On-vehicle computing system for autonomous driving and on-vehicle system operation control method

Abstract

The present application discloses an on-board computing system for autonomous driving and an on-board system operation control method, which relate to the field of autonomous driving technology. The system includes: by configuring a main system-level chip and a fault-tolerant system-level chip under a heterogeneous architecture, and synchronously running the same autonomous driving algorithm contained in the main system-level chip and the fault-tolerant system-level chip under the heterogeneous architecture, it is ensured that when a chip under any architecture fails, it can be promptly switched to another chip with a fault-tolerant configuration under other heterogeneous architecture to take over the synchronously running autonomous driving algorithm, thereby ensuring the safety of the entire vehicle.

Description

Technical Field

[0001] The present application relates to the field of autonomous driving technology, and in particular to an on-board computing system for autonomous driving and an on-board system operation control method, device, electronic device, storage medium, and computer program product. Background Art

[0002] With the continuous development of technologies such as computers, pattern recognition, and artificial intelligence, more and more computer control technologies are being applied to automobiles, forming the basis of autonomous driving technology. Autonomous driving systems can be divided into multiple levels based on their degree of automation: "L0" for no automation, "L1" for assisted driving, "L2" for partial automation, "L3" for conditional automation, "L4" for highly automated driving, and "L5" for fully automated driving.

[0003] In related technologies, different levels of autonomous driving systems have different requirements for the computing power of the on-board computing system. For example, for the "L4" level autonomous driving system, its driving decisions are mainly controlled by the car itself. In order to ensure the safety of autonomous driving, it is necessary to run high-precision, highly reliable automatic perception, decision-making planning and other algorithms on the on-board computing system, and the operation of the algorithm generally requires the support of a 100-1000TOPS high-computing power platform; therefore, it is urgent to propose an on-board computing system for autonomous driving to ensure that the computing power requirements of the corresponding level of autonomous driving system are met while improving the safety of autonomous driving operation. Summary of the Invention

[0004] The present application provides an on-board computing system for autonomous driving and an on-board system operation control method, device, electronic device, storage medium and computer program product to ensure that the computing power requirements of the corresponding level of autonomous driving system are met while improving the safety of autonomous driving operation.

[0005] The present application provides an on-vehicle computing system for autonomous driving, the system comprising: at least two computing modules with different architectures and communicatively connected to each other, wherein the system-level chip integrated in the computing module under one architecture serves as a main system-level chip, and the system-level chips integrated in the computing modules under the remaining other architectures serve as fault-tolerant system-level chips, the computing power of the fault-tolerant system-level chip being greater than or equal to the computing power of the main system-level chip; the main system-level chip and the fault-tolerant system-level chip being used to run the autonomous driving algorithm corresponding to the autonomous driving system under the target autonomous driving level and generate autonomous driving decision instructions, the functional type of the autonomous driving algorithm running on the main system-level chip and the fault-tolerant system-level chip being determined according to the relationship between the computing power required by the autonomous driving algorithm corresponding to the current target autonomous driving level and the computing power configured for the main system-level chip; the system further comprising a main control module for responding to the autonomous driving decision instructions.

[0006] The present application also provides a method for controlling the operation of an on-board system for autonomous driving, which is applied to an autonomous driving control system integrated with an on-board computing system for autonomous driving; the method includes: if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is less than or equal to the computing power of the main system-level chip configured for the autonomous driving system of the corresponding level, controlling the autonomous driving algorithm to run synchronously on the main system-level chip and the fault-tolerant system-level chip of the on-board computing system; if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is greater than the computing power of the main system-level chip configured for the autonomous driving system of the corresponding level, controlling the target function algorithm in the autonomous driving algorithm to run synchronously on the main system-level chip and the fault-tolerant system-level chip of the on-board computing system, and the remaining algorithms except the target function algorithm are executed by the remaining computing power in the main system-level chip or the fault-tolerant system-level chip; and executing the autonomous driving operation corresponding to the autonomous driving decision instruction on the autonomous driving vehicle in response to the autonomous driving decision instruction generated by the main system-level chip and / or the fault-tolerant system-level chip based on the running autonomous driving algorithm through the main control module of the on-board computing system.

[0007] The present application also provides an on-board system operation control device for autonomous driving, which is applied to an autonomous driving control system integrated with an on-board computing system for autonomous driving; the device includes: a first control module, which is used to control the autonomous driving algorithm to run synchronously on the main system-level chip and the fault-tolerant system-level chip of the on-board computing system if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is less than or equal to the computing power of the main system-level chip configured for the autonomous driving system of the corresponding level; a second control module, which is used to control the target function algorithm in the autonomous driving algorithm to run synchronously on the main system-level chip and the fault-tolerant system-level chip of the on-board computing system if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is greater than the computing power of the main system-level chip configured for the autonomous driving system of the corresponding level, and the remaining algorithms except the target function algorithm are executed by the remaining computing power in the main system-level chip or the fault-tolerant system-level chip; a first response module, which is used to respond to the autonomous driving decision instruction generated by the main system-level chip and / or the fault-tolerant system-level chip based on the running autonomous driving algorithm through the main control module of the on-board computing system, and execute the autonomous driving operation corresponding to the autonomous driving decision instruction on the autonomous driving vehicle.

[0008] The present application also provides an electronic device, comprising: a memory for storing a computer program; and a processor for implementing the steps of any of the above-mentioned vehicle system operation control methods for autonomous driving when executing the computer program.

[0009] The present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned vehicle-mounted system operation control methods for autonomous driving are implemented.

[0010] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of any of the above-mentioned vehicle system operation control methods for autonomous driving.

[0011] The in-vehicle computing system for autonomous driving provided in the present application configures a main system-level chip and a fault-tolerant system-level chip under a heterogeneous architecture, and runs the same autonomous driving algorithm contained in the main system-level chip and the fault-tolerant system-level chip synchronously under the heterogeneous architecture. This ensures that when a chip under any architecture fails, it can be promptly switched to another chip with a fault-tolerant configuration under other heterogeneous architecture to take over the synchronously running autonomous driving algorithm, thereby ensuring the safety of the entire vehicle. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0013] Figure 1 A schematic diagram of the structure of an on-board computing system for autonomous driving provided in an embodiment of the present application;

[0014] Figure 2 A schematic diagram of the structure of an on-board computing system for autonomous driving provided in an embodiment of the present application;

[0015] Figure 3 A flowchart of a method for controlling the operation of an on-board system for autonomous driving provided in an embodiment of the present application;

[0016] Figure 4 This is a structural block diagram of a vehicle-mounted system operation control device for autonomous driving provided in an embodiment of the present application;

[0017] Figure 5 This is a structural block diagram of the electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0018] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0019] It should be noted that, in the description of this application, the terms "comprises," "includes," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. The terms "first," "second," etc., in this application are used to distinguish similar objects, and are not used to describe a particular order or sequence.

[0020] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0021] With the continuous development of technologies such as computers, pattern recognition, and artificial intelligence, more and more computer control technologies are being applied to automobiles, forming autonomous driving technology. Autonomous driving systems can be divided into multiple levels based on their degree of automation, such as "L0" for no automation, "L1" for assisted driving, "L2" for partial automation, "L3" for conditional automation, "L4" for highly automated driving, and "L5" for fully automated driving. In related technologies, different levels of autonomous driving systems require different computing power from the onboard computing system. For example, in an "L4" autonomous driving system, driving decisions are primarily controlled by the vehicle itself. To ensure autonomous driving safety, high-precision and highly reliable algorithms for automatic perception, decision-making, and planning must be run on the onboard computing system. These algorithms require a high-performance computing platform with 100-1000 TOPS (tops per second), where 1 TOPS represents the processor's ability to perform one trillion operations per second.

