braking of the whole vehicle, and steers to achieve the safe braking of the vehicle. The auxiliary collision monitoring module determines whether the host vehicle has a collision risk based on the planned trajectory of the host vehicle and the predicted trajectory of road traffic participants, and when it is determined that there is a collision risk, reports the collision risk to the main function state machine management and control module through the auxiliary processing fault monitoring module;

[0041] The main function state machine management and control module switches the current vehicle control state to the control state in which the auxiliary processor and the main controller cooperate based on the collision risk, and reports the vehicle control state to the main control module. The main control module is used to control the vehicle based on the safe deceleration trajectory generated by the auxiliary planning module. Among them, the main function state machine management and control module contains a function state machine, and the function state machine is used to switch the vehicle control state.

[0042] Here, through the main-auxiliary dual-controller redundant architecture, the main processor executes the full-link autonomous driving task, the auxiliary processor real-time verifies the collision risk of the planned trajectory of the main controller, dynamically generates a safe deceleration trajectory, and the main controller automatically switches to the safe trajectory control of the auxiliary controller based on the collision risk, ensuring that the system actively degrades the vehicle control when the main control fails, significantly reducing the collision risk caused by missed detection or faults, and at the same time extending the user takeover response time.

[0043] As Figure 2 shown, the second aspect of the present invention provides an autonomous driving redundant control system, including a main autonomous driving controller, including a main processor and a main controller; an auxiliary autonomous driving controller, including an auxiliary processor; The main processor is used to monitor software module failures on the main processor and report the software module failures on the main processor to the main controller; The auxiliary processor is used to generate predicted trajectories and safe deceleration trajectories of road traffic participants; The main controller is used to switch the current vehicle control state to a control state in which the auxiliary processor and the main controller cooperate based on the software module failure on the main processor, and control the vehicle based on the safe deceleration trajectory.

[0044] Specifically, in this system, the main processor is used to monitor software module failures on the main processor, the main controller is used to monitor hardware failures of the main processor and the main controller and monitor software algorithm failures on the main controller; the auxiliary processor is used to monitor software module failures on the auxiliary processor; the auxiliary controller is used to monitor hardware failures of the auxiliary processor and the auxiliary controller and monitor software algorithm failures on the auxiliary controller.

[0045] Specifically, the software module failure on the main processor means that algorithms such as perception and planning running on it fail to function due to code errors, data anomalies or logical conflicts, triggering the main control failure monitoring module to detect the failure and report it.

[0046] Here, it can enable the main controller to quickly switch to the safe vehicle control state of the auxiliary processor based on the software fault signal, effectively avoiding risks caused by main control failure.

[0047] In an embodiment of the present invention, the main controller further includes a main control failure monitoring module, and the main control failure monitoring module is used to monitor hardware failures of the main processor and the main controller and monitor software algorithm failures on the main controller; When the main control failure monitoring module detects a failure, it reports the failure to the main function state machine management and control module and the auxiliary function state machine management and control module. The main function state machine management and control module and the auxiliary function state machine management and control module are used to jointly switch the current vehicle control state to a control state in which the auxiliary processor and the auxiliary controller cooperate based on the received failure, and report to the main control module and the auxiliary control module respectively; specifically, the main function state machine management and control module reports to the main control module, and the auxiliary function state machine management and control module reports to the auxiliary controller module; When the main control module receives the control state of cooperation between the auxiliary processor and the auxiliary controller, it prohibits the external output of steering, braking and / or throttle control instructions; When the auxiliary control module receives the control state of cooperation between the auxiliary processor and the auxiliary controller, it controls the vehicle based on the safe deceleration trajectory output by the auxiliary controller.

[0048] Here, the present invention monitors the hardware faults of the main processor and the main controller in real time through the main control fault monitoring module of the main controller, and monitors the software algorithm faults on the main controller. When an abnormality is detected, the main and auxiliary function state machine control modules are combined to switch to the state of controlling the vehicle by the auxiliary controller. The main control module prohibits the output of steering / braking commands to avoid conflicts. The auxiliary control module controls the vehicle based on the safe deceleration trajectory, realizing double redundant protection against hardware faults and software failures, ensuring that the system can still safely degrade to control the vehicle when the main control completely fails, minimizing the collision risk caused by controller faults, and meeting the safety requirements of high-level autonomous driving.

