Automatic driving whole vehicle redundant framework and vehicle

Abstract

The invention relates to an automatic driving whole vehicle redundancy framework and a vehicle, and the framework comprises a communication link and actuator redundancy module which is used for providing independent communication paths for an automatic driving main controller and an automatic driving redundancy controller; the sensor redundancy module is used for respectively providing independent sensor data links for the automatic driving main controller and the automatic driving redundancy controller; the power redundancy module is used for outputting power through the second power subsystem when the first power subsystem is in a second preset fault state; and the power supply redundancy module is used for providing power for the current vehicle through the second power supply circuit when the first power supply circuit is in a third preset fault state. Therefore, the redundant safety system oriented to L4-level automatic driving is provided, redundant safety is achieved from the whole vehicle system level, and the problems that an existing system is insufficient in redundant safety capacity and cannot cope with the specific scene working condition of L4-level automatic driving are solved.

Description

Technical Field

[0001] The present application relates to the field of autonomous driving technology, and in particular to an autonomous driving vehicle redundant architecture and vehicle. Background Art

[0002] Currently, L4 autonomous driving requires that the system can independently complete all driving operations in specific scenarios. From a safety perspective, achieving L4 autonomous driving requires redundancy at the vehicle level. Redundant backups are required for the powertrain, braking system, steering system, and other key components that determine the vehicle's driving capabilities to prevent system failures in unexpected situations.

[0003] In related technologies, existing redundancy design solutions typically implement redundant designs for independent subsystems or for information communication links. For example, some solutions only implement fault level determination and redundant switching logic within the autonomous driving controller, activating the backup control module when the lane centering function fails. However, this approach is limited to the algorithm level and cannot cover the entire vehicle's safety in the event of sudden failures in key execution systems such as power, braking, and steering. Other solutions use redundant security information flow channels, combined with encryption verification mechanisms, to achieve redundant control of chassis actuators and vehicle-wide signal verification. These solutions focus on the information security of the communication link rather than the systemic redundancy of vehicle-level functional safety.

[0004] It can be seen that although the above-mentioned related technologies provide a certain degree of fault tolerance in their respective fields, none of them have proposed a complete redundant architecture for L4 autonomous driving from the vehicle system level. They are unable to cope with the specific scenario conditions of L4 autonomous driving and are difficult to meet the strict requirements of high-level autonomous driving for failure operability, which urgently needs to be resolved. Summary of the Invention

[0005] This application provides a redundant architecture and vehicle for autonomous driving to address the problem that the current system's redundant safety capabilities are insufficient and cannot cope with the specific scenario conditions of L4 level autonomous driving. By proposing a redundant safety system for L4 level autonomous driving, redundant safety is achieved at the vehicle system level.

[0006] The first embodiment of the present application provides a redundant architecture for an autonomous driving vehicle, including:

[0007] a communication link and actuator redundancy module, configured to provide independent communication paths for the autonomous driving main controller and the autonomous driving redundant controller, respectively, and to execute a target to-be-executed function via a second execution unit in the component controller when a first execution unit in the execution component controller is in a first preset fault state;

[0008] A sensor redundancy module is used to provide independent sensor data links for the autonomous driving main controller and the autonomous driving redundant controller respectively;

[0009] a power redundancy module, configured to output power through the second power subsystem to maintain the current operation of the vehicle when the first power subsystem is in a second preset fault state;

[0010] The power supply redundancy module is used to provide power to the current vehicle through the second power supply circuit when the first power supply circuit is in a third preset fault state.

[0011] According to one embodiment of the present application, the communication link and actuator redundancy module includes:

[0012] a first CAN (Controller Area Network) bus, wherein the first CAN bus is respectively connected to the automatic driving main controller, the execution component controller, and the automatic driving redundant controller;

[0013] a second CAN bus, the second CAN bus being connected to the automatic driving main controller, the execution component controller, and the automatic driving redundant controller respectively;

[0014] a first vehicle-mounted communication unit, wherein the first vehicle-mounted communication unit is connected to the automatic driving main controller and the automatic driving redundant controller respectively;

[0015] The second vehicle-mounted communication unit, the first vehicle-mounted communication unit is respectively connected to the automatic driving main controller and the automatic driving redundant controller.