[0022] The embodiment of the present application provides a vehicle-mounted computing system for autonomous driving, such as Figure 1 As shown, the system includes:

[0023] At least two computing modules with different architectures that are communicatively connected to each other, where the system-on-chip (SOC) integrated in the computing module with one architecture serves as the main SOC (primary SOC), and the SOCs integrated in the computing modules with the other architectures serve as fault-tolerant SOCs, with the computing power of the fault-tolerant SOCs being greater than or equal to that of the main SOC;

[0024] For example, Figure 1 As shown, the embodiment of the present application includes three computing modules, wherein the main system-level chip is integrated on the computing module 1011, and the fault-tolerant system chip is integrated on the computing module 1012 and the computing module 1013. The architecture of the computing module 1011 is different from that of the computing module 1012, and the architecture of the computing module 1012 and the computing module 1013 can be the same or different. The embodiment of the present application does not limit the specific architecture type of the computing module and the number of computing modules under each architecture. Those skilled in the art can set it according to actual needs. For example, the main system-level chip can be developed based on the Thor chip, and the fault-tolerant system-level chip can be developed based on the J6 chip. In the embodiment of the present application, the computing power of the main system-level chip is adaptively configured according to the requirements of the current target autonomous driving level. In the embodiment of the present application, the computing power of the main system-level chip can be configured to at least meet the operating computing power requirements of the target type functional algorithm (i.e., the critical path algorithm that affects safe driving) in the autonomous driving algorithm of the corresponding level. For example, if the current target autonomous driving level is "L4" and the basic computing power requirement of the algorithm of this level is 1000TOPS, the computing power of the main system-level chip must be greater than or equal to 1000TOPS. In the embodiment of the present application, the computing power of the main SOC is configured to be 1000TOPS, so as to reduce the configuration cost while meeting the requirements of the corresponding level; the computing power of the fault-tolerant system-level chip is greater than or equal to the computing power of the main system-level chip to meet the fault-tolerant operation of the algorithm running on the main SOC.

[0025] The main system-on-chip and the fault-tolerant system-on-chip are used to run the autonomous driving algorithm corresponding to the autonomous driving system at the target autonomous driving level and generate autonomous driving decision instructions. The function type of the autonomous driving algorithm running on the main system-on-chip and the fault-tolerant system-on-chip is determined according to the relationship between the computing power required by the autonomous driving algorithm corresponding to the current target autonomous driving level and the computing power configured for the main system-on-chip;

[0026] Exemplarily, at least some of the autonomous driving algorithms run by the fault-tolerant system-level chip are the same as those of the main system-level chip, and the same autonomous driving algorithm runs synchronously in the main system-level chip and the fault-tolerant system-level chip. The autonomous driving algorithms that can be run on the fault-tolerant SoC can be identical to those running on the main SoC, or at least some of the autonomous driving algorithms can be identical to those running on the main SoC. The specific functional types of the autonomous driving algorithms running on the main SoC and the fault-tolerant SoC are determined by the relationship between the computing power required by the autonomous driving algorithms corresponding to the current target autonomous driving level and the computing power configured for the main SoC. If the computing power of the autonomous driving algorithms corresponding to the current target autonomous driving level is less than or equal to the computing power of the main SoC configured for the corresponding level of autonomous driving system, all autonomous driving algorithms are controlled to run simultaneously on the main SoC and the fault-tolerant SoC of the onboard computing system. If the computing power of the autonomous driving algorithms corresponding to the current target autonomous driving level is greater than the computing power of the main SoC configured for the corresponding level of autonomous driving system, the target function algorithms within the autonomous driving algorithms are controlled to run simultaneously on the main SoC and the fault-tolerant SoC of the onboard computing system, with the remaining algorithms, excluding the target function algorithms, being executed by the remaining computing power in the main SoC or the fault-tolerant SoC. By running the same algorithms simultaneously on the fault-tolerant SoC and the main SoC, fault-tolerant operation of the algorithms running on the main SoC is achieved. In the embodiment of the present application, at least part of the autonomous driving algorithms may include algorithms of the target function type on the main system-level chip, such as algorithms for sensing obstacles in front of the vehicle's direction of travel, vehicle positioning algorithms, and autonomous driving decision-making algorithms, etc., which ensure the safety of autonomous driving vehicles. By synchronously deploying and running the algorithms for ensuring the safety of autonomous driving vehicles in the fault-tolerant system-level chip and the main system-level chip, when any chip fails, the synchronously running autonomous driving algorithm can be taken over by another chip with a fault-tolerant configuration, thereby ensuring the safety of the entire vehicle.

[0027] The system also includes a main control module 102 for responding to autonomous driving decision instructions.

[0028] Exemplarily, the main control module may be a microcontroller unit (MCU), which may utilize a high-performance TC497 chip. It may simultaneously communicate with both the main SoC and the fault-tolerant SoC to respond to autonomous driving decision instructions generated by both. When the main SoC and the fault-tolerant SoC simultaneously execute the same algorithm to generate autonomous driving decision instructions for the same function, the main control module may select a response based on a preconfigured instruction selection strategy. For example, the main control module may be configured to prioritize responses to autonomous driving decision instructions generated by the main SoC. When the main SoC experiences hardware or communication failures, the main control module may respond to autonomous driving decision instructions generated by the fault-tolerant SoC using the same algorithm. This embodiment of the present application does not limit the instruction selection strategy, and those skilled in the art may configure it based on actual needs.

[0029] The on-board computing system for autonomous driving provided by an embodiment of the present invention configures a main system-level chip and a fault-tolerant system-level chip under a heterogeneous architecture, and synchronously runs the same autonomous driving algorithm contained in the main system-level chip and the fault-tolerant system-level chip under the heterogeneous architecture. This ensures that when a chip under any architecture fails, it can be promptly switched to another chip with a fault-tolerant configuration under other heterogeneous architecture to take over the synchronously running autonomous driving algorithm, thereby ensuring the safety of the entire vehicle.

[0030] As an optional implementation of the embodiment of the present application, the system also includes a fault-tolerant control module, which is communicatively connected to the main control module, and the chip architecture of the fault-tolerant control module is different from that of the main control module. For example, the fault-tolerant control module is communicatively connected to the main control module while being communicatively connected to the main system-level chip and the fault-tolerant system-level chip. The embodiment of the present application does not limit the number of fault-tolerant control modules. When multiple fault-tolerant control modules are included, the chip architectures of the multiple fault-tolerant control modules can be the same or different. By configuring the fault-tolerant control module for the main control module, it is possible to avoid affecting the timely response to the autonomous driving decision instructions when a fault occurs in the main control module, thereby affecting the driving safety of the autonomous driving vehicle. Moreover, by configuring the fault-tolerant control module under a heterogeneous architecture, the same fault can be avoided from affecting both the main control module and the fault-tolerant control module due to the different logic of the architecture and the main control module, thereby improving the fault avoidance capability.

[0031] As an optional implementation of the embodiment of the present application, the fault-tolerant system-level chip includes multiple computing modules and multiple fault-tolerant control modules, and each fault-tolerant control module is integrated one-to-one in the computing module where the fault-tolerant system-level chip is located.

[0032] For example, Figure 2As shown, the computing module where the fault-tolerant system-on-chip is located includes computing module 1012 and computing module 1013. Computing module 1012 integrates fault-tolerant system-on-chip 1 (SOC1), and computing module 1013 integrates fault-tolerant system-on-chip 2 (SOC2). There are two fault-tolerant control modules, namely, fault-tolerant control module 1 (MCU1) and fault-tolerant control module 2 (MCU2). Each fault-tolerant control module is integrated into the computing module where the fault-tolerant system-on-chip is located and is communicatively connected to the fault-tolerant system-on-chip in the computing module. That is, fault-tolerant control module 1 is communicatively connected to fault-tolerant system-on-chip 1 in the corresponding computing module 1012, and fault-tolerant control module 2 is communicatively connected to fault-tolerant system-on-chip 2 in the corresponding computing module 1013. By integrating multiple fault-tolerant control modules into each computing module where the fault-tolerant system-on-chip is located, data exchange delay and communication energy loss can be reduced, while the number and size of chips can be reduced and wiring costs can be reduced.

