Self-adaptive response control method and system for automatic driving longitudinal control redundant system of heavy-duty car

Abstract

The invention relates to the technical field of vehicle control, in particular to a self-adaptive response control method and system for an automatic driving longitudinal control redundant system of a heavy-duty car, and the method comprises the steps: continuously monitoring main and standby control paths of the system and states of all parts, and judging fault levels in real time, including normal, slight, moderate and serious faults. Executing a grading response strategy according to the grades: performing master control and standby hot standby verification in a normal state; when a slight fault occurs, the master control starts standby resource verification compensation; when a moderate fault occurs, a standby path is quickly switched, and the braking force is kept; when a serious fault occurs, an emergency path is activated immediately, deceleration is limited, an alarm is given, and safe deceleration of the vehicle is ensured. And recording and reporting the total event. The crossing from rigid switching to intelligent grading self-adaption is realized, and the continuity and efficiency of the system are improved while the safety is guaranteed.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of vehicle control, in particular to an adaptive response control method and system for a heavy truck automatic driving longitudinal control redundancy system. BACKGROUND

[0002] In the field of heavy truck automatic driving longitudinal control, redundancy system is the core to ensure driving safety, but the existing redundancy control scheme mostly adopts simple master-standby two-state switching logic, which only switches to standby path when detecting master path failure, lacking fine differentiation and adaptive response ability to fault degree.

[0003] For minor faults such as temporary contamination of camera and abnormal data of single non-critical sensor, the existing rigid strategy will directly trigger unnecessary path switching or even braking intervention, which not only destroys the continuity of automatic driving and reduces transportation efficiency, but also may introduce new safety risks and vehicle wear due to frequent unnecessary braking intervention in heavy load working conditions. At the same time, this scheme does not fully consider the particularity of heavy truck heavy load, long downhill and other complex scenes, resulting in poor scene adaptability of redundancy control, which cannot meet the safety requirements, and a dynamic adaptive response scheme based on fault level is urgently needed to balance safety and operational efficiency. SUMMARY

[0004] To solve the above problems, the present application provides an adaptive response control method and system for a heavy truck automatic driving longitudinal control redundancy system.

[0005] In the first aspect, the present application provides an adaptive response control method for a heavy truck automatic driving longitudinal control redundancy system, the redundancy system comprising at least a master control path and a standby control path, the method implementing hierarchical response based on preset fault levels, comprising the following steps: S1, continuously monitoring the working state and performance parameters of the master control path, standby control path, their associated sensors, actuators and control units; S2, determining the fault level of the system in real time according to the monitored working state and performance parameters, the fault level including normal working condition, minor fault, moderate fault and serious fault; S3, executing the control strategy corresponding to the fault level according to the real-time determination of the fault level, wherein: When it is determined as normal working condition, the master control path is used for longitudinal control, and the standby control path synchronizes control instructions and vehicle state data in hot backup mode and performs periodic deviation check; When it is determined as minor fault, the control right of the master control path is maintained, and the sensor data or computing resources of the standby control path are enabled to perform real-time check and compensation on the output of the master control path to ensure functional safety; When it is determined to be a moderate fault, the longitudinal control right is switched from the main control path to the backup control path within a preset first time threshold, and the brake force output is kept not lower than a preset first brake force keeping threshold during the switching process; When it is determined to be a serious fault, an emergency fault-tolerant mechanism is activated within a preset second time threshold, the emergency fault-tolerant mechanism at least includes activating an emergency backup path, limiting the maximum deceleration of the vehicle, and triggering a vehicle warning, and the second time threshold is less than the first time threshold, to ensure that the vehicle enters a controllable deceleration state; S4, record the fault event, the triggered response action and the vehicle state and control parameters related to the fault and the response, and report through the vehicle-mounted communication network.

[0006] Based on the fault level, a hierarchical response is implemented, the main path control and the backup path hot backup are considered in normal working conditions to balance control efficiency and redundancy reliability; the main path maintains control and the backup path compensates data in slight fault to avoid unnecessary switching; the moderate fault is quickly and seamlessly taken over and the brake force is guaranteed to be stable; in the case of serious fault, an emergency response is triggered and the deceleration is strictly controlled, which solves the problems of poor scene adaptability and single response strategy of the existing scheme, balances the safety and operation continuity of the heavy-duty automatic driving, and meets the harsh demands of complex scenes such as heavy load and long downhill.

[0007] As a preferred technical solution of the present application, the determination condition of the slight fault includes any of the following situations: The data confidence of any sensor in the main control path is lower than a first normal working threshold; There is a persistent abnormal deviation between the monitoring data of the same physical quantity of the main control path and the backup control path, and the deviation does not exceed the allowed redundancy checking tolerance; The computing resource occupancy rate of the main control unit exceeds a first load threshold affecting the execution of non-critical tasks.

