Vehicle-mounted computing system for automatic driving and vehicle-mounted system operation control method

Abstract

The invention discloses a vehicle-mounted computing system for automatic driving and a vehicle-mounted system operation control method, and relates to the technical field of automatic driving. The system comprises a main system-on-chip and a fault-tolerant system-on-chip under a configuration heterogeneous architecture; the same contained automatic driving algorithm is synchronously operated in the main system-on-chip and the fault-tolerant system-on-chip under the heterogeneous architecture, so that when the chip under any architecture fails, the chip can be timely switched to another fault-tolerant configured chip under other heterogeneous architectures to take over the synchronously operated automatic driving algorithm; and the driving safety of the whole vehicle is ensured.

Description

Technical Field

[0001] The present application relates to the field of autonomous driving technology, and in particular, to an in-vehicle computing system for autonomous driving, an in-vehicle system operation control method, device, electronic device, storage medium, and computer program product. Background Art

[0002] With the continuous development of technologies such as computers, pattern recognition, and artificial intelligence, more and more computer control technologies have been applied to automobiles to form autonomous driving technology. The automobile autonomous driving system can be divided into multiple levels according to the degree of automation, such as the "L0" level corresponding to no automation, the "L1" level corresponding to assisted driving, the "L2" level corresponding to partial automation, the "L3" level corresponding to conditional automation, the "L4" level corresponding to high automation, and the "L5" level corresponding to full automation.

[0003] In related technologies, in-vehicle computing systems with different levels of autonomous driving have different computing power requirements. For example, for an "L4" level autonomous driving system, its driving decisions are mainly controlled by the vehicle itself. To ensure the safety of autonomous driving, it is necessary to run high-precision and highly reliable automatic perception, decision-making, and planning algorithms on the in-vehicle computing system, and the operation of the algorithms generally requires a high computing power platform of 100 - 1000 TOPS to support. Therefore, there is an urgent need to propose an in-vehicle computing system for autonomous driving to ensure the safety of autonomous driving operation while meeting the computing power requirements of the corresponding level of autonomous driving system. Summary of the Invention

[0004] The present application provides an in-vehicle computing system for autonomous driving, an in-vehicle system operation control method, device, electronic device, storage medium, and computer program product to ensure the safety of autonomous driving operation while meeting the computing power requirements of the corresponding level of autonomous driving system.

[0005] The present application provides an in-vehicle computing system for autonomous driving. The system includes: at least two different architectures of computing modules that are communicatively connected to each other. The system-on-chip integrated in the computing module of one architecture is used as the main system-on-chip, and the system-on-chip integrated in the computing modules of the remaining other architectures is used as a fault-tolerant system-on-chip. The computing power of the fault-tolerant system-on-chip is greater than or equal to the computing power of the main system-on-chip. The main system-on-chip and the fault-tolerant system-on-chip are used to run the autonomous driving algorithms corresponding to the autonomous driving system at the target autonomous driving level and generate autonomous driving decision instructions. The functional types of the autonomous driving algorithms running on the main system-on-chip and the fault-tolerant system-on-chip are determined according to the relationship between the computing power required by the autonomous driving algorithms corresponding to the current target autonomous driving level and the computing power configured for the main system-on-chip. The system further includes a main control module for responding to the autonomous driving decision instructions.

[0006] The present application also provides a method for controlling the operation of an in-vehicle system for autonomous driving, which is applied to an autonomous driving control system integrated with an in-vehicle computing system for autonomous driving; the method includes: if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is less than or equal to the computing power of the main system-level chip configured for the autonomous driving system of the corresponding level, controlling the autonomous driving algorithm to run synchronously on the main system-level chip and the fault-tolerant system-level chip of the in-vehicle computing system; if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is greater than the computing power of the main system-level chip configured for the autonomous driving system of the corresponding level, controlling the target function algorithm in the autonomous driving algorithm to run synchronously on the main system-level chip and the fault-tolerant system-level chip of the in-vehicle computing system, and the remaining algorithms other than the target function algorithm are executed by the remaining computing power in the main system-level chip or the fault-tolerant system-level chip; the main control module of the in-vehicle computing system responds to the autonomous driving decision instruction generated by the main system-level chip and / or the fault-tolerant system-level chip based on the running autonomous driving algorithm, and performs the autonomous driving operation corresponding to the autonomous driving decision instruction on the autonomous driving vehicle. The present application also provides a device for controlling the operation of an in-vehicle system for autonomous driving, which is applied to an autonomous driving control system integrated with an in-vehicle computing system for autonomous driving; the device includes: a first control module, configured to control the autonomous driving algorithm to run synchronously on the main system-level chip and the fault-tolerant system-level chip of the in-vehicle computing system if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is less than or equal to the computing power of the main system-level chip configured for the autonomous driving system of the corresponding level; a second control module, configured to control the target function algorithm in the autonomous driving algorithm to run synchronously on the main system-level chip and the fault-tolerant system-level chip of the in-vehicle computing system if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is greater than the computing power of the main system-level chip configured for the autonomous driving system of the corresponding level, and the remaining algorithms other than the target function algorithm are executed by the remaining computing power in the main system-level chip or the fault-tolerant system-level chip; a first response module, configured to perform the autonomous driving operation corresponding to the autonomous driving decision instruction on the autonomous driving vehicle through the main control module of the in-vehicle computing system in response to the autonomous driving decision instruction generated by the main system-level chip and / or the fault-tolerant system-level chip based on the running autonomous driving algorithm. The present application also provides an electronic device, including: a memory, configured to store a computer program; a processor, configured to implement the steps of any of the above methods for controlling the operation of an in-vehicle system for autonomous driving when executing the computer program.

[0007] The present application also provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the steps of any of the above-mentioned on-vehicle system operation control methods for autonomous driving are implemented.

[0008] The present application also provides a computer program product including a computer program, wherein when the computer program is executed by a processor, the steps of any of the above-mentioned on-vehicle system operation control methods for autonomous driving are implemented.

[0009] The on-vehicle computing system for autonomous driving provided by the present application configures a main system-level chip and a fault-tolerant system-level chip under a heterogeneous architecture, and synchronously runs the same autonomous driving algorithms included under the heterogeneous architecture on the main system-level chip and the fault-tolerant system-level chip, ensuring that when a chip fails in any architecture, it can be timely switched to another chip with a fault-tolerant configuration under other heterogeneous architectures to take over the synchronously running autonomous driving algorithms, thus ensuring the driving safety of the whole vehicle. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] To more clearly illustrate the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0011] Figure 1 It is a schematic structural diagram of the on-vehicle computing system for autonomous driving provided by the embodiment of the present application; Figure 2 It is a schematic structural diagram of the on-vehicle computing system for autonomous driving provided by the embodiment of the present application; Figure 3 It is a schematic flowchart of an on-vehicle system operation control method for autonomous driving provided by the embodiment of the present application; Figure 4 It is a schematic block diagram of the structure of an on-vehicle system operation control device for autonomous driving provided by the embodiment of the present application; Figure 5 It is a schematic block diagram of the structure of the electronic device provided by the embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0012] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, rather than all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the protection scope of the present application.

[0013] It should be noted that in the description of this application, the terms "including", "comprising" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not expressly listed, or elements inherent to such process, method, article or device. The terms "first", "second", etc. in this application are used to distinguish similar objects, rather than to describe a specific order or sequence.

[0014] To enable those skilled in the art of this technology to better understand the solution of this application, the following further detailed description of this application will be given in conjunction with the accompanying drawings and specific embodiments.