[0033] As an optional implementation scheme of the embodiment of the present application, the main control module is used to monitor the operating status of the main system-level chip and the fault-tolerant system-level chip, and any one of the multiple fault-tolerant control modules is used to monitor the operating status of the main control module, the main system-level chip and the remaining other fault-tolerant system-level chips. The remaining other fault-tolerant system-level chips represent other fault-tolerant system-level chips except the fault-tolerant system-level chip where the current fault-tolerant control module is located.

[0034] For example, Figure 2 As shown, main control module 102 is used to monitor the main SoC, fault-tolerant SoC 1, and fault-tolerant SoC 2 in computing module 1011; fault-tolerant control module 1 is used to monitor main control module 102, the main SoC, and fault-tolerant SoC 2; and fault-tolerant control module 2 is used to monitor main control module 102, the main SoC, and fault-tolerant SoC 1. This monitoring architecture achieves system-level fault detection and reliability assurance through a multi-level, cross-monitoring mechanism. When an anomaly is detected, redundant switching is triggered promptly. Each fault-tolerant control module monitors not only the main control module but also other fault-tolerant SoCs, forming a mutual fault-tolerant check to prevent failure of a single monitoring node.

[0035] As an optional implementation of the embodiment of the present application, the system further includes: multiple Ethernet switches, each Ethernet switch is communicatively connected to the main control module and the computing module.

[0036] For example, Figure 2 As shown, the main control module and each computing module are interconnected via an Ethernet switch 103. In the embodiment of the present application, multiple Ethernet switches can be provided. Figure 2Not all are shown in the figure. The Ethernet switch can use two heterogeneous switches, a master and a slave. When the master Ethernet switch fails, the slave Ethernet switch takes over to achieve highly reliable communication between the main control module and the three computing modules, thereby achieving heterogeneous communication fault tolerance between the MCU and the SOC and heterogeneous dual-redundant communication fault tolerance between the SOC and the SOC, avoiding the impact of a single communication channel failure on vehicle driving safety.

[0037] As an optional implementation of the embodiment of the present application, the computing modules that communicate with each other are connected via a high-speed serial bus and an Ethernet switch. For example, in the embodiment of the present application, the high-speed serial bus can be a PCIE bus, specifically Figure 2 As shown, the first communication network is for communication between the computing module where the main system-level chip is located and the computing module where the fault-tolerant system-level chip is located, as well as between the computing modules where the two fault-tolerant system-level chips are located, through the PCIE bus; the second network is for communication through the Ethernet switch. The three computing modules are connected to the Ethernet switch at the same time, and each of them can communicate through Ethernet. When the PCIE communication physical hardware or communication link fails, it can switch to the Ethernet communication link, thereby realizing heterogeneous communication fault tolerance among the three computing modules.

[0038] The in-vehicle computing system for autonomous driving provided in the embodiments of the present application runs autonomous driving perception, positioning, decision-making and planning algorithms on the computing module. Its input can be various sensor data such as cameras, lidar and millimeter-wave radar, and the output decision-making and planning information is sent to the main MCU, MCU1 and MCU2. The main MCU, MCU1 and MCU2 belong to the MCU safety control computing, which mainly runs information security, functional safety, fault diagnosis, control and other algorithms. Its input is the decision-making and planning information of the system-level chip, and the output execution control information is sent to the chassis control system via the CAN port. Taking the current target autonomous driving level of "L4" as an example, the performance of the overall system can reach more than 2000TOPS, of which the main SOC provides 1000TOPS computing power, and SOC1 and SOC2 provide 560TOPS computing power respectively, thus meeting the high-performance computing power requirements of "L4" autonomous driving.

[0039] The system is backward compatible with lower-level autonomous driving scenarios (such as L3 and L2). Because lower levels of autonomous driving require less computing power, the hardware chips utilize a pin-2-pin compatibility design within the current heterogeneous fault-tolerant system architecture. This means the number and functionality of the chips remain unchanged, while the SoC and MCU utilize chips with lower computing power or performance. For example, for L2 autonomous driving scenarios, the Thor chip can be replaced with an Orin chip. For the J6 chip, a model with approximately half the computing power of the Orin chip, such as the J6M, can be selected, while the main MCU can be replaced with a slightly lower-performance MCU (such as the TC397). This system's scalable design significantly improves its versatility and flexibility, reduces development costs for scenario adaptation, and reduces development cycles.

[0040] An embodiment of the present application provides an on-board system operation control method for autonomous driving, which is applied to an autonomous driving control system integrated with the on-board computing system for autonomous driving in the above-mentioned embodiment. The autonomous driving control system can select an open source autonomous driving computing framework as the basic software system for high-fault-tolerant on-board software and transform it. The bottom layer supports heterogeneous architecture chips (such as Thor chips and J6 chips) in the on-board computing system in the above-mentioned embodiment, so that it supports a unified operating system (such as Ubantu 22.04). The operating system uses a standardized infrastructure and data distribution service developed based on robots as middleware, and ROS2 (Robot Operating System 2) as an upper-level programming interface. The upper layer has autonomous driving algorithms such as autonomous driving perception, decision-making planning, etc. implemented based on ROS2. The corresponding algorithm components are selected from the framework to build an application algorithm Pipline. Based on the launch file "logging_simulator.launch.xml" in the computing framework as a template, the algorithm is trimmed or added to it to form an algorithm carrier launch file. All algorithm pipelines are started based on a launch file to complete the operation on the system-level chip. Figure 3 As shown, the method includes the following steps:

[0041] Step S201: If the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is less than or equal to the computing power of the main system-on-chip configured for the autonomous driving system of the corresponding level, the autonomous driving algorithm is controlled to run synchronously on the main system-on-chip and the fault-tolerant system-on-chip of the on-board computing system;

[0042] For example, taking the current autonomous driving level of "L4" as an example, assuming that the computing power of the main system-level chip configured for the current level of autonomous driving system is 1000 TOPS, if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is less than or equal to the computing power of the main system-level chip configured for the autonomous driving system of the corresponding level, it indicates that the autonomous driving algorithm of the current autonomous driving system can be completely run on the main system-level chip. Since the algorithm of the fault-tolerant system-level chip is greater than or equal to the computing power of the main system-level chip, all autonomous driving algorithms are deployed on the fault-tolerant system-level chip, and the autonomous driving algorithms are controlled to run synchronously on the main system-level chip and the fault-tolerant system-level chip of the on-board computing system. When the main system-level chip fails, the fault-tolerant system-level chip can take over in time to achieve full fault tolerance for all autonomous driving algorithms running on the main system-level chip.

[0043] In step S202, if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is greater than the computing power of the main system-level chip configured for the autonomous driving system of the corresponding level, the target function algorithm in the autonomous driving algorithm is controlled to run synchronously on the main system-level chip and the fault-tolerant system-level chip of the on-board computing system, and the remaining algorithms except the target function algorithm are executed by the remaining computing power in the main system-level chip or the fault-tolerant system-level chip.