[0016] According to one embodiment of the present application, the sensor redundancy module includes a laser radar, a camera, a millimeter-wave radar, and an ultrasonic sensor, and the sensor redundancy module is further configured to:

[0017] transmitting the lidar data, the camera data, and the millimeter-wave radar data to the autonomous driving master controller based on the first sensor data link;

[0018] Based on the second sensor data link, the camera data, the millimeter-wave radar data and the ultrasonic radar data are transmitted to the automatic driving redundant controller.

[0019] According to one embodiment of the present application, the sensor redundancy module is further configured to:

[0020] When the automatic driving main controller is in a fourth preset fault state, current sensor data is received based on the second sensor data link, and a preset automatic driving algorithm is executed based on the current sensor data.

[0021] According to one embodiment of the present application, the power redundancy module includes an engine, a P1 generator, a clutch, a P3 drive motor, and a power battery. The power redundancy module is further used to:

[0022] In series mode, the clutch is controlled to be disconnected, the P1 generator is controlled to generate electricity, and the P3 drive motor is controlled to drive the current vehicle;

[0023] In parallel mode, controlling the clutch to close, and controlling the engine and the P3 drive motor to jointly drive the current vehicle;

[0024] In the oil-only mode, controlling the clutch to close, and controlling the engine to drive the current vehicle;

[0025] In pure electric mode, the clutch is controlled to be disconnected, and the P3 drive motor is controlled to drive the current vehicle.

[0026] According to one embodiment of the present application, the first power supply circuit includes a first power supply, and the first power supply is connected to the first execution unit;

[0027] The second power supply circuit includes a second power supply, and the second power supply is connected to the second execution unit.

[0028] According to one embodiment of the present application, the power supply redundancy module is further configured to:

[0029] Controlling the first power supply to be charged by a power battery via a power converter, and controlling the second power supply to be charged by an engine via a generator;

[0030] Alternatively, the first power supply is controlled to be charged by the engine via a generator, and the second power supply is controlled to be charged by the power battery via a power converter.

[0031] According to one embodiment of the present application, the first vehicle-mounted communication unit communicates with the autonomous driving main controller and the autonomous driving redundant controller via a first Ethernet, and the second vehicle-mounted communication unit communicates with the autonomous driving main controller and the autonomous driving redundant controller via a second Ethernet.

[0032] According to one embodiment of the present application, the execution component controller includes at least one of a braking component, a steering component, and a driving component.

[0033] According to the autonomous driving vehicle redundancy architecture provided in the embodiments of this application, a communication link and an actuator redundancy module are used to provide independent communication paths for the autonomous driving main controller and the autonomous driving redundant controller, respectively. A sensor redundancy module is used to provide independent sensor data links for the autonomous driving main controller and the autonomous driving redundant controller, respectively. A power redundancy module is used to output power through the second power subsystem when the first power subsystem is in a second preset fault state. A power supply redundancy module is used to provide power to the current vehicle through the second power supply circuit when the first power supply circuit is in a third preset fault state. Thus, by proposing a redundant safety system for L4 autonomous driving, redundant safety is achieved at the vehicle system level, resolving the current problem of insufficient redundant safety capabilities of the system and its inability to cope with the specific operating conditions of L4 autonomous driving.

[0034] A second aspect of the present application provides a vehicle comprising the autonomous driving vehicle redundant architecture of the above-mentioned embodiment.

[0035] According to the vehicle of the embodiment of the present application, through the above-mentioned autonomous driving vehicle redundant architecture, by proposing a redundant safety system for L4 level autonomous driving, redundant safety is achieved at the vehicle system level, solving the problem that the current system redundant safety capability is insufficient and cannot cope with the specific scenario conditions of L4 level autonomous driving.