[0049] In an embodiment of the present invention, the auxiliary processing fault monitoring module is used to monitor the software module faults on the auxiliary processor and report the software module faults on the auxiliary processor to the main function state machine control module; Based on the received faults, the main function state machine control module switches the current vehicle control state to the control state of the cooperation between the main processor and the main controller, and reports it to the main control module and the main planning module; When the main planning module receives the control state of the cooperation between the main processor and the main controller, it starts to generate the corresponding safe deceleration trajectory and uploads it to the main control module; The main control module controls the vehicle based on the safe deceleration trajectory generated by the main planning module.

[0050] Here, the present invention monitors the software module faults of the auxiliary processor in real time through the auxiliary processing fault monitoring module and reports them to the main function state machine control module, triggering the main control to switch to the control state of the cooperation between the main processor and the main controller; after the main planning module generates the safe deceleration trajectory, the main control module takes over the execution of braking / steering commands, ensuring that the system can still automatically switch to the main control safe vehicle control when the auxiliary control fails, avoiding control interruption caused by auxiliary control software faults, realizing redundant fault tolerance under the alternate failure of the main and auxiliary controllers, ensuring that the vehicle is continuously in a controllable state, and effectively reducing the collision risk.

[0051] In an embodiment of the present invention, the auxiliary controller further includes an auxiliary control fault monitoring module, and the auxiliary control fault monitoring module is used to monitor the hardware faults of the auxiliary processor and the auxiliary controller and monitor the software algorithm faults on the auxiliary controller; When the auxiliary control fault monitoring module monitors the software algorithm on the auxiliary controller, it reports the fault to the main function state machine control module. Based on the received fault, the main function state machine control module switches the current vehicle control state to the control state of the cooperation between the main processor and the main controller, and reports it to the main control module and the main planning module respectively. When the main planning module receives the control state of the cooperation between the main processor and the main controller, it starts to plan and calculate or generate a safe deceleration trajectory; When the main control module receives that the main state machine control module switches the current vehicle control state to the control state of the cooperation between the main processor and the main controller, the vehicle is controlled based on the safe deceleration trajectory output by the main controller.

[0052] Here, the auxiliary control fault monitoring module monitors the software and hardware faults of the auxiliary controller in real time and reports them. Based on this, the main function state machine switches to the vehicle control state of the cooperation between the main processor and the main controller; the main control module executes braking / steering instructions based on the safe deceleration trajectory generated by the main controller, and the auxiliary control module disables the output to avoid instruction conflicts, ensuring that the main control can still control the vehicle when the auxiliary control fails, realizing redundant fault tolerance under the alternating failure of the main and auxiliary automatic driving controllers, ensuring continuous control of the vehicle, and significantly reducing the collision risk caused by auxiliary control faults.

[0053] In an embodiment of the present invention, in order to better express the content of the present invention, a specific application scenario is now used for example description. Among them, the specific name conversions are shown in the following table:

[0054] As Figure 3 shown, Scenario 1 is expressed as: when the main automatic driving controller executes the automatic driving behavior, when there is a missed detection in

Perception 1

Fusion Prediction 1

Planning 1

Planning 1

Collision Monitoring Module

Collision Monitoring Module

Fusion Prediction 2

SOC Fault Monitoring 2

SOC Fault Monitoring 2

Function State Machine Control 1

Planning 2

Planning 2

Controller 1

Function State Machine Control 1

SOC Fault Monitoring 2

Control 1

Control 1

Function State Machine Control 1

Control 1

Planning 2

[0055] As Figure 4 shown, Scenario 2 is represented as: when there are software or hardware failures in the primary and secondary autonomous driving, the system automatically switches to the primary autonomous driving controller or the secondary autonomous driving controller to control the vehicle, and at the same time alarms and prompts the user to take over. ① Add a secondary autonomous driving controller. The secondary autonomous driving control is independently connected to Camera Group 2, and the number of cameras can be determined according to the actual situation; radar and lidar are jointly connected to the primary and secondary autonomous driving controllers through CAN or Ethernet communication methods. ② The primary autonomous driving controller outputs requests for throttle, braking, and steering during normal control based on perception, prediction, planning, and control. ③ The secondary autonomous driving controller calculates a safe deceleration trajectory in real time: a When no road traffic participants are recognized, it defaults to centering on the lane and planning the trajectory with a fixed deceleration of -3m / s 2 ; b If there are traffic participants, plan the trajectory according to the braking and collision avoidance strategy, and finally select the one with the larger absolute value of deceleration between strategies a and b. ④ The