[0008] The fine identification of faults provides accurate judgment basis for the slight fault response strategy of data compensation rather than path switching, reduces unnecessary control interruption, reduces the safety risk and vehicle loss caused by frequent switching in heavy load working condition, and at the same time guarantees the function safety without degradation.

[0009] As a preferred technical solution of the present application, the determination condition of the moderate fault includes any of the following situations: The actuator response delay of the main control path exceeds a first allowed delay threshold ensuring the longitudinal stability of the vehicle; The communication interruption time between the main control unit and the vehicle chassis system responsible for longitudinal control exceeds a first allowed interruption threshold affecting control continuity; The deviation of the brake force output by the main control path from the target value continues to exceed a first allowed deviation threshold value affecting the tracking accuracy; The key environment perception function of the main control path fails, and the function cannot be completely replaced by the perception system of the backup control path under the condition of meeting the control accuracy requirement.

[0010] Precise screening of fault scenarios requiring path switching ensures that the backup path only takes over when the main path cannot maintain effective control, avoids over-response to minor faults, prevents delayed handling of moderate faults, and ensures the rationality of the switching timing.

[0011] As a preferred technical solution of the present application, the determination conditions of the serious fault include any of the following situations: The state and instruction synchronization channel between the main control unit and the backup control unit is completely disabled; The brake output capacity of the main control path and the backup control path simultaneously decreases to a level that cannot meet the basic braking demand; The maximum safe deceleration of the vehicle evaluated in real time based on the current available resources of the system is lower than the minimum safe deceleration necessary to maintain the current driving state; The standby state of the emergency backup path for fault tolerance is not available.

[0012] Quickly identify extreme risk scenarios to provide accurate trigger basis for emergency response mechanisms, ensure that the highest level of safety response is immediately activated when the system is at risk of collapse, and maximize the probability of reducing the probability of serious accidents such as collisions and cargo overturns caused by serious faults in heavy vehicles with high load and high inertia.

[0013] As a preferred technical solution of the present application, in the response to the moderate fault, the backup control path is a brake circuit independent of the main control path, the first time threshold is set according to the vehicle dynamics stability requirement, and the first brake force threshold is a preset brake force retention rate target value.

[0014] Ensure the stability and reliability of the moderate fault switching process, the independent brake circuit avoids the interference of the main path fault to the backup path output, the time threshold of the dynamics adaptation ensures the switching to be fast and not to affect the vehicle attitude, and the brake force retention rate target value ensures the control accuracy of the vehicle speed during the switching process, avoiding the safety hazards caused by the sudden change of the brake force of the heavy vehicle due to the switching.

[0015] As a preferred technical solution of the present application, in the response to the serious fault, the emergency fault-tolerant mechanism is switched to a mechanical emergency path, the second time threshold is set according to the emergency degree of avoiding collision, and the maximum safe deceleration is limited according to the vehicle load and road adhesion condition.

[0016] The mechanical emergency path is not affected by the failure of the electronic system, and the design shorter than the first time threshold ensures the timeliness of emergency response, and the deceleration limit based on the load and road conditions effectively avoids secondary risks such as cargo overturning and tire locking caused by excessive deceleration of heavy vehicles, and improves the risk avoidance ability of surrounding traffic participants through the warning function.

[0017] As a preferred technical solution of the present application, the step of real-time evaluation of the maximum safe deceleration of the vehicle based on the current available resources of the system comprises: Real-time acquisition and maintenance of the availability state and performance attenuation coefficient of all brake execution units, including at least the line control brake unit of the main control path, the independent hydraulic brake unit of the backup control path, and the non-friction brake device; Based on the availability state, performance attenuation coefficient and physical parameters of each brake execution unit, the maximum braking force that each unit can provide at the current time is calculated, and the braking forces of all available units are summed to obtain the current theoretical maximum total braking force of the system; Divide the theoretical maximum total braking force by the current total mass of the vehicle to obtain the theoretical maximum deceleration without considering the road conditions ; Obtain the real-time estimated adhesion coefficient of the current road Calculate the maximum deceleration under adhesion condition , wherein is the acceleration due to gravity; Take the smaller value of the theoretical maximum deceleration and the maximum deceleration under adhesion condition as the final evaluated maximum safe deceleration of the vehicle .

[0018] The dynamic adaptive evaluation of deceleration overcomes the defects of traditional fixed deceleration setting that cannot adapt to load changes, brake wear and road differences, provides accurate quantitative basis for severe fault judgment, ensures that the deceleration is within a safe and reasonable range during emergency braking, and balances braking efficiency and driving stability.