[0044] For example, if the autonomous driving algorithm corresponding to the current target autonomous driving level is relatively complex and its computing power exceeds the computing power of the main SoC configured for the corresponding level of autonomous driving system, such as the autonomous driving algorithm of the currently deployed "L4" level autonomous driving system exceeding 1000TOPS, this indicates that the entire autonomous driving algorithm cannot be fully executed on the main SoC. To ensure the safety of autonomous driving, in the embodiments of the present application, the target function algorithm in the autonomous driving algorithm to be executed is synchronously executed on the main SoC and the fault-tolerant SoC. In the embodiments of the present application, the target function algorithm may be an algorithm corresponding to a key function to ensure the safety of autonomous driving, such as an algorithm for sensing obstacles ahead of the vehicle's direction of travel, a vehicle positioning algorithm, and an autonomous driving decision-making algorithm. The embodiments of the present application do not limit the type of the target function algorithm, and those skilled in the art can configure it based on operational safety requirements and the computing power configuration of the main SoC. By synchronously running the target function algorithm on the main SoC and the fault-tolerant SoC of the on-board computing system, fault-tolerant configuration of the critical path algorithm in the autonomous driving system is achieved.

[0045] The remaining algorithms except the target function algorithm are executed by the remaining computing power in the main system-level chip or the fault-tolerant system-level chip. That is, due to the limitation of the computing power of the overall configuration, the main system-level chip and the fault-tolerant system-level chip can only ensure the fault-tolerant configuration of the target function algorithm. For algorithms other than the target function algorithm, one of the main system-level chip or the fault-tolerant system-level chip can be selected to run. It is necessary to ensure that the remaining algorithms can be deployed and run while ensuring that the computing power occupied by the fault-tolerant configured target function algorithm and the computing power occupied by the remaining algorithms are less than or equal to the sum of the computing power configured by the main system-level chip and the fault-tolerant system-level chip. For example, if the computing power of the main system-level chip is 1000TOPS and the computing power of the fault-tolerant system-level chip is 1120 TOPS, if the computing power of the autonomous driving algorithm to be run is 1200TOPS, it can be seen that the computing power of the main system-level chip does not meet the computing power requirements for running all algorithms. At this time, the target function algorithm requiring 900 TOPS computing power can be screened out from all autonomous driving algorithms and run in the main system-level chip and the fault-tolerant system-level chip. At this time, the remaining computing power of the main system-level chip is 100TOPS, and the remaining computing power of the fault-tolerant system-level chip is 220TOPS, while the computing power requirement of the remaining algorithms of the autonomous driving algorithm is 300 TOPS. The remaining algorithms can be deployed in the main system-level chip or the fault-tolerant system-level chip respectively (for example, 100TOPS is deployed on the main system-level chip, and the algorithm with the remaining 200 TOPS is deployed in the fault-tolerant system-level chip), that is, the operation of the remaining algorithms can be realized. In the embodiment of the present application, the remaining algorithms can be detection methods such as obstacles on the side or rear of the vehicle. That is, when the main system-level chip fails, the fault-tolerant system-level chip can take over in real time, thereby realizing heterogeneous fault-tolerant computing of the critical path algorithm running on the system-level chip and the critical path algorithm running on the fault-tolerant system-level chip. This fault-tolerant method realizes flexible expansion of the system, ensuring system fault tolerance while meeting the needs of higher computing power scenarios.

[0046] In step S203, the main control module of the on-board computing system responds to the autonomous driving decision instructions generated by the main system-level chip and / or the fault-tolerant system-level chip based on the running autonomous driving algorithm, and executes the autonomous driving operation corresponding to the autonomous driving decision instructions on the autonomous driving vehicle.

[0047] For example, the main control module simultaneously receives autonomous driving decision instructions generated by both the main SoC and the fault-tolerant SoC. When both the main SoC and the fault-tolerant SoC simultaneously execute the same algorithm to generate autonomous driving decision instructions for the same function, the main control module can select one to respond based on a preconfigured instruction selection strategy. For example, the main control module can be configured to prioritize responding to autonomous driving decision instructions generated by the main SoC. If the main SoC encounters hardware or communication failures, the main control module can respond to autonomous driving decision instructions generated by the fault-tolerant SoC for the same function. This embodiment of the present application does not limit the instruction selection strategy, and those skilled in the art can configure it based on actual needs. If any function algorithm only runs on the main SoC or the fault-tolerant SoC, resulting in only one autonomous driving decision instruction for the same function, the main control module can execute the autonomous driving operation corresponding to the received autonomous driving decision instruction. Specifically, if the autonomous driving decision instruction is a steering instruction, the main control module can issue a steering control instruction to the vehicle chassis control system to control the autonomous vehicle to steer. The main control module can monitor the SOC for hardware failures. When the SOC fails, the MCU can issue instructions to control the autonomous vehicle, such as pulling over, to ensure the safety of autonomous driving.

[0048] The vehicle-mounted system operation control method for autonomous driving provided in the embodiment of the present application configures the algorithms running on the main system-level chip and the fault-tolerant system-level chip under the heterogeneous architecture based on the configured computing power and the computing power requirements of the autonomous driving algorithm at the current level, and synchronously runs the same autonomous driving algorithm contained in the main system-level chip and the fault-tolerant system-level chip under the heterogeneous architecture, ensuring that when a chip under any architecture fails, it can be promptly switched to another chip with a fault-tolerant configuration under other heterogeneous architecture to take over the synchronously running autonomous driving algorithm, thereby ensuring the safety of the entire vehicle.

[0049] As an optional implementation of the embodiment of the present application, the on-board computing system includes multiple fault-tolerant system-level chips; the method also includes: if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is less than or equal to the computing power of the main system-level chip configured for the autonomous driving system of the corresponding level, the first functional type algorithm in the autonomous driving algorithm is controlled to run on any fault-tolerant system-level chip, and the remaining other functional type algorithms are controlled to run on the remaining other fault-tolerant system-level chips.

[0050] For example, if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is less than or equal to the computing power of the main SoC configured for the corresponding level of autonomous driving system, the autonomous driving algorithm of the current autonomous driving system can be fully executed on the main SoC. Since the algorithm of the fault-tolerant SoC is greater than or equal to the computing power of the main SoC, the entire autonomous driving algorithm is deployed on the fault-tolerant SoC. The in-vehicle computing system in the embodiment of the present application includes multiple fault-tolerant SoCs. The algorithm running on the fault-tolerant SoC can be divided into multiple partial algorithms, each of which runs on a corresponding fault-tolerant SoC, thereby achieving load balancing across the multiple fault-tolerant SoCs. Specifically, the embodiment of the present application takes the vehicle computing system including two fault-tolerant system-level chips as an example, and copies the computing algorithms such as data reception, processing, and perception closely related to sensor data on the main system-level chip to one of the fault-tolerant system-level chips, and copies other algorithms, such as positioning, route planning and control algorithms, to another fault-tolerant system-level chip. The copied algorithm nodes are added to the "logging_simulator.launch.xml" file, and the main SOC forms algorithm fault tolerance with SOC1 and SOC2. The entire system will run two sets of identical perception, fusion and positioning algorithms at the same time.

[0051] As an optional implementation method of the embodiment of the present application, the method also includes: for the main system-level chip and the fault-tolerant system-level chip that synchronously run the same autonomous driving algorithm, if the corresponding upstream chip node includes a corresponding fault-tolerant node, subscribing to the first output result of the algorithm running on the upstream chip node and the second output result of the algorithm running on the fault-tolerant node corresponding to the upstream chip node; inputting the target output result into the main system-level chip and the fault-tolerant system-level chip, wherein the target output result is determined based on the first output result or the second output result; controlling the corresponding current autonomous driving algorithms to be run on the main system-level chip and the fault-tolerant system-level chip, and running them based on the target output result; and sending the running results to the downstream chip node, which is the node that subscribes to the autonomous driving algorithm running data on the main system-level chip and the fault-tolerant system-level chip.