[0015] With the continuous development of technologies such as computers, pattern recognition, and artificial intelligence, more and more computer control technologies have been applied to automobiles to form autonomous driving technologies. An automotive autonomous driving system can be divided into multiple levels according to the degree of automation, such as the "L0" level corresponding to no automation, the "L1" level corresponding to assisted driving, the "L2" level corresponding to partial automation, the "L3" level corresponding to conditional automation, the "L4" level corresponding to high automation, and the "L5" level corresponding to full automation. In related technologies, different levels of autonomous driving systems have different computing power requirements for in-vehicle computing systems. For example, for an "L4" level autonomous driving system, its driving decisions are mainly controlled by the vehicle itself. To ensure the safety of autonomous driving, it is necessary to run high-precision and highly reliable algorithms such as automatic perception and decision-making planning on the in-vehicle computing system, and the operation of the algorithms requires a high computing power platform of 100 - 1000 TOPS to support. Among them, 1 TOPS represents that the processor can perform one trillion operations per second.

[0016] An embodiment of this application provides an in-vehicle computing system for autonomous driving, as Figure 1 shown, the system includes: At least two different architectures of computing modules that are communicatively connected to each other. Among them, the system-on-chip (SOC) integrated in the computing module under one architecture is used as the main system-on-chip (main SOC), and the system-on-chips integrated in the computing modules under the remaining other architectures are used as fault-tolerant system-on-chips. The computing power of the fault-tolerant system-on-chip is greater than or equal to the computing power of the main system-on-chip; Exemplarily, such as Figure 1As shown, the embodiment of the present application includes 3 computing modules. The main system-on-chip is integrated on computing module 1011, and the fault-tolerant system-on-chip is integrated on computing module 1012 and computing module 1013. The architectures of computing module 1011 and computing module 1012 are different, and the architectures of computing module 1012 and computing module 1013 may be the same or different. The embodiment of the present application does not limit the specific architecture types of the computing modules and the number of computing modules under each architecture. Those skilled in the art can set according to actual needs. For example, the main system-on-chip can be developed based on the Thor chip, and the fault-tolerant system-on-chip can be developed based on the J6 chip. In the embodiment of the present application, the computing power of the main system-on-chip is adaptively configured according to the requirements of the current target autonomous driving level. In the embodiment of the present application, the computing power of the main system-on-chip can be configured to at least meet the computing power requirements for running the target type functional algorithms (i.e., the critical path algorithms that affect safe driving) in the autonomous driving algorithms corresponding to the corresponding level. If the current target autonomous driving level is the "L4" level and the basic requirement for the computing power of the algorithms at this level is 1000 TOPS, the computing power of the main system-on-chip needs to be greater than or equal to 1000 TOPS. In the embodiment of the present application, the computing power configured by the main SOC is 1000 TOPS, so as to reduce the configuration cost while meeting the requirements of the corresponding level; the computing power of the fault-tolerant system-on-chip is greater than or equal to the computing power of the main system-on-chip to meet the fault-tolerant operation of the algorithms running on the main SOC.

[0017] The main system-on-chip and the fault-tolerant system-on-chip are used to run the autonomous driving algorithms corresponding to the autonomous driving system at the current target autonomous driving level and generate autonomous driving decision instructions. The functional types of the autonomous driving algorithms running on the main system-on-chip and the fault-tolerant system-on-chip are determined according to the relationship between the computing power required by the autonomous driving algorithms corresponding to the current target autonomous driving level and the computing power configured for the main system-on-chip; Exemplarily, at least some of the autonomous driving algorithms running on the fault-tolerant system-on-chip are the same as those on the main system-on-chip, and the same autonomous driving algorithms are run synchronously on the main system-on-chip and the fault-tolerant system-on-chip. The autonomous driving algorithms that can be run on the fault-tolerant system-on-chip can be exactly the same as those running on the main system-on-chip, or at least some of the autonomous driving algorithms are the same as those running on the main system-on-chip. Specifically, the functional types of the autonomous driving algorithms running on the main system-on-chip and the fault-tolerant system-on-chip are determined according to the computing power required by the autonomous driving algorithms corresponding to the current target autonomous driving level and the computing power configured for the main system-on-chip. If the computing power of the autonomous driving algorithms corresponding to the current target autonomous driving level is less than or equal to the computing power of the main system-on-chip configured for the corresponding autonomous driving system, all autonomous driving algorithms are controlled to run synchronously on the main system-on-chip and the fault-tolerant system-on-chip of the vehicle-mounted computing system; if the computing power of the autonomous driving algorithms corresponding to the current target autonomous driving level is greater than the computing power of the main system-on-chip configured for the corresponding autonomous driving system, the target functional algorithms in the autonomous driving algorithms are controlled to run synchronously on the main system-on-chip and the fault-tolerant system-on-chip of the vehicle-mounted computing system, and the remaining algorithms other than the target functional algorithms are executed by the remaining computing power in the main system-on-chip or the fault-tolerant system-on-chip. By running the same algorithms synchronously on the fault-tolerant system-on-chip and the main system-on-chip, a fault-tolerant operation for the algorithms running on the main system-on-chip is realized. At least some of the autonomous driving algorithms in the embodiments of the present application may include algorithms of the target functional type on the main system-on-chip, such as algorithms for perceiving obstacles in front of the vehicle running direction, vehicle positioning algorithms, and autonomous driving decision-making algorithms, etc., which ensure the safety of autonomous driving vehicles. By synchronously deploying and running the algorithms that ensure the safety of autonomous driving vehicles in the fault-tolerant system-on-chip and the main system-on-chip, when any chip fails, the other chip with fault-tolerant configuration can take over the synchronously running autonomous driving algorithms, ensuring the safety of the whole vehicle driving.

[0018] The system further includes a main control module 102 for responding to autonomous driving decision instructions.

[0019] Exemplarily, the main control module can be a Microcontroller Unit (MCU), and the MCU can adopt a high-performance TC497 chip. It can communicate and connect with the main system-level chip and the fault-tolerant system-level chip simultaneously to respond to the autonomous driving decision instructions generated by the main system-level chip and the fault-tolerant system-level chip. When the main system-level chip and the fault-tolerant system-level chip synchronously run the same algorithm to generate the autonomous driving decision instructions for the same function, it can selectively respond based on the pre-configured instruction selection strategy. For example, it can be configured to preferentially respond to the autonomous driving decision instructions generated by the main system-level chip. When the main system-level chip has problems such as hardware or communication failures, it responds to the autonomous driving decision instructions generated by the fault-tolerant system-level chip for the same function algorithm. The present application embodiment does not limit the instruction selection strategy, and those skilled in the art can configure it according to actual needs.

[0020] The on-vehicle computing system for autonomous driving provided by the embodiments of the present invention configures the main system-level chip and the fault-tolerant system-level chip under the heterogeneous architecture, and synchronously runs the same autonomous driving algorithm included in the heterogeneous architecture in the main system-level chip and the fault-tolerant system-level chip, ensuring that when a chip fails in any architecture, it can be timely switched to another chip with fault-tolerant configuration under other heterogeneous architectures to take over the synchronously running autonomous driving algorithm, thus ensuring the driving safety of the whole vehicle.

[0021] As an optional implementation manner of the embodiments of the present application, the system further includes a fault-tolerant control module, which is communicatively connected to the main control module, and the chip architecture of the fault-tolerant control module is different from that of the main control module. Exemplarily, the fault-tolerant control module is communicatively connected to the main control module and communicatively connected to the main system-level chip and the fault-tolerant system-level chip at the same time. The present application embodiment does not limit the number of fault-tolerant control modules. When there are multiple fault-tolerant control modules, the chip architectures of the multiple fault-tolerant control modules can be the same or different. By configuring the fault-tolerant control module for the main control module, it can avoid affecting the timely response to the autonomous driving decision instructions when the main control module fails, thereby affecting the driving safety of the autonomous driving vehicle. Moreover, by configuring the fault-tolerant control module under the heterogeneous architecture, because the architecture is different from the logic of the main control module, it can avoid the same fault affecting both the main control module and the fault-tolerant control module at the same time, improving the fault avoidance ability.

[0022] As an optional implementation manner of the embodiments of the present application, there are multiple computing modules where the fault-tolerant system-level chips are located, and there are multiple fault-tolerant control modules. Each fault-tolerant control module is integrally corresponding to and integrated in the computing module where the fault-tolerant system-level chip is located.