[0036] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0038] Figure 1 This is a block diagram of a redundant architecture for an autonomous driving vehicle provided according to an embodiment of the present application;

[0039] Figure 2 Schematic diagram of the architecture of a communication link and actuator redundancy module according to one embodiment of the present application;

[0040] Figure 3 Schematic diagram of the architecture of a sensor redundancy module according to one embodiment of the present application;

[0041] Figure 4 Schematic diagram of the architecture of a power redundancy module according to one embodiment of the present application;

[0042] Figure 5 Schematic diagram of the architecture of a power supply redundancy module according to an embodiment of the present application. DETAILED DESCRIPTION

[0043] The following describes in detail embodiments of the present application, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0044] The following describes the redundant architecture and vehicle of an autonomous driving vehicle according to an embodiment of the present application with reference to the accompanying drawings. To address the issue mentioned in the background art above regarding the current system's insufficient redundancy and safety capabilities, which cannot cope with specific scenarios and operating conditions at the L4 level of autonomous driving, the present application provides a redundant architecture for an autonomous driving vehicle. This architecture utilizes a communication link and an actuator redundancy module to provide independent communication paths for the autonomous driving main controller and the autonomous driving redundant controller, respectively. It utilizes a sensor redundancy module to provide independent sensor data links for the autonomous driving main controller and the autonomous driving redundant controller, respectively. It utilizes a power redundancy module to output power through the second power subsystem when the first power subsystem is in a second preset fault state. It utilizes a power supply redundancy module to provide power to the current vehicle through the second power supply circuit when the first power supply circuit is in a third preset fault state. Thus, by proposing a redundant safety system for L4 level autonomous driving, redundant safety is achieved at the vehicle system level, resolving the issue of insufficient redundant safety capabilities and the inability of the current system to cope with specific scenarios and operating conditions at the L4 level of autonomous driving.

[0045] Specifically, Figure 1 A schematic diagram of a redundant architecture for an autonomous driving vehicle provided in an embodiment of the present application.

[0046] like Figure 1 As shown, the redundant architecture of the autonomous driving vehicle includes: a communication link and actuator redundancy module 100, a sensor redundancy module 200, a power redundancy module 300 and a power supply redundancy module 400.

[0047] Among them, the communication link and actuator redundancy module 100 is used to provide independent communication paths for the automatic driving main controller and the automatic driving redundant controller respectively, and when the first execution unit in the execution component controller is in the first preset fault state, the target function to be executed is executed through the second execution unit in the component controller; the sensor redundancy module 200 is used to provide independent sensor data links for the automatic driving main controller and the automatic driving redundant controller respectively; the power redundancy module 300 is used to output power through the second power subsystem when the first power subsystem is in the second preset fault state to maintain the operation of the current vehicle; the power supply redundancy module 400 is used to provide power to the current vehicle through the second power supply circuit when the first power supply circuit is in the third preset fault state.

[0048] Optionally, in some embodiments, the communication link and actuator redundancy module 100 includes: a first CAN bus, the first CAN bus is respectively connected to the autonomous driving main controller, the execution component controller and the autonomous driving redundant controller; a second CAN bus, the second CAN bus is respectively connected to the autonomous driving main controller, the execution component controller and the autonomous driving redundant controller; a first on-board communication unit, the first on-board communication unit is respectively connected to the autonomous driving main controller and the autonomous driving redundant controller; a second on-board communication unit, the first on-board communication unit is respectively connected to the autonomous driving main controller and the autonomous driving redundant controller.

[0049] In some embodiments, the execution component controller includes at least one of a braking component, a steering component, and a driving component.

[0050] Specifically, the vehicle redundancy architecture of this embodiment includes a primary and redundant autonomous driving controller. The controllers for actuators such as braking, steering, and driving each include a primary unit and a redundant unit. The communication link and actuator redundancy module 100 is a core component of the vehicle redundancy architecture, designed to ensure that the autonomous driving system maintains basic functionality even if a communication link or actuator fails.

