Vehicle travel control method and system

Abstract

The application provides a vehicle driving control method and system. The system comprises a safety monitoring layer, a task strategy layer and a real-time control layer. The safety monitoring layer determines driving safety decision information, generates safety constraint indication information according to the driving safety decision information and sends the safety constraint indication information to the real-time control layer. The task strategy layer determines task strategy decision information, generates a meta-instruction package comprising driving control strategy indication information according to the task strategy decision information and sends the meta-instruction package to the real-time control layer. The real-time control layer determines control instruction generation decision information, generates vehicle driving control instructions according to the safety constraint indication information, the meta-instruction package and the control instruction generation decision information and controls vehicle driving according to the vehicle driving control instructions. In this way, the real-time control layer fuses the safety constraint indication information, the meta-instruction package and the control instruction generation decision information to generate the vehicle driving control instructions, which can improve or ensure the real-time performance and accuracy of the vehicle driving control instructions and improve the driving stability and safety of the vehicle.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of vehicle driving control, in particular to a vehicle driving control method and system. BACKGROUND

[0002] With the deep integration of the automobile industry and artificial intelligence technology, vehicles have gradually evolved from assisted driving to high-level intelligent driving or autonomous driving to achieve intelligent driving of vehicles, and the core demand is to achieve safe, reliable and efficient vehicle driving control in complex traffic scenarios.

[0003] The traditional vehicle driving control method relies on a single vehicle control model to realize perception, decision-making and control of vehicle driving according to vehicle driving state information and environmental perception information. In this way of a single vehicle control model, the vehicle control model needs to process massive raw sensor data, complex decision logic and high-frequency control solving at the same time, and the performance requirement of the vehicle control model will be extremely high. The noise and data deviation of the model will directly affect the decision-making and control link, forming a chain reaction of "all for one and one for all", and the fault tolerance is extremely poor, which cannot meet the precise control requirements of intelligent driving or autonomous driving. Moreover, the vehicle control model consumes a lot of computing power, and is prone to processing delay exceeding the standard, which cannot meet the millisecond-level control requirements of intelligent driving or autonomous driving.

[0004] Therefore, the existing vehicle driving control method has poor fault tolerance, is prone to processing delay exceeding the standard, and cannot meet the control requirements of intelligent driving or autonomous driving. SUMMARY

[0005] The present application provides a vehicle driving control method and system, which divides the vehicle driving control system into layers, and each layer cooperates to realize the determination of the safety constraints of the vehicle, the generation of the meta-instruction package related to the driving control strategy, and then generates the decision information according to the safety constraints, the meta-instruction package including the driving control strategy, and the control instruction to generate the vehicle driving control instruction, and controls the vehicle driving according to the vehicle driving control instruction. In this way, compared with the way of perception, decision-making and control based on a single model, three levels are divided to realize perception, decision-making and control, the amount of data required by each layer is reduced, the possibility of noise and data deviation generated is reduced, the interference on control decision and final control is reduced, this layered architecture can allocate computing resources according to the functional characteristics of each level, so that the real-time performance and the performance can be more accurately balanced, the efficiency and accuracy of strategy generation are improved, and the real-time performance and accuracy of the vehicle driving control instruction are improved or ensured, and the efficiency and accuracy of vehicle control are improved.

[0006] In a first aspect, embodiments of the present application provide a vehicle driving control method applied to a vehicle driving control system for implementing vehicle driving control, the vehicle driving control system comprising a safety monitoring layer, a task strategy layer, and a real-time control layer, the method comprising: determining, by the safety monitoring layer, driving safety decision information corresponding to the vehicle, generating safety constraint indication information according to the driving safety decision information, and sending the safety constraint indication information to the real-time control layer; determining, by the task strategy layer, task strategy decision information corresponding to the vehicle, generating a meta-instruction package according to the task strategy decision information, the meta-instruction package comprising driving control strategy indication information, and sending the meta-instruction package to the real-time control layer; and determining, by the real-time control layer, control instruction generation decision information corresponding to the vehicle, generating vehicle driving control instructions according to the safety constraint indication information, the meta-instruction package, and the control instruction generation decision information, and controlling the vehicle to drive according to the vehicle driving control instructions.

[0007] According to the above technical solution, the safety monitoring layer determines driving safety decision information of the vehicle, generates safety constraint indication information according to the driving safety decision information, and sends the safety constraint indication information to the real-time control layer. The task strategy layer determines task strategy decision information, generates a meta-instruction package comprising driving control strategy indication information of the vehicle according to the task strategy decision information, and sends the meta-instruction package to the real-time control layer. The real-time control layer determines control instruction generation decision information, generates vehicle driving control instructions according to the safety constraint indication information, the meta-instruction package, and the control instruction generation decision information, and controls the vehicle according to the vehicle driving control instructions. In this way, the safety monitoring layer prioritizes the output of safety constraint indication information to set a safety bottom line, the task strategy layer provides a meta-instruction package to indicate a high-level control strategy, and the real-time control layer fuses the safety constraint indication information, the meta-instruction package, and the control instruction generation decision information to generate vehicle driving control instructions, thereby solving the problem of poor coordination in traditional hierarchical architecture, ensuring that the control instructions are compliant and meet the needs of the scene, and realizing precise linkage of safety constraints-strategy intentions-control execution. Each level dynamically generates safety constraint indication information, a meta-instruction package, and vehicle driving control instructions based on the information determined by itself, which can quickly adapt to changes in driving environments and vehicle states. Compared with the delay caused by single-model processing of the whole process, hierarchical parallel processing and precise information interaction ensure the real-time performance and dynamic adjustment capability of vehicle driving control instructions, and improve driving stability in complex scenarios. Therefore, the real-time performance and accuracy of vehicle driving control instructions can be improved or ensured, and vehicle driving stability and safety can be improved.

[0008] In a possible implementation of the first aspect, the task strategy layer includes a master agent and a plurality of sub-agents, different sub-agents correspond to different driving functions of the vehicle, the task strategy layer determines task strategy decision information corresponding to the vehicle, and generates the meta-instruction package according to the task strategy decision information, including: the master agent determines the task strategy decision information corresponding to the vehicle, determines the driving intention and the driving constraint information of the vehicle according to the task strategy decision information based on the reasoning planning kernel; the master agent determines the sub-task graph and the sub-agent calling plan according to the driving intention and the driving constraint information based on the reasoning planning kernel; the master agent calls at least one target sub-agent in the plurality of sub-agents based on the orchestration kernel, according to the sub-agent calling plan, and the registration information and the capability index information corresponding to each sub-agent, so that each target sub-agent generates corresponding sub-driving control strategy indication information according to each sub-task corresponding to each target sub-agent in the sub-task graph, to obtain a plurality of sub-driving control strategy indication information; and the master agent generates the meta-instruction package by performing corresponding processing on the plurality of sub-driving control strategy indication information according to the task strategy decision information based on the orchestration kernel.

[0009] According to the above technical solution, the master agent generates the sub-task graph and the sub-agent calling plan based on the reasoning planning kernel, calls the target sub-agent based on the orchestration kernel, so that each target sub-agent generates the sub-driving control strategy indication information of the corresponding function, and finally performs corresponding processing on the plurality of sub-driving control strategy indication information according to the task strategy decision information to generate the meta-instruction package. In this way, each sub-agent performs the sub-driving control strategy indication information generation in a division of labor manner, which accelerates the generation efficiency of the driving control strategy indication information.

[0010] In a possible implementation of the first aspect, the task strategy decision information includes safety summary information and last vehicle driving control related execution feedback information, the safety summary information is generated by the safety monitoring layer according to the driving safety decision information and sent to the task strategy layer, the execution feedback information is generated by the real-time control layer and sent to the task strategy layer, the master agent generates the meta-instruction package based on the orchestration kernel and according to the task strategy decision information, including: determining the sub-driving control strategy indication information that meets the safety summary in the plurality of sub-driving control strategy indication information according to the safety summary information or, to obtain a plurality of first sub-driving control strategy indication information; or determining the sub-driving control strategy indication information that meets the preset vehicle physical boundary in the plurality of sub-driving control strategy indication information according to the preset vehicle physical boundary, to obtain a plurality of first sub-driving control strategy indication information; determining the first sub-driving control strategy indication information whose risk level is lower than a preset risk level threshold in the plurality of first sub-driving control strategy indication information according to the risk level of each first sub-driving control strategy indication information, to obtain a plurality of second sub-driving control strategy indication information, or performing weight reduction processing on the first sub-driving control strategy indication information whose risk level is higher than or equal to the preset risk level threshold, to obtain a plurality of second sub-driving control strategy indication information; determining the second sub-driving control strategy indication information that can be executed in the plurality of second sub-driving control strategy indication information according to the execution feedback information, to obtain a plurality of third sub-driving control strategy indication information; determining the priority of each third sub-driving control strategy indication information, and sorting the plurality of third sub-driving control strategy indication information in descending order of priority to obtain a plurality of sorted third sub-driving control strategy indication information; generating a driving control strategy indication information set according to the plurality of sorted third sub-driving control strategy indication information; and generating a meta-instruction package according to the driving control strategy indication information set.

[0011] The above technical solution performs safety restriction, risk level control and priority sorting on the plurality of sub-driving control strategy indication information, so that each third sub-driving control strategy indication information in the generated driving control strategy indication information set is a control strategy that meets the safety driving requirement and has a low risk level, thereby improving the safety of vehicle driving control and reducing the risk of vehicle driving safety.

[0012] In a possible implementation of the first aspect, the real-time control layer includes a plurality of controllers, different controllers include different control algorithms, the meta-instruction package further includes a driving mode label, and the real-time control layer determines control instruction generation decision information, and generates the vehicle driving control instruction according to the safety constraint indication information, the meta-instruction package and the control instruction generation decision information, including: the real-time control layer determines a target controller according to the driving mode label, so that the target controller generates the vehicle driving control instruction according to the safety constraint indication information, the driving control strategy indication information and the control instruction generation decision information based on the corresponding control algorithm.

[0013] By using the technical solution, different controllers are used to generate vehicle driving control instructions for different driving scenarios, and the accuracy of the vehicle driving control instruction is improved.

[0014] In a possible implementation of the first aspect, the driving safety decision information includes first driving state information of the vehicle, road boundary constraint information and regulation constraint information, the safety monitoring layer generates the safety constraint indication information according to the driving safety decision information, including: generating a space safety constraint according to the road boundary constraint information; generating a state safety constraint according to the first driving state information and the regulation constraint information; generating an action safety constraint according to the first driving state information and the state safety constraint; and encapsulating the space constraint, the state constraint and the action constraint to generate the safety constraint indication information.

[0015] By using the technical solution, the space safety constraint, the state safety constraint and the action safety constraint are generated in advance as hard constraints of the real-time control layer, so as to limit the control range of the vehicle driving control instruction generated by the real-time control layer, and the safety of the vehicle driving control instruction is ensured to the greatest extent, and the vehicle driving safety is ensured.

[0016] In a possible implementation of the first aspect, the method further includes: the real-time control layer sends execution feedback information of the execution of the vehicle control instruction to the task strategy layer and the safety monitoring layer, so that the safety monitoring layer triggers the driving control takeover of the vehicle or updates the safety constraint indication information according to the execution feedback information, and the task strategy layer updates the meta-instruction package according to the execution feedback information.

[0017] By using the technical solution, the real-time control layer sends the execution feedback information of the execution of the vehicle control instruction to the task strategy layer and the safety monitoring layer, so that the safety monitoring layer determines whether to perform vehicle takeover control or generate new safety constraint indication information according to the execution feedback information, so as to ensure the safety of the vehicle to the greatest extent, and the task strategy layer optimizes the driving strategy indication information according to the execution feedback information, so as to generate a more accurate meta-instruction package, and then the real-time control layer generates a more accurate vehicle control instruction.

[0018] In a possible implementation of the first aspect, when the safety monitoring layer determines that the real-time control layer fails to control the vehicle, the safety monitoring layer triggers the takeover of the driving control of the vehicle to take over the driving control of the vehicle, and when any of the following conditions occurs, the safety monitoring layer determines that the real-time control layer fails to control the vehicle: the real-time control layer is abnormal; the real-time control layer is normal, but the vehicle control instruction is abnormal.

[0019] With the technical solution, when the safety monitoring layer determines that the vehicle fails to control, the safety monitoring layer triggers the takeover of the driving control of the vehicle, which can maximize the safety of the vehicle.

[0020] In a possible implementation of the first aspect, after the safety monitoring layer triggers the takeover of the driving control of the vehicle, the method further includes: the safety monitoring layer generates a target event and new safety constraint indication information, sends the target event to the task strategy layer, and sends the new safety constraint indication information to the real-time control layer, the target event includes a rollback event or a degradation event, the rollback event is used to make the task strategy layer regenerate the meta-instruction package, and the degradation event is used to make the task strategy layer regenerate the meta-instruction package and make the processing priority of the task strategy layer lower than that of the safety monitoring layer; the task strategy layer generates the meta-instruction package according to the task strategy decision information, including: the task strategy layer generates the meta-instruction package according to the task strategy decision information and the target event; and the real-time control layer generates the vehicle driving control instruction according to the safety constraint indication information, the meta-instruction package, and the control instruction generation decision information, including: the real-time control layer generates the vehicle driving control instruction according to the new safety constraint indication information, the meta-instruction package, and the control instruction generation decision information.

[0021] With the technical solution, the task strategy layer regenerates the meta-instruction package based on the rollback event or the degradation event transmitted by the safety monitoring layer, and updates the meta-instruction package in a timely manner, thereby ensuring the safety of the vehicle.

[0022] In a possible implementation of the first aspect, the safety monitoring layer, the main intelligent agent and the sub-intelligent agents included in the task strategy layer, and the real-time control layer communicate based on an A2A-Drive communication protocol.

[0023] With the technical solution, the safety monitoring layer, the main intelligent agent and the sub-intelligent agents included in the task strategy layer, and the real-time control layer communicate based on the same A2A-Drive communication protocol, thereby ensuring the format consistency of information among the safety monitoring layer, the main intelligent agent and the sub-intelligent agents included in the task strategy layer, and the real-time control layer.

[0024] In a second aspect, the implementation of the present application also discloses a vehicle driving control system, which comprises a safety monitoring layer, a task strategy layer and a real-time control layer. The safety monitoring layer is configured to determine driving safety decision information corresponding to the vehicle, generate safety constraint indication information according to the driving safety decision information, and send the safety constraint indication information to the real-time control layer. The task strategy layer is configured to determine task strategy decision information corresponding to the vehicle, generate a meta-instruction package according to the task strategy decision information, and send the meta-instruction package to the real-time control layer, wherein the meta-instruction package comprises driving control strategy indication information. The real-time control layer is configured to determine control instruction generation decision information corresponding to the vehicle, generate a vehicle driving control instruction according to the safety constraint indication information, the meta-instruction package and the control instruction generation decision information, and control the vehicle to drive according to the vehicle driving control instruction.

[0025] In a third aspect, the implementation of the present application also discloses a vehicle comprising the vehicle driving control system for executing the vehicle driving control method.

[0026] The beneficial effects of the second aspect and the third aspect described above can be referred to the related description in the first aspect or the second aspect, which will not be repeated here. BRIEF DESCRIPTION OF DRAWINGS

[0027] In order to more clearly illustrate the technical solutions of the present application, the drawings used in the embodiments will be briefly introduced as follows.

[0028] Figure 1 A structural schematic diagram of the vehicle driving control system provided by the embodiments of the present application;

[0029] Figure 2 A flowchart of the vehicle driving control method provided by the embodiments of the present application;

[0030] Figure 3 A flowchart of generating safety constraint indication information provided by the embodiments of the present application;

[0031] Figure 4 Another structural schematic diagram of the vehicle driving control system provided by the embodiments of the present application;

[0032] Figure 5 A flowchart of generating a meta-instruction package provided by the embodiments of the present application;

[0033] Figure 6 A flowchart of generating a vehicle driving control instruction provided by the embodiments of the present application;

[0034] Figure 7 A principle schematic diagram of the vehicle driving control system and method provided by the embodiments of the present application. DETAILED DESCRIPTION

[0035] With the deep integration of the automotive industry and artificial intelligence technology, vehicle driving systems have evolved from assisted driving to high-level intelligent driving or autonomous driving. The core demand is to achieve safe, reliable, and efficient vehicle control in complex traffic scenarios.

[0036] Traditional autonomous driving systems often use a single model to carry out the entire process of perception, decision-making, and control. This integrated design, although simple in structure, has many fundamental flaws. First, the vehicle control model needs to handle massive raw sensor data, complex decision logic, and high-frequency control solutions, which requires high performance from the vehicle control model. Noise and data bias in the vehicle control model can directly affect decision-making and control, leading to a chain reaction of errors. For example, when sensor accuracy is affected by rain and snow, it can directly lead to decision-making errors and control inaccuracies, and the system has poor fault tolerance. Second, real-time performance and performance are difficult to balance. A single model needs to handle massive raw sensor data (point cloud, image, etc.), complex decision logic, and high-frequency control solutions, which consumes a lot of computing power and can cause processing delays to exceed standards, making it difficult to meet the millisecond-level control requirements of autonomous driving, especially in high-speed and complex intersection scenarios, which significantly increases the risk.

[0037] Third, scalability and iteration efficiency are low. If new scenarios (such as special weather, unusual intersections) or functions (such as improving control accuracy) need to be adapted, the entire model needs to be restructured, trained, and verified, which not only takes a long development cycle but also may introduce new logic vulnerabilities, making it difficult to meet the diverse needs of traffic scenarios. At the same time, there is a lack of maintainability and auditability. The black-box nature of a single model makes it difficult to identify the source of a fault, whether it is in the perception, decision-making, or control stage, which makes it difficult to optimize offline and meet the requirements of ISO 26262 functional safety standards for traceability throughout the process. Finally, the robustness is insufficient. The generalization ability of a single model is limited, and it is easy to make incorrect decisions and fail to control when faced with extreme scenarios that have not been trained (such as sudden obstacles and road construction), which cannot guarantee the safety of vehicle travel.

[0038] Therefore, the existing vehicle driving control method has poor fault tolerance and is prone to processing delays, making it difficult to meet the control requirements of intelligent driving or autonomous driving.

[0039] Based on this, the application provides a vehicle driving control method and system. The vehicle driving control system includes a task strategy layer, a real-time control layer, and a safety monitoring layer. The safety monitoring layer determines corresponding driving safety decision information of the vehicle, generates safety constraint indication information according to the driving safety decision information, and sends the safety constraint indication information to the real-time control layer. The task strategy layer determines corresponding task strategy decision information of the vehicle, generates a meta-instruction package including driving control strategy indication information of the vehicle according to the task strategy decision information, and determines control instruction generation decision information. The real-time control layer generates a vehicle driving control instruction according to the safety constraint indication information, the meta-instruction package, and the control instruction generation decision information, and controls the vehicle according to the vehicle driving control instruction.

[0040] The vehicle driving control method and system provided by the implementation manner of the application realize accurate linkage of “safety constraint-strategy intention-control execution” through clear division of labor and interaction logic of the safety monitoring layer, the task strategy layer, and the real-time control layer. The safety monitoring layer preferentially outputs safety constraint indication information to define a safety bottom line. The task strategy layer provides a meta-instruction package of a high-level control strategy. The real-time control layer generates a vehicle control instruction by fusing safety constraints, the meta-instruction package, and control instruction generation decision information, thereby avoiding single-level decision deviation from a mechanism, solving the problem of poor coordination and asynchronous information of a traditional vehicle control architecture, and guaranteeing that a vehicle control instruction is compliant and meets scene requirements. Moreover, the real-time control layer receives safety hard constraints of the safety monitoring layer and a strategy meta-instruction package of the task strategy layer, and generates a vehicle control instruction in combination with control instruction generation decision information reflecting a current driving state of the vehicle, vehicle dynamics parameters, and real-time environmental information, thereby ensuring that the instruction does not break through a safety boundary and accurately landing a high-level driving intention, and greatly improving reliability and scene adaptability of the control instruction.

[0041] Further, each layer independently collects relevant information and bears core functions (for example, safety constraint generation / strategy meta-instruction generation / vehicle control instruction execution), and is decoupled through standardized information interaction. When a function of a certain layer is optimized (for example, a safety constraint algorithm is upgraded or a strategy scene is expanded), the entire system does not need to be reconstructed, and only the information collection or processing logic of the corresponding layer needs to be adjusted, thereby reducing iteration costs, facilitating fault positioning and maintenance, and meeting the ISO 26262 functional safety standard. Moreover, each layer dynamically generates corresponding output information (safety constraint indication information / meta-instruction package / vehicle control instruction) based on real-time collected relevant information, and can quickly adapt to road conditions and changes in the state of the vehicle. Compared with delay caused by single-model processing of the entire process, layered parallel processing and accurate information interaction ensure real-time performance and dynamic adjustment capability of the vehicle control instruction, and improve driving stability in complex scenes.