[0052] For example, for the main system-level chip and the fault-tolerant system-level chip that synchronously run the same autonomous driving algorithm, in order to ensure the consistency of the running results of the same autonomous driving algorithm running synchronously, each algorithm running synchronously on the main system-level chip and the fault-tolerant system-level chip must subscribe to the algorithm output of its upstream chip node, and also subscribe to the output of the fault-tolerant algorithm of the fault-tolerant node corresponding to its upstream chip node. Similarly, each algorithm must publish the results to the algorithm running on its downstream chip node. If its downstream chip node is configured with a corresponding fault-tolerant node, it must also publish the results to the fault-tolerant node corresponding to its downstream chip node. For autonomous driving decision instructions for the same function received from the upstream node and the corresponding fault-tolerant node, one of the autonomous driving decision instructions can be selected as the input of the current chip node based on the configured instruction selection strategy.

[0053] As an optional embodiment of the present application, the method further includes:

[0054] Step a1: If any downstream chip node subscribes to the running results of the autonomous driving algorithms running simultaneously on the main system-level chip and the fault-tolerant system-level chip, it is determined whether the communication index parameters between the main system-level chip and the fault-tolerant system-level chip meet the preset requirements;

[0055] For example, a fault-tolerant autonomous driving algorithm configured on both the main SoC and the fault-tolerant SoC will run synchronously, allowing both to simultaneously issue corresponding autonomous driving decision instructions. If any downstream chip node subscribes to the results of the autonomous driving algorithms running synchronously on the main SoC and the fault-tolerant SoC, such as a perception algorithm that subscribes to both the output of its upstream positioning algorithm (running on the main SoC) and the output of the corresponding fault-tolerant positioning algorithm (running on the fault-tolerant SoC), the perception algorithm will ultimately use the output of the positioning algorithm running on the main SoC or the fault-tolerant SoC. This requires determining whether the communication parameter parameters between the main SoC and the fault-tolerant SoC meet preset requirements. In this embodiment of the present application, the communication parameter parameters may include parameters such as communication frequency and communication time.

[0056] Step a2: If the communication index parameters meet the preset requirements, determine whether the autonomous driving algorithm running on the main system-level chip is a preset function type algorithm;

[0057] For example, if the communication indicator parameters meet preset requirements, indicating normal communication, the dual heterogeneous chips are operating in sync and the fault tolerance mechanism is effective. Determining whether the autonomous driving algorithm currently running on the main system chip is a preset functional type algorithm (such as positioning, planning, or sensor data calculation algorithms that have a significant impact on driving safety). This embodiment of the application does not limit the type of preset functional type algorithm, and those skilled in the art can determine it based on actual needs.

[0058] Step a3, if the autonomous driving algorithm is a preset function type algorithm, respond to the detection operation of the running result of the preset function type algorithm; illustratively, in the embodiment of the present application, the detection operation method of the running result of the preset function type algorithm can be to call the corresponding type of algorithm running accuracy detection algorithm to perform accuracy detection on the autonomous driving algorithm running on the main system-level chip.

[0059] Step a4: If the running result of the preset function type algorithm meets the requirements, the running result corresponding to the main system-level chip is used as the input of the downstream chip node; if the running result of the preset function type algorithm does not meet the requirements, the running result corresponding to the fault-tolerant system-level chip is used as the input of the downstream chip node.

[0060] As an optional implementation of the present application, the method further includes: if the autonomous driving algorithm is a non-preset function type algorithm, using the corresponding operating results of the main system-level chip as the input of the downstream chip node; if the main system-level chip fails, using the corresponding operating results of the fault-tolerant system-level chip as the input of the downstream chip node. By detecting the communication status and operating results to determine the input of the downstream chip node, the failover mechanism ensures that key functions can continue to operate stably in the event of a chip-level failure, thereby improving the operational safety and reliability of the autonomous driving system.

[0061] As an optional implementation of an embodiment of the present application, responding to a detection operation on the result of running an algorithm of a preset functional type includes: calling an error detection algorithm of a corresponding type according to the type of algorithm to be detected; and responding to the error detection operation on the result of running the algorithm of the preset functional type based on the called error detection algorithm. For example, taking the case where the autonomous driving algorithm of the preset functional type currently running on the main system-level chip is a positioning algorithm, a path planning algorithm, or a sensor algorithm, the system is pre-integrated with a positioning error monitoring algorithm, a path planning error monitoring algorithm, and a sensor error monitoring algorithm. Based on the functional type of the algorithm currently to be detected, the corresponding error detection algorithm is called to perform error detection on the data output by the algorithm of the response type of the main system-level chip. If the errors are all within the preset error range, it indicates that the data output by the main system-level chip meets the requirements.

[0062] As an optional embodiment of the present application, the vehicle-mounted computing system includes multiple fault-tolerant control modules, and the method further includes: when a main control module in the vehicle-mounted computing system fails, any one of the multiple fault-tolerant control modules is used as a new main control module to respond to receiving autonomous driving decision instructions and controlling the autonomous driving vehicle; when the new main control module fails, a new main control module is determined from the remaining other fault-tolerant control modules. Exemplarily, the fault-tolerant control module monitors the operating status of the main control module, and when it is monitored that the main control module in the vehicle-mounted computing system fails, any one of the multiple fault-tolerant control modules is used as a new main control module to respond to receiving autonomous driving decision instructions and controlling the autonomous driving vehicle; when the new main control module fails, a new main control module is determined from the remaining other fault-tolerant control modules. By designing a dynamic switching mechanism between the main control module and the fault-tolerant control module in the vehicle-mounted computing system, it is ensured that the autonomous driving function can continue to operate stably in the event of a hardware failure.

[0063] As an optional embodiment of the present application, the autonomous driving algorithm runs simultaneously on the main system-on-chip and the fault-tolerant system-on-chip of the on-board computing system. The main control module and the fault-tolerant control module can monitor hardware faults of the corresponding main system-on-chip and / or the fault-tolerant system-on-chip according to the monitoring configuration policy. The method further includes:

[0064] Step b1: If a hardware failure occurs in the main SoC or the fault-tolerant SoC, the autonomous driving vehicle is controlled to perform autonomous driving according to the current autonomous driving level.

[0065] For example, taking the current autonomous driving system's autonomous driving level as "L4," if a hardware failure is detected in either the main SoC or the fault-tolerant SoC, the current autonomous driving algorithm runs simultaneously on both the main SoC and the fault-tolerant SoC of the onboard computing system, achieving full fault tolerance for the autonomous driving algorithm. Therefore, if any SOC fails, the SOC containing the fault-tolerant algorithm runs the corresponding algorithm, taking over the algorithm running on the faulty hardware, allowing the autonomous driving system to continue operating at the current autonomous driving level of "L4." If hardware failures are detected simultaneously on all fault-tolerant SoCs, while the main SoC does not, the main SoC runs all autonomous driving algorithms. Even if the fault-tolerant SoC containing the fault-tolerant algorithm fails to operate normally, the system can still operate at the current autonomous driving level of "L4."

[0066] In step b2, if both the main SoC and the fault-tolerant SoC experience hardware failures, the main control module is controlled to send a stop command to the vehicle chassis control system. For example, if both the main SoC and the fault-tolerant SoC experience hardware failures, the main control module is controlled to send a stop command to the vehicle chassis control system, causing the vehicle to pull over.

[0067] As an optional embodiment of the present application, the target function algorithm in the autonomous driving algorithm is synchronously executed on the main system-on-chip and the fault-tolerant system-on-chip of the vehicle computing system, and the remaining algorithms other than the target function algorithm are executed by the remaining computing power in the main system-on-chip or the fault-tolerant system-on-chip. The method further includes:

[0068] Step c1: If a hardware failure occurs in the main system-on-chip or the fault-tolerant system-on-chip, the autonomous driving vehicle is controlled to perform autonomous driving according to the downgraded autonomous driving level;

[0069] For example, assuming the current autonomous driving system is operating at Level 4, if a hardware fault is detected in either the main SoC or the fault-tolerant SoC, and the current fault-tolerance strategy configures the target function algorithm within the autonomous driving algorithm for fault tolerance and runs it simultaneously on both the main and fault-tolerant SoCs, the remaining algorithms, excluding the target function algorithm, are not fault-tolerant. To ensure the operational safety of the autonomous driving vehicle, the autonomous driving vehicle is controlled to operate at a downgraded level, such as downgrading the autonomous driving system level from the current Level 4 to Level 2, to enhance manual control of the vehicle. If the main SoC does not experience a hardware fault, but the fault-tolerant SoC does, the main SoC can run all critical path algorithms, essentially ensuring safe autonomous driving on the critical path. In this case, the autonomous driving system can be downgraded from Level 4 to Level 2.