SOC Fault Monitoring Module 1

Function State Machine Control 1

Function State Machine Control 1

SOC Fault Monitoring 1

Control 1

Control 1

Function State Machine Control 1

Control 1

Planning 2

MCU Fault Monitoring 1

Function State Machine Control 1

Function State Machine Control 2

Function State Machine Control 1

Function State Machine Control 2

MCU Fault Monitoring 1

Control 1

Control 2

Control 1

Control 2

Control 2

Planning 2

SOC Fault Monitoring 2

Function State Machine Control 1

Function State Machine Control 1

SOC Fault Monitoring 2

Control 1

Planning 1

Planning 1

Function State Machine Control 1

Planning 1

Control 1

Function State Machine Control 1

Control 1

Planning 1

MCU Fault Monitoring 2

Function State Machine Control 1

Function State Machine Control 1

MCU Fault Monitoring 2

Control 1

Planning 1

[0056] Here, through the main - auxiliary dual - controller collaborative verification and redundancy switching mechanism, active safety protection is achieved for two core risks: undetected faults or abnormal trajectories of the main controller (Scenario 1) and software and hardware faults (Scenario 2): Safe takeover when the main controller fails: The auxiliary controller independently verifies the collision risk of the main controller's trajectory, dynamically generates a safe deceleration trajectory, the main controller switches to the auxiliary controller's trajectory and alarms, ensuring that the vehicle automatically decelerates and avoids collisions when undetected or planning errors occur; Software and hardware fault tolerance: The main and auxiliary controllers hierarchically monitor the processor algorithm faults and hardware communication anomalies, switch the vehicle control state through the function state machine (such as SOC2 + MCU1 / SOC1 + MCU1), the main or auxiliary controller takes over braking / steering based on the safe trajectory, and prohibits the faulty end from outputting instructions, realizing the continuous vehicle control ability under the alternating failure of the two controllers; Extension of the user takeover window: When a collision risk or fault is triggered, the system simultaneously alarms through the instrument (acoustic and light prompts) and decelerates the vehicle (maintains the lane before stopping), significantly reducing the collision probability caused by untimely human takeover.

[0057] The third aspect of the present invention provides an autonomous driving redundancy control method, including: Configuring a dual - controller as a main autonomous driving controller and an auxiliary autonomous driving controller, the main autonomous driving controller includes a main processor and a main controller; the auxiliary autonomous driving controller includes an auxiliary processor and an auxiliary controller; Making the main processor generate the planned trajectory of the vehicle and upload it to the main controller; Making the auxiliary processor generate the predicted trajectory and safe deceleration trajectory of road traffic participants, and judge whether the vehicle generates a collision risk based on the planned trajectory of the vehicle and the predicted trajectory of road traffic participants. When it is judged that a collision risk occurs, report the collision risk to the main controller; Making the main controller switch the current vehicle control state to the control state coordinated by the auxiliary processor and the main controller based on the collision risk, and control the vehicle based on the safe deceleration trajectory.

[0058] Through the dual - controller solution of the present invention, when the main controller senses missed detection, the secondary controller performs collision checking. If there is a collision risk, a safety braking strategy is implemented, and at the same time, an alarm is sent to request the driver to take over the vehicle to avoid the collision risk.

[0059] The fourth aspect of the present invention provides an autonomous driving redundancy control method, including: Configuring a dual - controller as a main autonomous driving controller and a secondary autonomous driving controller. The main autonomous driving controller includes a main processor and a main controller; the secondary autonomous driving controller includes a secondary processor and a secondary controller; Making the main processor monitor software module failures on the main processor and report the software module failures on the main processor to the main controller; Making the secondary processor generate a predicted trajectory and a safe deceleration trajectory of road traffic participants; Making the main controller switch the current vehicle control state to a control state where the secondary processor and the main controller cooperate based on the software module failures on the main processor, and control the vehicle based on the safe deceleration trajectory.

[0060] Through the dual - control solution of the present invention, when a software or hardware failure occurs in the autonomous driving controller, the safety of controlling the vehicle can be achieved through another controller, and at the same time, an alarm is given to remind the user to take over, giving the user sufficient reaction time to avoid the collision risk.

[0061] As Figure 5 shown, the fifth aspect of the present invention provides an electronic device, including: at least one processor; and at least one memory communicatively connected to the processor, where: the memory stores program instructions executable by the processor, and the processor can execute the steps of the method according to any one of the above - mentioned embodiments by invoking the program instructions.

[0062] The sixth aspect of the present invention discloses a readable storage medium storing a computer program, and the computer program is executed by a processor to perform the steps of the method according to any one of the above - mentioned embodiments.