[0019] As a preferred technical solution of the present application, the minimum safe deceleration necessary to maintain the current driving state is dynamically calculated by comprehensively considering collision avoidance requirements and speed control requirements, and the specific steps include: Obtain the relative distance and relative speed between the ego vehicle and the preceding vehicle or obstacle, and calculate the minimum deceleration required to avoid collision ; In long downhill or curved road scenarios, calculate the minimum deceleration required to maintain the target vehicle speed according to the current vehicle speed, target safe vehicle speed, road slope angle and look-ahead distance ; the minimum deceleration required to avoid a collision the minimum deceleration required to maintain the target vehicle speed and the preset reference deceleration the maximum value among the above as the minimum safety deceleration required to maintain the current driving state .

[0020] The scenario-based and dynamic adaptation of the minimum safety deceleration avoids the problem that a fixed threshold cannot meet the safety requirements in different working conditions, provides a quantitative standard that fits the actual driving scenarios for severe fault determination, ensures the accuracy and safety of the determination results, and improves the adaptation capability of the system to complex working scenarios.

[0021] As a preferred technical solution of the present application, in S2, from monitoring the fault condition to determining the corresponding fault level and triggering the response, an anti-interference confirmation process is included, specifically: For the determination conditions of minor faults and moderate faults, when the condition is first monitored to be met, a first confirmation time window is started; only when the fault condition continues or accumulates to exceed the first proportion threshold within the first confirmation time window, the corresponding fault level is finally determined to be entered; For the determination condition of severe faults, when the condition is first monitored to be met, a second confirmation time window shorter than the first confirmation time window is started; only when the fault condition continues to appear within the second confirmation time window, the severe fault level is finally determined to be entered and the response is immediately triggered; In the first confirmation time window or the second confirmation time window, the system maintains the original fault level and the corresponding strategy, but continuously records the to-be-confirmed fault event.

[0022] The false fault signals such as transient interference and sensor false alarms are effectively filtered, unnecessary responses caused by misjudgment are avoided, the accuracy of fault determination is improved; at the same time, a shorter confirmation window is adopted for severe faults to ensure the timeliness of the response in emergency situations, and the balance between anti-interference misjudgment and rapid response to emergency faults is achieved, thereby improving the reliability and stability of the redundant control of the system.

[0023] In a second aspect, the present application also provides an adaptive response redundant control system for automatic driving longitudinal control of heavy trucks, comprising: a state monitoring module for continuously monitoring the working states and performance parameters of the main control path, the backup control path, and the sensors, actuators, and control units associated therewith; a fault diagnosis and level determination module in communication connection with the state monitoring module, for determining the fault level of the system in real time according to the monitored working states and performance parameters, the fault level including normal working condition, minor fault, moderate fault, and severe fault; A hierarchical strategy execution module, in communication connection with the fault diagnosis and level determination module, is configured to execute a control strategy corresponding to the fault level determined in real time. When it is determined that the working condition is normal, the hierarchical strategy execution module is configured to instruct the main control path to execute longitudinal control, and instruct the standby control path to synchronously control the control instruction and vehicle state data in a hot backup manner, and execute periodic deviation check; When it is determined that the working condition is slightly faulty, the hierarchical strategy execution module is configured to maintain the control right of the main control path, while instructing the sensor data or computing resource of the standby control path to perform real-time check and compensation on the output of the main control path; When it is determined that the working condition is moderately faulty, the hierarchical strategy execution module is configured to instruct the longitudinal control right to be switched from the main control path to the standby control path within a preset first time threshold, and control the braking force output during the switching process to be not lower than a preset first braking force maintaining threshold; When it is determined that the working condition is seriously faulty, the hierarchical strategy execution module is configured to activate an emergency fault-tolerant mechanism within a preset second time threshold, the emergency fault-tolerant mechanism at least including activating an emergency backup path, limiting the maximum deceleration of the vehicle, and triggering a vehicle warning, the second time threshold being smaller than the first time threshold; A data recording and communication module is configured to record fault events, triggered response actions, and related vehicle states and control parameters, and report them through a vehicle-mounted communication network; The main control path and the standby control path are physically or logically isolated from each other.

[0024] As can be seen from the above technical solutions, the present application has the following advantages: the rigid logic of traditional main-standby two-state switching is changed, the most matching countermeasures can be taken according to the actual influence degree of the fault, thereby the continuity of automatic driving, operation efficiency and ride comfort are maximized under the premise of ensuring functional safety, and unnecessary degradation or emergency intervention caused by frequent triggering of non-critical faults is avoided. BRIEF DESCRIPTION OF DRAWINGS

[0025] In order to more clearly illustrate the technical solutions of the present application, the drawings required in the description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0026] Figure 1 The flowchart of the method provided by the embodiment of the present application is shown.

[0027] Figure 2 The redundant system architecture diagram is shown.

[0028] Figure 3 A block diagram of a control system according to an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to make the application purposes, features and advantages of the present application more obvious and easy to understand, the technical solutions protected by the present application will be described clearly and completely below by using specific embodiments and drawings. Obviously, the embodiments described below are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0030] Unless otherwise defined, all technical and scientific terms used in the present application have the same meanings as commonly understood by those skilled in the art to which the present application belongs. The terms used in the specification of the present application are only for the purpose of describing specific embodiments and are not intended to limit the present application.