[0070] In step c2, if both the main SoC and the fault-tolerant SoC experience hardware failures, the main control module is controlled to send a parking command to the vehicle chassis control system. For example, if both the main SoC and the fault-tolerant SoC experience hardware failures, the main control module is controlled to send a parking command to the vehicle chassis control system, causing the vehicle to pull over.

[0071] As an optional embodiment of the present application, after controlling the main control module to send a parking instruction to the vehicle chassis control system, the method also includes: if the main control module is configured with an assisted driving function of the target type, controlling the autonomous driving vehicle to perform autonomous driving in combination with the assisted driving function.

[0072] For example, after the main control module sends a parking command to the vehicle chassis control system, the autonomous driving level can be reduced from "L4" to "L1". If the main control module in the on-board computing system at the "L1" level is configured with assisted driving functions such as automatic parking or panoramic effect, assisted parking can be performed based on the assisted driving functions at the "L1" level.

[0073] The vehicle-mounted system operation control method for autonomous driving provided in the embodiment of the present application, based on the hardware fault-tolerant design, implements fault tolerance at the software algorithm level by deploying an autonomous driving computing framework platform, realizes collaborative fault-tolerant design of software and hardware, and takes into account the high performance of the overall system, meets the high computing power requirements of autonomous driving scenarios of corresponding autonomous driving levels while achieving safety and reliability of the overall system. The overall vehicle-mounted computing system implements fault tolerance at four levels: SOC computing, MCU safety control computing, and communication and algorithm, thereby achieving overall high fault tolerance of the system.

[0074] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method.

[0075] The embodiments of the present application further provide a vehicle-mounted system operation control device for autonomous driving, which is applied to an autonomous driving control system integrated with the vehicle-mounted computing system for autonomous driving of the above embodiments; Figure 4 As shown, the device includes:

[0076] A first control module 301 is configured to control the autonomous driving algorithm to run synchronously on the main system-on-chip and the fault-tolerant system-on-chip of the on-board computing system if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is less than or equal to the computing power of the main system-on-chip configured for the autonomous driving system of the corresponding level;

[0077] A second control module 302 is configured to control the target function algorithm in the autonomous driving algorithm to be executed synchronously on the main system-on-chip and the fault-tolerant system-on-chip of the onboard computing system if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is greater than the computing power of the main system-on-chip configured for the autonomous driving system of the corresponding level, and the remaining algorithms other than the target function algorithm are executed by the remaining computing power in the main system-on-chip or the fault-tolerant system-on-chip;

[0078] The first response module 303 is configured to, through the main control module of the onboard computing system, respond to the autonomous driving decision instruction generated by the main system-on-chip and / or the fault-tolerant system-on-chip based on the running autonomous driving algorithm, and execute the autonomous driving operation corresponding to the autonomous driving decision instruction on the autonomous driving vehicle. For details, please refer to the description of the corresponding steps in the above method embodiment and will not be repeated here.

[0079] The vehicle-mounted system operation control device for autonomous driving provided in the embodiment of the present application configures the algorithms running on the main system-level chip and the fault-tolerant system-level chip under the heterogeneous architecture based on the configured computing power and the computing power requirements of the autonomous driving algorithm at the current level, and synchronously runs the same autonomous driving algorithm contained in the main system-level chip and the fault-tolerant system-level chip under the heterogeneous architecture, thereby ensuring that when a chip under any architecture fails, it can be promptly switched to another chip with a fault-tolerant configuration under other heterogeneous architecture to take over the synchronously running autonomous driving algorithm, thereby ensuring the safety of the entire vehicle.

[0080] As an optional implementation of the embodiment of the present application, the on-board computing system includes multiple fault-tolerant system-level chips; the device also includes: a third control module, which is used to control the first function type algorithm in the autonomous driving algorithm to run on any fault-tolerant system-level chip if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is less than or equal to the computing power of the main system-level chip configured for the autonomous driving system of the corresponding level, and the remaining other function type algorithms to run on the remaining other fault-tolerant system-level chips.

[0081] As an optional implementation manner of the embodiment of the present application, the device also includes: a subscription module, which is used to subscribe to the first output result of the algorithm running on the upstream chip node and the second output result of the algorithm running on the fault-tolerant node corresponding to the upstream chip node for the main system-level chip and the fault-tolerant system-level chip that synchronously run the same autonomous driving algorithm, if the corresponding upstream chip node contains a corresponding fault-tolerant node; an input module, which is used to input the target output result into the main system-level chip and the fault-tolerant system-level chip, wherein the target output result is determined based on the first output result or the second output result; a fourth control module, which is used to control the corresponding current autonomous driving algorithms to be run on the main system-level chip and the fault-tolerant system-level chip, and run them based on the target output result; a sending module, which is used to send the running results to the downstream chip node, which is the node that subscribes to the running data of the autonomous driving algorithms on the main system-level chip and the fault-tolerant system-level chip.

[0082] As an optional implementation manner of the embodiment of the present application, the device also includes: a judgment module, which is used to judge whether the communication index parameters between the main system-level chip and the fault-tolerant system-level chip meet the preset requirements if any downstream chip node subscribes to the running results of the autonomous driving algorithms running synchronously on the main system-level chip and the fault-tolerant system-level chip; a first judgment module, which is used to judge whether the autonomous driving algorithm running on the main system-level chip is a preset function type algorithm if the communication index parameters meet the preset requirements; a second response module, which is used to respond to the detection operation of the running results of the preset function type algorithm if the autonomous driving algorithm is the preset function type algorithm; a second judgment module, which is used to use the corresponding running results of the main system-level chip as the input of the downstream chip node if the running results of the preset function type algorithm meet the requirements; a third judgment module, which is used to use the corresponding running results of the fault-tolerant system-level chip as the input of the downstream chip node if the running results of the preset function type algorithm do not meet the requirements.

[0083] As an optional implementation of the embodiment of the present application, the device also includes: a fourth judgment module, which is used to use the operating results corresponding to the main system-level chip as the input of the downstream chip node if the autonomous driving algorithm is a non-preset functional type algorithm; and a fifth judgment module, which is used to use the operating results corresponding to the fault-tolerant system-level chip as the input of the downstream chip node when the main system-level chip fails.

[0084] As an optional implementation of an embodiment of the present application, the second response module includes: a calling sub-module, which is used to call the corresponding type of error detection algorithm according to the type of algorithm to be detected; and a detection sub-module, which is used to respond to the error detection operation of the running result of the preset functional type algorithm based on the called error detection algorithm.

[0085] As an optional implementation of the embodiment of the present application, the on-board computing system includes multiple fault-tolerant control modules; the device also includes: a sixth determination module, which is used to use any one of the multiple fault-tolerant control modules as a new main control module when a main control module in the on-board computing system fails, to respond to receiving autonomous driving decision instructions and control operations on the autonomous driving vehicle; a third response module, which is used to respond to determining a new main control module from the remaining other fault-tolerant control modules when a new main control module fails.