[0042] Next, the vehicle driving control method and system provided by the implementation manner of the application are described in detail with reference to the accompanying drawings.

[0043] Referring to Figure 1 The vehicle driving control system provided by the implementation of the present application comprises a safety monitoring layer (L0 layer), a task strategy layer (L2 layer) and a real-time control layer (L1 layer).

[0044] The safety monitoring layer is configured to determine driving safety decision information corresponding to the vehicle, generate safety constraint indication information according to the driving safety decision information, and send the safety constraint indication information to the real-time control layer.

[0045] The task strategy layer is configured to determine task strategy decision information corresponding to the vehicle, generate a meta-instruction package according to the task strategy decision information, and send the meta-instruction package to the real-time control layer, wherein the meta-instruction package comprises driving control strategy indication information.

[0046] The real-time control layer is configured to determine control instruction generation decision information corresponding to the vehicle, generate a vehicle driving control instruction according to the safety constraint indication information, the meta-instruction package and the control instruction generation decision information, and control the vehicle according to the vehicle driving control instruction.

[0047] The vehicle driving control method provided by the implementation of the present application is applied to a vehicle driving control system, such as Figure 2 , and specifically comprises the following steps.

[0048] S100, the safety monitoring layer determines driving safety decision information corresponding to the vehicle, generates safety constraint indication information according to the driving safety decision information, and sends the safety constraint indication information to the real-time control layer.

[0049] In the implementation of the present application, the driving safety decision information comprises first state information for reflecting a first state of the vehicle and first driving constraint information for reflecting a first driving constraint of the vehicle, the first state information comprises first driving state information, sensor state information and actuator state information, the first driving state information comprises vehicle speed information, front wheel steering angle information, lateral acceleration information, minimum distance information from an obstacle around the vehicle and time to collision (TTC) information from a front obstacle, the sensor state information comprises sensor health information, the actuator state information comprises actuator operating state information, and the first driving constraint information comprises road boundary information and driving regulation constraint information, wherein the driving regulation information comprises vehicle dynamics limit information and a current adhesion coefficient.

[0050] The safety monitoring layer (also referred to as a safety bottom layer) comprises two modes, one of which is a constraint mode in a normal driving control state of the vehicle, configured to perform front safety constraint, generate control constraint (i.e., safety constraint indication information) according to the driving safety decision information, and provide a safety constraint domain for the real-time control layer, wherein the safety constraint indication information comprises state safety constraint, spatial safety constraint and action safety constraint.

[0051] As Figure 3 shown, the safety monitoring layer determines driving safety decision information, generates safety envelope according to the driving safety decision information, including the following steps.

[0052] S110, generating spatial safety constraint according to road boundary constraint information.

[0053] For example, based on perception and prediction, a safe spatial geometry available for the vehicle is constructed as the spatial safety constraint.

[0054] Specifically, the spatial safety constraint is determined according to the road or lane feasible space included in the road boundary constraint information and the occupied space of the ith obstacle .

[0055] In an implementation mode, the spatial safety constraint is as follows:

[0056]

[0057] wherein, is the spatial safety constraint, is the road or lane feasible space, is the occupied space of the ith obstacle.

[0058] It should be noted that, is the occupied space of the obstacle after collision calculation, for example, the actual occupied space of the obstacle is enlarged by 1m.

[0059] S120, generating state safety constraint according to the first driving state information and the regulation constraint information.

[0060] For example, the state safety constraint is generated according to the vehicle dynamics limit parameters, the road adhesion coefficient, and the vehicle speed information, the front wheel steering angle information, and the longitudinal acceleration information included in the first driving state information.

[0061] Specifically, the maximum deceleration, the maximum steering angle, and other information are determined according to the road adhesion coefficient and the dynamics limit parameters and other regulation constraint information, and the minimum speed, the maximum speed, and the maximum steering angle change rate are determined, and the state safety constraint is generated based on the following inequality set:

[0062]

[0063] wherein, is the state safety constraint, is the minimum speed, is the vehicle speed information, is the maximum speed, is the front wheel steering angle information, is a maximum steering angle, is longitudinal acceleration information, is a maximum acceleration, is a steering angle rate of change, is a maximum steering angle rate of change.

[0064] It should be noted that the state safety constraint can also be determined according to a vehicle speed-steering angle-longitudinal acceleration safety lookup table method.

[0065] It should also be noted that when the road surface types are different, the road surface adhesion coefficients are different, for example, the road surface adhesion coefficients corresponding to the parking lot pavement, the rain and snow road surface, and the ice surface are different.

[0066] S130, generating an action safety constraint according to the first driving state information and the state safety constraint.

[0067] For example, if it is determined that the vehicle control is a discrete control action, the prohibition information is generated as the action safety constraint through an action mask (action_mask). If it is determined that the vehicle control is a continuous control action, the action safety constraint is generated according to a preset inequality.

[0068] S140, encapsulating the space constraint, the state constraint, and the action constraint to generate safety constraint indication information.

[0069] For example, a structured safety constraint bundle (SafetyConstraintBundle) is output as the first safety constraint indication information, which includes a formal expression of the space safety constraint, the state safety constraint, and the action safety constraint.

[0070] Further, the safety monitoring layer sends the first safety constraint indication information to the real-time control layer as a hard constraint boundary for the real-time control layer to determine a vehicle control instruction.

[0071] In the implementation manner of the present application, the step S100 further includes:

[0072] S110', preprocessing the driving safety decision information to obtain standardized driving safety decision information.

[0073] For example, a time stamp alignment operation is performed on all information included in the driving safety decision information to avoid time sequence disorder, a legality verification is performed on the driving safety decision information, for example, a numerical range verification and a data integrity verification are performed, and in the case of passing the verification, a confidence filtering is performed, for example, only high-reliability data with a perception / determination confidence greater than or equal to 0.9 is reserved, and low-confidence data is directly discarded, to obtain the standardized driving safety decision information, and then the steps S110-S140 are executed to generate the safety constraint indication information according to the standardized driving safety decision information.

[0074] That is, the steering, acceleration (acc), brake limiting constraints issued by the L0 layer in this application are the highest priority hard safety constraints, which directly limit the control output boundary of the L1 real-time control layer. All L1 controls need to generate control signals within this constraint, and any form of breakthrough is not allowed.

[0075] Further, in the implementation manner of the application, the safety monitoring layer is further configured to generate safety summary information according to the driving safety decision information and the execution feedback information of the last vehicle driving control sent by the real-time control layer, and send the safety summary information to the task strategy layer.

[0076] For example, the safety monitoring layer generates safety summary information for this time for task strategy generation according to the driving safety decision information and the execution feedback information, and sends the safety summary information to the task strategy layer.

[0077] S200, the task strategy layer determines the task strategy decision information corresponding to the vehicle, generates a meta-instruction package according to the task strategy decision information, and sends the meta-instruction package to the real-time control layer. The meta-instruction package includes driving control strategy indication information.

[0078] In the implementation manner of the application, the task strategy decision information is a planning snapshot of the vehicle, which is used to reflect the system state of the vehicle, the second state information such as execution feedback, the driving intention such as target specification information, the first driving environment information such as environment summary, and the second driving constraint information such as safety summary. The task strategy decision information includes goal specification information (GoalSpec), environment summary information (WorldSummary), system state information (SystemState), safety summary information (SafetySummary), and execution feedback information (ExecFeedback) of the last vehicle driving control. The goal specification information includes target intention, driving style, driving priority, time delay budget, and fault tolerance strategy. The environment summary information includes road / boundary geometry summary, free space coding (Ray), Top-K dynamic obstacle semantic information, and static obstacle summary information. The system state information includes vehicle speed, gear, vehicle system health (such as algorithm, delay, cooling water temperature / power, etc.), sensor quality, positioning quality, and map confidence information. The safety summary information includes risk level, prohibited mode, action mask summary, and takeover state information. The execution feedback information includes feasibility of vehicle control instruction, tracking error prediction, saturation risk, and solution failure / illegal action statistics.

[0079] It should be noted that the safety summary information is generated by the safety monitoring layer according to the first driving related information and the execution feedback information of the last vehicle driving control feedback by the real-time control layer, and is sent to the task strategy layer. The execution feedback information is generated by the real-time control layer according to the execution result of the vehicle control instruction.

[0080] Further, in the implementation of the present application, the task strategy layer generates task strategy decision information by acquiring semantic task information (including navigation / parking / driving style information), structured environment summary information, system state information, safety summary information sent by the safety monitoring layer, and execution feedback information sent by the real-time control layer.

[0081] It should be noted that the structured environment summary is not raw point cloud data, and includes structured feature vectors, discrete field sets, enumerated fields, etc. related to the driving environment of the vehicle. Optionally, it is interpretable text semantic information for explaining the environment summary field and does not enter the control closed loop, that is, it can not participate in the subsequent meta-instruction package generation, vehicle driving control instruction, etc. Control closed loop. The system state information is, for example, the health degree / degradation state of the sensors and actuators of the vehicle intelligent driving system.

[0082] Further, as shown in Figure 4 In the implementation of the present application, the task strategy layer includes a main agent (Master Agent) and an extensible sub-agent library (sub-Agent warehouse), and the sub-agent library includes a plurality of sub-agents, and different sub-agents correspond to different driving functions of the vehicle. The main agent includes a reasoning planning core (LLM Planning Core) and an orchestration core (Orchestrator Core).

[0083] Moreover, the main agent and each sub-agent perform collaborative communication based on an Agent to Agent (A2A-Drive) intelligent agent communication protocol for autonomous driving optimization.

[0084] It should be noted that the A2A-Drive communication protocol provides a unified envelope (trace / span, priority, deadline, reliability, schema version, idempotent key, authentication), quality of service (Quality of Service, QoS) and event mechanism, so that the communication between the main agent ↔ sub-agent ↔ safety monitoring layer / real-time control layer meets the engineering requirements of “expired discard, budget slice, heartbeat health, observable and replayable”, thereby realizing non-hard real-time but high-robustness strategy orchestration and interpretable closed loop, and triggering interruptable / rollbackable degradation and takeover strategy in the case of timeout, infeasibility, risk transition, etc.

[0085] The main agent is used for understanding a task, decomposing a subtask, calling a sub-agent to give an executable "policy fragment" (i.e., a sub-driving control policy). Among them, the reasoning planning kernel performs constraint-aware intent solidification and policy skeleton generation based on strictly structured task policy decision information (PlanningSnapshot), and outputs a phased subtask graph and a sub-agent query plan.

[0086] In the implementation of the present application, the reasoning planning kernel is responsible for intent understanding, policy reasoning, candidate policy skeleton / subtask graph generation, and explanation and uncertainty giving.

[0087] The mode form and deployment mode of the reasoning planning kernel mainly have the following three engineering modes.

[0088] Mode P0: rule + small model, mode P0 does not apply a large language model, or a weak large language model is used, mainly for early testing, and the intent analysis mainly relies on preset rules or small model classifiers.

[0089] Mode P1: small large language model at the vehicle end or special planning large language model, mainly through the deployment of a small model, the received input information is environmental summary information and target planning information, and the output is strictly structured JSON format or Protobuf (binary format) driving intent and driving constraint information, which is processed by the arrangement kernel.

[0090] Mode P2: cloud large language model, mainly used for research and development, simulation, data closed loop link, used for training a strategy library, prompt word iteration, playback analysis, which can better help the model grow, so that the large language model can be better applied to formal intent and driving constraint information analysis.

[0091] In a specific embodiment of the present application, a large language model is deployed in the reasoning planning kernel to perform task policy decision information identification processing.

[0092] Of course, other models such as natural language models for semantic understanding and intent recognition processing can also be deployed in the reasoning planning kernel.

[0093] For example, the main agent converts semantic task information (including navigation / parking / driving style information), structured environmental summary information, system state information, safety summary information sent by the safety monitoring layer, and execution feedback information sent by the real-time control layer into strong constraint structured summaries to avoid uncontrollable free text input into the large language model. Therefore, in the implementation of the present application, the input to the reasoning planning kernel of the large language model is a planning snapshot (PlanningSnapshot, i.e., task policy decision information).

[0094] The orchestration kernel is responsible for sub-agent retrieval and parallel scheduling, result fusion, constraint management, risk gating, rollbackable execution, real-time budget control, and output meta-command bundle. Based on the capability index and health degree image of the sub-agent library, the orchestration kernel initiates sub-agent call plans (A2A agent_queries) within a certain time delay budget through a parallel scheduling engine, collects policy fragments (PolicyFragment) of the same format output by each sub-agent, and generates a rollbackable candidate strategy set (StrategyBundle) through hard constraint filtering, risk sorting, feasibility scoring, and conflict resolution, etc. Finally, the orchestration kernel encapsulates the candidate strategy set into a meta-command bundle (MetaCommandBundle) with an expiration date and constraint prompt, and delivers it to the real-time control layer.

[0095] In the implementation of the present application, the sub-agent library is the core infrastructure for the task strategy layer to realize multi-agent collaborative decision-making, and is essentially a standardized, scalable, auditable, and professional agent resource pool with a capability index. The sub-agent library is an agent platform of the task strategy layer, which uniformly manages all specialized sub-agents, such as scene recognition sub-agents, interactive game sub-agents, trajectory prediction sub-agents, local planning sub-agents, and risk assessment sub-agents. The sub-agent library provides full life cycle services such as standardized access, capability modeling, index retrieval, scheduling execution, resource allocation, and fault backup for each sub-agent, and outputs structured and verifiable policy fragments (PolicyFragment, i.e., sub-driving control strategy indication information) to the main agent, which supports final strategy fusion and generates a meta-command bundle. It should be noted that the vehicle control strategy indication information included in the meta-command bundle, i.e., the quantitative target and phased action intention information in the meta-command bundle, is not a control strategy that determines the control amount, but specifies the control method and control range, and the specific control target and control instruction are determined by the real-time control layer.

[0096] The sub-agent library is an agent platform of the task strategy layer, which can be understood as a "smart decision-making production line". This production line does not rely on a single large model to complete the whole process of decision-making, but rather breaks down the decision-making task into six well-defined "processes", such as scene recognition, semantic and task decomposition, behavior decision / gaming, motion planning, explanation / HMI (human-machine interaction), and supervision / audit. In each process, a batch of reusable "tools" (sub-agents) are pre-configured, which can be taken, combined, and scheduled by the main agent as needed.

[0097] From the engineering perspective, the six categories of sub-agents are equivalent to six processes, and each sub-agent is equivalent to a dedicated tool. The working methods of the tools are divided into two types: one is periodic execution, such as regular refresh judgment, state, suggestion, etc., and the other is event triggering, such as intervention only in critical scenarios, human input request or system exception.

[0098] The application defines the capability description standard for each sub-agent in the sub-agent warehouse. Each sub-agent must complete registration in the registry, synchronize the metadata of the sub-agent, and provide the basis for the retrieval and scheduling of the main agent. The metadata includes basic identification information, task range (supported_tasks), data requirements (required_inputs), output specifications (output_schema), performance indicators, resource consumption (resource_cost), safety thresholds (safety_level), running status (health_status), version management (versioning).

[0099] The basic identification information includes agent_id, agent_name, and agent_type. The task range refers to the supported tasks, such as PARKING_ALIGN, NARROW_PASS, and YIELD_NEGOTIATION. The data requirements include dependent abstract fields, such as Ray, TopK, and boundary information. The output specifications include the output of the sub-navigation control strategy version, such as PolicyFragment version. The performance indicators include inference latency (latency_profile, including P50 / P95 quantile values). The resource consumption includes CPU resource consumption, GPU resource consumption, and memory estimation. The safety threshold is the maximum risk level that can be output, such as prohibiting the output of aggressive strategies in high-risk scenarios. The running status is, for example, the sub-agent heartbeat, error rate, and the latest successful running time. The version management is, for example, the model version, policy library version, and rule version involved.

[0100] The application also defines a uniform output format of policy fragments (PolicyFragment) of each sub-agent in the sub-agent warehouse, and the initial of all sub-agents is standardized to the PolicyFragment format, which provides a unified data basis for policy fusion of the orchestration kernel. Key fields of the policy fragment include preconditions, core strategy proposal, policy confidence, risk estimate information, fallback, and decision explanation code.

[0101] The preconditions include road width range, opposite vehicle distance, and passable space. The core strategy proposal includes mode tag, objective, and second safety constraint indication information (constraints hint, i.e., soft constraint for L1). The objective is, for example, target speed, target pose, and corridor prompt. The second safety constraint is, for example, amplitude limit, safety distance, and jerk constraint (lateral distance extreme constraint). Further, the core strategy proposal further includes meta-action sequence (meta_action_seq). The risk estimate information is aligned with the risk level of the safety constraint indication information of L0. The fallback includes stop, downgrade, and request takeover.

[0102] The application implements six categories of sub-agents in the sub-agent library. The following six categories of Agent modules cover the core requirements of the whole decision-making process. In the future, more functional modules can be extended based on this framework to improve system adaptability.

[0103] The six categories of sub-agents of the application include scene recognition and mode management agents (Scene&Mode Management Agents), semantic understanding and task decomposition agents (Semantic Task Decomposition Agents), behavior decision and interaction game agents (Behavior&Negotiation Agents), motion planning and trajectory generation agents (Motion Planning Agents), explainability and human-machine interaction agents (Explainability&HMI Agents), and model supervision and verification agents (Model Supervision&Validation Agents).

[0104] Firstly, traditional intelligent driving control systems rely on fixed rules or single model to determine driving scenarios. In the rapid switching of multiple scenarios such as parking, low-speed meeting, and narrow road passing, it is difficult to maintain decision consistency and safety, and mode jitter or strategy mismatch problems are prone to occur.

[0105] The present application introduces a scenario recognition and mode management type agent, which accurately identifies the current driving scenario based on structured environment summary information and system situation information (including system state information and safety summary information), and outputs driving mode identification with confidence. Such an agent generates a unified scenario mode description by jointly analyzing road geometric features, free space morphology, dynamic traffic body (i.e. dynamic obstacles) distribution, and vehicle intelligent driving system state, and introduces confidence and stability constraints in the mode switching process to suppress jitter.

[0106] That is, in the present application, the scenario recognition and mode management type agent identifies the driving scenario according to the task strategy decision information including structured environment summary information and system situation information, and outputs driving mode information (scene_mode). The driving scenario recognition includes generating a unified driving mode description information by jointly analyzing road geometric features, free space morphology, dynamic traffic body (i.e. dynamic obstacles) distribution, and vehicle intelligent driving system state, to obtain driving mode label and corresponding confidence information. In this way, by identifying the driving scenario, smooth switching and stable maintenance of the driving mode between different scenarios are realized, providing a consistent context basis for subsequent driving behavior decision, trajectory planning and control parameter selection, effectively reducing the decision risk caused by scene misjudgment.

[0107] Further, traditional intelligent driving control systems are difficult to understand high-level task instructions or driving preferences, and cannot effectively decompose abstract task goals into executable phased sub-tasks, resulting in a lack of global consistent execution logic in complex tasks such as "safe parking" and "courtesy meeting".

[0108] The present application introduces a semantic understanding and task decomposition type agent, which is responsible for parsing high-level driving instructions or task goals and converting them into structured target description, constraint conditions and priority information. On this basis, through task scheduling and phased scheduling mechanism, the overall driving task is divided into several sub-tasks with clear preconditions and completion conditions, which are managed in the form of directed acyclic graph (DAG) or phase state machine.

[0109] That is, in the present application, the semantic understanding and task decomposition type agent receives the user natural language instruction, and synchronously calls the scene recognition and mode management type agent to output the scene mode information, analyzes the high-order driving instruction or task target, generates the structured target description, constraint condition and priority information, and through the task arrangement and phased scheduling mechanism, according to the target description, constraint condition and priority information, the scene mode information output by the scene recognition and mode management type agent and the execution feedback information or safety summary information, the overall driving task is divided into several sub-tasks to generate a sub-task graph, a node state machine, a sub-agent geometry to be activated and a merged meta-instruction package, wherein each sub-task has a precondition and a completion condition. In this way, by introducing the semantic understanding and task decomposition type agent, the system is endowed with the explainable decomposition ability and dynamic re-planning ability for complex driving tasks. When the task execution is blocked or the environment changes, the sub-task execution order or switching strategy can be quickly adjusted, which significantly improves the robustness of the system in real complex scenarios.