[0023] Exemplarily, such as Figure 2As shown in the figure, the computing module where the fault-tolerant system-on-chip is located includes computing module 1012 and computing module 1013. Fault-tolerant system-on-chip 1 (SOC1) is integrated in computing module 1012, and fault-tolerant system-on-chip 2 (SOC2) is integrated in computing module 1013. There are two fault-tolerant control modules, namely fault-tolerant control module 1 (MCU1) and fault-tolerant control module 2 (MCU2). Each fault-tolerant control module is integrated in the computing module where the fault-tolerant system-on-chip is located and is communicatively connected to the fault-tolerant system-on-chip in the computing module. That is, fault-tolerant control module 1 is communicatively connected to fault-tolerant system-on-chip 1 in corresponding computing module 1012, and fault-tolerant control module 2 is communicatively connected to fault-tolerant system-on-chip 2 in corresponding computing module 1013. By integrating multiple fault-tolerant control modules in each computing module where the fault-tolerant system-on-chip is located, it is possible to reduce data interaction latency, reduce communication energy consumption, while reducing the number and volume of chips and lowering the wiring cost.

[0024] As an optional implementation manner of an embodiment of the present application, the main control module is used to monitor the operating states of the main system-on-chip and the fault-tolerant system-on-chip. Any one of the multiple fault-tolerant control modules is used to monitor the operating states of the main control module, the main system-on-chip, and the remaining other fault-tolerant system-on-chips. The remaining other fault-tolerant system-on-chips refer to the other fault-tolerant system-on-chips except the fault-tolerant system-on-chip where the current fault-tolerant control module is located.

[0025] Exemplarily, as Figure 2 shown, main control module 102 is used to monitor the main system-on-chip, fault-tolerant system-on-chip 1, and fault-tolerant system-on-chip 2 in computing module 1011; fault-tolerant control module 1 is used to monitor main control module 102, the main system-on-chip, and fault-tolerant system-on-chip 2; fault-tolerant control module 2 is used to monitor main control module 102, the main system-on-chip, and fault-tolerant system-on-chip 1. This monitoring architecture realizes system-level fault detection and reliability guarantee through a multi-level and cross-monitoring mechanism. When an abnormality is detected, redundant switching is triggered in a timely manner. Each fault-tolerant control module not only monitors the main control module, but also monitors other fault-tolerant system-on-chips, forming a fault-tolerant mutual inspection to prevent the failure of a single monitoring node.

[0026] As an optional implementation manner of an embodiment of the present application, the system further includes: a plurality of Ethernet switches, and each Ethernet switch is communicatively connected to the main control module and the computing module.

[0027] Exemplarily, as Figure 2 shown, the main control module is interconnected with each computing module through Ethernet switch 103. In the embodiment of the present application, a plurality of Ethernet switches can be set. Figure 2Not all shown in the figure, the Ethernet switch can adopt two heterogeneous switches, namely the master and the slave. When the master Ethernet switch fails, the slave Ethernet switch takes over to achieve highly reliable communication between the main control module and the three computing modules, thereby realizing heterogeneous communication fault tolerance between the MCU and the SOC and heterogeneous dual-redundancy communication fault tolerance between the SOC and the SOC, avoiding the impact on vehicle driving safety caused by the failure of a single communication channel.

[0028] As an optional implementation manner of the embodiment of the present application, the mutually communicatively connected computing modules are connected through a high-speed serial bus and an Ethernet switch. Exemplarily, in the embodiment of the present application, the high-speed serial bus can be a PCIE bus, specifically as Figure 2 shown, in the first set of communication network, the computing module where the main system-level chip is located communicates with the computing module where the fault-tolerant system-level chip is located and between the computing modules where the two fault-tolerant system-level chips are located through the PCIE bus; the second set of network is to communicate through the Ethernet switch, and the three computing modules are simultaneously connected to the Ethernet switch, and they can communicate with each other through Ethernet. When a failure occurs in the PCIE communication physical hardware or communication link, it can be switched to the Ethernet communication link, thereby realizing heterogeneous communication fault tolerance between the three computing modules.

[0029] The in-vehicle computing system for autonomous driving provided by the embodiment of the present application runs algorithms such as perception, positioning, and decision-making planning for autonomous driving on the computing module. Its input can be various sensor data such as cameras, lidar, and millimeter-wave radars, and the output decision-making planning information is given to the main MCU, MCU1, and MCU2; the main MCU, MCU1, and MCU2 belong to the MCU safety control calculation, and they mainly run algorithms such as information security, functional safety, fault diagnosis, and control. Their input is the decision-making planning information of the system-level chip, and the output execution control information is sent to the chassis control system through the CAN port. Taking the current target autonomous driving level as "L4" as an example, the performance of the overall system can reach more than 2000 TOPS, where the main SOC provides 1000 TOPS of computing power, and SOC1 and SOC2 respectively provide 560 TOPS of computing power, so as to meet the high-performance computing power requirements of "L4" level autonomous driving.

[0030] The system can be backward compatible with the requirements of lower-level (such as L3 and L2) autonomous driving scenarios. Since the lower the autonomous driving level, the less computing power is required. In the current heterogeneous fault-tolerant system architecture, the hardware chips adopt a Pin-2-Pin compatibility design, that is, the number and functions of the chips remain unchanged, and lower-computing-power or lower-performance chips are used for the SOC and MCU. For example, for the L2-level autonomous driving scenario, the Thor chip can be replaced with the Orin chip, and for the J6 chip, a chip model with about half the computing power of the Orin chip can be selected, such as J6M, and the main MCU can be replaced with a slightly lower-performance MCU (such as TC397). The scalable design of the system greatly improves the versatility, flexibility and development cost of scenario adaptation of the system, and saves the development cycle.

[0031] An embodiment of the present application provides a method for controlling the operation of an in-vehicle system for autonomous driving, which is applied to an autonomous driving control system integrated with the in-vehicle computing system for autonomous driving in the above embodiment. The autonomous driving control system can select an open-source autonomous driving computing framework as the basic software system of the high-fault-tolerant in-vehicle software and transform it. The underlying layer supports the heterogeneous architecture chips (such as Thor chips and J6 chips) in the in-vehicle computing system in the above embodiment, enables it to support a unified operating system (such as Ubantu 22.04), uses the standardized infrastructure for robot development and the data distribution service as middleware, and ROS2 (the second generation of the robot operating system) as the upper-layer programming interface. The upper layer has autonomous driving algorithms such as autonomous driving perception and decision-making planning implemented based on ROS2, and corresponding algorithm components are selected from the framework to build an application algorithm Pipline. Based on the launch file "logging_simulator.launch.xml" in the computing framework as a template, algorithm pruning or addition is performed on it to form an algorithm carrier launch file. All algorithm piplines are started based on one launch file to complete the operation on the system-on-chip. As Figure 3 shown, the method includes the following steps: Step S201, if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is less than or equal to the computing power of the main system-on-chip configured for the autonomous driving system of the corresponding level, control the autonomous driving algorithm to run synchronously on the main system-on-chip and the fault-tolerant system-on-chip of the in-vehicle computing system; Exemplarily, taking the current automated driving level as "L4" as an example, assume that the computing power of the main system-level chip configured for the automated driving system at the current level is 1000 TOPS. If the computing power of the automated driving algorithm corresponding to the current target automated driving level is less than or equal to the computing power of the main system-level chip configured for the automated driving system at the corresponding level, it indicates that the automated driving algorithm of the current automated driving system can fully run on the main system-level chip. Since the algorithm of the fault-tolerant system-level chip is greater than or equal to the computing power of the main system-level chip, all automated driving algorithms are deployed on the fault-tolerant system-level chip, and the automated driving algorithm is controlled to run synchronously on the main system-level chip and the fault-tolerant system-level chip of the vehicle-mounted computing system. When the main system-level chip fails, the fault-tolerant system-level chip can take over in time to achieve full fault tolerance for all automated driving algorithms running on the main system-level chip. Step S202, if the computing power of the automated driving algorithm corresponding to the current target automated driving level is greater than the computing power of the main system-level chip configured for the automated driving system at the corresponding level, control the target function algorithm in the automated driving algorithm to run synchronously on the main system-level chip and the fault-tolerant system-level chip of the vehicle-mounted computing system, and the remaining algorithms other than the target function algorithm are executed by the remaining computing power in the main system-level chip or the fault-tolerant system-level chip.