[0051] For example, Figure 2 As shown, the communication link and actuator redundancy module 100 mainly includes two independent CAN buses (a first CAN bus and a second CAN bus, Figure 2 CAN1 and CAN2) and two vehicle-mounted communication units (i.e., the first vehicle-mounted communication unit and the second vehicle-mounted communication unit, Figure 2 The CAN1 and CAN2 buses are connected to the autonomous driving main controller, the actuator controller, and the autonomous driving redundant controller, respectively, forming a dual-channel redundant communication network. This allows one CAN bus to fail due to message loss, verification failure, or other communication failures, allowing the other CAN bus to take over communication tasks. This supports continuous information exchange between the autonomous driving main controller, the redundant controller, and the actuator controller, thereby avoiding system interruption due to single point failures.

[0052] Furthermore, actuator redundancy is achieved by configuring a main unit and a redundant unit for key actuator components such as braking, steering, and driving. For example, refer to Figure 2The main brake controller and redundant brake controller, the main steering controller and redundant steering controller, and the main drive controller and redundant drive controller are shown. The main unit and redundant units are connected to different CAN buses and can independently respond to control commands. If the main unit fails to operate normally due to hardware or software failure, the redundant unit can be immediately activated and take over basic control functions, such as providing basic braking force, maintaining basic steering capability, or driving the vehicle to a safe area. This ensures that the vehicle's minimum risk maneuver (MRM) can be implemented, such as pulling over or low-speed cruising, to protect occupant and road safety.

[0053] Furthermore, vehicle-mounted communication redundancy is achieved by two independent TBOX vehicle-mounted network communication units (the first vehicle-mounted communication unit and the second vehicle-mounted communication unit), which are respectively connected to the automatic driving main controller and the redundant controller to realize independent network communication of the automatic driving main and redundant controllers, so that when problems occur in the vehicle system, the vehicle can be rescued through remote control commands.

[0054] Optionally, in some embodiments, the first vehicle-mounted communication unit communicates with the autonomous driving main controller and the autonomous driving redundant controller via a first Ethernet, and the second vehicle-mounted communication unit communicates with the autonomous driving main controller and the autonomous driving redundant controller via a second Ethernet.

[0055] Specifically, if Figure 2 As shown, communication between the first onboard communication unit TBOX1 and the autonomous driving main controller and redundant controller occurs via the first Ethernet network ETH1. ETH1 uses the high-speed Ethernet protocol to provide independent network communication channels for the autonomous driving main controller and redundant controller, ensuring low latency and high reliability of data transmission. The main controller sends vehicle status information, sensor data, and control instructions to the first onboard communication unit TBOX1 via the first Ethernet network ETH1, and also receives dispatch commands from the cloud or remote control center.

[0056] Furthermore, the second onboard communication unit TBOX2 establishes redundant communication links with the autonomous driving main controller and redundant controller via the second Ethernet ETH2. ETH2 is physically isolated from the first Ethernet ETH1, utilizing independent switches and routing paths to prevent single points of failure from impacting overall communication. The main controller and redundant controller exchange data with the second onboard communication unit TBOX2 via the second Ethernet ETH2, forming a backup channel parallel to the first Ethernet ETH1. If communication anomalies occur on the first Ethernet ETH1 due to hardware damage, electromagnetic interference, or a network attack, the system automatically switches to the second Ethernet ETH2, maintaining a real-time connection between the vehicle and the cloud.

[0057] Optionally, in some embodiments, the sensor redundancy module 200 includes a lidar, a camera, a millimeter-wave radar, and an ultrasonic sensor. The sensor redundancy module is also used to: transmit the lidar data, the camera data, and the millimeter-wave radar data to the autonomous driving main controller based on a first sensor data link; and transmit the camera data, the millimeter-wave radar data, and the ultrasonic radar data to the autonomous driving redundant controller based on a second sensor data link.