[0031] As shown in Figure 1 , the present application provides an adaptive response control method for a heavy truck automatic driving longitudinal control redundancy system, the redundancy system as shown in Figure 2 , at least comprising a main control path and a backup control path, the method implements hierarchical response based on preset fault levels, including the following steps: S1, continuously monitoring the working state and performance parameters of the main control path, the backup control path, the associated sensors, actuators and control units; S2, determining the fault level currently reached by the system in real time according to the monitored working state and performance parameters, the fault level including normal working condition, slight fault, moderate fault and serious fault; In the embodiments of the present application, the determination conditions of the slight fault include any of the following situations: The data confidence of any sensor in the main control path is lower than the first normal working threshold; in the embodiments of the present application, the data confidence is calculated by multi-dimensional information fusion, which is used to quantify the reliability of single sensor data. The calculation steps are as follows: For each sensor data, the self-diagnosis state , data update timestamp , and sensor signal strength are synchronously collected. The value is generally normal as 1, warning as 0.5, and fault as 0.

[0032] The time freshness factor is calculated as , where τ is the effective time constant of the sensor data, which is usually set to 2-3 times of the sensor data publishing period. The timestamp of the last time the sensor output valid data.

[0033] Compare the current sensor data with the measurements of the same target by other sensors of the same type or different types in the system. Suppose there are N other sensors providing valid data , the current sensor data is , then the consistency factor can be calculated as: Consistency factor , where is the allowed deviation threshold of the physical quantity under typical working conditions.

[0034] The final data confidence is obtained by weighted fusion:

[0035] where, is a preset weight coefficient, and . The value of ranges from 0 to 1, and the higher the value, the higher the confidence.

[0036] The first normal working threshold can be calibrated to 0.7 according to historical data, and if it is lower than this value, it is considered that the data confidence is abnormal, triggering a slight fault determination.

[0037] There is a persistent abnormal deviation between the monitoring data of the same physical quantity by the main control path and the backup control path, and the deviation does not exceed the allowed redundancy check tolerance; the allowed redundancy check tolerance is set as follows: For key physical quantities, in the embodiment of the present application, the vehicle speed v, longitudinal acceleration a, and main brake pressure P, based on vehicle dynamics and sensor characteristics, the confidence interval of the current working condition is established. For example, on good road surface, the deviation between the speed calculated based on the wheel speed sensor and the speed calculated based on the fusion of vision / radar can be set as: .

[0038] On low adhesion road or bumpy road, the tolerance related to wheel speed is relaxed; in high temperature environment, the tolerance related to pressure sensor is relaxed.

[0039] Only when the deviation continuously exceeds the dynamic tolerance for a preset N consecutive control periods, the determination of persistent abnormal deviation is triggered.

[0040] The calculation resource occupancy rate of the main control unit exceeds the first load threshold affecting the execution of non-critical tasks.

[0041] The determination conditions of moderate fault include any of the following situations: the actuator response delay of the main control path exceeds a first allowed delay threshold ensuring vehicle longitudinal stability; the communication interruption duration between the main control unit and the vehicle chassis system responsible for longitudinal control exceeds a first allowed interruption threshold affecting control continuity; In the embodiment of the present application, the first allowed delay threshold ensuring vehicle longitudinal stability is determined online by the vehicle dynamics model:

[0042] wherein: is the allowed vehicle speed fluctuation range, is the current desired deceleration, is the allowed maximum yaw rate increment, is the current vehicle speed, is the vehicle understeering coefficient, and the formula comprehensively determines the allowed maximum execution delay from two dimensions of longitudinal speed control accuracy and lateral stability.

[0043] the first allowed interruption threshold affecting control continuity is set as:

[0044] wherein: is the execution period of the longitudinal controller, is the effective time length set according to the vehicle model that can accurately extrapolate the future state of the vehicle, is the set fault tolerance coefficient, which is usually 3-5 in the embodiment of the present application. If the communication interruption exceeds this time, the state prediction error will exceed the control allowed range, so it is determined as a moderate fault.

[0045] the deviation of the brake force output by the main control path from the target value continuously exceeds a first allowed deviation threshold affecting tracking accuracy; the key environmental perception function of the main control path fails, and the function cannot be completely replaced by the perception system of the backup control path under the condition of meeting the control accuracy requirement.

[0046] The determination conditions of the serious fault include any of the following situations: the state and instruction synchronization channel between the main control unit and the backup control unit completely fails; the brake output capability of the main control path and the backup control path simultaneously decreases to a level that cannot meet the basic braking demand; the maximum safe deceleration of the vehicle evaluated in real time based on the current available system resources is lower than the minimum safe deceleration necessary to maintain the current driving state; the standby state of the emergency backup path for fault tolerance is unavailable.