[0032] Exemplarily, if the automated driving algorithm corresponding to the current target automated driving level is relatively complex and its computing power is greater than the computing power of the main system-level chip configured for the automated driving system at the corresponding level, such as the automated driving algorithm of the currently deployed "L4" level automated driving system exceeds 1000 TOPS, it indicates that all automated driving algorithms cannot fully run on the main system-level chip. To ensure the safety of automated driving, in the embodiments of the present application, the target function algorithm in the to-be-run automated driving algorithm is run synchronously on the main system-level chip and the fault-tolerant system-level chip. In the embodiments of the present application, the target function algorithm can be the algorithm corresponding to the key function to ensure the safety of automated driving, such as the algorithm for perceiving obstacles in front of the vehicle running direction, the vehicle positioning algorithm, and the automated driving decision-making algorithm, etc. The embodiments of the present application do not limit the type of the target function algorithm, and those skilled in the art can set it according to the running safety needs and the computing power configuration of the main system-level chip; by running the target function algorithm synchronously on the main system-level chip and the fault-tolerant system-level chip of the vehicle-mounted computing system, the fault tolerance configuration of the key path algorithm in the automated driving system is realized.

[0033] The remaining algorithms other than the target functional algorithm are executed by the remaining computing power in the main system-on-chip or the fault-tolerant system-on-chip. That is, due to the limitation of the overall configured computing power, the main system-on-chip and the fault-tolerant system-on-chip can only ensure the fault-tolerant configuration for the target functional algorithm. For the algorithms other than the target functional algorithm, either the main system-on-chip or the fault-tolerant system-on-chip can be selected to run. It is necessary to ensure that while the remaining algorithms can be deployed and run, the computing power occupied by the target functional algorithm with fault-tolerant configuration and the computing power occupied by the remaining algorithms are less than or equal to the total computing power configured by the main system-on-chip and the fault-tolerant system-on-chip. For example, the computing power configured by the main system-on-chip is 1000 TOPS, and the computing power configured by the fault-tolerant system-on-chip is 1120 TOPS. If the computing power of the current autonomous driving algorithm to be run is 1200 TOPS, it can be seen that the computing power of the main system-on-chip does not meet the computing power requirements for running all algorithms. At this time, the target functional algorithm that requires 900 TOPS of computing power can be selected from all autonomous driving algorithms and run on the main system-on-chip and the fault-tolerant system-on-chip. At this time, the remaining computing power of the main system-on-chip is 100 TOPS, and the remaining computing power of the fault-tolerant system-on-chip is 220 TOPS. The computing power requirement for the remaining algorithms of the autonomous driving algorithm is 300 TOPS. The remaining algorithms can be respectively deployed on the main system-on-chip or the fault-tolerant system-on-chip (for example, 100 TOPS is deployed on the main system-on-chip, and the remaining 200 TOPS of the algorithm is deployed on the fault-tolerant system-on-chip), that is, the operation of the remaining algorithms can be realized. In the embodiment of the present application, the remaining algorithms can be detection methods for obstacles on the side or rear of the vehicle, etc. That is, when the main system-on-chip fails, the fault-tolerant system-on-chip can achieve real-time takeover, so as to realize the heterogeneous fault-tolerant calculation of the critical path algorithm running on the system-on-chip and the critical path algorithm running on the fault-tolerant system-on-chip. This fault-tolerant method realizes the flexible expansion of the system and meets the requirements of higher computing power scenarios while ensuring system fault tolerance.

[0034] Step S203: The main control module of the vehicle-mounted computing system responds to the autonomous driving decision instruction generated by the main system-on-chip and / or the fault-tolerant system-on-chip based on the running autonomous driving algorithm, and performs the autonomous driving operation corresponding to the autonomous driving decision instruction on the autonomous driving vehicle.

[0035] Exemplarily, the main control module simultaneously receives the autonomous driving decision instructions generated by the main system-on-chip and the fault-tolerant system-on-chip. When the main system-on-chip and the fault-tolerant system-on-chip synchronously run the same algorithm to generate the autonomous driving decision instructions for the same function, it can select one response based on the pre-configured instruction selection strategy. For example, it can be configured to preferentially respond to the autonomous driving decision instructions generated by the main system-on-chip. When problems such as hardware or communication failures occur in the main system-on-chip, it responds to the autonomous driving decision instructions generated by the fault-tolerant system-on-chip for the same function algorithm. The embodiments of the present application do not limit the instruction selection strategy, and those skilled in the art can configure it according to actual needs. If any function algorithm only runs on the main system-on-chip or the fault-tolerant system-on-chip, such that only one autonomous driving decision instruction is generated for the same function, at this time, the main control module can execute the autonomous driving operation corresponding to the autonomous driving decision instruction based on the received autonomous driving decision instruction. Specifically, for example, if the autonomous driving decision instruction is a steering instruction, that is, the main control module can send a steering control instruction to the vehicle chassis control system to control the autonomous driving vehicle to steer. The main control module can monitor the hardware faults of the SOC. When the SOC fails, the MCU can issue instructions to control the autonomous driving vehicle, such as pulling over to the side of the road, etc., to ensure the safety of autonomous driving.

[0036] The vehicle-mounted system operation control method for autonomous driving provided by the embodiments of the present application configures the algorithms running on the main system-on-chip and the fault-tolerant system-on-chip based on the configured computing power of the heterogeneous architecture and the computing power requirements of the autonomous driving algorithms at the current level, and synchronously runs the same autonomous driving algorithms included in the heterogeneous architecture on the main system-on-chip and the fault-tolerant system-on-chip, ensuring that when a chip fails in any architecture, it can be timely switched to another chip with fault-tolerant configuration in other heterogeneous architectures to take over the synchronously running autonomous driving algorithms, thus ensuring the safety of the whole vehicle during driving.

[0037] As an optional implementation manner of the embodiments of the present application, the vehicle-mounted computing system includes multiple fault-tolerant system-on-chips; the method further includes: if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is less than or equal to the computing power of the main system-on-chip configured for the autonomous driving system at the corresponding level, controlling the first function type algorithm in the autonomous driving algorithm to run on any one of the fault-tolerant system-on-chips, and the remaining other function type algorithms to run on the remaining other fault-tolerant system-on-chips.

[0038] Exemplarily, if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is less than or equal to the computing power of the main system-level chip configured for the autonomous driving system of the corresponding level, it indicates that the autonomous driving algorithm of the current autonomous driving system can fully run on the main system-level chip. Since the algorithm of the fault-tolerant system-level chip is greater than or equal to the computing power of the main system-level chip, all the autonomous driving algorithms are deployed on the fault-tolerant system-level chip. The in-vehicle computing system in the embodiments of the present application includes multiple fault-tolerant system-level chips. The algorithms running on the fault-tolerant system-level chips can be divided into multiple partial algorithms and run on the corresponding fault-tolerant system-level chips respectively to achieve load balancing of the multiple fault-tolerant system-level chips. Specifically, taking the in-vehicle computing system including two fault-tolerant system-level chips as an example in the embodiments of the present application, the computing algorithms such as data reception, processing, and perception that are closely related to sensor data on the main system-level chip are copied to one of the fault-tolerant system-level chips, and other algorithms such as positioning, route planning, and control are copied to the other fault-tolerant system-level chip. The copied algorithm nodes are added to the "logging_simulator.launch.xml" file, and the main SOC forms algorithm fault tolerance with SOC1 and SOC2. The entire system will simultaneously run two sets of the same perception, fusion, and positioning algorithms.