[0058] Optionally, in some embodiments, the sensor redundancy module 200 is also used to: when the autonomous driving main controller is in a fourth preset fault state, receive current sensor data based on the second sensor data link, and execute a preset autonomous driving algorithm based on the current sensor data.

[0059] Specifically, if Figure 3 As shown, in the sensor redundancy architecture of the embodiment of the present application, the autonomous driving main controller and the autonomous driving redundant controller run different algorithms. The algorithm running on the autonomous driving main controller includes a laser radar, camera, and millimeter-wave radar fusion perception algorithm, which can achieve Level 4 autonomous driving in the Robotaxi scenario. The algorithm running on the autonomous driving redundant controller includes a camera, millimeter-wave radar fusion perception algorithm, and a close-range ultrasonic detection algorithm, which can implement a minimum-risk pull-over strategy in the Robotaxi emergency scenario.

[0060] As a result, sensor data is fed to both the primary and redundant controllers via independent links. If the primary controller fails or malfunctions, the redundant controller can still receive sensor data and run the autonomous driving algorithm.

[0061] Optionally, in some embodiments, the power redundancy module 300 includes an engine, a P1 generator, a clutch, a P3 drive motor and a power battery. The power redundancy module 300 is also used to: in series mode, control the clutch to disconnect, control the P1 generator to generate electricity, and control the P3 drive motor to drive the current vehicle; in parallel mode, control the clutch to close, and control the engine and P3 drive motor to jointly drive the current vehicle; in pure oil mode, control the clutch to close, and control the engine to drive the current vehicle; in pure electric mode, control the clutch to disconnect, and control the P3 drive motor to drive the current vehicle.

[0062] Specifically, the power redundancy architecture of the embodiment of the present application can be as follows: Figure 4 As shown, the vehicle platform can adopt a hybrid power system with a P1P3 architecture, achieving power redundancy through flexible switching of multiple working modes.

[0063] Furthermore, if Figure 4As shown, in series mode, the system disconnects the clutch, allowing the engine to operate independently in the optimal efficiency range. At this time, the P1 motor acts as a generator to convert the mechanical energy output by the engine into electrical energy, and the P3 motor acts as a drive motor to drive the vehicle. The power battery is used to balance the engine's power generation power and the P3 motor's drive power.

[0064] Furthermore, in parallel mode, the clutch is closed, and the engine and P3 motor jointly drive the vehicle. The system also supports two basic operating modes: pure oil and pure electric. In pure oil mode, the clutch remains closed, the P1 and P3 motors are deactivated, and the engine alone provides driving force. In pure electric mode, the clutch is disengaged, the engine and P1 motor are deactivated, and the P3 motor drives the vehicle.

[0065] To ensure the reliability of the power supply system, Figure 4 As shown, the vehicle is equipped with two independent low-voltage batteries: a main low-voltage battery and a redundant low-voltage battery. The main low-voltage battery is charged from the power battery via a DCDC (Direct Current to Direct Current) power converter, while the redundant low-voltage battery is charged via the engine-driven generator. This ensures that the vehicle has two independent low-voltage power supplies. In the event of failure or malfunction of the fuel system or the pure electric system, the other system can serve as a backup power system to support the vehicle's minimal risk strategy.

[0066] Optionally, in some embodiments, the first power supply circuit includes a first power supply connected to the first execution unit; the second power supply circuit includes a second power supply connected to the second execution unit.

[0067] Optionally, in some embodiments, the power supply redundancy module 400 is further used to: control the first power supply to be charged by the power battery via the power converter, and control the second power supply to be charged by the engine via the generator; or, control the first power supply to be charged by the engine via the generator, and control the second power supply to be charged by the power battery via the power converter.