[0047] S3、according to the real-time determined fault level, execute the control strategy corresponding to the level, wherein: When determining as normal working condition, the longitudinal control is executed by the main control path, the standby control path synchronously controls the instruction and vehicle state data in hot backup mode, and the periodic deviation check is executed to prepare for seamless takeover; When determining as slight fault, the control right of the main control path is maintained, while the sensor data or the calculation resource of the standby control path is enabled to perform real-time check and compensation on the output of the main control path to ensure functional safety; When determining as moderate fault, within a preset first time threshold, the longitudinal control right is switched from the main control path to the standby control path, and the brake force output is kept not lower than a preset first brake force keeping threshold during the switching process; When determining as serious fault, within a preset second time threshold, an emergency fault-tolerant mechanism is activated, the emergency fault-tolerant mechanism at least includes activating an emergency backup path, limiting the maximum deceleration of the vehicle, and triggering a vehicle warning, and the second time threshold is less than the first time threshold to ensure that the vehicle enters a controllable deceleration state; S4, record the fault event, the triggered response action, and the vehicle state and control parameters related to the fault and the response, and report through the vehicle-mounted communication network.

[0048] In some embodiments, in the response to the moderate fault, the standby control path is a brake circuit independent of the main control path, the first time threshold is set according to the vehicle dynamics stability requirement, and the first brake force threshold is a preset brake force keeping rate target value.

[0049] In some embodiments, in the response to the serious fault, the emergency fault-tolerant mechanism is switched to a mechanical emergency path, the second time threshold is set according to the emergency degree of avoiding collision, and the maximum safe deceleration is limited according to the vehicle load and road adhesion condition.

[0050] In the embodiments of the application, the step of real-time evaluating the maximum safe deceleration of the vehicle based on the current system available resources comprises: Real-time acquisition and maintenance of the availability state and performance attenuation coefficient of all brake execution units, the brake execution units at least including the linear brake unit of the main control path, the independent hydraulic brake unit of the standby control path, and the non-friction brake device; Based on the availability state, performance attenuation coefficient and physical parameters of each brake execution unit, the maximum brake force that each unit can provide at the current time is calculated respectively, and the brake forces of all available units are summed to obtain the current theoretical maximum total brake force of the system The theoretical maximum total brake force​ Divide by the current vehicle total mass , to get the theoretical maximum deceleration not considering road conditions ; Obtain the real-time estimated adhesion coefficient of the current road surface , calculate the maximum deceleration under adhesion condition restriction , where is the acceleration of gravity Take the smaller value of the theoretical maximum deceleration and the adhesion-limited deceleration as the final evaluated vehicle maximum safe deceleration , that is: .

[0051] The minimum safe deceleration necessary to maintain the current driving state is dynamically calculated by combining collision avoidance requirements and speed control requirements, and the specific steps include: Obtain the relative distance and relative speed between the ego vehicle and the preceding vehicle or obstacle, calculate the minimum deceleration required to avoid collision , the calculation formula is: , where is the preset safety distance margin In the case of long downhill or curved road, according to the current vehicle speed , the target safe vehicle speed , the road slope angle and the look-ahead distance , calculate the minimum deceleration required to maintain the target speed , the calculation formula is: ; It should be noted that the required look-ahead distance is dynamically determined according to the current vehicle state and driving scenario. In one embodiment, a constant look-ahead time-based model is used, that is , where is a pre-calibrated time constant, which is set to 2.5 seconds in the embodiment of the present application. In another embodiment, is generated in real time by the upper motion planning module according to high-precision map and traffic environment information, and is delivered to the control system as one of the target parameters.

[0052] Take the maximum value of the collision avoidance requirement deceleration , the minimum deceleration required to maintain the target speed and the preset reference deceleration as the minimum safe deceleration necessary to maintain the current driving state .

[0053] In some embodiments, in S2, from monitoring the fault condition to determining the corresponding fault level and triggering the response, an anti-interference confirmation process is included, specifically: For the determination condition of minor fault and moderate fault, when the condition is first monitored to be met, a first confirmation time window is started; only when the fault condition continues or accumulatively occurs more than a first proportion threshold within the first confirmation time window, the corresponding fault level is finally determined to be entered; For the determination condition of severe fault, when the condition is first monitored to be met, a second confirmation time window shorter than the first confirmation time window is started; only when the fault condition continues to occur within the second confirmation time window, the severe fault level is finally determined to be entered and the response is immediately triggered; In the first confirmation time window or the second confirmation time window, the system maintains the original fault level and the corresponding strategy, but continues to record the to-be-confirmed fault event.