[0039] As an optional implementation manner of the embodiments of the present application, the method further includes: for the main system-level chip and the fault-tolerant system-level chip that synchronously run the same autonomous driving algorithm, if the corresponding upstream chip node includes the corresponding fault-tolerant node, subscribing to the first output result of the algorithm running on the upstream chip node and the second output result of the algorithm running on the fault-tolerant node corresponding to the upstream chip node; inputting the target output result into the main system-level chip and the fault-tolerant system-level chip, where the target output result is determined according to the first output result or the second output result; controlling the currently to-be-run autonomous driving algorithm corresponding to the main system-level chip and the fault-tolerant system-level chip to run based on the target output result; and sending the operation result to the downstream chip node, where the downstream chip node is the node that subscribes to the operation data of the autonomous driving algorithm on the main system-level chip and the fault-tolerant system-level chip.

[0040] Exemplarily, for a main system-on-chip and a fault-tolerant system-on-chip that synchronously run the same autonomous driving algorithm, in order to ensure the consistency of the running results of the same autonomous driving algorithm running synchronously, each algorithm running synchronously on the main system-on-chip and the fault-tolerant system-on-chip should not only subscribe to the algorithm output of its upstream chip node, but also subscribe to the output of the fault-tolerant algorithm of the corresponding fault-tolerant node of its upstream chip node. Similarly, each algorithm should not only publish the result to the algorithm running on its downstream chip node. If its downstream chip node is configured with a corresponding fault-tolerant node, it should also publish it to the corresponding fault-tolerant node of its downstream chip node; for the autonomous driving decision instructions for the same function sent down by the upstream node and the corresponding fault-tolerant node, one of the autonomous driving decision instructions can be selected as the input of the current chip node based on the configured instruction selection strategy. As an optional implementation manner of this application, the method further includes: Step a1, if any downstream chip node subscribes to the running results of the autonomous driving algorithms running synchronously on the main system-on-chip and the fault-tolerant system-on-chip, determine whether the communication metric parameters between the main system-on-chip and the fault-tolerant system-on-chip meet the preset requirements; Exemplarily, for the autonomous driving algorithms configured with fault tolerance on the main system-on-chip and the fault-tolerant system-on-chip, they will run synchronously on the main system-on-chip and the fault-tolerant system-on-chip, so that the main system-on-chip and the fault-tolerant system-on-chip will simultaneously send down the corresponding autonomous driving decision instructions. If any downstream chip node subscribes to the running results of the autonomous driving algorithms running synchronously on the main system-on-chip and the fault-tolerant system-on-chip, for example, the perception algorithm subscribes to both the output of its upstream positioning algorithm (running on the main system-on-chip) and the output of the corresponding fault-tolerant positioning algorithm of this positioning algorithm (running on the fault-tolerant system-on-chip). Whether the perception algorithm finally uses the output of the positioning algorithm running on the main system-on-chip or the output of the positioning algorithm running on the fault-tolerant system-on-chip, it is necessary to determine whether the communication metric parameters between the main system-on-chip and the fault-tolerant system-on-chip meet the preset requirements. In the embodiments of this application, the communication metric parameters may include parameters such as communication frequency and communication time.

[0041] Step a2, if the communication metric parameters meet the preset requirements, determine whether the autonomous driving algorithm running on the main system-on-chip is a preset function type algorithm; Exemplarily, if whether the communication metric parameters meet the preset requirements indicates normal communication, it means that the running states of the dual heterogeneous chips are synchronized and the fault tolerance mechanism is effective. Determine whether the autonomous driving algorithm currently running on the main system chip is a preset function type algorithm (such as algorithms that have a greater impact on driving safety, such as positioning, planning, or sensor data calculation, etc.). The type of this preset function type algorithm is not limited in the embodiments of this application, and those skilled in the art can determine it according to actual needs.

[0042] Step a3, if the autonomous driving algorithm is a preset function type algorithm, respond to the detection operation of the running result of the preset function type algorithm; Exemplarily, in the embodiment of the present application, the detection operation method for the running result of the preset function type algorithm may be to call the algorithm running accuracy detection algorithm of the corresponding type to detect the accuracy of the autonomous driving algorithm running on the main system-level chip.

[0043] Step a4, if the running result of the preset function type algorithm meets the requirements, use the running result corresponding to the main system-level chip as the input of the downstream chip node; if the running result of the preset function type algorithm does not meet the requirements, use the running result corresponding to the fault-tolerant system-level chip as the input of the downstream chip node.

[0044] As an optional implementation manner of the embodiment of the present application, the method further includes: if the autonomous driving algorithm is a non-preset function type algorithm, use the running result corresponding to the main system-level chip as the input of the downstream chip node; when the main system-level chip fails, use the running result corresponding to the fault-tolerant system-level chip as the input of the downstream chip node. By detecting the communication state and the running result to determine the input of the downstream chip node, it is ensured that the key functions can still run continuously and stably through the fault switching mechanism in the case of chip-level failures, improving the running safety and reliability of the autonomous driving system.

[0045] As an optional implementation manner of the embodiment of the present application, responding to the detection operation of the running result of the preset function type algorithm includes: according to the type of the algorithm to be detected, calling the error detection algorithm of the corresponding type; based on the called error detection algorithm, responding to the error detection operation of the running result of the preset function type algorithm. Exemplarily, taking the preset function type of autonomous driving algorithm currently running on the main system-level chip as any one of the positioning algorithm, path planning algorithm, or sensor algorithm as an example, the system is pre-integrated with a positioning error monitoring algorithm, a path planning error monitoring algorithm, and a sensor error monitoring algorithm. Based on the function type of the algorithm to be detected currently, call the corresponding error detection algorithm to perform error detection on the data output by the main system-level chip response type algorithm. If the errors are all within the preset error range, it indicates that the data output by the main system-level chip meets the requirements.

[0046] As an alternative implementation of the present application, the in-vehicle computing system includes multiple fault-tolerant control modules, and the method further includes: when the main control module in the in-vehicle computing system fails, any one of the multiple fault-tolerant control modules is used as the new main control module to respond to receiving the autonomous driving decision instruction and controlling the autonomous driving vehicle; when the new main control module fails, a new main control module is determined from the remaining other fault-tolerant control modules in response. Exemplarily, the fault-tolerant control module monitors the operating state of the main control module. When it monitors that the main control module in the in-vehicle computing system fails, any one of the multiple fault-tolerant control modules is used as the new main control module to respond to receiving the autonomous driving decision instruction and controlling the autonomous driving vehicle. When the new main control module fails, a new main control module is determined from the remaining other fault-tolerant control modules in response. By designing a dynamic switching mechanism between the main control module and the fault-tolerant control module in the in-vehicle computing system, it is ensured that the autonomous driving function can still operate continuously and stably in the scenario of hardware failure. As an alternative implementation of the present application, the autonomous driving algorithm runs synchronously on the main system-on-chip and the fault-tolerant system-on-chip of the in-vehicle computing system. The main control module and the fault-tolerant control module can monitor the hardware failures of the corresponding main system-on-chip and / or fault-tolerant system-on-chip according to the monitoring configuration strategy; the method further includes: Step b1, if a hardware failure occurs in the main system-on-chip or the fault-tolerant system-on-chip, control the autonomous driving vehicle to perform autonomous driving according to the current autonomous driving level. Exemplarily, taking the autonomous driving level of the current autonomous driving system as the "L4" level as an example, when it is monitored that any one of the main system-on-chip and the fault-tolerant system-on-chip fails, since the current autonomous driving algorithm runs synchronously on the main system-on-chip and the fault-tolerant system-on-chip of the in-vehicle computing system, that is, complete fault tolerance of the autonomous driving algorithm is achieved. Therefore, when any SOC fails, the SOC where the fault-tolerant algorithm is located runs the corresponding algorithm and takes over the algorithm running on the faulty hardware, so that the autonomous driving system still performs autonomous driving at the current autonomous driving level of "L4". When it is monitored that all the fault-tolerant system-on-chips fail simultaneously while the main system-on-chip does not fail, since all the autonomous driving algorithms run on the main system-on-chip, the autonomous driving can still be performed at the current autonomous driving level of "L4" when the fault-tolerant system-on-chip where the fault-tolerant algorithm is located cannot operate normally.