[0110] Further, in a multi-traffic participant scene, such as meeting, yielding, intersection, etc., the traditional vehicle driving control method is difficult to model the potential behavior of other traffic participants, and is prone to make overly conservative or aggressive decisions, affecting traffic efficiency and safety.

[0111] The present application introduces a behavior decision and interactive game type agent, which evaluates and selects different driving behavior strategies based on structured environment information and opponent state to obtain the optimal driving behavior strategy, and combines the intention prediction results of other traffic participants to perform game analysis on discrete behaviors such as passing, yielding, temporary stopping, and backing up to yield, and outputs clear behavior decisions and intention prompts. The behavior decision and interactive game type agent combines the prediction results of the intentions of other traffic participants to perform game analysis on discrete behaviors such as passing, yielding, temporary stopping, and backing up to yield, and outputs clear behavior decisions and intention prompts. In this way, by modeling the interaction between traffic participants, the system can make decisions that are more in line with human driving habits while ensuring safety boundaries, thereby improving the acceptability and traffic efficiency of autonomous driving in complex interactive scenarios.

[0112] That is, in the present application, based on the behavior decision and interactive game type agent, the behavior decision result is generated according to the environment summary information and safety summary information included in the task strategy decision information, and the behavior decision result is the optimal driving behavior strategy.

[0113] Further, the traditional vehicle driving control method uses a single planning algorithm, which is difficult to balance global rationality, local feasibility and real-time performance at the same time, especially in low-speed high-precision scenarios (such as parking and narrow road communication), planning failure or control infeasibility problems occur frequently.

[0114] This application introduces a motion planning and trajectory generation agent to generate multiple candidate motion trajectories with effective time windows. This agent is guided by the behavioral decision-making results and task strategy decision-making information, including safety summaries, output by a behavioral decision-making and interactive game agent. During the planning process, the agent comprehensively considers vehicle dynamics feasibility, environmental safety distance, curvature, and comfort constraints based on environmental summary information and system state information included in the task strategy decision-making information. This results in a set of trajectories with effective time windows. Furthermore, each candidate motion trajectory is evaluated and ranked using multiple indicators to obtain a ranked set of target trajectories.

[0115] In this way, by decoupling trajectory generation from evaluation, multiple candidates for the planned trajectory are achieved, making it evaluable and fallback possible. This effectively avoids the system deadlock problem caused by the failure of a single path and improves the planning success rate in complex scenarios.

[0116] Furthermore, existing intelligent driving control systems lack the ability to explain their own decision-making process, making it difficult to meet the needs of testing and verification, system debugging, and establishing user trust.

[0117] This application introduces an interpretive and human-computer interaction-based intelligent agent that uses structured information such as behavioral decisions and intent prompts generated during the decision-making process by a behavioral decision-making and interactive game-theoretic intelligent agent to provide interpretive output for the behavior selection, risk assessment, and constraint trade-offs of the vehicle driving control system. Simultaneously, based on the user's interactive input of driving preferences and task requests, this input is transformed into constraint or goal adjustment signals and fed back to the behavioral decision-making and interactive game-theoretic intelligent agent.

[0118] In other words, in this application, the interpreting and interpersonal interaction intelligent agent generates explanatory information based on the behavioral decisions and intent prompts output by the behavioral decision-making and interactive game-playing intelligent agent, in order to explain the reasons for the selection of the driving control strategy. Furthermore, the user's input information related to driving preferences and task requests is transformed into constraint information or goal adjustment signals and fed back to the behavioral decision-making and interactive game-playing intelligent agent, so that the agent can generate behavioral decisions based on the constraint information or goal adjustment signals.

[0119] In this way, the interpretable and interactive intelligent agent, without affecting the real-time control closed loop, realizes the interpretability and interactivity of the decision-making process of the intelligent driving control system, and improves the transparency and credibility of the system at the engineering verification and user use levels.

[0120] Further, even in the intelligent driving decision-making system based on large language model (LLM) and multi-agent collaboration as proposed in this application, the high-level decision-making process often involves non-deterministic reasoning, strategy combination and cross-module information integration, which can easily lead to the following problems: the decision-making reasoning result is inconsistent with the actual environment state, resulting in "model hallucination"; in extreme or rare scenarios, the system lacks the ability to record and trace abnormal decision paths; when multiple sub-agents collaborate to output, it is difficult to determine whether a decision exceeds the designed intent or safety assumption range; therefore, existing vehicle driving control systems usually lack independent supervision and verification mechanisms for high-level decision-making processes, affecting system verifiability and compliance.

[0121] The present application introduces a model supervision and verification agent as a bypass supervision agent independent of the specific task execution logic to verify, audit and record the high-level decision-making process in real time or quasi-real time.

[0122] Specifically, the model supervision and verification agent supervises and verifies the processing process and output information of other sub-agents based on at least one of the following mechanisms: decision consistency verification mechanism, hallucination and abnormal reasoning detection mechanism, key decision node recording and labeling mechanism, decision risk grading and audit interface.

[0123] Among them, the decision consistency verification mechanism is to analyze the consistency of policy fragments, behavior suggestions and constraint information from different sub-agents, detect whether there are decision outputs that are in obvious conflict with the current scene mode, system state or safety assumption, and perform decision consistency verification.

[0124] The hallucination and abnormal reasoning detection mechanism is to identify unverifiable assumptions, non-existent targets, logical jumps or unreasonable behavior chains in high-level decision-making based on structured summary information and system situation information included in task strategy decision information, and mark them as potential hallucinations or abnormal reasoning nodes.

[0125] The key decision node recording and labeling mechanism automatically records key decision nodes such as task switching, mode switching, risk mutation and strategy rollback, and attaches triggering conditions, context states and related sub-agent outputs for subsequent review, analysis and verification.

[0126] The decision risk grading and audit interface grades the decision-making process according to the degree of abnormality and risk level, and provides alarm or recommended downgrade processing signals to the decision-making arrangement kernel of the main agent when necessary.

[0127] Thus, by introducing model supervision and verification class agents, the high-level decision-making process is independently supervised without interfering with the real-time control loop, improving the overall safety of the system, effectively reducing the illusion decision risk introduced by the uncertainty of large model reasoning, providing traceable, replayable, and auditable decision evidence chain for the autonomous driving system, and significantly improving the feasibility of vehicle driving control system in engineering verification, functional safety evaluation, and regulatory compliance.

[0128] Further, in the implementation of the present application, as shown in Figure 5 The task policy layer determines task policy decision information, and generates a meta-instruction package according to the task policy decision information, including the following steps.

[0129] S210, the main agent generates task policy decision information according to semantic task information, structured environment summary information, system state information, safety summary information, and execution feedback information.

[0130] For example, the main agent converts the semantic task information (including navigation / parking / driving style information), structured environment summary information, system state information, safety summary information sent by the safety monitoring layer, and execution feedback information sent by the real-time control layer into a strongly constrained structured summary to avoid uncontrollable input of free text into a large language model. Therefore, in the implementation of the present application, the input to the large language model is a planning snapshot (PlanningSnapshot, i.e., task policy decision information).

[0131] S220, the main agent determines the driving intention and driving constraint information of the vehicle based on the reasoning planning kernel and according to the task policy decision information.

[0132] For example, the reasoning planning kernel generates a reasoning strategy in two stages to reduce model hallucination and uncontrollability. First, the first stage is to perform constraint-aware intent grounding according to task strategy decision information to generate driving intent and driving constraint information, including intent label (intent_label), hard constraint information (hard_constraints), soft objective information (soft_objectives), and uncertainty (uncertainty). The intent label (intent_label) is, for example, PASSING_CRUISE (following cruise overtaking), PARKING (parking), and NARROW_PASS (narrow road passing / meeting). The hard constraint information is non-violation information, including safety distance threshold, prohibition of reversing, maximum acceleration, and the like. The soft objective information is information that needs to be weighed, such as efficiency / comfort / energy consumption. The uncertainty information is positive degree information of driving intent and constraint consolidation and analysis information of whether to call more sub-agents.

[0133] In S230, the main agent determines a sub-task graph and a sub-agent calling plan based on the reasoning planning kernel according to the driving intent and driving constraint information.

[0134] Further, the second stage is to generate a strategy skeleton, a sub-task graph, and a sub-agent calling plan by the reasoning planning kernel (Task Graph / Meta-Policy Skeleton). The sub-task graph (task_graph) includes stage nodes + transition conditions (FSM / HTN), and the sub-agent calling plan (agent_queries) includes target sub-agents that need to be called, parallel or serial calling methods, calculation budget, and priority information of each sub-agent. Further, candidate policy fragment information (candidate_policy_fragments) can also be generated according to the driving intent and driving constraint information. The candidate policy fragment information is a strategy generated by referencing a preset repository strategy template.

[0135] It should be noted that when the reasoning planning kernel generates the strategy skeleton and the sub-task graph, the calling result information of the last planning kernel calling sub-agent is also obtained for correction processing to obtain a new sub-task graph and sub-agent calling plan.

[0136] Further, in the implementation of the present application, the strategy skeleton, sub-task graph, sub-agent call plan and other information output by the reasoning planning kernel need to meet the requirements of strong verification, rejection and degradation. That is, the orchestration kernel performs Schema verification on the above information output by the reasoning planning kernel: field integrity, correct type, legal enumeration, and threshold range (such as speed upper limit and jerk upper limit); determine to meet the safety range (SafetyGuard): the reasoning planning kernel is not allowed to directly give a "bypass safety" suggestion, and all constraints must be consistent with the safety summary information; deterministic control: temperature = 0 or extremely low, the output must be repeatable; with explanation code: each key decision is accompanied by a reason_code, which is convenient for playback and attribution.

[0137] It should be noted that temperature = 0 or extremely low means that the "randomness" parameters of the model (such as the temperature of the LLM, the sampling strategy, and the exploration rate ε of the RL model) are closed or extremely low, and the model is forced to output "unique deterministic results" rather than a probabilistic candidate set, and the output must be repeatable, that is, the same input (sensor data + scene + instruction) → the same output (decision + trajectory + control instruction), and the execution results are consistent across hardware and across time. The key decision is accompanied by a reason_code, that is, each core decision (such as C1 output YIELD and D1 select trajectory 1) is bound to a standardized code (such as YIELD_001 = priority to oncoming vehicles and TRAJ_003 = optimal curvature), rather than a natural language description.

[0138] The implementation of the present application also provides a debugging link for a large language model, including offline unit testing D0 (Schema & Policy Sanity), offline playback D1 (Replay Planner), shadow mode D2 (Shadow Mode Online), and failure attribution D3 (Failure Attribution).

[0139] Among them, the offline unit test is used for basic rule verification. Before the LLM module accesses the sub-agent warehouse, it verifies that the output is "format legal, policy compliant" to filter low-level errors (such as output not conforming to schema, triggering disabled mode) and avoid invalid debugging. For example, input fixed PlanningSnapshot (planning snapshot), PlanningSnapshot needs to include the full amount of input required for LLM decision-making, and cover regular scenarios + edge scenarios, including schema verification, forbidden mode verification, and golden trace regression on PlanningSnapshot. Among them, schema verification mainly uses JSONSchema / Protobuf verification tools to verify the output format after calling LLM to generate output, Forbidden_modes verification (structured forbidden mode field verification) is mainly based on the preset forbidden mode list (such as "narrow road forced overtaking" and "parking direction dead"), to check whether the LLM output contains forbidden keyword fields, constraint expressions, and GoldenTrace regression mainly saves the "input→output" benchmark set (goldentrace). After LLM / prompt version update, re-execute and compare the output.

[0140] For example, if the schema pass rate is 100%, the forbidden mode trigger rate is 0%, and the GoldenTrace regression consistency is ≥99%, it is considered that the verification is passed.

[0141] Offline playback is used to verify the timing strategy. It mainly breaks through the limitations of single-frame testing, verifies the decision stability of LLM in time-continuous scenarios (such as decision coherence in the whole process of narrow road meeting), compares expert strategies / historical versions, and evaluates the strategy rationality. Extract the time sequence WorldSummary sequence from real vehicle rosbag or simulation platform records (such as PreScan / Simulink) at a preset sampling frequency (10Hz / 20Hz), call LLM+Orchestrator (or only call Orchestrator) frame by frame, generate MetaCommandBundle, and compare with expert strategies / historical versions to determine strategy consistency, trigger rollback times, and conservative degree indicators.

[0142] For example, if the timing strategy consistency compared with the expert strategy / historical version is ≥95%, the decision rollback times is ≤1 times / 100 frames, the conservative degree: TTC average 3~8s, and the trajectory curvature peak value is ≤0.02 rad / m, the responsibility has no timing strategy verification.

[0143] The shadow mode is used for online risk-free verification, which is mainly used to verify the effectiveness of the decision of the LLM-driven MasterAgent in real complex scenarios when the real vehicle is running, and to find out the scene conditions of "LLM suggestion is not reliable" and the countermeasures. For example, the MasterAgent (LLM+Orchestrator) runs as a bypass module and does not access the real-time control layer. It receives the same input as the real decision link (WorldSummary, user instructions, etc.) in real time, and synchronously generates MetaCommandBundle records to record the difference between "LLM suggestion" and "actual L1 execution result". For example, record the LLM suggestion as a comparison benchmark, the actual L1 layer execution instruction as the real execution result, the difference type for positioning the problem direction, and the scene condition for digging the problem scene distribution. Use statistical analysis (such as decision tree / XGBoost) to analyze the association between scene conditions and differences, and add the conditions dug out to the scene constraint table of the regularized Agent of B1a constraint or optimize the prompt / sample of LLM.

[0144] For example, the difference rate between LLM suggestion and actual execution is ≤5% (core scenario) or ≤10% (edge scenario), the trigger rate of high-risk differences (such as collision risk-related) is 0%, and the coverage rate of problem scenario digging is ≥90% (that is, all "unreliable" scenarios can be counted). If it is considered to pass the verification.

[0145] Failure attribution is used for full-link fault tracing, which is mainly used to trace the full-link data when LLM decision triggers a failure event (such as decision deviation too large in shadow mode or trigger risk in simulation), and accurately locate the root cause of the problem (such as LLM input missing, sub-Agent response abnormal, and Orchestrator fusion error). The complete tracing link of the failure event includes input PlanningSnapshot, sub-Agent response (PolicyFragment set), fusion decision log (overall link check), output MetaCommandBundle, L1ExecFeedback, and L0 risk change. By locating the failure link, for example, from back to front, first check if L1ExecFeedback is executed successfully, then check if MetaCommandBundle is reasonable, then check if the sub-Agent response is abnormal, and finally check if the input is correct to query the failure cause.

[0146] For example, the root cause positioning time of the failure event is ≤1 hour per event, the retest pass rate after root cause rectification is 100%, and the recurrence rate of similar failure events is 0%.

[0147] S240, the main intelligent agent calls at least one target sub-intelligent agent in the plurality of sub-intelligent agents based on the orchestration kernel, according to the sub-intelligent agent calling plan and the registration information and the capability index information corresponding to each sub-intelligent agent, so that each target sub-intelligent agent generates corresponding sub-vehicle control strategy indication information according to each sub-task corresponding to each target sub-intelligent agent in the sub-task graph, to obtain a plurality of sub-vehicle control strategy indication information.

[0148] S250, the main intelligent agent generates a meta-instruction package by performing corresponding processing on the plurality of sub-vehicle control strategy indication information based on the orchestration kernel according to the task strategy decision information.

[0149] The orchestration kernel is responsible for sub-intelligent agent and parallel scheduling, result fusion, constraint management, risk gating, rollback execution, real-time budget control, and output of a meta-instruction package. The orchestration kernel includes a task graph management submodule, a sub-intelligent agent registration and capability index management submodule, a sub-intelligent agent parallel scheduling engine, a policy fusion and conflict resolution submodule, a constraint governor, a rollback and degradation management submodule, and a trace and audit management submodule.

[0150] The task graph management submodule is used to maintain the task graph / phase machine (HTN hierarchical task network / FSM finite state machine) of the current driving task, match the phased execution process of the PARKING / CRUISE / NARROW_PASS scene, trigger sub-task decomposition according to the scene (for example, parking is divided into SEARCH_SLOT→ALIGN→INSERT→STOP), provide task basis for sub-agent retrieval, and synchronize the task phase state in real time to trigger the activation / sleep of the corresponding sub-agent.

[0151] The sub-agent registration and capability index management submodule is used to maintain the core attribute library of the full quantum agent: capability description (adaptation scene / task), input and output schema, version number, delay profile (average / maximum time consumption), health degree (online / offline / abnormal); support multi-dimensional accurate retrieval: according to the retrieval order combination of scene tag (scene_tag) / task type (task_type) / risk level (risk_level) / vehicle type (vehicle_type) / map type (map_type), quickly match the necessary sub-agent under the current scene; dynamically update the agent health degree, and automatically exclude abnormal agents from the retrieval results.

[0152] The sub-agent parallel scheduling engine is used to concurrently call sub-agents according to the retrieval results, supports custom priority, timeout control, budget slicing, and high-priority agents are preferentially allocated computing power; a built-in fast path mechanism is provided: when the real-time budget is tight, only the core necessary sub-agents are called, and non-core functions are discarded to ensure the main link; timeout monitoring is performed on the sub-agents, and if the timeout is exceeded, the TIMEOUT identifier is returned, which provides a basis for subsequent fusion degradation.

[0153] The core input of the strategy fusion and conflict resolution submodule is the PolicyFragment (policy fragment) output by each sub-agent, and the core output is a single StrategyBundle (candidate driving control strategy set) with ordering and confidence. The core logic of conflict processing: according to the order of hard constraint priority→risk priority→feasibility priority→experience trade-off, layer-by-layer filtering, ordering and weighting: among them, the hard constraint filtering is to directly discard the strategies that violate SafetySummary (safety constraints) / VehicleLimits (vehicle physical boundaries); the risk ordering is to directly discard or weight high-risk strategies; if all candidates are high-risk, trigger system policy degradation; the feasibility scoring is to quantify the "ability to be effectively executed by L1" of the predicted strategy by combining L1 layer ExecFeedback (historical tracking error, actuator saturation risk, control success rate), and eliminate low feasibility proposals; the experience target trade-off is to weight and sort soft targets such as comfort / efficiency / energy consumption (weights can be configured according to scenes, such as high speed and high efficiency, parking and high comfort); the optional output is to retain the top-2 candidate strategies for L1 / downstream, support fast strategy switching in emergency scenarios, and improve rollback ability.

[0154] The constraint governor is used to integrate SafetySummary (L0 safety risk) + VehicleLimits (vehicle physical limits) + ModePolicy (scene mode policy) into standardized hard constraints, covering dimensions such as vehicle speed, gear, steering, reversing, braking, etc. The MetaCommandBundle after fusion is globally gated, strictly filtering out illegal instructions, illegal gears, prohibited reversing, etc. Instructions with missing constraints are automatically supplemented with default safety constraints (such as default narrowing of lateral safety distance in low-speed scenarios).

[0155] The rollback and degradation management submodule is used to monitor L1 / L0 feedback (tracking error exceeds standard, actuator saturation, L0 risk level rises sharply, heartbeat timeout) in real time, trigger targeted strategy rollback: strategy replacement, switch to conservative mode, suspend meta-action execution; maintain a hierarchical degradation system, trigger by risk level, ensure the system is always in a safe state: the first level of degradation is L2 autonomous strategy→more conservative L2 strategy; the second level of degradation is L2 autonomous strategy→pure rule strategy (no model involved); the third level of degradation is rule strategy→short stop / hold current state; the fourth level of degradation is short stop→send takeover request to the driver; monitor the environment in real time after degradation, and automatically upgrade when the recovery condition is met (such as switching back to L2 autonomous strategy from rule strategy when the risk decreases).

[0156] The tracking and audit management submodule is used to generate a structured trace tree every time a decision is made, recording key information throughout the link: the list of called sub-agents, the time information of each agent, the output results of each agent, the basis for policy integration (such as which policies are filtered, ordering weights), constraint verification results; log information is bound with trace_id, including version information (Orchestrator version / sub-agent version / model version), timestamp, multi-dimensional index label (scene_tag, etc.); log persistent storage is performed, supporting offline retrieval, playback and compliance audit, meeting the traceability requirements of functional safety ISO26262.