[0063] A computer-readable storage medium may include: any entity or device capable of carrying a computer program, a recording medium, a USB flash drive, a portable hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), and a software distribution medium, etc. The computer program includes computer program code. The computer program code may be in the form of source code, object code, an executable file, or some intermediate form, etc. A computer-readable storage medium may include: any entity or device capable of carrying computer program code, a recording medium, a USB flash drive, a portable hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), and a software distribution medium, etc.

[0064] Any process or method description represented in a flowchart or otherwise described herein may be understood to represent a module, segment, or portion of code including one or more executable instructions for implementing a specific logical function or process. The scope of the preferred embodiments of the present invention includes additional implementations, where functions may be executed in a substantially simultaneous manner or in a reverse order according to the functions involved, rather than in the order shown or discussed. This should be understood by those skilled in the art to which the embodiments of the present invention pertain.

[0065] The logic and / or steps represented in a flowchart or otherwise described herein, for example, may be considered as a sequenced list of executable instructions for implementing a logical function, and may be specifically implemented in any computer-readable medium for use by an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processing module, or other systems that can fetch and execute instructions from the instruction execution system, apparatus, or device), or in conjunction with such instruction execution systems, apparatuses, or devices.

[0066] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An autonomous driving redundancy control system, characterized in that, Comprising: The main autonomous driving controller, including a main processor and a main controller; The auxiliary autonomous driving controller, including an auxiliary processor; The main processor is used to generate the planned trajectory of the host vehicle and upload it to the auxiliary processor; The auxiliary processor is used to generate the predicted trajectories of road traffic participants and the safe deceleration trajectory, and to determine whether the host vehicle has a collision risk based on the planned trajectory of the host vehicle and the predicted trajectories of road traffic participants, and when it is determined that there is a collision risk, report the collision risk to the main controller; The main controller is used to switch the current vehicle control state to the control state in which the auxiliary processor and the main controller cooperate based on the collision risk, and control the vehicle based on the safe deceleration trajectory.

2. The autonomous driving redundancy control system according to claim 1, wherein The auxiliary autonomous driving controller further includes an auxiliary controller, wherein: The main processor includes a main planning module; The main controller includes a main control module and a main function state machine management and control module; The auxiliary processor includes an auxiliary fusion prediction module, an auxiliary planning module, an auxiliary collision monitoring module, and an auxiliary processing fault monitoring module; the main planning module is used to generate the planned trajectory of the host vehicle and transmit it to the auxiliary collision monitoring module; The auxiliary fusion prediction module is used to generate the predicted trajectories of road traffic participants and transmit them to the auxiliary collision monitoring module; the auxiliary planning module is used to generate the safe deceleration trajectory in real time and transmit it to the main control module; The auxiliary controller includes an auxiliary control module and an auxiliary function state machine management and control module; the auxiliary collision monitoring module determines whether the host vehicle has a collision risk based on the planned trajectory of the host vehicle and the predicted trajectories of road traffic participants, and when it is determined that there is a collision risk, reports the collision risk to the main function state machine management and control module through the auxiliary processing fault monitoring module; The main function state machine management and control module switches the current vehicle control state to the control state in which the auxiliary processor and the main controller cooperate based on the collision risk, and reports the vehicle control state to the main control module, and the main control module controls the vehicle based on the safe deceleration trajectory generated by the auxiliary planning module.

3. The autonomous driving redundancy control system according to claim 2, wherein, The main function state machine management and control module contains a function state machine, and the function state machine is used to switch the vehicle control state.

4. The autonomous driving redundancy control system according to claim 1, wherein It further includes a shared sensor group and an independent camera group; the shared sensor group includes a radar and a lidar, and is simultaneously connected to the main autonomous driving controller and the auxiliary autonomous driving controller through a communication interface; the independent camera group is independently connected to the main autonomous driving controller and the auxiliary autonomous driving controller respectively.

5. An autonomous driving redundant control system, characterized in that, Comprising: The main autonomous driving controller, including a main processor and a main controller; The auxiliary autonomous driving controller, including an auxiliary processor; The main processor is used to monitor the software module faults on the main processor and report the software module faults on the main processor to the main controller; The auxiliary processor is used to generate the predicted trajectories of road traffic participants and the safe deceleration trajectory; The main controller is used to switch the current vehicle control state to the control state in which the auxiliary processor and the main controller cooperate based on the software module faults on the main processor, and control the vehicle based on the safe deceleration trajectory.