[0054] As Figure 3 shown, the embodiment of the present application also provides an adaptive response redundant control system for automatic driving longitudinal control of heavy trucks, comprising: A state monitoring module for continuously monitoring the working state and performance parameters of the main control path, the backup control path, and the sensors, actuators and control units associated therewith; A fault diagnosis and level determination module in communication connection with the state monitoring module, for determining the fault level of the system in real time according to the monitored working state and performance parameters, the fault level including normal working condition, minor fault, moderate fault and severe fault; A hierarchical strategy execution module in communication connection with the fault diagnosis and level determination module, for executing the control strategy corresponding to the fault level determined in real time, wherein: When the normal working condition is determined, the hierarchical strategy execution module is configured to instruct the main control path to perform longitudinal control, and instruct the backup control path to synchronously control the control instruction and vehicle state data in a hot backup manner, and perform periodic deviation check; When the minor fault is determined, the hierarchical strategy execution module is configured to maintain the control right of the main control path, while instructing the sensor data or computing resources of the backup control path to perform real-time check and compensation on the output of the main control path; When the moderate fault is determined, the hierarchical strategy execution module is configured to instruct the longitudinal control right to be switched from the main control path to the backup control path within a preset first time threshold, and control the braking force output during the switching process to be not lower than a preset first braking force maintaining threshold; When a serious fault is determined, the hierarchical strategy execution module is configured to activate an emergency fault-tolerant mechanism within a preset second time threshold, the emergency fault-tolerant mechanism at least including activating an emergency backup path, limiting the maximum deceleration of the vehicle, and triggering a vehicle warning, and the second time threshold is less than the first time threshold. A data recording and communication module is configured to record fault events, triggered response actions, and related vehicle states and control parameters, and report them through a vehicle-mounted communication network. The main control path and the backup control path are physically or logically isolated from each other.

[0055] In some embodiments, the fault diagnosis and level determination module is configured to determine a minor fault when any of the following conditions occurs: The data confidence of any sensor in the main control path is below a first normal working threshold; There is a persistent abnormal deviation between the monitoring data of the same physical quantity of the main control path and the backup control path, and the deviation does not exceed the allowed redundancy check tolerance; The computing resource occupancy rate of the main control unit exceeds a first load threshold that affects the execution of non-critical tasks.

[0056] In some embodiments, the fault diagnosis and level determination module is configured to determine a moderate fault when any of the following conditions occurs: The actuator response delay of the main control path exceeds a first allowed delay threshold that ensures vehicle longitudinal stability; The communication interruption duration between the main control unit and the vehicle chassis system responsible for longitudinal control exceeds a first allowed interruption threshold that affects control continuity; The deviation of the brake force output by the main control path from the target value continuously exceeds a first allowed deviation threshold that affects tracking accuracy; The key environmental perception function of the main control path fails, and the function cannot be completely replaced by the perception system of the backup control path under the condition of meeting the control accuracy requirement.

[0057] In some embodiments, the fault diagnosis and level determination module is configured to determine a serious fault when any of the following conditions occurs: The state and instruction synchronization channel between the main control unit and the backup control unit is completely disabled; The brake output capability of the main control path and the backup control path simultaneously drops to a level that cannot meet the basic braking demand; The maximum safe deceleration of the vehicle evaluated in real time based on the current system available resources is lower than the minimum safe deceleration necessary to maintain the current driving state; The standby state of the emergency backup path for fault tolerance is not available.

[0058] In some embodiments, a safety margin assessment module is further included for real-time assessment of the maximum safe deceleration of the vehicle and the required minimum safe deceleration; The safety margin assessment module is configured to: (a) obtain and maintain the availability status and performance degradation coefficient of all braking execution units in real time, based on which the current theoretical maximum total braking force of the system is calculated, and combined with the total mass of the vehicle and the current road surface estimated adhesion coefficient, the maximum safe deceleration of the vehicle is assessed; (b) based on the environmental perception information, the minimum deceleration required to avoid a collision and the minimum deceleration required to maintain the target vehicle speed are calculated, and combined with the pre-set reference deceleration, the minimum safe deceleration required to maintain the current driving state is determined.

[0059] In some embodiments, the fault diagnosis and level determination module includes an anti-interference confirmation logic unit; The anti-interference confirmation logic unit is configured to: For conditions triggering minor fault or moderate fault determination, a first confirmation time window is started for continuous confirmation, and only when the conditions continue to meet the pre-set proportion within the window or accumulate, the final determination result is output; For conditions triggering serious fault determination, a shorter second confirmation time window is started for immediate confirmation, and only when the conditions continue to meet within the window, the final determination result is output and the response is triggered.

[0060] In some embodiments, the backup control path includes a hydraulic braking circuit independent of the hydraulic braking circuit of the main control path line control unit; the emergency backup path is an emergency braking cable or push rod device mechanically connected to the brake pedal.

[0061] Those skilled in the art can clearly understand that the technology in the embodiments of the present application can be realized by means of software and the necessary general hardware platform. Based on such understanding, the technical solutions in the embodiments of the present application can be embodied in the form of a software product, which is stored in a storage medium such as a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc. Various storage media that can store program codes, including a number of instructions for causing a computer terminal (which can be a personal computer, a server, or a second terminal, a network terminal, etc.) to execute all or part of the steps of the method described in the embodiments of the present application.