[0047] Step b2, if hardware failures occur in both the main system-on-chip and the fault-tolerant system-on-chip, control the main control module to send a parking instruction to the vehicle chassis control system. Exemplarily, when it is monitored that hardware failures occur in both the main system-on-chip and the fault-tolerant system-on-chip, control the main control module to send a parking instruction to the vehicle chassis control system, so that the vehicle performs a side parking operation. As an alternative embodiment of the present application, the target function algorithm in the autonomous driving algorithm runs synchronously on the main system-level chip and the fault-tolerant system-level chip of the in-vehicle computing system, and the remaining algorithms other than the target function algorithm are executed by the remaining computing power in the main system-level chip or the fault-tolerant system-level chip. The method further includes: Step c1, if a hardware failure occurs in the main system-level chip or the fault-tolerant system-level chip, control the autonomous driving vehicle to perform autonomous driving according to the degraded autonomous driving level. Exemplarily, still taking the autonomous driving level of the current autonomous driving system as the "L4" level as an example, when it is monitored that a hardware failure occurs in any one of the main system-level chip and the fault-tolerant system-level chip, since the current fault-tolerant strategy is to perform fault-tolerant configuration on the target function algorithm in the autonomous driving algorithm and run it synchronously on the main system-level chip and the fault-tolerant system-level chip, and the remaining algorithms other than the target function algorithm are not configured with fault tolerance. To ensure the running safety of the autonomous driving vehicle, control the autonomous driving vehicle to perform autonomous driving according to the degraded autonomous driving level, such as downgrading the autonomous driving system level from the current "L4" level to the "L2" level to enhance the manual control part of the vehicle. When there is no hardware failure in the main system-level chip but a hardware failure occurs in the fault-tolerant system-level chip, since all the key path algorithms of autonomous driving are run on the main system-level chip, the driving safety on the key path of autonomous driving can be basically ensured. At this time, the autonomous driving system can be downgraded from the current "L4" level to the "L2" level.

[0048] Step c2, if hardware failures occur in both the main system-level chip and the fault-tolerant system-level chip, control the main control module to send a parking instruction to the vehicle chassis control system. Exemplarily, when it is monitored that hardware failures occur in both the main system-level chip and the fault-tolerant system-level chip, control the main control module to send a parking instruction to the vehicle chassis control system, so that the vehicle performs a side parking operation.

[0049] As an alternative embodiment of the present application, after controlling the main control module to send a parking instruction to the vehicle chassis control system, the method further includes: if the main control module is configured with an auxiliary driving function of a target type, control the autonomous driving vehicle to perform autonomous driving in combination with the auxiliary driving function.

[0050] Exemplarily, after controlling the main control module to send a parking instruction to the vehicle chassis control system, the autonomous driving level can be downgraded from the "L4" level to the "L1" level. If the main control module in the in-vehicle computing system at the "L1" level is configured with auxiliary driving functions such as automatic parking or panoramic imaging, auxiliary parking can be performed based on the auxiliary driving function at the "L1" level.

[0051] The vehicle-mounted system operation control method for autonomous driving provided by the embodiments of the present application, on the basis of hardware fault tolerance design, performs fault tolerance at the software algorithm level by deploying an autonomous driving computing framework platform, realizes software and hardware collaborative fault tolerance design, and considers the high performance of the overall system, meets the high computing power requirements of autonomous driving scenarios at the corresponding autonomous driving level while realizing the safety and reliability of the overall system. The overall vehicle-mounted computing system realizes fault tolerance at four levels: SOC computing, MCU safety control computing, communication, and algorithms, so as to achieve the overall high fault tolerance of the system.

[0052] Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be implemented by means of software plus a necessary general hardware platform. Of course, it can also be implemented by hardware, but in many cases, the former is a better implementation method.

[0053] The embodiments of the present application also provide a vehicle-mounted system operation control device for autonomous driving, which is applied to an autonomous driving control system integrated with the vehicle-mounted computing system for autonomous driving in the above embodiments; as Figure 4 shown, the device includes: A first control module 301, configured to control the autonomous driving algorithm to run synchronously on the main system-level chip and the fault-tolerant system-level chip of the vehicle-mounted computing system if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is less than or equal to the computing power of the main system-level chip configured for the autonomous driving system of the corresponding level; A second control module 302, configured to control the target function algorithm in the autonomous driving algorithm to run synchronously on the main system-level chip and the fault-tolerant system-level chip of the vehicle-mounted computing system if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is greater than the computing power of the main system-level chip configured for the autonomous driving system of the corresponding level, and the remaining algorithms other than the target function algorithm are executed by the remaining computing power in the main system-level chip or the fault-tolerant system-level chip; A first response module 303, configured to respond to the autonomous driving decision instruction generated by the main system-level chip and / or the fault-tolerant system-level chip based on the running autonomous driving algorithm through the main control module of the vehicle-mounted computing system, and perform the autonomous driving operation corresponding to the autonomous driving decision instruction on the autonomous driving vehicle. For specific reference, see the description of the corresponding steps in the above method embodiments, and details are not described herein again.

[0054] The on-vehicle system operation control device for autonomous driving provided by the embodiment of the present application configures the algorithms running on the main system-level chip and the fault-tolerant system-level chip based on the configured computing power of the main system-level chip and the fault-tolerant system-level chip under the heterogeneous architecture and the computing power requirements of the autonomous driving algorithm at the current level, and synchronously runs the same autonomous driving algorithm included under the heterogeneous architecture on the main system-level chip and the fault-tolerant system-level chip, ensuring that when a chip fails in any architecture, it can be timely switched to another chip with a fault-tolerant configuration under other heterogeneous architectures to take over the synchronously running autonomous driving algorithm, thus ensuring the driving safety of the whole vehicle.

[0055] As an optional implementation manner of the embodiment of the present application, the on-vehicle computing system includes multiple fault-tolerant system-level chips; the device further includes: a third control module, configured to control the first functional type algorithm in the autonomous driving algorithm to run on any one of the fault-tolerant system-level chips and the remaining other functional type algorithms to run on the remaining other fault-tolerant system-level chips if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is less than or equal to the computing power of the main system-level chip configured for the autonomous driving system at the corresponding level.

[0056] As an optional implementation manner of the embodiment of the present application, the device further includes: a subscription module, configured to subscribe to the first output result of the algorithm running on the upstream chip node and the second output result of the algorithm running on the fault-tolerant node corresponding to the upstream chip node if the corresponding upstream chip node includes a corresponding fault-tolerant node for the main system-level chip and the fault-tolerant system-level chip that synchronously run the same autonomous driving algorithm; an input module, configured to input a target output result into the main system-level chip and the fault-tolerant system-level chip, where the target output result is determined according to the first output result or the second output result; a fourth control module, configured to control the currently to-be-run autonomous driving algorithm corresponding to the main system-level chip and the fault-tolerant system-level chip to run based on the target output result; and a distribution module, configured to distribute the operation result to the downstream chip node, where the downstream chip node is a node that subscribes to the operation data of the autonomous driving algorithm on the main system-level chip and the fault-tolerant system-level chip.