[0157] That is, the implementation of the present application, based on the above module to generate meta-instruction package includes: task graph management submodule to maintain the current stage machine or subtask graph (FSM / HTN) state, according to the scene trigger subtask disintegration, for sub-agent retrieval task basis. Sub-agent registration and ability index management submodule to obtain each sub-agent registration table information (Agent Registry), including the ability of each sub-agent description, input and output schema, version, delay portrait, health, also used to obtain the corresponding ability index information of each sub-agent, according to the preset retrieval order and according to the sub-agent call plan and each sub-agent corresponding registration information and ability index information call at least one target sub-agent in multiple sub-agents, based on parallel scheduling engine concurrent call target sub-agent, make each target sub-agent according to each subtask in the subtask graph corresponding to each target sub-agent to generate the corresponding sub-drive control strategy (PolicyFragment), to get multiple sub-drive control strategy, based on strategy fusion and conflict resolution submodule according to task strategy decision information on multiple sub-drive control strategy strategy fusion and conflict resolution processing (as an example of the corresponding processing), generate strategy candidate package (StrategyBundle), constraint governor will include the task strategy decision information of the security summary and the vehicle limit, mode strategy to the final hard constraint information, to generate the final meta-instruction package (MetaCommandBundle) according to hard constraint information and strategy candidate package.

[0158] In the implementation of the present application, the preset retrieval order is scene_tag / task_type / risk_level / vehicle_type / map_type.

[0159] Further, in the implementation of the present application, for step S250, the master agent generates the meta-instruction package based on the arrangement kernel according to the task strategy decision information to process the plurality of sub-driving control strategies, including: determining the sub-driving control strategy indication information in the plurality of sub-driving control strategy indication information that conforms to the safety summary according to the safety summary information, to obtain a plurality of first sub-driving control strategy indication information; or determining the sub-driving control strategy indication information in the plurality of sub-driving control strategy indication information that conforms to the preset vehicle physical boundary according to the preset vehicle physical boundary, to obtain a plurality of first sub-driving control strategy indication information, determining the first sub-driving control strategy indication information in the plurality of first sub-driving control strategy indication information whose risk level is lower than a preset risk level threshold according to the risk level of each first sub-driving control strategy indication information, to obtain a plurality of second sub-driving control strategy indication information, or performing weight reduction processing on the first sub-driving control strategy indication information whose risk level is higher than or equal to the preset risk level threshold, to obtain a plurality of second sub-driving control strategy indication information, determining the second sub-driving control strategy indication information in the plurality of second sub-driving control strategy indication information that can be executed according to the execution feedback information, to obtain a plurality of third sub-driving control strategy indication information, determining the priority of each third sub-driving control strategy indication information, and sorting the plurality of third sub-driving control strategy indication information in descending order of priority, to obtain the plurality of third sub-driving control strategy indication information after sorting, generating the driving control strategy indication information set according to the plurality of third sub-driving control strategy indication information after sorting, and generating the meta-instruction package according to the driving control strategy indication information set.

[0160] For example, the policy fusion and conflict resolution submodule eliminates the sub-driving control strategies that violate the safety summary / vehicle physical boundary, obtains a plurality of first sub-driving control strategies that conform to the safety summary and the vehicle physical boundary, eliminates the strategies in the plurality of first sub-driving control strategies whose risk level is high, to obtain a plurality of second sub-driving control strategies whose risk level is lower than a preset risk level threshold (for example, the risk level is high) or a plurality of second sub-driving control strategies whose risk level is low after weight reduction processing on the sub-driving control strategies whose risk level is high, scores the plurality of second sub-driving control strategies according to the execution feedback information fed back by the real-time control layer, takes the second sub-driving control strategies whose feasibility score is higher than a preset feasibility threshold as a plurality of third sub-driving control strategies, sorts the plurality of third sub-driving control strategies according to the soft target information included in the driving intention and driving constraint information, obtains the plurality of third sub-driving control strategies after sorting, to obtain a driving control strategy set, and converts the driving control strategy set into a meta-instruction package. The driving control strategy set includes candidate strategies, for example, the plurality of sub-driving control strategies output by each sub-agent, and the top 2 sub-driving control strategies are retained.

[0161] Further, the constraint governor generates a standardized hard constraint according to the security digest, the vehicle physical limit, and the scene mode strategy, and generates a final meta-command bundle by gating the meta-command bundle based on the standardized hard constraint.

[0162] It should be noted that in the implementation of the present application, the driving control strategy indication information is used to indicate at least one of the driving scene mode, the driving state target, the driving selection parameter, and the driving behavior label of the vehicle, which is not a direct control quantity, but a suggestive indication information.

[0163] The meta-command bundle includes a driving mode label (mode_tag) and vehicle driving control strategy information, and the vehicle driving control strategy information includes a quantitative target (objective (non-control quantity)), a second security constraint (constraints_hint, i.e., a soft constraint for L1), a phased action intention (meta_action_seq), and an instruction validity period (valid_for_ms). The driving model can reflect the current driving scene, such as NORMAL_DRIVE (normal driving), PARKING_ALIGN (parking alignment), NARROW_PASS_YIELD (narrow road passing and yielding), and UNSTUCK_REVERSE (unstuck reverse), which is used to guide the real-time control layer to select the controller and the parameter set. The quantitative target can reflect the control target of the vehicle, such as the speed target, the lateral offset target, the parking target, and the comfort target, which is used to explicitly indicate the result to be achieved by the real-time control layer, rather than how to achieve it. The second security constraint can reflect the control limit of the vehicle, such as the speed upper limit, the acceleration upper limit, the steering angle limit, the steering angle change rate, the curvature range in the parking scene, and the lateral acceleration range, which is used to narrow the control search space of the real-time control layer, and to balance performance and safety. The phased action intention is structured, discrete / semi-discrete information, which can reflect the control target in different phases, such as the reverse scene: deceleration→short stop 1s→right side offset→slow through, which is used to explicitly indicate the execution steps for the real-time control layer to support "execute by phase and rollback by feedback". The instruction validity period can reflect the use period of the instruction, which is automatically invalidated after expiration.

[0164] In an implementation, the quantitative target and the phased action intention are the aforementioned driving control strategy indication information.

[0165] Of course, the meta-instruction package also includes identification information (trace_id / span_id), version information (version), decision confidence (confidence), risk prompt information (risk_hint), and decision interpretation code (reason_code). Among them, the identification information runs through the whole link and is used for playback, audit, and failure attribution. The version information is used to determine whether it is consistent with the schema version and policy version for version checking. The decision confidence (0~1) is used to reflect the confidence information of the meta-instruction package, and high confidence information (e.g., greater than 0.8) indicates that the confidence of the meta-instruction package is high. The risk prompt information is used to reflect the security risk, including low risk, medium risk, and high risk. The decision interpretation code is used to explain the policy information of the meta-instruction package and can also be used for offline audit.

[0166] The Orchestrator kernel is the real-time decision core, and real-time budget control is the key to engineering landing. Determinism is the basis for production certification and fault reproduction, both of which are achieved through fine process decomposition, timeout strategy, and version fixation.

[0167] In a specific example of the present application, the total decision cycle of the Orchestrator is set to 50~500ms (which can be configured according to the scene, such as 50ms for high-speed cruising and 500ms for parking), and the core adopts a budget slicing mechanism to split the total budget into fixed time consumption for each link, ensuring that the whole process is completed within the budget. If a certain link is timed out, a step-by-step fallback strategy is triggered. For example, the total budget is 200ms, the budget slicing strategy is 20ms for snapshot building and index retrieval to generate PlanningSnapshot, and the multi-dimensional index retrieval sub-Agent is used, 120ms is used for concurrent sub-Agent calling, which is the core link, and TIMEOUT is returned directly if it is timed out, and the fusion is degraded, 40ms is used for policy fusion and constraint management (such as conflict resolution and hard constraint gating), and 20ms is used for log packet and MetaCommandBundle distribution (such as trace_id binding and L1 communication).

[0168] If a timeout problem occurs, the specific timeout strategy is as follows: for sub-Agent timeout: return TIMEOUT identifier for single / multiple sub-Agent timeout, and automatically degrade / abandon the strategy of the timeout Agent in the fusion stage, and use rule strategy to supplement; for total budget timeout: directly trigger the conservative fast path, abandon all sub-Agent calling, and directly output the predefined conservative strategy (rule strategy / short stop / keep current state), to ensure that L1 layer has instructions to execute and avoid control interruption.

[0169] Orchestrator kernel determinacy is fixed input corresponding to fixed output, that is, the same input snapshot + the same version must be completely consistent, ensuring that the decision result is reproducible and authenticable.

[0170] For the runtime (A2A Runtime) between agents as a sub-agent warehouse, the underlying communication and operation support framework is provided for the Orchestrator and each sub-agent, sub-agent, and Agent and L0 / L1 layer to provide unified message packaging, QoS guarantee, latency / retransmission, heartbeat, tracking, permission and security, and version evolution.

[0171] For unified message packaging, define a message format common to all agents, including core data, metadata (version / index / trace_id), and communication identification, to ensure that messages between different agents and modules are interoperable.

[0172] For QoS service quality guarantee, QoS levels are divided according to business importance (e.g., L0 safety feedback is the highest level and E1 decision explanation is the lowest level), to ensure low latency and high reliable transmission of core links, and to control traffic on non-core links.

[0173] For latency / retransmission control, set maximum latency thresholds and retransmission times for messages of different QoS levels. If the message is not delivered within the time limit, an exception alert is triggered to avoid decision delays caused by message accumulation.

[0174] For global heartbeat and link monitoring, the Orchestrator monitors the global heartbeat of all sub-agents and the status of inter-agent communication links. In the event of an exception, the agent health is updated in real time and a downgrade is triggered.

[0175] For trace transmission, trace_id is transmitted in all communication messages to ensure that a single decision trace tree can be linked across agents and modules, enabling full-link tracking.

[0176] For permissions and security, each agent is assigned independent operation permissions, and communication messages are encrypted / verified to prevent illegal calls and data tampering.

[0177] For smooth version evolution, support gray upgrade / rollback of agent version and message format to ensure uninterrupted real-time decision links during version updates and adapt to online upgrade needs.

[0178] Further, a debug / replay tool chain is provided for the Orchestrator kernel. As a full-link debugging and verification system for the sub-agent repository, it connects the trace logs of the Orchestrator and the communication data of the A2A Runtime, realizes the full-process debugging from "offline replay" to "online shadow mode" to "failure attribution", guarantees the effectiveness and certainty of strategy rollback reproduction, and is the core tool for LLM / model agent debugging and mass production problem positioning. It is fully compatible with the D0-D3 debugging link. Offline replay mainly includes loading rosbag / A2A Runtime communication logs / Orchestrator trace tree, reproducing the complete decision link according to the timestamp, supporting single frame / continuous frame debugging, locating "decision problems of a certain link / a certain agent", shadow mode mainly includes supporting Orchestrator / sub-agent "only reasoning, not issuing" in real-time vehicle running, recording the difference between decision suggestions and actual L1 execution results, verifying the effectiveness of the strategy without risk, failure case attribution mainly includes retrieving failure cases according to trace_id / multi-dimensional index, pulling full-link trace data (input snapshot, agent call record, fusion basis, L1 / L0 feedback), realizing root cause rapid positioning, strategy rollback reproduction mainly includes supporting reproduction of different downgrade / rollback scenarios, verifying whether the trigger logic of Rollback&Degrade Manager is reasonable, ensuring the safety of the downgrade strategy, prompt / model version locking mainly includes supporting the forced locking of Prompt version and model version for LLM agents, realizing regression verification after version iteration combined with goldentrace, guaranteeing certainty, and golden trace unit test mainly includes depositing a standardized goldentrace use case library (input snapshot→standard output), supporting offline unit testing of the Orchestrator and each sub-agent, and ensuring that the core strategy does not degrade after version update.

[0179] Further, in the implementation of the present application, the Master Agent and each sub-agent generate meta-instruction packages based on the following methods:

[0180] The Master Agent receives vehicle sensor fusion data, vehicle state, map information, etc. (periodic trigger / event trigger such as scene change, vehicle speed mutation), generates a globally unique trace_id=T (format: timestamp+random code, such as 20260127100000_001); integrates GoalSpec+WorldSummary+SystemState+SafetySummary+ExecFeedback, constructs a standardized PlanningSnapshot, automatically labels multi-dimensional index tags (scene_tag / task_type / risk_level / vehicle_type / map_type) for PlanningSnapshot, embeds metadata, and the Master Agent's large language model reasoning kernel delivers PlanningSnapshot{trace_id=T, index label, full input data} to Orchestrator, triggering a single round of decision-making process.

[0181] The Orchestrator receives the PlanningSnapshot{trace_id=T, index label, full input data} from the Master Agent, and the task graph management submodule matches the current task graph / stage machine according to the index label of the PlanningSnapshot. The registered and capability index management submodule of the sub-agent retrieves the adapted sub-Agent according to the multi-dimensional index (scene_tag=NARROW_PASS_YIELD_001+risk_level=MEDIUM+vehicle_type=SUV), filters out the core sub-Agent set, obtains the target sub-Agent, and the sub-agent parallel scheduling engine allocates a unique span_id=Ti to each sub-Agent, sets the parent_span_id=T, generates an AgentQuery message according to the A2A-Drive protocol, and delivers it to all retrieved sub-Agents in parallel. The message contains PlanningSnapshot fragments+trace_id=T+span_id=Ti+parent_span_id=T+QoS level. N parallel AgentQuery{trace_id=T, span_id=Ti, parent_span_id=T, sub-Agent exclusive input}.

[0182] Each sub-Agent receives the AgentQuery message of the Orchestrator, checks the legality of the message according to the A2A-Drive protocol (trace / span_id validity, input data integrity), directly discards and reports exceptions for illegal messages, each sub-Agent executes local reasoning based on exclusive input data, strictly follows deterministic rules (such as temperature = 0, fixed version, no random factor), generates each sub-Agent exclusive PolicyFragment (policy fragment), and embeds its own version information (model / prompt / schema), reason_code (decision attribution code), link identifier (trace_id = T + span_id = Ti + parent_span_id = T), each sub-Agent returns PolicyFragment in parallel to the Orchestrator according to the A2A-Drive protocol, and returns PolicyFragment{status = TIMEOUT, no valid policy} if the sub-Agent reasoning times out, obtains N parallel PolicyFragment{trace_id = T, span_id = Ti, reason_code, policy data, version information}.

[0183] The strategy fusion and conflict resolution submodule of the Orchestrator core receives all / timeout sub-AgentPolicyFragment, collects all sub-Agent PolicyFragment, performs degradation processing (discards invalid policies and uses a predefined rule policy to supplement) on timeout / abnormal agents, performs conflict resolution in the order of hard constraint priority->risk priority->feasibility priority->experience trade-off, discards policies that violate SafetySummary / VehicleLimits, reduces the weight of high-risk policies / discard, triggers policy degradation for high-risk policies, predicts the feasibility of the policy based on L1 historical ExecFeedback, removes low feasibility policies, sorts the feasible policies (i.e., multiple third driving control strategies) according to comfort / efficiency / energy consumption, generates Top-N candidate strategies (i.e., a set of sub-driving control strategies), and generates a standardized MetaCommandBundle (meta-command bundle) after the final compliance check (filtering of overspeed, illegal gear, prohibition of reverse driving, etc.) of the fused strategy by the constraint governor. The SafetySummary+VehicleLimits+ModePolicy is converted into a hard constraint, and the standardized MetaCommandBundle (meta-command bundle) is generated. The global trace_id=T is reused, and the full metadata (Orchestrator version, sub-Agent version set, fusion basis, multi-dimensional index label) is embedded. The Top-2 candidate strategies can be optionally retained (supporting L1 fast switching / rollback), and the final output is MetaCommandBundle{trace_id=T, Top-N candidate strategies, full metadata, compliance constraint instructions}.

[0184] After the Orchestrator generates the compliant MetaCommandBundle, the MetaCommandBundle (trace_id=T) is downlinked from the L2 layer to the L1 execution layer according to the A2A-Drive protocol, and real-time downlink logs are pushed to the TraceLogger.

[0185] After L1 execution layer receives the MetaCommandBundle, it checks the trace_id and the legality of the instructions. If the instructions are legal, it parses and executes them (converts them into vehicle control quantities: throttle / brake / steering). If the instructions are illegal, it discards them and requests a retransmission of the meta-instruction package. During the process of discarding and retransmission, the vehicle continues to generate vehicle control instructions and control the vehicle based on the last valid meta-instruction package (hold-last-valid) or enters a conservative mode (fallback controller). After the check is passed, the L1 execution layer performs the control execution of the current MetaCommandBundle and collects the core data ExecFeedback (tracking error, actuator saturation state, control success rate, actual vehicle speed / steering angle) of the current execution. According to the A2A-Drive protocol, the ExecFeedback is packaged, the trace_id T is multiplexed, the execution status code (success / failure / partial execution), the execution time, and the hardware state are embedded, and the ExecFeedback {trace_id=T, tracking error, actuator state, execution result} is simultaneously returned to the Orchestrator (for the next round of strategy optimization) and the MasterAgent (for global state awareness).

[0186] The Orchestrator / MasterAgent updates the local state according to the ExecFeedback (e.g., the Orchestrator records the execution feasibility, and the MasterAgent updates the PlanningSnapshot).

[0187] When the L0 security layer detects a risk transition (e.g., risk level from LOW to CRITICAL, collision probability increases sharply, L1 heartbeat timeout), in order to ensure thread safety (i.e., not to produce a half package), a RollbackEvent is generated after the RollbackEvent walks an independent high-priority event channel, i.e., priority = 0 (which is the highest priority of A2A-Drive, preempting all or most of the regular processing), and there are interruptible checkpoints in each stage of the orchestration kernel. When the orchestration kernel receives the RollbackEvent, it performs a self-check based on the interruptible checkpoints, switches the current meta-instruction bundle (active bundle) in an atomic switching manner, generates an emergency bundle, and embeds trace_id = T, risk transition reason, and target downgrade level. The L0 sends the RollbackEvent to the Orchestrator in a preemptive manner according to the A2A-Drive protocol, interrupts the current regular decision-making process of the Orchestrator, and the rollback and downgrade management submodule of the Orchestrator immediately triggers the rollback / downgrade action, replaces the current strategy with a conservative strategy, suspends the execution of the meta-action corresponding to the meta-instruction bundle, generates an emergency MetaCommandBundle, and the Orchestrator sends the emergency MetaCommandBundle to the L1, forcing the L1 to execute the conservative / downgrade action (e.g., emergency braking, short stop, direction lock), and synchronizes the rollback / downgrade state to the MasterAgent and TraceLogger, and records the abnormal link.

[0188] It should be noted that the atomic switching manner is a process of switching the "currently effective meta-instruction bundle" from the first meta-instruction bundle to the second meta-instruction bundle after the orchestration kernel receives the rollback event. It appears as a single indivisible state update to the outside, so that the real-time control layer can only read one of the first meta-instruction bundle or the second meta-instruction bundle at any time, and will not read the intermediate state meta-instruction bundle in the construction process.

[0189] The tracking and auditing management submodule included in the orchestrator kernel collects all output data + link actions in each of the aforementioned steps in real time, including PlanningSnapshot, AgentQuery, PolicyFragment, MetaCommandBundle, ExecFeedback, RollbackEvent (if any), constructs a structured decision tree (TraceTree) based on trace_id=T and span_id=Ti, records the list of called sub-agents, the time consumed by each module, the basis for policy fusion, the constraint verification result, the rollback / degradation reason (if any), all version information, embeds full-dimensional index tags, link identifiers, and module versions in the log, standardizes the packaging according to the A2A-Drive protocol, ensures the uniformity of the log format, persists the full-link log to the vehicle local / cloud, supports multi-dimensional retrieval according to trace_id / index tags, and stores the log compatible with the Debug / ReplayToolchain, which can reproduce the full-link decision-making process offline, realize failure case attribution, policy rollback reproduction, and golden trace verification.

[0190] Next, in specific examples, the scenario recognition and mode management class agent includes a scenario recognition agent A1 (Scene Classifier), the semantic understanding and task decomposition class agent includes an instruction parsing agent (InstructionParser) B1, a constraint normalization agent (Constraint Normalizer) B1a, and a task orchestration agent (Orchestrator / DAG) B2, the behavior decision and interaction game class agent includes an interaction game agent (Right-of-way&Negotiation) C1, an opponent intent prediction agent (Opponent Intent Prediction) C1a, an unstuck / recovery agent C2, the motion planning and trajectory generation class agent includes a local trajectory planning agent (Local Planner) D1, a trajectory evaluation / sorting agent (Trajectory Critic) D1a, and a parking special planning agent (Parking Planner) D2, the explanation and interpersonal interaction class agent includes a decision explanation agent (DecisionExplainer) E1 and a cabin interaction agent (Cabin Interaction) E2, and the model supervision and verification class agent is an example. The specific process of generating a specific sub-driving control strategy by each sub-agent in actual application is described.