[0062] In several embodiments provided by the present application, it should be understood that the disclosed system, device and method can be implemented in other manners. For example, the embodiments of the device described above are merely schematic, and the division of the units is merely a logical function division. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections between the units can be indirect couplings or communication connections through some interfaces, devices or units, and can be in electrical, mechanical or other forms.

[0063] The units described as separated components can or can not be physically separated, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purposes of the embodiments of the present application.

[0064] In addition, each function unit in the embodiments of the present application can be integrated in a processing unit, or each unit can exist physically as a separate unit, or two or more units can be integrated in one unit.

[0065] The above description of the disclosed embodiments enables a person skilled in the art to implement or use the present application. Various modifications to the embodiments will be apparent to those skilled in the art, and the general principles defined in the present application can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown in the present application, but will conform to the widest scope consistent with the principles and novel features disclosed in the present application.

Claims

1. An adaptive response control method for a redundant longitudinal control system for autonomous driving of heavy-duty vehicles, wherein the redundant system includes at least a primary control path and a backup control path, characterized in that, The method implements a graded response based on a preset fault level, including the following steps: S1. Continuously monitor the working status and performance parameters of the main control path, backup control path and their associated sensors, actuators and control units; S2. Based on the monitored working status and performance parameters, determine the current fault level of the system in real time. The fault level includes normal working condition, minor fault, moderate fault and severe fault. S3. Based on the real-time determined fault level, execute the control strategy corresponding to that fault level, wherein: When the condition is determined to be normal, the main control path performs longitudinal control, while the backup control path synchronizes control commands and vehicle status data in a hot backup manner and performs periodic deviation checks. When a minor fault is identified, control of the main control path is maintained, while sensor data or computing resources of the backup control path are used to perform real-time verification and compensation of the output of the main control path to ensure functional safety. When a moderate fault is determined, within the preset first time threshold, the longitudinal control is switched from the main control path to the backup control path, and the braking force output is kept not lower than the preset first braking force holding threshold during the switching process. When a serious fault is determined, an emergency fault tolerance mechanism is activated within a preset second time threshold. The emergency fault tolerance mechanism includes at least activating an emergency backup path, limiting the maximum deceleration of the vehicle, and triggering a vehicle warning. The second time threshold is less than the first time threshold to ensure that the vehicle enters a controllable deceleration state. S4. Record fault events, triggered response actions, and vehicle status and control parameters related to the fault and response, and report them through the vehicle communication network.

2. The adaptive response control method for a redundant longitudinal control system for automatic driving of heavy-duty vehicles according to claim 1, characterized in that, The criteria for determining a minor fault include any of the following: The confidence level of data from any sensor in the main control path is lower than the first normal operating threshold. There is a continuous abnormal deviation between the monitoring data of the same physical quantity between the main control path and the backup control path, and the deviation does not exceed the allowable redundancy verification tolerance. The main control unit's computing resource utilization exceeds the first load threshold affecting the execution of non-critical tasks.

3. The adaptive response control method for a redundant longitudinal control system for automatic driving of heavy-duty vehicles according to claim 2, characterized in that, The criteria for determining a moderate fault include any of the following: The actuator response delay of the main control path exceeds the first permissible delay threshold to ensure the longitudinal stability of the vehicle; The duration of the communication interruption between the main control unit and the vehicle chassis system responsible for longitudinal control exceeds the first permissible interruption threshold that affects the continuity of control. The deviation between the braking force output by the main control path and the target value continues to exceed the first permissible deviation threshold that affects tracking accuracy; The critical environmental awareness function of the main control path fails, and this function cannot be fully taken over by the awareness system of the backup control path while meeting the control accuracy requirements.

4. The adaptive response control method for a redundant longitudinal control system for autonomous driving of heavy-duty vehicles according to claim 3, characterized in that, The criteria for determining a serious fault include any of the following: The status and command synchronization channel between the main control unit and the backup control unit has completely failed. The braking output capabilities of both the primary control path and the backup control path simultaneously decrease to a level that cannot meet basic braking requirements. The maximum safe deceleration of the vehicle, as assessed in real time based on the available resources of the current system, is lower than the minimum safe deceleration necessary to maintain the current driving state. The standby status of the emergency backup path used for fault tolerance is unavailable.

5. The adaptive response control method for a redundant longitudinal control system for autonomous driving of heavy-duty vehicles according to claim 4, characterized in that, In the response to a moderate fault, the backup control path is a braking loop independent of the main control path. The first time threshold is set according to the vehicle dynamics stability requirements, and the first braking force threshold is a preset target value for braking force retention rate.