[0057] As an alternative implementation manner of an embodiment of the present application, the device further includes: a judgment module, configured to judge whether communication metric parameters between the main system-on-chip and the fault-tolerant system-on-chip meet preset requirements if any downstream chip node subscribes to the operation results of the autonomous driving algorithms running synchronously on the main system-on-chip and the fault-tolerant system-on-chip; a first determination module, configured to determine whether the autonomous driving algorithm running on the main system-on-chip is a preset function type algorithm if the communication metric parameters meet the preset requirements; a second response module, configured to respond to the detection operation of the operation results of the preset function type algorithm if the autonomous driving algorithm is a preset function type algorithm; a second determination module, configured to use the operation results corresponding to the main system-on-chip as the input for the downstream chip node if the operation results of the preset function type algorithm meet the requirements; a third determination module, configured to use the operation results corresponding to the fault-tolerant system-on-chip as the input for the downstream chip node if the operation results of the preset function type algorithm do not meet the requirements. As an alternative implementation manner of an embodiment of the present application, the device further includes: a fourth determination module, configured to use the operation results corresponding to the main system-on-chip as the input for the downstream chip node if the autonomous driving algorithm is not a preset function type algorithm; a fifth determination module, configured to use the operation results corresponding to the fault-tolerant system-on-chip as the input for the downstream chip node when the main system-on-chip fails. As an alternative implementation manner of an embodiment of the present application, the second response module includes: a call sub-module, configured to call an error detection algorithm of a corresponding type according to the type of the algorithm to be detected; a detection sub-module, configured to respond to the error detection operation of the operation results of the preset function type algorithm based on the called error detection algorithm.

[0058] As an alternative implementation manner of an embodiment of the present application, the vehicle-mounted computing system includes multiple fault-tolerant control modules; the device further includes: a sixth determination module, configured to use any one of the multiple fault-tolerant control modules as a new main control module to respond to receiving an autonomous driving decision instruction and controlling an autonomous driving vehicle when the main control module in the vehicle-mounted computing system fails; a third response module, configured to respond to determining a new main control module from the remaining other fault-tolerant control modules when the new main control module fails.

[0059] As an alternative embodiment of the embodiment of the present application, the autonomous driving algorithm runs synchronously on the main system-level chip and the fault-tolerant system-level chip of the in-vehicle computing system. The device further includes: a fifth control module, configured to control the autonomous driving vehicle to perform autonomous driving according to the current autonomous driving level if a hardware failure occurs in the main system-level chip or the fault-tolerant system-level chip; a sixth control module, configured to control the autonomous driving vehicle to perform autonomous driving according to the current autonomous driving level if no hardware failure occurs in the main system-level chip but a hardware failure occurs in the fault-tolerant system-level chip; a seventh control module, configured to control the main control module to send a parking instruction to the vehicle chassis control system if hardware failures occur in both the main system-level chip and the fault-tolerant system-level chip.

[0060] As an alternative embodiment of the embodiment of the present application, the target function algorithm in the autonomous driving algorithm runs synchronously on the main system-level chip and the fault-tolerant system-level chip of the in-vehicle computing system, and the remaining algorithms other than the target function algorithm are executed by the remaining computing power in the main system-level chip or the fault-tolerant system-level chip. The device further includes: an eighth control module, configured to control the autonomous driving vehicle to perform autonomous driving according to the degraded autonomous driving level if a hardware failure occurs in the main system-level chip or the fault-tolerant system-level chip; a ninth control module, configured to control the autonomous driving vehicle to perform autonomous driving according to the degraded autonomous driving level if no hardware failure occurs in the main system-level chip but a hardware failure occurs in the fault-tolerant system-level chip; a tenth control module, configured to control the main control module to send a parking instruction to the vehicle chassis control system if hardware failures occur in both the main system-level chip and the fault-tolerant system-level chip.

[0061] As an alternative embodiment of the embodiment of the present application, the device further includes: an auxiliary module, configured to control the autonomous driving vehicle to perform autonomous driving in combination with the assisted driving function if the main control module is configured with an assisted driving function of a target type. For the description of the features in the corresponding embodiment of the in-vehicle system operation control device for autonomous driving, reference may be made to the relevant description in the corresponding embodiment of the in-vehicle system operation control method for autonomous driving, which will not be elaborated here one by one.

[0062] An embodiment of the present application further provides an electronic device, as Figure 5 shown, including a memory 10 and a processor 20. A computer program is stored in the memory 10, and the processor 20 is configured to run the computer program to execute the steps in any of the above embodiments of the in-vehicle system operation control method for autonomous driving.

[0063] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. The computer program is configured to execute the steps in any of the above embodiments of the in-vehicle system operation control method for autonomous driving when running.

[0064] In an exemplary embodiment, the above computer-readable storage medium may include, but is not limited to: various media such as USB flash drives, read-only memory (ROM), random access memory (RAM), external hard drives, magnetic disks, or optical discs that can store computer programs.

[0065] The embodiments of the present application further provide a computer program product. The above computer program product includes a computer program, and when the computer program is executed by a processor, it implements the steps in any of the above embodiments of the method for controlling the operation of an in-vehicle system for autonomous driving.

[0066] The embodiments of the present application further provide another computer program product, including a non-volatile computer-readable storage medium. The non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, it implements the steps in any of the above embodiments of the method for controlling the operation of an in-vehicle system for autonomous driving.

[0067] Those skilled in the art can further realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. To clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described according to functions in the above description. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Skilled professionals can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present application.

[0068] The above has provided a detailed introduction to an in-vehicle computing system and a method, device, electronic device, storage medium, and computer program product for controlling the operation of an in-vehicle system for autonomous driving provided by the present application. Specific examples are used in this article to elaborate on the principles and implementation manners of the present application. The description of the above embodiments is only used to help understand the method and its core idea of the present application. It should be noted that for those of ordinary skill in the art in this technical field, without departing from the principle of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the protection scope of the claims of the present application.

Claims

1. An in-vehicle computing system for autonomous driving, characterized in that, The system includes: At least two computing modules with different architectures and communicatively connected to each other. Among them, the system-on-chip integrated in the computing module under one architecture serves as the main system-on-chip, and the system-on-chips integrated in the computing modules under the remaining other architectures serve as fault-tolerant system-on-chips. The computing power of the fault-tolerant system-on-chip is greater than or equal to the computing power of the main system-on-chip; The main system-on-chip and the fault-tolerant system-on-chip are used to run the autonomous driving algorithms corresponding to the autonomous driving system at the target autonomous driving level and generate autonomous driving decision instructions. The functional types of the autonomous driving algorithms running on the main system-on-chip and the fault-tolerant system-on-chip are determined according to the relationship between the computing power required by the autonomous driving algorithms corresponding to the current target autonomous driving level and the computing power configured for the main system-on-chip; The system further includes a main control module for responding to the autonomous driving decision instructions.

2. The on-vehicle computing system for autonomous driving according to claim 1, characterized in that, The system further includes a fault-tolerant control module communicatively connected to the main control module, and the chip architecture of the fault-tolerant control module is different from that of the main control module.

3. The vehicle-mounted computing system for autonomous driving according to claim 2, wherein: There are multiple computing modules where the fault-tolerant system-on-chips are located, and there are multiple fault-tolerant control modules. Each fault-tolerant control module is integrally corresponding and integrated in the computing module where the fault-tolerant system-on-chip is located.

4. The vehicle-mounted computing system for autonomous driving according to claim 3, wherein: The main control module is used to monitor the operating states of the main system-on-chip and the fault-tolerant system-on-chip. Any one of the multiple fault-tolerant control modules is used to monitor the operating states of the main control module, the main system-on-chip, and the remaining other fault-tolerant system-on-chips. The remaining other fault-tolerant system-on-chips refer to the other fault-tolerant system-on-chips except the fault-tolerant system-on-chip where the current fault-tolerant control module is located.

5. The vehicle-mounted computing system for autonomous driving according to claim 3, wherein The system further includes: multiple Ethernet switches, and each Ethernet switch is communicatively connected to the main control module and the computing module.

6. The in-vehicle computing system for autonomous driving according to claim 5, characterized in that, The communicatively connected computing modules are connected through a high-speed serial bus and the Ethernet switch.