[0068] Specifically, if Figure 5 As shown, the power supply redundancy architecture of the embodiment of the present application uses a main low-voltage battery and a redundant low-voltage battery as independent low-voltage power sources to ensure continuous power supply to the vehicle's key systems. The main low-voltage battery is charged by the engine-driven generator and is protected by diode 1 to prevent reverse voltage interference from the redundant low-voltage battery power supply circuit; the redundant low-voltage battery is charged by the power battery via a DCDC converter and is protected by diode 2 to prevent reverse voltage interference from the redundant low-voltage battery power supply circuit.

[0069] The above two power supply systems are completely independent, providing power for the main execution unit and redundant execution unit respectively: the main controllers of the braking, steering, driving and other execution components are connected to the main low-voltage battery circuit, while their redundant controllers are connected to the redundant low-voltage battery circuit, thereby realizing power supply isolation at the hardware level and avoiding single point failure causing system paralysis.

[0070] Under normal operating conditions, relay 1 remains closed and relay 2 is disconnected. The main low-voltage battery circuit supplies power to the main unit of the autonomous driving main controller and the actuator, ensuring the normal operation of the main unit of the controller of the braking, steering, and drive actuator, and the main controller of the autonomous driving. When the first power supply circuit (i.e., the main low-voltage battery circuit) experiences a short circuit, voltage anomaly, or other faults, relay 1 immediately disconnects, while relay 2 closes, and the low-voltage power supply circuit of the entire vehicle switches from the main low-voltage battery power supply circuit to the redundant low-voltage battery power supply circuit. During the switching process, the capacitor component plays a key role, maintaining voltage stability through instantaneous energy storage and discharge, ensuring that the control system will not fail due to power fluctuations during the switching period. In addition, each controller is designed with dual power input to ensure that if one power supply fails, the other power supply can still maintain power supply, ensuring that each controller has basic functions.

[0071] According to the autonomous driving vehicle redundant architecture proposed in the embodiments of this application, a communication link and an actuator redundancy module are used to provide independent communication paths for the autonomous driving main controller and the autonomous driving redundant controller, respectively. A sensor redundancy module is used to provide independent sensor data links for the autonomous driving main controller and the autonomous driving redundant controller, respectively. A power redundancy module is used to output power through the second power subsystem when the first power subsystem is in a second preset fault state. A power supply redundancy module is used to provide power to the current vehicle through the second power supply circuit when the first power supply circuit is in a third preset fault state. Thus, by proposing a redundant safety system for L4 autonomous driving, redundant safety is achieved at the vehicle system level, resolving the current problem of insufficient redundant safety capabilities of the system and its inability to cope with the specific operating conditions of L4 autonomous driving. This ensures the redundant safety of the L4 autonomous driving system and reduces the risk of failure of the overall functional safety goals of L4 autonomous driving due to failure of individual system functions.

[0072] An embodiment of the present application also provides a vehicle, which includes the autonomous driving vehicle redundant architecture of the above embodiment.

[0073] According to the vehicle of the embodiment of the present application, by proposing a redundant safety system for L4 level autonomous driving, redundant safety is achieved at the vehicle system level, solving the problem that the current system's redundant safety capabilities are insufficient and cannot cope with the specific scenario conditions of L4 level autonomous driving.

[0074] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and features of different embodiments or examples without contradiction.

[0075] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of technical features indicated. Thus, a feature specified as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of this application, "N" means at least two, for example, two, three, etc., unless otherwise specifically defined.

[0076] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may be performed out of the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present application belong.

[0077] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or N wires (electronic devices), a portable computer disk cartridge (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and programmable read-only memory (EPROM or flash memory), fiber optic devices, and a portable compact disc read-only memory (CDROM). Furthermore, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing it in another suitable manner if necessary, and then storing it in a computer memory.

[0078] It should be understood that various parts of the present application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiment, the N steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used to implement: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0079] Those skilled in the art will understand that all or part of the steps in the method of the above embodiment can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiment.