[0086] As an optional implementation scheme of the embodiment of the present application, the autonomous driving algorithm runs synchronously on the main system-level chip and the fault-tolerant system-level chip of the on-board computing system, and the device also includes: a fifth control module, which is used to control the autonomous driving vehicle to perform autonomous driving according to the current autonomous driving level if a hardware failure occurs in the main system-level chip or the fault-tolerant system-level chip; a sixth control module, which is used to control the autonomous driving vehicle to perform autonomous driving according to the current autonomous driving level if a hardware failure occurs in the main system-level chip but a hardware failure occurs in the fault-tolerant system-level chip; and a seventh control module, which is used to control the main control module to send a parking command to the vehicle chassis control system if a hardware failure occurs in both the main system-level chip and the fault-tolerant system-level chip.

[0087] As an optional implementation scheme of the embodiment of the present application, the target function algorithm in the autonomous driving algorithm runs synchronously on the main system-level chip and the fault-tolerant system-level chip of the on-board computing system, and the remaining algorithms except the target function algorithm are executed by the remaining computing power in the main system-level chip or the fault-tolerant system-level chip. The device also includes: an eighth control module, which is used to control the autonomous driving vehicle to perform autonomous driving according to the downgraded autonomous driving level if a hardware failure occurs in the main system-level chip or the fault-tolerant system-level chip; a ninth control module, which is used to control the autonomous driving vehicle to perform autonomous driving according to the downgraded autonomous driving level if a hardware failure occurs in the main system-level chip but a hardware failure occurs in the fault-tolerant system-level chip; and a tenth control module, which is used to control the main control module to send a parking command to the vehicle chassis control system if a hardware failure occurs in both the main system-level chip and the fault-tolerant system-level chip.

[0088] As an optional implementation of the embodiment of the present application, the device also includes: an auxiliary module, which is used to control the autonomous driving vehicle to perform autonomous driving in combination with the assisted driving function if the main control module is configured with an assisted driving function of the target type.

[0089] For the description of the features in the embodiments corresponding to the vehicle-mounted system operation control device for autonomous driving, please refer to the relevant description of the embodiments corresponding to the vehicle-mounted system operation control method for autonomous driving, and will not be repeated here.

[0090] The embodiment of the present application also provides an electronic device, such as Figure 5 As shown, it includes a memory 10 and a processor 20, wherein the memory 10 stores a computer program, and the processor 20 is configured to run the computer program to execute the steps in any of the above-mentioned embodiments of the vehicle-mounted system operation control method for autonomous driving.

[0091] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program, wherein the computer program is configured to execute the steps of any of the above-mentioned embodiments of the vehicle-mounted system operation control method for autonomous driving when running.

[0092] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0093] An embodiment of the present application also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the steps in any of the above-mentioned embodiments of the vehicle-mounted system operation control method for autonomous driving.

[0094] An embodiment of the present application also provides another computer program product, including a non-volatile computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps in any of the above-mentioned embodiments of the vehicle-mounted system operation control method for autonomous driving.

[0095] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0096] The above is a detailed introduction to the on-board computing system for autonomous driving and the on-board system operation control method, device, electronic device, storage medium and computer program product provided by this application. This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method of this application and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of this application, several improvements and modifications can be made to this application, and these improvements and modifications also fall within the scope of protection of the claims of this application.

Claims

1. A vehicle-mounted computing system for autonomous driving, characterized in that: The system comprises: At least two computing modules with different architectures that are communicatively connected to each other, wherein the system-on-chip integrated in the computing module of one architecture serves as a primary system-on-chip, and the system-on-chip integrated in the computing module of the other architecture serves as a fault-tolerant system-on-chip, and the computing power of the fault-tolerant system-on-chip is greater than or equal to the computing power of the primary system-on-chip; The main system-level chip and the fault-tolerant system-level chip are used to run the autonomous driving algorithm corresponding to the autonomous driving system under the target autonomous driving level and generate autonomous driving decision instructions. The functional type of the autonomous driving algorithm running on the main system-level chip and the fault-tolerant system-level chip is determined according to the relationship between the computing power required by the autonomous driving algorithm corresponding to the current target autonomous driving level and the computing power configured for the main system-level chip. The functional type of the autonomous driving algorithm running on the main system-level chip and the fault-tolerant system-level chip is determined according to the relationship between the computing power required by the autonomous driving algorithm corresponding to the current target autonomous driving level and the computing power configured for the main system-level chip, including: if If the computing power of the autonomous driving algorithm corresponding to the previous target autonomous driving level is less than or equal to the computing power of the main system-level chip configured for the autonomous driving system of the corresponding level, the autonomous driving algorithm is controlled to run synchronously on the main system-level chip and the fault-tolerant system-level chip of the onboard computing system. If the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is greater than the computing power of the main system-level chip configured for the autonomous driving system of the corresponding level, the target function algorithm in the autonomous driving algorithm is controlled to run synchronously on the main system-level chip and the fault-tolerant system-level chip of the onboard computing system, and the remaining algorithms except the target function algorithm are executed by the remaining computing power in the main system-level chip or the fault-tolerant system-level chip. The system also includes a main control module for responding to the autonomous driving decision instruction, wherein the main control module is included in a downstream chip node. If any of the downstream chip nodes subscribes to the running results of the autonomous driving algorithms running synchronously on the main system-level chip and the fault-tolerant system-level chip, it is determined whether the communication index parameters between the main system-level chip and the fault-tolerant system-level chip meet the preset requirements; if the communication index parameters meet the preset requirements, it is determined whether the autonomous driving algorithm running on the main system-level chip is a preset function type algorithm; if the autonomous driving algorithm is a preset function type algorithm, it responds to the detection operation of the running result of the preset function type algorithm; if the running result of the preset function type algorithm meets the requirements, the running result corresponding to the main system-level chip is used as the input of the downstream chip node; if the running result of the preset function type algorithm does not meet the requirements, the running result corresponding to the fault-tolerant system-level chip is used as the input of the downstream chip node.

2. The vehicle-mounted computing system for autonomous driving according to claim 1, wherein: The system further includes a fault-tolerant control module, which is in communication with the main control module. The chip architecture of the fault-tolerant control module is different from that of the main control module.

3. The vehicle-mounted computing system for autonomous driving according to claim 2, wherein: The fault-tolerant system-on-chip includes a plurality of computing modules, the fault-tolerant control modules include a plurality of fault-tolerant control modules, and each of the fault-tolerant control modules is integrated in a one-to-one correspondence in the computing module where the fault-tolerant system-on-chip is located.

4. The vehicle-mounted computing system for autonomous driving according to claim 3, wherein: The main control module is used to monitor the operating status of the main system-level chip and the fault-tolerant system-level chip. Any one of the multiple fault-tolerant control modules is used to monitor the operating status of the main control module, the main system-level chip and the remaining other fault-tolerant system-level chips. The remaining other fault-tolerant system-level chips represent other fault-tolerant system-level chips except the fault-tolerant system-level chip where the current fault-tolerant control module is located.

5. The vehicle-mounted computing system for autonomous driving according to claim 3, wherein: The system further includes: a plurality of Ethernet switches, each of which is communicatively connected to the main control module and the computing module.

6. The vehicle-mounted computing system for autonomous driving according to claim 5, characterized in that: The computing modules that are communicatively connected to each other are connected via a high-speed serial bus and the Ethernet switch.