7. A method for controlling the operation of an on-board system for autonomous driving, characterized in that: An autonomous driving control system applied to an on-vehicle computing system for autonomous driving integrated as described in any one of claims 1-6; The method includes: If the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is less than or equal to the computing power of the main system-on-chip configured for the autonomous driving system at the corresponding level, control the autonomous driving algorithm to run synchronously on the main system-on-chip and the fault-tolerant system-on-chip of the on-vehicle computing system; If the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is greater than the computing power of the main system-on-chip configured for the autonomous driving system at the corresponding level, control the target functional algorithm in the autonomous driving algorithm to run synchronously on the main system-on-chip and the fault-tolerant system-on-chip of the on-vehicle computing system, and the remaining algorithms except the target functional algorithm are executed by the remaining computing power in the main system-on-chip or the fault-tolerant system-on-chip; The main control module of the in-vehicle computing system executes the corresponding autonomous driving operation of the autonomous driving decision instruction for the autonomous driving vehicle in response to the autonomous driving decision instruction generated by the main system-on-chip and / or the fault-tolerant system-on-chip based on the running autonomous driving algorithm.

8. The method for controlling the operation of an in-vehicle system for autonomous driving according to claim 7, wherein The in-vehicle computing system includes multiple fault-tolerant system-on-chips; the method further includes: If the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is less than or equal to the computing power of the main system-on-chip configured for the autonomous driving system of the corresponding level, control the first functional type algorithm in the autonomous driving algorithm to run on any one of the fault-tolerant system-on-chips, and the remaining other functional type algorithms to run on the remaining other fault-tolerant system-on-chips.

9. The method for operating and controlling an in-vehicle system for autonomous driving according to claim 7, wherein The method further includes: For the main system-on-chip and the fault-tolerant system-on-chip that synchronously run the same autonomous driving algorithm, if the corresponding upstream chip node includes the corresponding fault-tolerant node, subscribe to the first output result of the algorithm running on the upstream chip node and the second output result of the algorithm running on the corresponding fault-tolerant node of the upstream chip node; Input the target output result into the main system-on-chip and the fault-tolerant system-on-chip, where the target output result is determined according to the first output result or the second output result; Control the currently to-be-run autonomous driving algorithm corresponding to the main system-on-chip and the fault-tolerant system-on-chip to run based on the target output result; Send the operation result to the downstream chip node, where the downstream chip node is the node that subscribes to the operation data of the autonomous driving algorithm on the main system-on-chip and the fault-tolerant system-on-chip.

10. The vehicle-mounted system operation control method for autonomous driving according to claim 9, characterized in that: The method further includes: If any downstream chip node subscribes to the operation results of the autonomous driving algorithms synchronously running on the main system-on-chip and the fault-tolerant system-on-chip, determine whether the communication metric parameters between the main system-on-chip and the fault-tolerant system-on-chip meet the preset requirements; If the communication metric parameters meet the preset requirements, determine whether the autonomous driving algorithm running on the main system-on-chip is a preset functional type algorithm; If the autonomous driving algorithm is a preset functional type algorithm, respond to the detection operation of the operation result of the preset functional type algorithm; If the operation result of the preset functional type algorithm meets the requirements, use the operation result corresponding to the main system-on-chip as the input for the downstream chip node; If the operation result of the preset functional type algorithm does not meet the requirements, use the operation result corresponding to the fault-tolerant system-on-chip as the input for the downstream chip node.

11. The method for operating and controlling an in-vehicle system for autonomous driving according to claim 10, characterized in that, The method further includes: If the autonomous driving algorithm is a non-preset functional type algorithm, use the operation result corresponding to the main system-on-chip as the input for the downstream chip node; When the main system-on-chip fails, use the operation result corresponding to the fault-tolerant system-on-chip as the input for the downstream chip node.

12. The method for controlling the operation of an in-vehicle system for autonomous driving according to claim 10, wherein The responding to the detection operation of the operation result of the preset functional type algorithm includes: According to the type of the algorithm to be detected, call the corresponding type of error detection algorithm; Based on the called error detection algorithm, respond to the error detection operation of the operation result of the preset functional type algorithm.

13. The method for controlling the operation of an in-vehicle system for autonomous driving according to claim 7, characterized in that, The in-vehicle computing system includes multiple fault-tolerant control modules; the method further includes: When the main control module in the in-vehicle computing system fails, any one of the multiple fault-tolerant control modules is used as the new main control module to respond to receiving an autonomous driving decision instruction and controlling an autonomous driving vehicle; When the new main control module fails, respond to determining a new main control module from the remaining other fault-tolerant control modules.

14. The vehicle-mounted system operation control method for autonomous driving according to claim 13, characterized in that: The autonomous driving algorithm runs synchronously on the main system-on-chip and the fault-tolerant system-on-chip of the in-vehicle computing system, and the method further includes: If a hardware failure occurs in the main system-on-chip or the fault-tolerant system-on-chip, control the autonomous driving vehicle to perform autonomous driving according to the current autonomous driving level; If hardware failures occur in both the main system-on-chip and the fault-tolerant system-on-chip, control the main control module to send a parking instruction to the vehicle chassis control system.

15. The vehicle-mounted system operation control method for autonomous driving according to claim 13, characterized in that: The target function algorithm in the autonomous driving algorithm runs synchronously on the main system-on-chip and the fault-tolerant system-on-chip of the in-vehicle computing system, and the remaining algorithms other than the target function algorithm are executed by the remaining computing power in the main system-on-chip or the fault-tolerant system-on-chip, and the method further includes: If a hardware failure occurs in the main system-on-chip or the fault-tolerant system-on-chip, control the autonomous driving vehicle to perform autonomous driving according to the degraded autonomous driving level; If hardware failures occur in both the main system-on-chip and the fault-tolerant system-on-chip, control the main control module to send a parking instruction to the vehicle chassis control system.

16. The method for controlling the operation of an in-vehicle system for autonomous driving according to claim 14 or 15, characterized in that, After controlling the main control module to send a parking instruction to the vehicle chassis control system, the method further includes: If the main control module is configured with an auxiliary driving function of a target type, control the autonomous driving vehicle to perform autonomous driving in combination with the auxiliary driving function.

17. An in-vehicle system operation control device for autonomous driving, characterized in that, An autonomous driving control system applied to an in-vehicle computing system for autonomous driving as described in any one of claims 1-6; the device includes: A first control module, configured to control the autonomous driving algorithm to run synchronously on the main system-on-chip and the fault-tolerant system-on-chip of the in-vehicle computing system if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is less than or equal to the computing power of the main system-on-chip configured for the autonomous driving system of the corresponding level; A second control module, configured to control the target function algorithm in the autonomous driving algorithm to run synchronously on the main system-on-chip and the fault-tolerant system-on-chip of the in-vehicle computing system if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is greater than the computing power of the main system-on-chip configured for the autonomous driving system of the corresponding level, and the remaining algorithms other than the target function algorithm are executed by the remaining computing power in the main system-on-chip or the fault-tolerant system-on-chip; A first response module, configured to, through the main control module of the in-vehicle computing system, respond to an autonomous driving decision instruction generated by the main system-on-chip and / or the fault-tolerant system-on-chip based on the running autonomous driving algorithm, and perform an autonomous driving operation corresponding to the autonomous driving decision instruction on the autonomous driving vehicle.

18. An electronic device, characterized in that, Includes: A memory for storing a computer program; A processor for implementing the steps of the method for controlling the operation of an on-vehicle system for autonomous driving according to any one of claims 7 to 16 when executing the computer program.

19. A computer-readable storage medium, characterized in that: A computer program is stored in the computer-readable storage medium, wherein the computer program, when executed by the processor, implements the steps of the method for controlling the operation of an on-vehicle system for autonomous driving according to any one of claims 7 to 16.

20. A computer program product, characterized in that, Including computer instructions for causing a computer to execute the steps of the method for controlling the operation of an on-vehicle system for autonomous driving according to any one of claims 7 to 16.

Images