[0191] The scene recognition agent A1 provides a standardized scene mode for all subsequent agents, which is the core basis for the Orchestrator to retrieve sub-agents and trigger scenario-based strategies. Through multi-source feature fusion processing of environmental abstract information (such as road boundaries / free space / Top-K dynamic obstacles), system state information (such as speed / gear / positioning quality information), and safety abstract information (such as risk level), road geometric features (width, curvature, convergence trend), free space shape embedding features, dynamic body density and relative speed distribution are extracted. The unified fusion feature vector is integrated through feature alignment algorithm to eliminate multi-source data redundancy and conflict. Further, the fusion feature vector is input into a lightweight classifier (GBDT, shallow MLP or small Transformer) to take Top-K features (tokens) to reduce power consumption, and the scene mode and confidence are initially output. Then, through HMM, Bayesian filtering or EMA time series smoothing algorithm, mode jitter is suppressed, and the stable posterior probability, final scene mode information (scene_mode), confidence (confidence) and explanation basis (mode_evidence) are output for subsequent sub-agents.

[0192] For example, for the parking scenario, the "parking area / low-speed high-precision positioning" scene is recognized, and B2 is driven to the parking stage machine, while B1a is triggered to tighten the curvature / speed constraint; for the straight road head-on collision scenario, the "narrow road intersection / high density of opposite dynamic bodies" scene is recognized, and C1 is triggered to enter the interactive game strategy, while D1 is triggered to generate a set of collision avoidance candidate trajectories; for the cruise overtaking scenario, the "high-speed / neighbor lane empty / no opposite car" scene is recognized, and D1 is triggered to generate an overtaking trajectory, and B1a is triggered to relax the straight road acceleration constraint.

[0193] The instruction analysis agent B1 converts natural language instructions into structured machine executable targets, balancing the flexibility of user interaction and the certainty of system execution. By obtaining natural language instructions and current task context information (including scene recognition information output by the scene recognition agent A1, and map region and target region in the road / boundary geometry summary included in the environment summary information), the association between instructions and scenes is established to avoid analyzing instructions out of context. The rule / CFG / slot-filling channel is used for basic analysis to ensure the stability and measurability of the analysis results. At the same time, the LLM channel is enabled for fault tolerance and completion to handle ambiguous instructions or colloquial expressions, improve analysis flexibility, and perform consistency checking and rollback of LLM analysis results with scene recognition information / output by the scene recognition agent A1 and instruction targets that exceed the map feasible area / vehicle capacity. If there is a conflict, automatically rollback to the rule channel output result to avoid analysis errors, and further convert ambiguous natural language constraints (such as "steady / avoid the edge / pass quickly") into standardized intermediate semantics, finally output structured information (including goal_type, target_region, constraints, priority), which is passed to the normalization agent B1a to support constraint normalization.

[0194] For example, in the safe parking scenario, the goal_type is analyzed as PARK, the target_region matches the parking space polygon, and the constraints are "comfort / low speed", which are linked to B1a to tighten the jerk / steer_rate limit; in the right lane yielding scenario, the goal_type is analyzed as YIELD, the target_region is the right lane passable corridor, and the priority is set to safe yielding, which is linked to C1 to enter the yielding game strategy; in the fast pass through the narrow road scenario, the goal_type is analyzed as PASS, the priority is set to efficiency, and B1a relaxes the narrow road acceleration constraint appropriately (without violating safety).

[0195] The constraint normalization intelligent agent B1a converts the fuzzy constraints, scene characteristics, and vehicle capabilities of B1 into quantified parameter constraints that can be directly consumed by L1, while providing safety bias hints for L0. It is the key to connecting upper-level decision-making and lower-level execution. By parameter mapping table establishment and continuous interpolation processing on the constraints (structured intermediate semantics) output by B1, the scene_mode output by A1, and the vehicle capability profile (SystemState / static configuration, such as vehicle type / turning radius / power performance), the mapping relationship between the comfort / eco / sport modes and the quantified parameters is established, supporting continuous interpolation (such as "a little more stable" corresponding to a comfort weight of 0.7, linear adjustment of parameters); Context-aware scene adaptation, such as parking / narrow road meeting to tighten curvature and lateral acceleration, straight-line cruising to loosen acceleration constraints, and high-speed overtaking to increase the upper limit of longitudinal acceleration, is performed, and the execution link is aligned: all quantified constraints are consistent with the input requirements of L1 trajectory generation / controller, compatible with existing planning / control hierarchical architecture, and do not need to modify the L1 bottom logic.

[0196] For example, in the parking scenario, B1a outputs v_max≤5km / h, jerk_max≤0.5m / s³, steer_rate_max≤5deg / s, and curv_max≤0.03rad / m, ensuring fine control at low speed; in the narrow road meeting scenario, B1a outputs lateral acceleration≤1m / s², lateral safety distance bias+0.5m, and curv_max≤0.02rad / m, avoiding side-by-side / scraping; in the high-speed cruising scenario, B1a outputs a_max≤2m / s², jerk_max≤1m / s³, and loosens the straight-line curvature constraint, balancing efficiency and comfort.

[0197] The task orchestration intelligent agent B2 undertakes upper-layer instructions and scenarios, disassembles them into structured sub-tasks DAG / phase state machines, schedules and activates corresponding sub-agents, and finally combines to generate a MetaCommandBundle, which is the core landing carrier of the orchestration kernel of the Orchestrator. The structured targets output by B1 / B1a, the scene_mode output by A1, the ExecFeedback (execution feedback information) output by L1, and the SafetySummary (risk summary information) output by L0 are obtained, and the scene solidification phased task process (i.e., HFSM+DAG task disassembly) is performed according to the scene, for example, in a parking scenario, the task is disassembled into SEARCH_SLOT→ALIGN→INSERT→STRAIGHTEN→STOP; in a narrow road meeting scenario, the task is disassembled into DETECT→NEGOTIATE→YIELD / GO→CLEAR; in a cruising overtaking scenario, the task is disassembled into CHECK→OVERTAKE→RETURN→CLEAR; the PolicyFragment of each sub-agent is summarized based on a strategy fragment combiner, conflict detection, priority arbitration, and validity_window management are performed to avoid instruction conflicts / expirations; and finally, a feedback closed loop is executed: based on L1.ExecFeedback (tracking error, actuator saturation, control success rate), re-planning / phase switching is triggered to ensure that the strategy can run, adjust, and rollback.

[0198] For example, in a parking scenario, D2 (parking special planning), C1 (low-speed obstacle avoidance), and B1a (parking constraints) are activated, and are scheduled gradually according to the phase machine, and the L1 fine steering control is triggered in the INSERT phase; in a narrow road meeting scenario, C1 (interactive game), C1a (intention prediction), D1 (local trajectory planning), and D1a (trajectory evaluation) are activated, the C1 / C1a are scheduled at a high frequency in the NEGOTIATE phase to ensure the real-time performance of the game decision, and in a cruising overtaking scenario, D1 (overtaking trajectory planning), D1a (trajectory evaluation), and B1a (overtaking constraints) are activated, the acceleration constraint is relaxed in the OVERTAKE phase, and the steering constraint is tightened in the RETURN phase.

[0199] The interactive game agent C1 outputs clear pass / yield decisions for narrow road meeting / signal-free intersection scenarios, provides behavior basis for trajectory planning, and considers game rationality and execution safety. By obtaining the Top-K state (position / speed / acceleration) of the opposite vehicle, the width of the meeting, the space for yielding, and the SafetySummary output by L0, it is first determined whether there is a legal meeting corridor / yielding pocket. If there is no legal space, SHORT_STOP is directly output to avoid aggressive decisions (i.e., rule legality verification). After rule screening, linear / GBDT cost or multi-agent RL is used to score the candidate decisions, considering scenario adaptability and interpretability (i.e., scoring based on a learnable scoring mechanism). Stackelberg game (leader / follower assumption) is used, and the intent probability distribution of C1a is injected as a risk enhancement term. High uncertainty is biased towards yielding / short stopping (i.e., conservative game solving), and an executable intent prompt (such as "short stop for 1s") is output with time / action details, directly guiding D1 to generate a controllable trajectory segment, avoiding the disconnection between decision and trajectory (i.e., executable intent prompt). Finally, the decision action (GO / YIELD / SHORT_STOP(t) / REVERSE_YIELD / CREEP), intent_hint (intent prompt, such as "short stop for 1s and then pass") is output.

[0200] For example, for the narrow road meeting-opposite vehicle yielding scenario, GO + "low-speed creeping through (0.5 m / s)" is output to guide D1 to generate a straight trajectory. For the narrow road meeting-no yielding space for both sides scenario, SHORT_STOP(2s) + "wait for the opposite vehicle to act" is output, and D1 generates a stop trajectory, which is re-evaluated after 2s. For the signal-free intersection-opposite vehicle going first scenario, YIELD + "yield to the right, leave 1m lateral space" is output to guide D1 to generate a right-side yielding trajectory.

[0201] The intention prediction agent C1a predicts the intention probability distribution of the opposite / adjacent vehicle, provides risk basis for C1, and avoids the misjudgment risk of single deterministic prediction. By obtaining the relative speed, lateral offset, acceleration intention, and short window historical trajectory (1-3s) of the target vehicle, based on a lightweight sequence model (using GRU / TemporalCNN / small Transformer), the prediction accuracy and low latency (inference ≤10ms) are considered, the real-time decision is adapted, and the multi-modal distribution is output. That is, instead of outputting a single deterministic intention, a probability distribution is output, which is more suitable for C1's risk trade-off (such as P(go_first)=0.6, P(yield)=0.4, C1 tends to be conservative), the prediction uncertainty is output. When the uncertainty is high (such as >0.7), a risk copy signal is sent to C1, suggesting output of SHORT_STOP / CREEP, and the signal is also used for L0 safety side auditing (i.e. uncertainty-aware), and finally the intention probability distribution (P(go_first) / P(yield) / P(reverse_yield)), uncertainty (prediction uncertainty, 0-1) is output.

[0202] For example, for the opposite vehicle low-speed approaching scene, the output is P(go_first)=0.8, P(yield)=0.2, uncertainty=0.2, and C1 outputs YIELD; for the opposite vehicle braking / stopping scene, the output is P(go_first)=0.1, P(yield)=0.9, uncertainty=0.1, and C1 outputs GO; for the opposite vehicle trajectory fluctuation scene, the output is P(go_first)=0.5, P(yield)=0.5, uncertainty=0.8, and C1 outputs SHORT_STOP (1s), and sends a risk signal to L0.

[0203] The escape / unlock intelligent agent C2 is aimed at oscillation / steering dead / insufficient space and other stuck scenes, and outputs a structured recovery action sequence to make the vehicle escape from the stuck state, which is the fault-tolerant bottom-up module of the system. By obtaining the L1 output ExecFeedback (failure count / actuator saturation / tracking error exceeding), WorldSummary (surrounding space that can retreat / static obstacle distribution), the stuck fault mode is solidified, such as oscillation (repeated forward and backward), steering dead, insufficient space, and actuator saturation, and the stuck reason is accurately located (i.e. fault mode recognition FSM). The built-in standardized recovery action template is combined with beam search to do local small search, and the optimal recovery sequence is generated, each step of which has precondition (execution precondition) and validity period to avoid invalid execution (i.e. small search based on action template library). The recovery sequence is a "meta-action" and is not directly issued to control quantity, but is still executed through the planning / control link of D1 / L1 to ensure system architecture consistency (i.e. execution link alignment, which is the key to engineering landing), and finally outputs the recovery action sequence candidate (such as REVERSE small→STEER reset→CREEP→REPLAN) and the action trigger condition (such as failure count≥3 / steering wheel dead≥2s).

[0204] For example, for the scene of parking steering wheel dead + insufficient space, the output is: recovery sequence: REVERSE small (0.5m)→STEER reset (reset steering wheel)→CREEP (0.3m / s)→REPLAN (replan parking trajectory); for the scene of narrow road meeting oscillation (repeated forward and backward), the output recovery sequence is: SHORT_STOP (1s)→STEER reset→YIELD (right yield)→CREEP through; for the actuator saturation (throttle / brake full) scene, the output recovery sequence is: STOP→remove actuator saturation→CHECK space→REPLAN.

[0205] The local trajectory planning agent D1 takes over the behavior decision of C1 and the parameter constraints of B1a, generates a set of multiple candidate executable trajectories, provides control basis for L1, and covers all scenarios except parking. By obtaining the behavior decision of C1, the ParamConstraints output by B1a, and the WorldSummary, vehicle state (speed / position / pose), first, the trajectory is sampled through Frenetlattice / multiple candidate curves (covering all feasible behaviors), and then the trajectory is optimized through QP / nonlinear smoothing to meet the curvature / jerk / acceleration / deceleration constraints of B1a (i.e., execute the sampling+optimization hybrid strategy); strictly according to the ParamConstraints of B1a, the trajectory is cropped, the discrete behavior (GO / YIELD) is mapped to the corresponding trajectory segment, and the feasibility is checked combined with the vehicle dynamics model to ensure the trajectory is executable (i.e., constraint clipping alignment is performed); 3-5 candidate trajectories are generated, sorted by cost, for D1a to evaluate and screen, and the Top-2 candidates are reserved for L1, (i.e., multiple candidate output is performed), so that L1 selects the candidate trajectory driving strategy under the L0 hard constraint and L1 executable gating to generate vehicle driving control instructions or performs degradation processing on the current trajectory driving strategy, and then generates vehicle driving control instructions based on the degraded vehicle driving strategy, and finally outputs traj_set (candidate trajectory set, including position / speed / acceleration / steering angle time series), cost (each trajectory cost, such as safety / comfort / efficiency), validity_window (trajectory validity period, such as 200ms).

[0206] For example, for the narrow road meeting-straight (GO) scenario, a low-speed crawling straight trajectory is generated, which is laterally biased 0.2m from the road center to meet the lateral safety distance constraint; for the narrow road meeting-yield (YIELD) scenario, a right-receding trajectory is generated, which is laterally biased 0.3m from the right side of the road, and the speed is ≤1m / s; for the cruising overtaking scenario, a four-segment trajectory of “acceleration→lane change→maintenance→return to original lane” is generated, with an acceleration a=1.5m / s², meeting the overtaking efficiency and safety constraints.

[0207] It should be noted that, for example, the Top-2 candidate set is provided to L1, and if both candidate trajectories are infeasible, L1 enters conservative control (e.g., safe parking) by itself.

[0208] The trajectory selection / sequencing agent D1a performs multi-dimensional quantitative evaluation and sequencing on the trajectory set generated by D1, outputs the optimal trajectory, and ensures the safety, feasibility, and comfort of the trajectory. By obtaining the traj_set output by D1, the risk summary / safety constraints output by L0, and the intention probability distribution output by C1a, a standardized scoring system is established, including safety indicators (min_dist minimum distance / TTC collision time), feasibility indicators (curv_peak curvature peak / speed change amplitude), and experience indicators (comfort / efficiency), with dynamic adjustment of weights according to the scene (e.g., narrow road meeting safety weight = 0.7, efficiency weight = 0.1) (i.e., multi-index weighted scoring); the intention probability distribution of C1a is mapped to the TTC weight, such as P(go_first) = 0.8 for the opposite car, which increases the TTC score weight in that direction and reduces the aggressive trajectory score (i.e., risk-enhanced scoring); detailed score breakdown is output, which does not enter the control closed loop, is only used for E1 decision explanation and L0 / sixth type of safety side audit (i.e., interpretable decomposition), and finally outputs best_traj_id (optimal trajectory ID) and score_breakdown (score breakdown, such as min_dist / TTC / curv_peak / comfort / efficiency).

[0209] For example, for narrow road meeting candidate trajectories, trajectory 1 (straight, TTC = 2s, curv_peak = 0.02 rad / m), trajectory 2 (yield, TTC = 5s, curv_peak = 0.01 rad / m), the safety weight is high, and after scoring, trajectory 2 is the optimal; for cruising overtaking candidate trajectories, trajectory 1 (fast overtaking, a = 2m / s², efficiency = 0.9), trajectory 2 (smooth overtaking, a = 1m / s², comfort = 0.9), the efficiency weight is high in high-speed scenarios, and trajectory 1 is the optimal.

[0210] The parking special planning agent D2 generates a segmented fine parking trajectory for vertical / side / inclined parking, adapting to the low speed, high precision, and multiple constraint requirements of parking. By obtaining the parking space geometry (polygon / length / width), free space shape (Ray / free-space detection result), static obstacle Top-K, B1a parking parameter constraint, based on the parking space geometry and free space shape, the parking feasible region is generated first, then the key points are generated in the region, and finally the complete trajectory is spliced by segmented curve (i.e. geometric feasible space driving is performed); it is naturally adapted to the parking stage machine of B2, and the trajectory of each stage is independently generated and smoothly connected, which is convenient for L1 to execute by stage, and supports intra-stage re-planning (i.e. stage-by-stage strategy is executed); the trajectory optimization focuses on steering smoothness at low speed, steer_rate≤5deg / s, jerk≤0.5m / s³, to ensure parking accuracy and comfort (i.e. low-speed high-precision optimization is performed), and finally outputs the segmented parking trajectory (including ALIGN / INSERT / STRAIGHTEN / STOP stage trajectory), key points (stage switching points such as alignment point / insertion start point).

[0211] For example, for a vertical parking scene, a four-segment trajectory of "aligning the parking space→ reversing and cutting in→ straightening the vehicle body→ stopping" is generated, the curvature in the cutting-in stage is ≤0.03 rad / m, and the lateral error in the straightening stage is ≤0.1 m; for a side parking (narrow parking space) scene, a multi-segment trajectory of "front alignment→ reversing and cutting in→ multiple fine tuning→ stopping" is generated, the fine tuning distance is ≤0.3 m each time, to ensure that the surrounding obstacles are not scratched.

[0212] The decision explanation agent E1, as a bypass interaction agent that does not interfere with the real-time closed loop, provides interpretable decision text + evidence chain for the driver / test / auditor, improves system transparency, and meets the requirements of mass production compliance and user trust. Obtain structured summary of system (behavior selection of C1, constraint of B1a, score breakdown of D1a, intention probability of C1a, risk level), template-based explanation based on structured summary (ensure determinism), optional natural language polishing by LLM (only read structured fields, do not read original sensor stream, avoid black box) (i.e. template-based explanation + LLM polishing); all explanations are bound to trace_id and PolicyFragment / score_breakdown of each Agent, supporting offline playback / acceptance, ensuring the authenticity and traceability of the explanation, so that the evidence chain can be implemented, and finally output natural language explanation text, evidence chain (trace_id + each Agent fragment reference, such as C1 decision fragment / D1a score fragment).

[0213] For example, for narrow road meeting yielding, the output explanation text is: "Currently detected narrow road meeting scene, the opposite vehicle has an 80% probability of going first, to ensure safety, choose to yield to the right, maintain a 1m lateral safety distance"; evidence chain: reference C1 decision fragment / C1a intention probability fragment / B1a safety constraint fragment; for parking straightening scene, the output explanation text is: "Currently in the parking straightening stage, to ensure that the vehicle body is parallel to the parking space, execute a small steering adjustment, steering rate 5 deg / s"; evidence chain: reference D2 trajectory fragment / B1a parking constraint fragment.

[0214] The cabin interaction agent E2, as the "interaction hub" of the cabin user and the system, processes cabin voice / touch interaction instructions, updates user preference constraints / task requests, and does not directly control the amount, to ensure real-time closed loop without interference. By obtaining cabin interaction instructions (voice / touch, such as "straighten a little" "give up parking" "continue through"), current task state (B2 phase, such as parking INSERT phase / meeting NEGOTIATE phase), the cabin fuzzy interaction instruction is converted into a standardized preference / task request, avoiding invalid interaction (i.e. interaction instruction structuring); interaction input only changes "target / constraint / priority", does not directly issue control amount, all updates are through B1 / B1a / B2 into the decision link, and then executed by L1, to ensure system real-time and stability, without interfering with real-time closed loop; interaction request and current B2 task state are consistency checked, such as receiving "continue parking" request in parking STOP phase, directly rejecting and feeding back (i.e. task state checking), finally outputting preference constraint update (→B1a, such as "straighten a little" → tighten the body straightening constraint), task request (→B2, such as "give up parking" → trigger task termination / rollback).