7. A method for controlling the operation of an on-board system for autonomous driving, characterized in that: An autonomous driving control system integrated with an on-vehicle computing system for autonomous driving according to any one of claims 1 to 6; the method comprising: If the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is less than or equal to the computing power of the main system-level chip configured for the autonomous driving system of the corresponding level, control the autonomous driving algorithm to run synchronously on the main system-level chip and the fault-tolerant system-level chip of the on-board computing system; If the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is greater than the computing power of the main system-level chip configured for the autonomous driving system of the corresponding level, the target function algorithm in the autonomous driving algorithm is controlled to run synchronously on the main system-level chip and the fault-tolerant system-level chip of the on-board computing system, and the remaining algorithms except the target function algorithm are executed by the remaining computing power of the main system-level chip or the fault-tolerant system-level chip; The main control module of the on-board computing system responds to the autonomous driving decision instruction generated by the main system-on-chip and / or the fault-tolerant system-on-chip based on the running autonomous driving algorithm, and executes the autonomous driving operation corresponding to the autonomous driving decision instruction on the autonomous driving vehicle; If any of the downstream chip nodes subscribes to the running results of the autonomous driving algorithms running synchronously on the main system-level chip and the fault-tolerant system-level chip, it is determined whether the communication index parameters between the main system-level chip and the fault-tolerant system-level chip meet the preset requirements; If the communication indicator parameters meet the preset requirements, determining whether the autonomous driving algorithm running on the main system-level chip is a preset function type algorithm; If the autonomous driving algorithm is a preset function type algorithm, responding to a detection operation on an operation result of the preset function type algorithm; If the operation result of the preset function type algorithm meets the requirements, the operation result corresponding to the main system-level chip is used as the input of the downstream chip node; If the running result of the preset function type algorithm does not meet the requirement, the running result corresponding to the fault-tolerant system-level chip is used as the input of the downstream chip node.

8. The vehicle-mounted system operation control method for autonomous driving according to claim 7, characterized in that: The vehicle-mounted computing system includes a plurality of fault-tolerant system-level chips; the method further includes: If the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is less than or equal to the computing power of the main system-level chip configured for the autonomous driving system of the corresponding level, the first functional type algorithm in the autonomous driving algorithm is controlled to run on any of the fault-tolerant system-level chips, and the remaining other functional type algorithms are controlled to run on the remaining other fault-tolerant system-level chips.

9. The vehicle-mounted system operation control method for autonomous driving according to claim 7, characterized in that: The method further comprises: For the main system-on-chip and the fault-tolerant system-on-chip that synchronously run the same autonomous driving algorithm, if the corresponding upstream chip node includes a corresponding fault-tolerant node, subscribe to the first output result of the algorithm running on the upstream chip node and the second output result of the algorithm running on the fault-tolerant node corresponding to the upstream chip node; inputting a target output result into the main system-on-chip and the fault-tolerant system-on-chip, wherein the target output result is determined according to the first output result or the second output result; Controlling the corresponding currently running autonomous driving algorithms on the main system-on-chip and the fault-tolerant system-on-chip to run them based on the target output result; The operation results are sent to the downstream chip nodes, which are nodes that subscribe to the autonomous driving algorithm operation data on the main system-level chip and the fault-tolerant system-level chip.

10. The vehicle-mounted system operation control method for autonomous driving according to claim 9, characterized in that: The method further comprises: If the autonomous driving algorithm is a non-preset function type algorithm, the operation result corresponding to the main system-level chip is used as the input of the downstream chip node; When the main system-level chip fails, the corresponding operation result of the fault-tolerant system-level chip is used as the input of the downstream chip node.

11. The vehicle-mounted system operation control method for autonomous driving according to claim 9, characterized in that: The response to the detection operation of the preset function type algorithm running result includes: According to the type of algorithm to be detected, call the corresponding type of error detection algorithm; Based on the called error detection algorithm, an error detection operation is responded to the result of running the preset function type algorithm.

12. The vehicle-mounted system operation control method for autonomous driving according to claim 7, characterized in that: The vehicle-mounted computing system includes a plurality of fault-tolerant control modules; the method further includes: When a main control module in the vehicle computing system fails, any one of the plurality of fault-tolerant control modules is used as a new main control module to respond to and receive autonomous driving decision instructions and control operations on the autonomous driving vehicle; When the new master control module fails, a new master control module is determined from the remaining fault-tolerant control modules.

13. The vehicle-mounted system operation control method for autonomous driving according to claim 12, characterized in that: The autonomous driving algorithm is synchronously run on the main system-on-chip of the onboard computing system and the fault-tolerant system-on-chip, and the method further includes: If a hardware failure occurs in the main system-level chip or the fault-tolerant system-level chip, controlling the autonomous driving vehicle to perform autonomous driving according to the current autonomous driving level; If hardware failure occurs in both the main system-level chip and the fault-tolerant system-level chip, the main control module is controlled to send a parking instruction to the vehicle chassis control system.

14. The vehicle-mounted system operation control method for autonomous driving according to claim 12, characterized in that: The target function algorithm in the autonomous driving algorithm is synchronously executed on the main system-on-chip and the fault-tolerant system-on-chip of the on-board computing system, and the remaining algorithms other than the target function algorithm are executed by the remaining computing power in the main system-on-chip or the fault-tolerant system-on-chip. The method further includes: If a hardware failure occurs in the main system-level chip or the fault-tolerant system-level chip, controlling the autonomous driving vehicle to perform autonomous driving according to the downgraded autonomous driving level; If hardware failure occurs in both the main system-level chip and the fault-tolerant system-level chip, the main control module is controlled to send a parking instruction to the vehicle chassis control system.

15. The vehicle-mounted system operation control method for automatic driving according to claim 13 or 14, characterized in that: After controlling the main control module to send a parking instruction to the vehicle chassis control system, the method further includes: If the main control module is configured with an assisted driving function of the target type, the autonomous driving vehicle is controlled to perform autonomous driving in combination with the assisted driving function.

16. A vehicle-mounted system operation control device for automatic driving, characterized in that: An autonomous driving control system integrated with an on-board computing system for autonomous driving according to any one of claims 1 to 6; the device comprising: a first control module configured to control the autonomous driving algorithm to run synchronously on the main system-on-chip and the fault-tolerant system-on-chip of the onboard computing system if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is less than or equal to the computing power of the main system-on-chip configured for the autonomous driving system of the corresponding level; a second control module, configured to, if the computing power of the autonomous driving algorithm corresponding to the current target autonomous driving level is greater than the computing power of the main system-level chip configured for the autonomous driving system of the corresponding level, control the target function algorithm in the autonomous driving algorithm to be executed synchronously on the main system-level chip and the fault-tolerant system-level chip of the onboard computing system, with the remaining algorithms other than the target function algorithm being executed by the remaining computing power in the main system-level chip or the fault-tolerant system-level chip; a first response module, configured to respond, through the main control module of the onboard computing system, to an autonomous driving decision instruction generated by the main system-on-chip and / or the fault-tolerant system-on-chip based on the running autonomous driving algorithm, to execute an autonomous driving operation corresponding to the autonomous driving decision instruction on the autonomous driving vehicle; a judgment module, configured to judge whether communication index parameters between the main system-level chip and the fault-tolerant system-level chip meet preset requirements if any of the downstream chip nodes subscribes to the operation results of the autonomous driving algorithms running synchronously on the main system-level chip and the fault-tolerant system-level chip; A first determination module is configured to determine whether the autonomous driving algorithm executed by the main system-level chip is a preset function type algorithm if the communication indicator parameter meets a preset requirement; a second response module, configured to respond to a detection operation on an operation result of the preset function type algorithm if the autonomous driving algorithm is a preset function type algorithm; A second determination module is configured to use the operation result corresponding to the main system-level chip as the input of the downstream chip node if the operation result of the preset function type algorithm meets the requirement; The third determination module is configured to use the corresponding operation result of the fault-tolerant system-on-chip as the input of the downstream chip node if the operation result of the preset function type algorithm does not meet the requirement.

17. An electronic device, characterized in that: include: memory for storing computer programs; A processor, configured to implement the steps of the vehicle-mounted system operation control method for autonomous driving as described in any one of claims 7 to 15 when executing a computer program.

18. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the vehicle-mounted system operation control method for autonomous driving as claimed in any one of claims 7 to 15 are implemented.

19. A computer program product, characterized in that It includes computer instructions, which are used to cause a computer to execute the steps of the vehicle-mounted system operation control method for autonomous driving as described in any one of claims 7 to 15.

Images