[0080] In addition, the functional units in the various embodiments of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into a module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0081] The storage medium mentioned above may be a read-only memory, a magnetic disk, or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present application. Persons skilled in the art may make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present application.

Claims

1. A redundant architecture for an autonomous driving vehicle, characterized in that: include: a communication link and actuator redundancy module, configured to provide independent communication paths for the autonomous driving main controller and the autonomous driving redundant controller, respectively, and to execute a target to-be-executed function via a second execution unit in the component controller when a first execution unit in the execution component controller is in a first preset fault state; A sensor redundancy module is used to provide independent sensor data links for the autonomous driving main controller and the autonomous driving redundant controller respectively; a power redundancy module, configured to output power through the second power subsystem to maintain the current operation of the vehicle when the first power subsystem is in a second preset fault state; The power supply redundancy module is used to provide power to the current vehicle through the second power supply circuit when the first power supply circuit is in a third preset fault state.

2. The architecture according to claim 1, wherein: The communication link and actuator redundancy module includes: a first CAN bus, wherein the first CAN bus is respectively connected to the automatic driving main controller, the execution component controller, and the automatic driving redundant controller; a second CAN bus, the second CAN bus being connected to the automatic driving main controller, the execution component controller, and the automatic driving redundant controller respectively; a first vehicle-mounted communication unit, wherein the first vehicle-mounted communication unit is connected to the automatic driving main controller and the automatic driving redundant controller respectively; The second vehicle-mounted communication unit, the first vehicle-mounted communication unit is respectively connected to the automatic driving main controller and the automatic driving redundant controller.

3. The architecture according to claim 1, wherein: The sensor redundancy module includes a laser radar, a camera, a millimeter-wave radar, and an ultrasonic sensor. The sensor redundancy module is also used to: transmitting the lidar data, the camera data, and the millimeter-wave radar data to the autonomous driving master controller based on the first sensor data link; Based on the second sensor data link, the camera data, the millimeter-wave radar data and the ultrasonic radar data are transmitted to the automatic driving redundant controller.

4. The architecture according to claim 3, characterized in that The sensor redundancy module is further used for: When the automatic driving main controller is in a fourth preset fault state, current sensor data is received based on the second sensor data link, and a preset automatic driving algorithm is executed based on the current sensor data.

5. The architecture according to claim 1, wherein: The power redundancy module includes an engine, a P1 generator, a clutch, a P3 drive motor, and a power battery. The power redundancy module is also used to: In series mode, the clutch is controlled to be disconnected, the P1 generator is controlled to generate electricity, and the P3 drive motor is controlled to drive the current vehicle; In parallel mode, controlling the clutch to close, and controlling the engine and the P3 drive motor to jointly drive the current vehicle; In the oil-only mode, controlling the clutch to close, and controlling the engine to drive the current vehicle; In pure electric mode, the clutch is controlled to be disconnected, and the P3 drive motor is controlled to drive the current vehicle.

6. The architecture according to claim 1, wherein: The first power supply circuit includes a first power supply, and the first power supply is connected to the first execution unit; The second power supply circuit includes a second power supply, and the second power supply is connected to the second execution unit.

7. The architecture according to claim 6, characterized in that The power supply redundancy module is further used for: Controlling the first power supply to be charged by a power battery via a power converter, and controlling the second power supply to be charged by an engine via a generator; Alternatively, the first power supply is controlled to be charged by the engine via a generator, and the second power supply is controlled to be charged by the power battery via a power converter.

8. The architecture according to claim 2, wherein: The first vehicle-mounted communication unit communicates with the automatic driving main controller and the automatic driving redundant controller via a first Ethernet, and the second vehicle-mounted communication unit communicates with the automatic driving main controller and the automatic driving redundant controller via a second Ethernet.

9. The architecture according to claim 1, wherein: The actuator controller includes at least one of a braking component, a steering component, and a driving component.

10. A vehicle, characterized in that: include: The redundant architecture of an autonomous driving vehicle according to any one of claims 1 to 9.

Images