[0215] For example, for the "straighten a little" interaction scene in parking: output preference constraint update → B1a, tighten the body straightening constraint (lateral error ≤ 0.05m), B2 triggers D2 to re-plan the straightening trajectory; for the "give up yielding, continue through" interaction scene in narrow road meeting: output task request → B2, B2 re-evaluates the scene, and if feasible, triggers C1 to re-bargain, and D1 generates a passing trajectory; for the "emergency stop" interaction scene in any stage, output high-priority task request → B2, B2 immediately triggers L1 to stop, with higher priority than all regular tasks.

[0216] In the implementation of the present application, the scene recognition→instruction analysis→constraint normalization→task arrangement→interaction decision→trajectory planning→execution feedback are layered, the upper layer provides basis for the lower layer, and the lower layer provides feedback for the upper layer, forming a closed loop, to achieve better and more accurate vehicle driving strategy generation.

[0217] At S300, the real-time control layer determines control instruction generation decision information corresponding to the vehicle, generates a vehicle driving control instruction according to the safety constraint indication information, the meta-instruction package, and the control instruction generation decision information, and controls the vehicle to drive according to the vehicle driving control instruction.

[0218] In the implementation of the present application, the control instruction generation decision information includes current observation feature information (obs_vec) for reflecting the third state of the vehicle and vehicle dynamics parameter information (for example, a vehicle dynamics model) for reflecting vehicle dynamics parameters. The current observation feature information includes vehicle speed information, steering angle information, longitudinal acceleration information, lateral position information, and the like, and the vehicle dynamics parameter information includes vehicle wheelbase information, road adhesion coefficient information, and the like.

[0219] Further, in the present application, the local target driving information is generated according to the meta-instruction package, and the local target driving information includes local road curvature, local driving trajectory, local driving speed, local attitude constraint, and the like.

[0220] The real-time control layer is located at the execution core position of the vehicle driving control system architecture, and is responsible for converting the control instruction generation decision information and the meta-instruction package into real-time control instructions that can directly act on the vehicle actuators within the strong safety constraint envelope (that is, the safety constraint indication information) provided by the safety monitoring layer. The design core is not a single pursuit of optimal control performance, but to achieve unified scheduling of multiple algorithms, dynamic balance of performance-stability-safety, scene-based precise control under strong real-time and high safety constraints, while taking into account the scalability, verifiability, and engineering landing of the architecture.

[0221] In the implementation of the present application, the real-time control layer includes multiple controllers, different controllers include different control algorithms, for example, a reinforcement learning controller (RL Control) includes a reinforcement learning algorithm, a model predictive controller (MPC Control) includes a model predictive algorithm, and a hybrid controller (Hybrid Control) includes a reinforcement learning algorithm and a model predictive algorithm. It should be noted that the L1 internally shields the implementation differences of different control algorithms (RL / MPC / hybrid control), and provides a standardized and parameterized control interface to the outside, the upper L2 and the lower actuator only interact with the interface, and the "algorithm and interface decoupling" is realized. In this way, the selection, switching, upgrading and expansion of the control algorithm do not need to modify the upper and lower layer codes, and only need to adapt the algorithm inside L1. The RL controller is used for complex, strong nonlinear, and rule difficult to enumerate scenarios, especially low-speed, strong geometric constraint tasks, such as parking (low-speed high-precision), escape (stuck scene), and low-speed fine control (narrow road passing). The MPC controller is used for scenarios with explicit models, constraints that can be expressed, and trajectory predictability, such as normal driving (cruise / following), overtaking, straight road passing, and high-speed driving. The Hybrid controller is used to fuse the scene adaptability of RL and the stability of MPC, uses RL for fine control in the low-speed section, uses MPC for stable tracking in the high-speed section, quickly switches in the event of a fault, such as escape recovery, narrow road passing (medium and low speed), and parking straightening stage.

[0222] The real-time control layer realizes high-performance control in normal conditions, automatic degradation when the risk increases or the computing power is insufficient, and explicitly reports the failure state to L0 when the control is not feasible, triggers safety takeover, and reserves an adjustable interface that can be called by the Agent module of the L2 level in the future.

[0223] The outputs of all control algorithms are unified as lateral control, longitudinal control, and auxiliary control, which are directly connected to the steering, power, brake, gearbox, and other actuators. The lateral control instruction is, for example, the steering angle and the steering angle rate of change, the longitudinal control instruction is, for example, the acceleration and the acceleration rate of change, and the auxiliary control instruction is, for example, the gear instruction (forward (D) / reverse (R) / neutral (N) / parking (P)) and the parking instruction (one-key parking (P)).

[0224] The control behavior of L1 is not determined by a single signal, but is jointly constrained and cooperatively scheduled by the mode label (driving intention / scene) of L2 and the safety envelope (strong safety constraint) of L0. The two determine the "control strategy direction" and "control search boundary" of L1, respectively, and finally determine: which controller to use, in what range to control, and to what extent to control.

[0225] As Figure 6As shown, the real-time control layer determines control instruction generation decision information, generates vehicle driving control instructions according to the safety constraint indication information, the meta-instruction package and the control instruction generation decision information, including the following steps.

[0226] In S310, the real-time control layer standardizes and pre-processes the safety constraint indication information, the meta-instruction package and the control instruction generation decision information, to generate standardized safety constraint indication information, meta-instruction package and control instruction generation decision information.

[0227] For example, the standardization and pre-processing includes input information legality verification and filtering, such as verifying the validity of trace_id, whether the instruction valid_for_ms is expired (such as discarded if more than 2s), checking whether the L2 output constraint conflicts with the L0 output hard constraint (such as L2 requires vehicle speed 20km / h≤L0 upper limit 25km / h, which is legal), and whether the vehicle observation value is abnormal (such as negative vehicle speed is bottomed out with historical value), to filter unnecessary data and obtain standardized safety constraint indication information, meta-instruction package and control instruction generation decision information.

[0228] In addition, if L2 new instruction + L0 emergency constraint are received at the same time, L0 is given priority (such as L0 suddenly requires vehicle speed≤15km / h, covering 20km / h of L2); expired / illegal instructions are directly discarded, and the last period legal instruction is used (to avoid control interruption).

[0229] In S320, the real-time control layer determines the target controller according to the driving mode label, so that the target controller generates vehicle driving control instructions based on the corresponding control algorithm according to the standardized safety constraint indication information, driving control strategy indication information and control instruction generation decision information.

[0230] For example, the real-time control layer selects the adaptive controller according to the mode_tag of L2, and loads the scenario parameter to narrow the solution space.

[0231] The mode label represents the current driving intention or style, for example, the mode label can be divided into driving style, scene type and action type, the driving style includes power saving, comfort and aggressiveness, the scene type includes normal driving, low-speed fine control and parking / escape, and the action type includes short stop, alignment correction, obstacle avoidance and overtaking. The mode label does not directly determine the control amount, but is used to select the controller type (RL / MPC / Hybrid), and is used to select the control parameter set (weight, gain, target speed, comfort factor, etc.) required by the controller.

[0232] Further, the parameter scenario configuration comprises: loading a dynamic parameter: adjusting a maximum deceleration (-3 m / s2), a steering response delay (10 ms) based on a current adhesion coefficient μ=0.8; loading a constraint parameter: writing a safety constraint indication information (vehicle speed ≤25 km / h) of L0 and a second safety constraint (vehicle speed ≤20 km / h) included in the meta-instruction package of L2 into a constraint matrix of the target controller; loading a comfort parameter: jerk (acceleration) ≤5 m / s3, a steering angle rate of change ≤8° / s (to avoid passenger discomfort), to obtain a target controller parameter (ControllerInstance) of the configured parameter.

[0233] Further, the target controller forms a safety envelope (SafetyEnvelope) based on a state constraint, a space constraint and an action constraint of L0, and limits a control search space of L1 in a feedforward manner, wherein determining a control search boundary based on the state safety constraint comprises a speed, a steering angle, an acceleration amplitude limit, and a vehicle position feasible region for a state output of the target controller, determining a control search boundary based on the space safety constraint comprises a feasible space corridor, an obstacle occupancy area, and a parking space geometry boundary for trajectory / space planning of the target controller, and determining a control search boundary based on the action safety constraint comprises a steering angle rate of change limit, a discrete action mask, and a continuous inequality constraint for an action output of the control algorithm.

[0234] Further, vehicle driving control instruction generation is performed based on the target controller.

[0235] In an implementation manner of the present application, if the target controller is an MPC controller, model initialization is first performed, comprising: loading a vehicle dynamics model: a single-track model (applicable to low-speed / normal scenario), inputting a current observation obs_vec (vehicle speed, steering angle, etc.), and initializing an observation state quantity x=[v, δ, x_pos, y_pos, yaw]; loading a reference trajectory / objective: converting an objective (vehicle speed 20 km / h, right deviation 0.3 m) of L2 into a reference trajectory ref_traj (time sequence position / speed / pose) of the target controller; and loading a constraint matrix: converting L0 / L2 constraints into inequality constraints (such as v≤20 km / h, |δ|≤5°), and writing into a constraint set of the target controller, so that the target controller performs constraint on the reference trajectory according to the constraint matrix, to make the reference trajectory meet safety regulations, and finally obtain a vehicle driving control instruction.

[0236] In an implementation manner of the present application, if the target controller is an RL controller, that is, for example, in a parking scenario, a vehicle driving control instruction is generated based on the RL controller.

[0237] Parking is a typical challenging scenario in autonomous driving due to limited parking space, strict geometric constraints, and the need for precise lateral and longitudinal coordinated control. Traditional MPC / PID is difficult to adapt to the non-convex constraints of complex parking spaces. Therefore, a dedicated parking RL control module is built into the L1 layer as the core control solution for parking scenarios.

[0238] The core design of this module is "precise modeling of geometrically feasible space + strong binding of safety constraints + collaborative work with other controllers". Under L0 safety constraints and L2 parking sub-task scheduling, it learns and executes efficient parking operation sequences through reinforcement learning, while taking into account the stability, generalization and safety of engineering implementation.

[0239] The core challenge of parking problems lies not in semantic understanding, but in the accurate utilization of local geometrically feasible space. Therefore, the perception and state modeling of parking RL abandons high-dimensional inputs such as point clouds and BEV grids, and adopts a lightweight modeling method of "ray-based free space encoding + Top-K obstacle structured features" to directly provide core effective information for RL, which significantly improves the training efficiency, inference speed and generalization ability of RL.

[0240] First, ray construction is performed, and ray-based encoding is used to describe the shape of the feasible space. The core design is to emit rays from the center of the rear axle of the vehicle (consistent with the vehicle's kinematic model). The distance encoding of the rays accurately describes the geometric feasible space shape around the vehicle, directly answering the question that RL cares about most: how far can the vehicle travel in a certain direction.

[0241] Specifically, the coordinate system adopts the egoframe coordinate system to avoid positioning errors of the global coordinate system and adapt to low-speed local control of parking; the rays are evenly distributed at specific angles (e.g., 0°~360°, step size 15°, a total of 24 rays), and each ray is set with a maximum detectable range ( (e.g., 5m), covering all feasible directions around the vehicle; near-circular ray hit calculation: find the nearest intersection point between each ray and the target set to obtain the minimum distance. Objective 2 includes soft edges for parking spaces, hard boundaries for roads, static obstacles (walls, pillars, parked vehicles), and dynamic obstacles (with appropriate expansion to ensure safety).

[0242] The formula for calculating ray hit is as follows:

[0243]

[0244] in, The value is the ray-coded value, and its range is [0, 1]. For the minimum distance, This represents the maximum distance.

[0245] Further, the Top-K obstacle structured features capture the key geometric relationships.

[0246] Ray encoding only describes the spatial "shape", and the relative geometric relationship between the vehicle and the key obstacles (such as the distance / angle of the vehicle and the parking space line, the adjacent vehicle) needs to be explicitly captured in fine parking, so the Top-K obstacle structured features are introduced, which are spliced with the ray encoding, the ego state, and the parking space information into a fixed-dimensional observation vector, avoiding RL training divergence caused by high-dimensional input.

[0247] Among them, the Top-K selection strategy includes sorting the surrounding obstacles according to the Euclidean distance from the ego vehicle and selecting the K closest obstacles (engineering commonly used K = 4~6, taking into account information integrity and lightweight), for each Top-K obstacle, structured features such as relative distance, relative angle, and obstacle size are extracted to avoid high-dimensional redundancy of the original point cloud, and the ray encoding vector + Top-K obstacle structured features + ego state (speed / steering angle / parking space relative position) + target parking space information (parking space center / angle / size) are spliced into a fixed-dimensional observation vector as the input of RL.

[0248] In this way, the fixed-dimensional observation vector is much lower than the point cloud / BEV grid, greatly improving the real-time inference speed of RL and meeting the lightweight requirement. The geometric feature modeling is not dependent on a specific parking space type and can be generalized to various parking scenarios such as vertical, lateral, diagonal, and narrow parking spaces. The fixed-dimensional input avoids noise interference of high-dimensional data, improving the convergence of RL training and the stability of control.

[0249] Further, the action and safety are coordinated, i.e., based on strong safety constraints, the final generated vehicle control instruction does not break the L0 safety constraints.

[0250] Specifically, the action design of the parking RL follows the "discrete element action + strong binding of safety constraints" principle, ensuring that the RL action output not only meets the fine control requirements of parking but also strictly within the L0 safety envelope, avoiding aggressive actions of RL from the root. For discrete element actions, parking is a low-speed fine control, so the RL outputs discrete horizontal and vertical combined element actions rather than continuous control quantities, simplifying the action space of RL, improving training efficiency, and improving the interpretability of control. For example, generate longitudinal action: small forward (such as 0.1 m / s), small backward (such as -0.1 m / s), stop; lateral action: small left turn (such as 5 deg), small right turn (such as -5 deg), straighten; combined action: such as "small backward + small right turn" "small forward + straighten", covering all fine control scenarios of parking.

[0251] Further, for the safety constraint strong binding: the action must pass through double-layer filtering, the discrete element action of RL is not directly output, but needs to pass through the double-layer filtering of L0 safety envelope to ensure the safety of the action, and the filtered action is converted into continuous control quantity of L1 unified interface.

[0252] The first layer is actionmask: L0 generates forbidden action mask according to obstacle distribution and parking space boundary, directly shielding illegal actions (such as shielding "right turn + forward" when there is an obstacle on the right side of the vehicle);

[0253] The second layer is continuous limiting: the filtered discrete element action is converted into continuous control quantity (steering angle / acceleration), and the amplitude limiting is performed according to the safety envelope of L0 (such as steering angle change rate≤5deg / s).

[0254] The filtered control quantity still finally follows the unified control interface of L1, and passes through the actuator protection logic (such as steering angle out-of-range protection, anti-lock braking), and is then issued to the vehicle actuator to ensure the compatibility and safety with the bottom layer hardware.

[0255] Further, in the implementation manner of the application, the RL controller also cooperates with other controllers to perform vehicle control in a non-exclusive, multi-stage series / switching manner.

[0256] The parking RL does not exclusively control the whole parking process, but cooperates with PID / MPC and other traditional controllers in multiple stages in series and dynamically switches, fully utilizes the advantages of RL in complex geometric constraints, and simultaneously utilizes the stability of PID / MPC in trajectory tracking and fine adjustment to realize "complementary advantages and cooperative control".

[0257] For example, the whole parking process is divided into five stages: SEARCH_SLOT (finding a parking space)→ALIGN (alignment)→INSERT (cutting in)→STRAIGHTEN (straightening)→STOP (stopping).

[0258] The cooperation logic of the parking RL and other controllers is as follows: ALIGN (alignment) stage: PID / MPC is the main part and RL is the auxiliary part - PID / MPC realizes coarse alignment of the vehicle and the parking space, and RL finely corrects the alignment error; INSERT (cutting in) stage: RL exclusively controls - the core parking stage, which utilizes the scene adaptability of RL to process the non-convex constraints of complex parking spaces and realizes accurate horizontal and vertical cooperative cutting in; STRAIGHTEN (straightening) stage: RL cooperates with PID in series - RL completes preliminary straightening, and PID performs high-precision vehicle body straightening and parking space centering to ensure parking accuracy (horizontal error≤0.1m).

[0259] Further, if it is determined that the current is an abnormal scene, the RL automatically exits and switches to MPC / PID control, for example, when L0 detects that the risk is rising (such as there is an obstacle in the parking space) or the RL tracking error exceeds the standard, the RL immediately exits and switches to the more stable MPC / PID to ensure parking safety.

[0260] In the implementation of the present application, the parking RL controller follows the engineering landing principle in algorithm selection and training strategy, fixes the input and output interface standard, realizes hot plugging of the model, and adopts an efficient training strategy to ensure the performance, stability and generalization of the model. Among them, through experimental verification, DQN and PPO are the most effective RL algorithms for parking scenes. Both of them are lightweight algorithms, have fast training convergence speed, and support discrete action space, adapt to the action design of parking RL, and realize hot plugging of the model - the algorithm can be switched according to the scene requirements without modifying the input and output interface.

[0261] In the implementation of the present application, the training strategy of the RL controller mainly uses simulation offline training (taking into account training efficiency and safety), combines Curriculum Learning and success / failure episode reuse to ensure the training stability and scene generalization of the model, and greatly reduces the real vehicle training cost.

[0262] Among them, the Curriculum Learning strategy is to design the training scene in the order of "from easy to difficult, from wide to narrow", from standard wide parking spaces (such as 2.5m x 5m) to narrow parking spaces (such as 2.2m x 4.8m), and from vertical parking spaces to side and diagonal parking spaces, so that the model can gradually learn the control strategy of complex scenes and improve the generalization; the success / failure episode reuse strategy is to retain successful parking episodes (as positive samples, to strengthen effective strategies) and label failed episodes (as negative samples, to analyze failure reasons and optimize the reward function) during the training process, which greatly improves the training stability of the model and avoids ineffective training; and in the simulation training, vehicle dynamics error and sensor noise are added to adapt the model to the hardware characteristics of the real vehicle, reduce the domain deviation from simulation to real vehicle, model the lightweight perception features, greatly reduce the training data volume and training time, and adapt to the rapid iteration requirements of engineering.

[0263] Further, the real-time control layer also feeds back the execution feedback information of the vehicle control instruction to the safety monitoring layer and the task strategy layer, so that the safety monitoring layer updates the safety constraint indication information according to the execution feedback information to generate new safety constraint indication information or triggers the takeover of the vehicle driving control, and the task strategy layer updates the meta-instruction package by taking the execution feedback information as the execution feedback information of the last vehicle control to generate a new meta-instruction package.

[0264] In a normal scenario, the control arbitration module included in L1 selects an optimal control algorithm according to the scenario mode tag of L2, and exclusively controls the right to load a scenario parameter set to implement high-performance control within the L0 safety envelope, for example, using RL control for a parking scenario (parking dedicated), using MPC control for a cruise / high-speed scenario, using hybrid control for an escape scenario, and using RL / MPC switching control (low-speed RL and high-speed MPC) for a narrow road meeting. Based on the execution of the vehicle driving control instruction, execution feedback information is fed back to L0 and L2.

[0265] For example, the execution feedback information related to parking control (tracking error, actuator state, parking stage completion) is fed back to the parking dedicated planning agent D2 and the task scheduling agent B2 of L2 in real time, and L2 dynamically adjusts the parking sub-task strategy (such as re-planning a parking trajectory or adjusting a stage switching condition) according to the execution feedback information, forms a closed loop of “L2 strategy guidance -> L1 RL control -> execution feedback -> L2 strategy optimization”, and improves the overall success rate of parking.

[0266] In the implementation of the application, the L1 real-time control layer as an execution core forms a deep closed loop cooperation with the L0 safety monitoring layer, the L2 task strategy layer, and each sub-agent, and is a key bridge from “strategy” to “execution” of the entire architecture. L1 selects a target controller and loads parameters according to the mode tag (driving intention / scene) provided by L2, and at the same time, the execution feedback of L1 is fed back to L2 to support dynamic adjustment of the L2 strategy. L1 makes all control behaviors of L1 be executed within the envelope according to the safety envelope (strong safety constraint) provided by L0, and reports failure to L0 in an abnormal situation to trigger L0 safety bottom-up. The execution feedback information of L1 can directly act on the sub-agent to update the sub-driving control strategy of the sub-agent. Moreover, the control instruction, algorithm selection, parameter set, and safety envelope of L1 all carry trace_id / span_id, and are linked with the full-link TraceLogger of the A2A architecture to support offline playback, failure attribution, and compliance audit.