6. The adaptive response control method for a longitudinal control redundancy system for automatic driving of heavy-duty vehicles according to claim 4, characterized in that, In response to severe failures, the emergency fault tolerance mechanism switches to the mechanical emergency path, the second time threshold is set according to the urgency of avoiding a collision, and the maximum safe deceleration is limited according to the vehicle load and road adhesion conditions.

7. The adaptive response control method for a redundant longitudinal control system for automatic driving of heavy-duty vehicles according to claim 1, characterized in that, The steps for real-time assessment of the vehicle's maximum safe deceleration based on currently available system resources: The availability status and performance degradation coefficient of all braking actuators are acquired and maintained in real time. The braking actuators include at least a line-controlled braking unit for the main control path, an independent hydraulic braking unit for the backup control path, and a non-friction braking device. Based on the availability, performance degradation coefficient and physical parameters of each braking actuator, the maximum braking force that each unit can provide at the current moment is calculated, and the braking forces of all available units are summed to obtain the current theoretical maximum total braking force of the system. Dividing the theoretical maximum total braking force by the current total mass of the vehicle yields the theoretical maximum deceleration, without considering road conditions. ; Obtain the real-time estimated adhesion coefficient of the current road surface. Calculate the maximum deceleration under adhesion constraints. ,in It is the acceleration due to gravity; Take the theoretical maximum deceleration Maximum deceleration under adhesion conditions The smaller value among them is used as the final assessment of the vehicle's maximum safe deceleration. .

8. The adaptive response control method for a longitudinal control redundancy system for automatic driving of heavy-duty vehicles according to claim 7, characterized in that, The minimum safe deceleration necessary to maintain the current driving state is dynamically calculated by combining collision avoidance requirements and speed control requirements. The specific steps include: Obtain the relative distance and relative speed between the vehicle and the vehicle in front or an obstacle, and calculate the minimum deceleration required to avoid a collision. ; In scenarios involving long downhill slopes or curves, the minimum deceleration required to maintain the target speed is calculated based on the current vehicle speed, the target safe vehicle speed, the road slope angle, and the look-ahead distance. ; Find the minimum deceleration required to avoid a collision. Minimum deceleration required to maintain the target vehicle speed and preset baseline deceleration The maximum value in the range is used as the minimum safe deceleration necessary to maintain the current driving state. .

9. The adaptive response control method for a longitudinal control redundancy system for automatic driving of heavy-duty vehicles according to claim 4, characterized in that, In S2, the process from detecting the fault condition to determining the corresponding fault level and triggering a response includes an anti-interference confirmation process, specifically: For the criteria for determining minor and moderate faults, a first confirmation time window is initiated when the criteria are first detected; only when the fault condition continues or accumulates to exceed a first proportional threshold within the first confirmation time window will it be finally determined to enter the corresponding fault level. For the criteria for determining a serious fault, when the condition is first detected to be met, a second confirmation time window that is shorter than the first confirmation time window is initiated; only when the fault condition continues to occur within the second confirmation time window is the fault finally determined to be at the serious fault level and a response is immediately triggered. Within the first or second confirmation time window, the system maintains the original fault level and corresponding strategy, but continues to record fault events pending confirmation.

10. An adaptive response redundancy control system for longitudinal control of autonomous driving in heavy-duty vehicles, characterized in that, include: The status monitoring module is used to continuously monitor the working status and performance parameters of the main control path, backup control path, and their associated sensors, actuators, and control units; The fault diagnosis and level determination module is communicatively connected to the status monitoring module and is used to determine the current fault level of the system in real time based on the monitored working status and performance parameters. The fault level includes normal working condition, minor fault, moderate fault and severe fault. A hierarchical strategy execution module, communicatively connected to the fault diagnosis and level determination module, is used to execute a control strategy corresponding to the fault level based on the real-time determined fault level, wherein: When the condition is determined to be normal, the hierarchical strategy execution module is configured to: instruct the main control path to execute longitudinal control, and instruct the backup control path to synchronize the control instructions and vehicle status data in a hot backup manner, and perform periodic deviation verification. When a minor fault is determined, the hierarchical strategy execution module is configured to: maintain control of the main control path, and at the same time instruct the use of sensor data or computing resources of the backup control path to perform real-time verification and compensation of the output of the main control path. When a moderate fault is determined, the graded strategy execution module is configured to: within a preset first time threshold, switch the longitudinal control from the main control path to the backup control path, and control the braking force output during the switching process to be no less than a preset first braking force holding threshold. When a serious fault is determined, the graded strategy execution module is configured to: activate the emergency fault tolerance mechanism within a preset second time threshold. The emergency fault tolerance mechanism includes at least activating the emergency backup path, limiting the maximum deceleration of the vehicle, and triggering a vehicle warning. The second time threshold is less than the first time threshold. The data recording and communication module is used to record fault events, triggered response actions, and related vehicle status and control parameters, and to report them through the vehicle communication network. The primary control path and the backup control path are physically or logically isolated from each other.

Images