6. The autonomous driving redundancy control system according to claim 5, characterized in that, The auxiliary autonomous driving controller further includes an auxiliary controller, wherein: The main processor includes a main planning module and a main processing fault monitoring module; The main controller includes a main control module and a main function state machine management and control module; The auxiliary processor includes an auxiliary planning module and an auxiliary processing fault monitoring module; The auxiliary controller includes an auxiliary control module and an auxiliary function state machine management and control module; The main planning module is used to generate a planned trajectory of the vehicle itself and transmit it to the auxiliary collision monitoring module; The main processing fault monitoring module is used to monitor software module faults on the main processor and report the software module faults on the main processor to the main function state machine management and control module; The main function state machine management and control module is used to switch the current vehicle control state to a control state in which the auxiliary processor and the main controller cooperate based on the software module faults on the main processor, and report the vehicle control state to the main control module; The auxiliary planning module is used to generate a safe deceleration trajectory in real time and transmit it to the main control module; The main control module is used to control the vehicle based on the safe deceleration trajectory.

7. The redundant control system for autonomous driving according to claim 6, wherein, The main controller further includes a main control fault monitoring module, and the main control fault monitoring module is used to monitor hardware faults of the main processor and the main controller and monitor software algorithm faults on the main controller; When the main control fault monitoring module detects a fault, it reports the fault to the main function state machine management and control module and the auxiliary function state machine management and control module. The main function state machine management and control module and the auxiliary function state machine management and control module are used to jointly switch the current vehicle control state to a control state in which the auxiliary processor and the auxiliary controller cooperate based on the received fault, and report it to the main control module and the auxiliary control module respectively.

8. The autonomous driving redundancy control system according to claim 7, wherein When the main control module receives the control state of the cooperation between the auxiliary processor and the auxiliary controller, it prohibits the external output of steering, braking, and / or throttle control commands; when the auxiliary control module receives the control state of the cooperation between the auxiliary processor and the auxiliary controller, it controls the vehicle based on the safe deceleration trajectory output by the auxiliary controller.

9. The redundant control system for autonomous driving according to claim 6, wherein The auxiliary processing fault monitoring module is used to monitor software module faults on the auxiliary processor and report the software module faults on the auxiliary processor to the main function state machine management and control module; The main function state machine management and control module switches the current vehicle control state to a control state in which the main processor and the main controller cooperate based on the received fault, and reports it to the main control module and the main planning module.

10. The autonomous driving redundancy control system according to claim 9, wherein When the main planning module receives the control state of the cooperation between the main processor and the main controller, it starts to generate a corresponding safe deceleration trajectory and uploads it to the main control module; The main control module controls the vehicle based on the safe deceleration trajectory generated by the main planning module.

11. A redundant control method for autonomous driving, characterized in that, Including: Configuring dual controllers as a main automatic driving controller and an auxiliary automatic driving controller. The main automatic driving controller includes a main processor and a main controller; the auxiliary automatic driving controller includes an auxiliary processor; Making the main processor generate a planned trajectory of the vehicle itself and upload it to the main controller; Cause the auxiliary processor to generate a predicted trajectory and a safe deceleration trajectory of a road traffic participant, and determine whether the host vehicle has a collision risk based on the planned trajectory of the host vehicle and the predicted trajectory of the road traffic participant, and when it is determined that there is a collision risk, report the collision risk to the main controller; Cause the main controller to switch the current vehicle control state to a control state in which the auxiliary processor and the main controller cooperate based on the collision risk, and control the vehicle based on the safe deceleration trajectory.

12. An autonomous driving redundancy control method, characterized in that, Comprising: Configure a dual controller as a main autonomous driving controller and an auxiliary autonomous driving controller, the main autonomous driving controller includes a main processor and a main controller; the auxiliary autonomous driving controller includes an auxiliary processor; Cause the main processor to monitor software module failures on the main processor and report the software module failures on the main processor to the main controller; Cause the auxiliary processor to generate a predicted trajectory and a safe deceleration trajectory of a road traffic participant; Cause the main controller to switch the current vehicle control state to a control state in which the auxiliary processor and the main controller cooperate based on the software module failures on the main processor, and control the vehicle based on the safe deceleration trajectory.

13. An electronic device, characterized in that, Comprising: At least one processor; And at least one memory communicatively connected to the processor, wherein: the memory stores program instructions executable by the processor, and the processor can execute the steps of the autonomous driving redundancy control method according to claim 11 or 12 by invoking the program instructions.

14. A readable storage medium stores a computer program, characterized in that, The computer program is executed by the processor to perform the steps of the autonomous driving redundancy control method according to claim 11 or 12.

Images