[0267] In the implementation of the application, the main agent and each sub-agent included in the safety monitoring layer and the task strategy layer and the real-time control layer communicate based on an A2A-Drive communication protocol.

[0268] The A2A-Drive communication protocol is a unified communication protocol standard of an automatic driving sub-agent cooperation architecture, which provides standardized, highly reliable, traceable, and strong real-time communication capabilities for MasterAgent, Orchestrator, each sub-agent, and L1 / L0 layers, and solves core problems such as non-uniform interfaces, difficult tracking, no real-time guarantee, and poor version compatibility in multi-agent distributed deployment.

[0269] A2A-Drive communication protocol adopts a four-layer hierarchical design, from the bottom layer transmission to the top layer interaction mode, and makes full-dimensional specifications, while defining a unified message encapsulation header, six types of core semantic messages, sub-agent heartbeat health mechanism, and standardized error codes. All designs are in line with the strong real-time, high-security, and engineering landing requirements of the vehicle scene, and are the communication cornerstone of the entire A2A agent collaboration architecture.

[0270] A2A-Drive communication protocol adopts a four-layer hierarchical architecture from bottom to top, with clear responsibility boundaries and decoupled design for each layer. The lower layer provides basic capabilities for the upper layer, and the upper layer encapsulates business semantics and interaction logic based on the lower layer, while supporting independent iteration and expansion of each layer, balancing compatibility and flexibility.

[0271] Layered core design principles: transmission reliability, encapsulation unification, semantic standardization, and interaction scenario.

[0272] A2A-Drive communication protocol includes the transport layer L0 (Transport Layer), the unified message encapsulation layer L1 (A2AEnvelope), the semantic layer schema L2 (SemanticSchemas), and the interaction mode layer L3 (InteractionPatterns).

[0273] Among them, the transport layer L0 is used to implement bottom-layer data transmission and network capability guarantee, based on in-vehicle middleware (such as SOME / IP / DDS) or gRPC; supports: priority queue, traffic throttling, timeout control, retransmission mechanism, idempotency guarantee.

[0274] The unified message encapsulation layer L1 is used to encapsulate all messages in a unified envelope. All business messages must be wrapped in a layer of standardized protocol header, and the encapsulation content includes: tracking identifier, version information, QoS, security signature, priority, etc.

[0275] The semantic layer schema L2 is used to define the structured semantics of business messages. The schema of core business messages such as PlanningSnapshot / PolicyFragment is standardized and defined. The schema must be versioned, backward compatible, and field extensible.

[0276] The interaction mode layer L3 is used to define the standardized interaction logic between multiple agents, defining four types of core interaction modes, covering all collaboration scenarios: request / response (query sub-agent), publish / subscribe (state broadcast), event (exception / rollback / takeover), and stream (optional: continuous suggestion stream).

[0277] The unified message envelope of the unified message packaging layer L1 is the core of the A2A-Drive protocol, and all business messages (L2 layer schema) must be wrapped in this envelope. The protocol header is a mandatory field, which constitutes the "business card" of the sub-agent, and realizes core capabilities such as full-link tracking, real-time control, security verification, version management, etc. The protocol header field is a unified header (Header) that includes: protocol_version: semantic version, that is, the version number of the A2A-Drive protocol itself, used to realize protocol layer version management and backward compatibility, and low version Agent can parse high version protocol basic field; schema_id+schema_version: XXX@X.X (such as PolicyFragment@1.2) encapsulated L2 layer business message schema identifier + version, used to clearly message business type and version, solve business message version compatibility problem; msg_type enumeration: REQ / RESP / PUB / EVENT / HEARTBEAT / ACK message type, used to match L3 layer interaction mode, guide Agent to do message processing logic (such as REQ corresponds to request, RESP corresponds to response); trace_id: globally unique string (such as timestamp + random code) globally unique identifier of a complete decision link, full-link tracking core, generated by MasterAgent, throughout the whole process from PlanningSnapshot to L1 execution, supporting offline playback / audit; span_id+parent_span_id: local unique string, span_id is the sub-link identifier of the current Agent; parent_span_id is the span_id of the caller (root node is trace_id), used to form the call tree and trace the call relationship between Agents (such as the span_id of C1 called by Orchestrator is associated), locate the time consumption / exception of a single Agent; sender / receiver: standardized agent_id (such as A1 / Orchestrator / L1), unique identifier of the Agent of the message sender / receiver, used to clearly the message sender / receiver, avoid message disorder / misfire; priority 0~7 (0 is the highest priority): message transmission priority, vehicle real-time core, such as L0's RollbackEvent set to 0, and ordinary state broadcast set to 7; deadline_ms (unit: ms): hard deadline of the message, strong real-time constraint, messages exceeding the deadline are discarded by the receiver, avoiding expired messages affecting decision-making; timestamp: monotonic clock + wall-clock timestamp (wall-clock), monotonic clock for time sequence sorting; wall-clock for manual time alignment to solve the vehicle clock synchronization problem, ensuring the time sequence consistency of the message, facilitating offline analysis time alignment;reliability enum: BEST_EFFORT / RELIABLE, where the transmission reliability requirement of the message is BEST_EFFORT (best effort) for non-core state broadcast; RELIABLE (reliable transmission) for core decision messages (such as AgentQuery / MetaCommandBundle), and the underlying automatically retransmits until success / timeout; idempotency_key: a unique string idempotency key used to solve the problem of repeated execution, and the receiver determines whether the message has been processed according to the idempotency key to avoid repeated reasoning of the sub-agent caused by the Orchestrator retransmitting the AgentQuery; auth: signature / permission token (string), message identity authentication and permission verification, which can be simplified in the vehicle (such as a fixed token), but a field must be reserved to protect the message from being tampered with / forged by illegal agents to meet functional safety requirements; payload_hash: string (such as MD5 / SHA256) message body (payload) hash value optional field, used to verify the integrity of the message body to prevent data tampering / loss during transmission; compression enum: NONE / LZ4 message body compression algorithm. It is an optional field, and LZ4 lightweight compression is used for large messages (such as PlanningSnapshot) to improve transmission efficiency and reduce bandwidth occupancy.

[0278] Among them, deadline_ms, priority, trace / span_id are the three core elements of this protocol for system compatibility, real-time performance, and traceability, and all agents must strictly parse and process these three fields.

[0279] Further, in the implementation manner of the application, the semantic layer schemaL2 defines the most core 6 types of structured business message schemas in the A2A architecture, covering the whole decision link from decision input Agent call strategy fusion instruction issuance exception rollback, all schemas follow the versioning, backward compatibility, and field extensibility principles, and the field design is consistent with the input and output requirements of each agent, while being compatible with the scheduling and fusion logic of the Orchestrator.

[0280] All schema messages are transmitted as the payload of the A2A Envelope, identified by schema_id+schema_version.

[0281] 6 categories of structured service message schema include PlanningSnapshot (planning snapshot), AgentQuery (Agent query request), PolicyFragment (policy fragment, i.e. sub-vehicle control strategy), StrategyBundle (sub-vehicle control strategy set, optional reporting), MetaCommandBundle (meta-command bundle), RollbackEvent / DegradeEvent (rollback / degradation event).

[0282] PlanningSnapshot (planning snapshot) is a global decision input snapshot generated by the Master Agent, used for Orchestrator scheduling and sub-Agent reasoning, and also supports offline playback, auditing, and reproduction (core traceable carrier). Core fields include GoalSpec (global goal), WorldSummary (environment summary), SystemState (vehicle state), SafetySummary (safety risk summary), ExecFeedback (last round of execution feedback summary), full version information (Agent / model / protocol version), and multi-dimensional index label (scene_tag / task_type, etc.).

[0283] AgentQuery (Agent query request) is a capability call request with budget and constraints initiated by the Orchestrator to the sub-Agent, which is the core message for the Orchestrator to schedule sub-Agents. Key fields include task_tag (task label), scene_tag (scene label), budget_ms (sub-Agent available reasoning delay), risk_level (current risk level), required_outputs (required output fields, on-demand request), and snapshot_ref (PlanningSnapshot hash / id, to avoid repeated transmission of large payload).

[0284] PolicyFragment (policy fragment, i.e. sub-vehicle control strategy) is the standardized strategy reasoning result returned by the sub-Agent to the Orchestrator, which is the core output message of each sub-Agent. Core fields include agent_id (sub-Agent side), reason_code (decision attribution code), policy_data (policy core data such as C1's GO / YIELD and D1's trajectory set), confidence (strategy confidence), and error_code (reasoning error code).

[0285] StrategyBundle (sub-drive control strategy set, optional reporting) is the product of the fusion of multiple PolicyFragment inside Orchestrator, which can be reported to Master agent / L0 optionally, used for auditing and degradation reference; the core fields include candidate_policies (candidate policy set with sorting weight), reject_reasons (rejected policy fragment and reason), fusion_basis (fusion basis such as hard constraint filtering / risk sorting), validity_window (policy validity period).

[0286] MetaCommandBundle (meta-command bundle) is the standardized execution instruction issued by Orchestrator to L1 real-time control layer, which is the core message that L1 can directly consume; the core fields include mode_tag (driving mode tag such as parking / comfort / escape), objective (control target such as efficiency / comfort / safety), constraints_hint (constraint hint, parameter constraint reference for L1), meta_action_seq (meta-action sequence, optional), valid_for_ms (instruction validity period, expired and discarded).

[0287] RollbackEvent / DegradeEvent (rollback / degrade event) is an abnormal handling event issued by L0 / Orchestrator to each Agent, covering rollback, degradation, takeover, policy revocation and all abnormal scenarios, with the highest priority (priority=0); the core fields include trigger (event trigger reason: TIMEOUT / INFEASIBLE / RISK_SPIKE / ILLEGAL_ACTION), recommended_action (recommended execution action: STOP / YIELD / REQUEST_TAKEOVER / FALLBACK_MODE), evidence_ref (evidence reference, associated with relevant trace / span_id, used for tracing), urgency (urgency).

[0288] The interaction mode layer L3 is based on the basic capabilities of L0-L2, and defines four types of core standardized interaction modes, covering all Agent coordination scenarios in the A2A architecture, each mode matching specific business needs, and being strongly bound with msg_type to realize the standardization and scenario of interaction logic.

[0289] All interaction modes follow the unified encapsulation of A2A Envelope, and the underlying transport layer provides corresponding QoS and reliability guarantee for different modes. Four types of core standardized interaction modes include request / response, publish / subscribe, event, and stream.

[0290] Further, to ensure the distributed collaborative stability of the A2A architecture, the A2A-Drive communication protocol also defines a heartbeat and health degree mechanism for sub-agents. The protocol requires all sub-agents to implement a heartbeat and health degree reporting mechanism. The Orchestrator, as the health degree management center, updates the health_status of the Agent according to the heartbeat information and serves as the core basis for retrieval and scheduling (not scheduling unhealthy agents), avoiding decision failure caused by Agent abnormalities.

[0291] Each sub-agent must support reporting heartbeat messages (HEARTBEAT). The core fields of the heartbeat message include uptime_ms (Agent runtime), last_error_code (last error code), latency_p50 / p95 (recent inference latency P50 / P95), cpu / gpu / mem (resource occupancy), queue_depth (request queue depth), and current_version (Agent current version).

[0292] The Orchestrator determines the health status of the Agent according to the resource occupancy, latency, error code, and queue depth of the heartbeat, updates the health_status (health status), and uses it for retrieval and scheduling (for example, not scheduling unhealthy agents). The health status is divided into HEALTHY (healthy), DEGRADED (degraded), UNHEALTHY (unhealthy), and OFFLINE (offline). The scheduling strategy is to only schedule HEALTHY agents. DEGRADED agents are only used as backups. UNHEALTHY / OFFLINE agents are excluded from the retrieval list. When the Agent state becomes DEGRADED / UNHEALTHY, the Orchestrator sends an event alarm and triggers a backup Agent switching or strategy degradation. After the Agent recovers to HEALTHY, the Orchestrator automatically adds it to the scheduling list, realizing hot plug.

[0293] In the implementation of the application, the A2A-Drive communication protocol also defines a standardized unified error code covering all communication and business processing scenarios, and all RESP (response) / EVENT (event) messages must carry error_code+reason_code, error_code is a standardized enumeration, and reason_code is a detailed reason readable by humans, realizing the standardization and interpretability of errors.

[0294] The error code includes: OK (success, no error), E_SCHEMA_INVALID (message schema is invalid (version is incompatible / field is missing)), E_TIMEOUT (transmission timeout / processing timeout), E_UNSUPPORTED_TASK (unsupported task / scenario), E_RISK_TOO_HIGH (risk level is too high, processing is refused), E_CONSTRAINT_CONFLICT (constraint conflict, a feasible solution cannot be generated), E_DEPENDENCY_UNAVAILABLE (dependent Agent / module is unavailable), E_NOT_AUTHORIZED (unauthorized, identity verification fails), and E_INTERNAL (internal error (Agent itself fails)).

[0295] In the implementation of the application, the A2A-Drive communication protocol is deeply collaborative with the Master Agent, the Orchestrator, each business sub-Agent, and the L1 / L0 layer, all Agents communicate through the A2A-Drive protocol, realizing the interconnection and intercommunication of heterogeneous Agents, the priority+deadline_ms of the protocol provides real-time guarantee for parallel scheduling of the Orchestrator, ensuring that the decision is completed within the budget, the trace / span_id of the protocol is linked with the Trace Logger of the Orchestrator, realizing full-link tracing from input to execution, the RollbackEvent / DegradeEvent of the protocol is linked with the safety gate of the L0 and the rollback and degradation manager of the Orchestrator, realizing rapid response to risk scenarios, the hierarchical design and version compatibility mechanism of the protocol support independent iteration and hot plug of each Agent and control algorithm, and adapt to the rapid research and development needs of automatic driving.

[0296] Further, in the implementation of the application, the safety monitoring layer is also used for monitoring the real-time control layer, and in a case where it is determined that the real-time control layer fails in vehicle driving control, triggering takeover of driving control of the vehicle.

[0297] In the implementation of the present application, another mode of the safety monitoring layer is a takeover mode in an abnormal vehicle control state. When the real-time control layer fails / communication is abnormal / actuator is abnormal (as an example of vehicle driving control failure), the vehicle driving control is taken over, the real-time control layer enters the safety control mode through a high-priority safety event, the real-time control layer only allows execution of an emergency braking control instruction set or a minimum risk maneuver control instruction set issued by the safety monitoring layer, and prohibits execution of a normal meta-instruction package of the task strategy layer, so as to control the vehicle to enter emergency braking or minimum risk maneuver (MRM).

[0298] It should be noted that in the implementation of the present application, the safety control mode can be realized by an independent safety controller or a safety arbitration module of the safety monitoring layer, or the safety monitoring layer can issue a high-priority safety event, and an independent safety controller or a safety arbitration module of the real-time control layer is used to realize the safety control mode based on the high-priority safety event.

[0299] In the implementation of the present application, the safety monitoring layer determines that the vehicle driving control is failed when any of the following conditions occurs.

[0300] Failure determination one: temporal and communication failure, that is, abnormal running of the real-time control layer.

[0301] The temporal and communication failure determination can determine unresolvable failure, for example, the real-time control layer control thread is deadlocked / crashed, the real-time controller is starved by the scheduling system (RT failure), the communication link between the task strategy layer and the real-time control layer is interrupted (that is, it is determined that there is a communication fault between the task strategy layer and the real-time control layer of the vehicle), and the instruction flow from the task strategy layer to the real-time control layer is abnormal, causing the real-time control layer to run empty. Among them, the real-time controller is starved by the scheduling system, that is, the scheduling system does not allocate sufficient CPU / GPU computing power, scheduling time slice, to the L1 layer according to the real-time requirement, causing the L1 layer control instruction generation delay, execution timeout or even process blocking, ultimately causing vehicle control misalignment and response lag.

[0302] Further, it can also be determined according to the heartbeat mechanism whether the real-time controller is abnormal. For example, if it is determined that the heartbeat monitoring for the real-time control layer is timed out, it is determined that the real-time controller is abnormal.

[0303] Specifically, the real-time control layer must send a heartbeat to the safety monitoring layer at a fixed period. The heartbeat does not carry a control quantity, but only carries {timestamp, real-time control layer state (L1_status), running state hash value (exec_state_hash)}, and the real-time control layer only trusts a monotonically increasing timestamp.

[0304] That is, if (t_now - t_L1_heartbeat) > T_timeout => Takeover.

[0305] Wherein, t_now is the current timestamp, t_L1_heartbeat is the last heartbeat timestamp reported by the real-time control layer, T_timeout is the L1 layer heartbeat timeout threshold, T_timeout is not a constant, but a hierarchical threshold, and T_timeout is optimized for different driving scenarios, Takeover is the takeover action to be triggered.

[0306] The above inequality means that if the difference between the current time and the last heartbeat time of the L1 layer exceeds the preset timeout threshold, the system takeover action is triggered.

[0307] Failure determination two: control infeasibility (ControlInfeasibility), that is, the real-time control layer is running normally, but the vehicle control instruction is abnormal, and the L1 layer is already untrusted.

[0308] In any of the following cases, it is considered that the control is infeasible: the target controller outputs illegal action (that is, it is determined that the real-time control layer controls the vehicle beyond the safety constraint indication information), for example, the RL outputs illegal action, the target controller fails to return the old solution (that is, it is determined that the real-time control layer fails to control the vehicle according to the execution feedback information), the control target conflicts with the physical constraint (for example, it is determined that the vehicle is at risk according to the first driving state information and the regulation constraint information of the vehicle, the sensor of the vehicle is determined to be invalid according to the first driving state information of the vehicle, and the actuator of the vehicle is determined to be invalid according to the first driving state information of the vehicle), the real-time control layer is dragged to death by the intention information output by the task strategy layer, and the real-time control layer enters a loop.

[0309] When it is determined that failure determination one or failure determination two is triggered, the safety monitoring layer triggers takeover control to perform emergency braking or minimum risk condition control (also known as minimum risk maneuver).

[0310] Wherein, the control strategy of the minimum risk maneuver is that for longitudinal control, braking is preferred, the minimum acceleration a_min is the lower limit of the regulation, and the emergency braking deceleration a_emergency is the maximum controllable deceleration of ABS, and for lateral control, stability is preferred, the vehicle is controlled to the side, and no new lateral excitation information is introduced.

[0311] In the implementation of the application, the safety monitoring layer not only serves as a real-time safety constraint provider of the real-time control layer to limit the search space of the real-time control layer, but also has the ability to take over forcibly to perform a minimum risk maneuver (MRM) when the system is abnormal, the control fails or the communication is interrupted. The safety monitoring layer ensures that the system meets the functional safety and operational safety requirements in any running state through the double mechanism of "feedforward safety constraint + after-the-fact forced bottom-up".

[0312] Further, in the implementation of the application, after the safety monitoring layer triggers the takeover of the driving control of the vehicle, the safety monitoring layer generates target events and new safety constraint indication information, sends the target events to the task strategy layer, and sends the new safety constraint indication information to the real-time control layer.

[0313] The target events include rollback events or degradation events. The rollback events are used to make the task strategy layer regenerate the meta-instruction package, and the degradation events are used to make the task strategy layer regenerate the meta-instruction package and make the processing priority of the task strategy layer lower than that of the safety monitoring layer.

[0314] The task strategy layer generates the meta-instruction package according to the task strategy decision information, including that the task strategy layer generates the meta-instruction package according to the task strategy decision information and the target events.

[0315] For example, the safety monitoring layer sends the rollback events generated by the current takeover event to the task strategy layer and adds them to the safety digest, so that the orchestration kernel of the master intelligent agent generates a new meta-instruction package according to the event information of the rollback events and the new task strategy decision information generated according to the new safety digest.

[0316] Or the safety monitoring layer sends the degradation events generated by the current takeover event to the task strategy layer and triggers the task strategy layer to add them to the safety digest, so that the orchestration kernel of the master intelligent agent generates a new meta-instruction package according to the event information of the degradation events and the new task strategy decision information generated according to the new safety digest, and performs degradation processing to reduce the processing priority of the task strategy layer, so that the processing priority of the task strategy layer is lower than that of the safety monitoring layer.

[0317] Further, in the implementation of the application, the safety monitoring layer updates the safety constraint indication information according to the takeover event to obtain new safety constraint indication information, and the real-time control layer generates vehicle driving control instructions according to the safety constraint indication information, the meta-instruction package and the control instructions, including that the real-time control layer generates vehicle driving control instructions according to the new safety constraint indication information, the meta-instruction package and the control instructions.

[0318] In the implementation of the application, the processing result of the safety monitoring layer can affect the processing result of the task strategy layer and the real-time control layer, so that the meta-instruction package generated by the task strategy layer meets the safety requirement, the vehicle control instruction generated by the real-time control layer also meets the safety requirement, and the execution feedback information of the real-time control layer can trigger the takeover control of the safety monitoring layer and the update of the meta-instruction package of the task strategy layer, so as to form a closed-loop vehicle driving control and ensure the accuracy and real-time performance of the vehicle driving control.

[0319] The vehicle driving control system provided by the implementation of the application has the following advantages: the core cooperative logic of the three-layer link is that L0 outputs safety constraint indication information, L2 outputs structured meta-instruction and constraint, L1 converts the meta-instruction into a real-time control signal within the safety envelope of L0, and L0 performs full-dimensional safety verification and preemptive bottom-up on the control instruction generated by L1, and there are bidirectional feedback channels (execution feedback / constraint feedback / exception feedback) between the three layers to support dynamic adjustment of the link; meanwhile, each layer follows a verifiable and degradable design, and when a single layer fails, it can trigger in-layer and cross-layer degradation to ensure continuous and safe operation of the system.

[0320] The L2 layer is the "decision brain" of the automatic driving, and is composed of a Master Agent (LLM Planning+Orchestrator) and a standardized sub-Agent warehouse. It is the core of the strategy decision in the three-layer link and does not undertake the strong real-time control responsibility, but focuses on task understanding, sub-task decomposition, multi-Agent cooperation, and explainable strategy generation. It is used to understand the semantic task issued by the user / system, decompose it into an executable sub-task process, call the adaptive sub-Agent through the Orchestrator to generate a "strategy fragment", fuse the structured meta-instruction / meta-action sequence, and provide clear control constraints and targets for the L1 layer, while supporting strategy interruption, rollback, and explanation to adapt to the decision requirements of complex scenarios. The L1 layer is the "execution hub" of the three-layer link, which is the core bridge between the L2 strategy and the vehicle executor, and is used to convert the high-level intention into a real-time control signal. It is the core carrier of strong real-time execution, and has multiple control algorithm modules that can be dynamically switched according to the L2 mode label and the scene. It is used to accurately receive the meta-instruction / meta-action and control constraints issued by the L2 layer, and convert the high-level intention into continuous control signals (steering wheel / throttle / brake / gear) that can be directly executed by the vehicle executor within the strong safety constraint envelope provided by the L0 safety bottom-up layer, while feeding back the execution feasibility to L2 / L0 to ensure the real-time performance, accuracy, and feasibility of the control.

[0321] The L0 layer is the "security bottom line" of the three-layer link, as the highest priority module of the entire autonomous driving system, does not participate in policy decision and real-time control, and is only focused on full-dimensional safety monitoring, hard constraint generation, preemptive safety bottom, ensures that at any time, when L2 / L1 fails, the decision is aggressive or detects a safety risk, can override the upper layer output with the highest priority, and forcibly places the vehicle in a safe state, which is the last barrier of system safety. It is used to realize global, full-time and deterministic safety monitoring and bottom, based on the most original sensor data and vehicle state, to generate unbreakable safety constraints, to perform final safety check on L1 control signal, and to preemptively execute minimum risk maneuver (MRM) when detecting risk transition / system failure, to ensure that the vehicle can meet the functional safety requirements in any scenario and any system state, without safety runaway risk.

[0322] The vehicle driving control method provided by the implementation manner of the application adopts a hierarchical architecture of L2-L1-L0 for collaborative design, introduces a main intelligent agent in the task strategy layer, and mounts an extensible sub-intelligent agent warehouse in the main intelligent agent. The sub-intelligent agent warehouse is similar to an (intelligent factory), each sub-intelligent agent corresponds to a driving function or a policy tool with clear capability boundary, the main intelligent agent dynamically selects, combines and schedules appropriate sub-intelligent agents from the "intelligent factory" based on the current task target, environment summary and system state, and calls the selected sub-intelligent agent to generate a structured meta-instruction package. The real-time control layer converts the meta-instruction package from the task strategy layer into executable continuous control instructions, which are completed by a reinforcement learning controller, a model predictive controller or a hybrid controller under the condition of vehicle dynamics and safety constraint indication information. The safety monitoring layer applies a deterministic safety constraint and failure monitoring mechanism to the control output of the real-time control layer, and can directly take over the execution in abnormal conditions, to ensure that the vehicle driving control system always meets the functional safety and operational safety requirements.

[0323] The vehicle driving control method provided in the application is an automatic driving decision control system based on an A2A-Drive intelligent agent collaborative architecture. The system is a hierarchical automatic driving decision control system based on a large language model (LLM), reinforcement learning (RL) and a multi-agent collaborative communication mechanism (Agent-to-Agent, A2A-Drive). In the real vehicle operation scenario, the high-level task understanding and strategy decision (L2) are clearly separated from the real-time control execution (L1) and the safety bottom line (L0), forming a clear hierarchical closed loop. Different driving ability modules can be independently developed and trained at the L2 layer, and can be combined for use as needed through the A2A-Drive protocol without interfering with the L1 / L0 control link. New driving functions or vehicle interaction capabilities can be accessed to the system as new sub-agent modules without the need to reconstruct the existing control and safety architecture. Under the premise of meeting strict real-time and safety constraints, the multi-agent can stably and efficiently operate in the L2-L1-L0 full link.

[0324] As Figure 7As shown, in the implementation of the present application, the task strategy layer includes a master agent that obtains task / instructions: navigation / parking / style (eco, comfort, sport), obtains system state information (including computing power / delay / health / positioning quality), and obtains environment summary (WorldSummary) based on perception / positioning / map information, etc. The environment summary includes boundary geometry / free space Ray / Tok-K dynamic body / static summary, generates a planning snapshot (PlanningSnapshot) including goal specification information (GoalSpec), environment summary information (WorldSummary), system state information (SystemState), safety summary information (SafetySummary), and execution feedback information (ExecFeedback) of the last vehicle travel control. The LLM planning reasoning kernel of the master agent first performs intent solidification (S1) and then generates a strategy skeleton (S2). The orchestration kernel of the master agent performs sub-agent scheduling / fusion / constraint management / rollback. The orchestration kernel calls the target sub-agent corresponding to the sub-travel control strategy (PolicyFragment) in the sub-agent warehouse based on the A2A sub-agent to obtain the target sub-agent. The sub-agent warehouse includes a capability registry of each sub-agent to define the resource computing power (I / O) of each sub-agent / delay profile / safety level. Each sub-agent includes at least a scene recognition and mode management agent A, a semantic understanding and task decomposition agent B, a behavior decision and interactive game agent C, a motion planning and trajectory generation agent D, an explanation and human-computer interaction agent E, and a model supervision and verification agent F. The orchestration kernel processes multiple sub-travel control strategies according to the planning snapshot (scheduling / fusion / constraint management / rollback) to generate a meta-instruction package. The meta-instruction package (MetaCommandBundle) includes a driving mode tag (mode_tag), a quantitative target (objective (non-control quantity)), a second safety constraint (constraints_hint, i.e., a soft constraint for L1), a phased action intent (meta_action_seq), and an instruction validity period (valid_for_ms). The meta-instruction package is issued to the real-time control layer.The safety bottom layer performs safety monitoring according to driving safety decision information such as time-to-collision (TTC) / distance / health, generates a safety envelope (safety constraint indication information) including state safety constraints, space safety constraints and action safety constraints, and sends the safety envelope to the real-time control layer. If the safety bottom layer determines that the vehicle control is abnormal through monitoring, the vehicle takeover is triggered with the highest priority to perform emergency braking or minimum control mechanism (MRM) to control the actuator and trigger rollback events / degradation events to the orchestration kernel of the task strategy layer to make the orchestration kernel regenerate the meta-instruction package or perform degradation operation. The real-time control layer includes a machine learning controller (RLControl), a model predictive modeler (MPC Control) and a hybrid controller (Hybrid Control). The safety envelope, observation feature information (obs_vec), local target driving information generated by the meta-instruction package and vehicle dynamics model are used for control arbitration and mode scheduling, and the target controller is determined from the machine learning controller (RLControl), the model predictive modeler (MPC Control) and the hybrid controller (Hybrid Control) according to the driving mode label (mode_tag) included in the meta-instruction package. The vehicle driving control instructions are generated based on the target controller, such as sending steering instructions (steer) / throttle opening instructions (throttle) / brake instructions (brake) / gear instructions (gear) to the actuator, and the vehicle / environment evolution is performed based on the execution result of the actuator. The perception / positioning / map generation is performed again to generate a new environment summary to participate in the next vehicle driving control.

[0325] The embodiments of the present application also provide a vehicle including a vehicle driving control system to perform the vehicle driving control method.

[0326] The embodiments of the present application also provide a chip for executing the vehicle driving control method in the above embodiments.

[0327] The embodiments of the present application also provide a computer readable storage medium having computer instructions stored therein, when the computer instructions are executed on the processor of the computer device, the processor of the computer device executes the technical solutions of the vehicle driving control method in the above embodiments.

[0328] It is to be understood that the above description is intended to be illustrative and not restrictive. Many other implementations will be apparent to those of skill in the art upon reading and understanding the above description. Although the application has been described with reference to certain implementations, it is to be understood that these are intended in an illustrative sense and not a restrictive sense. The scope of the application is not intended to be limited to the described implementations but is instead intended to encompass any and all implementations consistent with the language of the following claims. Therefore, many modifications and variations of the implementations described and illustrated herein are possible and can be made to suit particular circumstances or requirements without departing from the spirit and scope of the application which is defined by the appended claims. Changes can be made to the methods described and illustrated herein without departing from the spirit and scope of the application. For example, the steps can be performed in a different order, or additional steps can be added, or some of the steps can be eliminated, without departing from the scope of the application. Similarly, the methods described and illustrated herein can be performed by different parties, or in different locations, without departing from the scope of the application. Furthermore, the methods described and illustrated herein can be implemented by a computer program, or other computer-implemented means, without departing from the scope of the application. Although the application has been described and illustrated with reference to particular implementations, the principles of the application are not limited to these implementations. The application can be implemented in other ways, and the scope of the application is not limited to the specific implementations described and illustrated herein. It is to be understood that the features implied by the following claims, including any accompanying dependence claims, are to be understood as being incorporated in one or more aspects of the application as appropriate and that various modifications or changes in form and detail can be made by those skilled in the art without departing from the spirit and scope of the application as expressed in the following claims.

[0329] It should be noted that in this specification, similar reference numbers and letters in the drawings represent similar items, and thus once an item is defined in one drawing, it need not be further defined and explained in subsequent drawings.

[0330] It should be noted that the terms "first", "second", and so on are used only for distinguishing between similar items, and cannot be understood as indicating or implying relative importance.

[0331] It should be noted that in the drawings, some structural or methodological features can be shown in a particular arrangement and / or order. However, it should be understood that such a particular arrangement and / or order can not be required. Rather, in some implementations, these features can be arranged in a manner different from that shown in the illustrative drawings. Additionally, the inclusion of structural or methodological features in a particular figure does not imply that such features are required in all implementations, and in some implementations, these features can not be included or can be combined with other features.

[0332] While the application has been illustrated and described in detail in the drawings and foregoing description, the same is to be considered as illustrative and not restrictive in character, it being understood that only the preferred implementations have been shown and described and that all changes and modifications that come within the spirit of the application are desired to be protected.

Claims

1. A vehicle driving control method, characterized in that, A vehicle driving control system for implementing vehicle driving control is provided, the vehicle driving control system comprising a safety monitoring layer, a task strategy layer, and a real-time control layer, the task strategy layer comprising a main intelligent agent and multiple sub-intelligent agents, different sub-intelligent agents corresponding to different driving functions of the vehicle, the real-time control layer comprising multiple controllers, different controllers comprising different control algorithms, the method comprising: The safety monitoring layer determines the driving safety decision information corresponding to the vehicle, generates safety constraint indication information based on the driving safety decision information, and sends the safety constraint indication information to the real-time control layer. The driving safety decision information includes the vehicle's first driving state information, road boundary constraint information, and regulatory constraint information. Generating the safety constraint indication information based on the driving safety decision information includes: generating spatial safety constraints based on the road boundary constraint information; generating state safety constraints based on the first driving state information and the regulatory constraint information; generating action safety constraints based on the first driving state information and the state safety constraints; and encapsulating the spatial constraint information, state constraint information, and action constraint information to generate the safety constraint indication information. The task strategy layer determines the task strategy decision information corresponding to the vehicle, generates a meta-instruction package based on the task strategy decision information, and sends the meta-instruction package to the real-time control layer. Determining the task strategy decision information corresponding to the vehicle and generating the meta-instruction package based on the task strategy decision information includes: the main agent determining the task strategy decision information corresponding to the vehicle; based on an inference planning kernel, determining the vehicle's driving intention and driving constraint information based on the task strategy decision information; determining a sub-task graph and a sub-agent invocation plan based on the driving intention and driving constraint information; based on an orchestration kernel, invoking at least one target sub-agent among the multiple sub-agents according to the sub-agent invocation plan and the registration information and capability index information corresponding to each sub-agent, so that each target sub-agent generates corresponding sub-driving control strategy indication information according to each sub-task corresponding to each target sub-agent in the sub-task graph, thereby obtaining multiple sub-driving control strategy indication information; and processing the multiple sub-driving control strategy indication information according to the task strategy decision information to generate the meta-instruction package, which includes driving control strategy indication information and a driving mode label. The real-time control layer determines the control command generation decision information corresponding to the vehicle, generates vehicle driving control commands based on the safety constraint indication information, the meta-instruction package, and the control command generation decision information, and controls vehicle driving according to the vehicle driving control commands. The generation of vehicle driving control commands based on the safety constraint indication information, the meta-instruction package, and the control command generation decision information includes: determining a target controller based on the driving mode label, so that the target controller generates the vehicle driving control commands based on the corresponding control algorithm, according to the safety constraint indication information, the driving control strategy indication information, and the control command generation decision information.

2. The vehicle driving control method according to claim 1, characterized in that, The task strategy decision information includes safety summary information and execution feedback information related to the previous vehicle driving control. The safety summary information is generated by the safety monitoring layer based on the driving safety decision information and sent to the task strategy layer. The execution feedback information is generated by the real-time control layer and sent to the task strategy layer. The main intelligent agent, based on the orchestration kernel, processes the multiple sub-driving control strategy indication information according to the task strategy decision information to generate the meta-instruction package, including: Based on the safety summary information, determine the sub-driving control strategy indication information that conforms to the safety summary among the plurality of sub-driving control strategy indication information to obtain a plurality of first sub-driving control strategy indication information; or based on a preset vehicle physical boundary, determine the sub-driving control strategy indication information that conforms to the preset vehicle physical boundary among the plurality of sub-driving control strategy indication information to obtain a plurality of first sub-driving control strategy indication information. Based on the risk level of each first sub-driving control strategy indication information, determine the first sub-driving control strategy indication information whose risk level is lower than a preset risk level threshold among the plurality of first sub-driving control strategies, so as to obtain a plurality of second sub-driving control strategy indication information, or perform downweighting on the first sub-driving control strategy indication information whose risk level is higher than or equal to the preset risk level threshold, so as to obtain a plurality of second sub-driving control strategy indication information. Based on the execution feedback information, determine the executable second sub-driving control strategy indication information from the plurality of second sub-driving control strategy indication information, and obtain a plurality of third sub-driving control strategy indication information; The priority of each of the third sub-driving control strategy indication information is determined, and the multiple third sub-driving control strategy indication information is sorted in descending order of priority to obtain the sorted multiple third sub-driving control strategy indication information. Based on the sorted third sub-driving control strategy indication information, a driving control strategy indication information set is generated; The meta-instruction package is generated based on the driving control strategy instruction information set.

3. The vehicle driving control method according to claim 2, characterized in that, The method further includes: The real-time control layer sends execution feedback information to the task strategy layer and the safety monitoring layer to execute the vehicle control command, so that the safety monitoring layer can trigger takeover of the vehicle's driving control or update the safety constraint indication information based on the execution feedback information, and the task strategy layer can update the meta-instruction package based on the execution feedback information.

4. The vehicle driving control method according to claim 3, characterized in that, The method further includes: When the safety monitoring layer determines that the real-time control layer has failed in its control over the vehicle's driving, it triggers a takeover of the vehicle's driving control. The safety monitoring layer determines that the real-time control layer has failed in its control over the vehicle's driving when any of the following conditions occur: The real-time control layer is malfunctioning. The real-time control layer is operating normally, but the vehicle control commands are abnormal.

5. The vehicle driving control method according to claim 4, characterized in that, After the safety monitoring layer triggers takeover of the vehicle's driving control, the method further includes: The security monitoring layer generates a target event and new security constraint indication information, sends the target event to the task strategy layer, and sends the new security constraint indication information to the real-time control layer. The target event includes a rollback event or a degradation event. The rollback event is used to cause the task strategy layer to regenerate the meta-instruction package, and the degradation event is used to cause the task strategy layer to regenerate the meta-instruction package and make the processing priority of the task strategy layer lower than the processing priority of the security monitoring layer. The task strategy layer generates a meta-instruction package based on the task strategy decision information, including: The task strategy layer generates the meta-instruction package based on the task strategy decision information and the target event; The real-time control layer generates vehicle driving control commands based on the safety constraint indication information, the meta-instruction packet, and the control command generation decision information, including: The real-time control layer generates vehicle driving control commands based on the new safety constraint indication information, the meta-instruction package, and the control commands.

6. The vehicle driving control method according to claim 5, characterized in that, The security monitoring layer, the task strategy layer (including the main intelligent agent and each of the sub-intelligent agents), and the real-time control layer communicate with each other based on the A2A-Drive communication protocol.

7. A vehicle driving control system, characterized in that, The vehicle driving control system includes a safety monitoring layer, a task strategy layer, and a real-time control layer. The task strategy layer includes a main intelligent agent and multiple sub-intelligent agents, each corresponding to a different driving function of the vehicle. The real-time control layer includes multiple controllers, each employing a different control algorithm. The safety monitoring layer is used to determine the driving safety decision information corresponding to the vehicle, generate safety constraint indication information based on the driving safety decision information, and send the safety constraint indication information to the real-time control layer. The driving safety decision information includes the vehicle's first driving state information, road boundary constraint information, and regulatory constraint information. Generating the safety constraint indication information based on the driving safety decision information includes: generating spatial safety constraints based on the road boundary constraint information; generating state safety constraints based on the first driving state information and the regulatory constraint information; generating action safety constraints based on the first driving state information and the state safety constraints; and encapsulating the spatial constraint information, state constraint information, and action constraint information to generate the safety constraint indication information. The task strategy layer is used to determine the task strategy decision information corresponding to the vehicle, generate a meta-instruction package based on the task strategy decision information, and send the meta-instruction package to the real-time control layer. Determining the task strategy decision information corresponding to the vehicle and generating the meta-instruction package based on the task strategy decision information includes: the main agent determining the task strategy decision information corresponding to the vehicle; based on an inference planning kernel, determining the vehicle's driving intention and driving constraint information based on the task strategy decision information; determining a sub-task graph and a sub-agent invocation plan based on the driving intention and driving constraint information; based on an orchestration kernel, invoking at least one target sub-agent among the multiple sub-agents according to the sub-agent invocation plan and the registration information and capability index information corresponding to each sub-agent, so that each target sub-agent generates corresponding sub-driving control strategy indication information according to each sub-task corresponding to each target sub-agent in the sub-task graph, thereby obtaining multiple sub-driving control strategy indication information; and processing the multiple sub-driving control strategy indication information according to the task strategy decision information to generate the meta-instruction package, which includes driving control strategy indication information and a driving mode label. The real-time control layer is used to determine the control command generation decision information corresponding to the vehicle, generate vehicle driving control commands based on the safety constraint indication information, the meta-instruction package, and the control command generation decision information, and control vehicle driving according to the vehicle driving control commands. The generation of vehicle driving control commands based on the safety constraint indication information, the meta-instruction package, and the control command generation decision information includes: determining a target controller based on the driving mode label, so that the target controller generates the vehicle driving control commands based on the corresponding control algorithm according to the safety constraint indication information, the driving control strategy indication information, and the control command generation decision information.

Images