Redundant system, device, storage medium, and program product for autonomous vehicle

Abstract

According to embodiments of this disclosure, a redundancy system, device, storage medium, and program product for autonomous vehicles are provided. The method includes: a first computing unit and a corresponding first bus communication unit; and a second computing unit and a corresponding second bus communication unit; wherein the first computing unit is connected via the first bus communication unit to a set of sensors specific to the redundancy system, and the second computing unit is connected via the second bus communication unit to the set of sensors; wherein, in response to the redundancy system taking over the autonomous vehicle, a target computing unit in the first and second computing units is configured to generate control signals for the autonomous vehicle based on perception data from the set of sensors. Based on this approach, embodiments of this disclosure can improve the reliability of autonomous driving systems.

Description

Technical Field

[0001] The exemplary embodiments disclosed herein generally relate to the field of computers, and particularly to a redundant system, device, computer-readable storage medium, and computer program product for autonomous vehicles. Background Technology

[0002] With the rapid development of autonomous driving technology, autonomous vehicles are able to drive completely autonomously without human intervention. In this technology, the reliability indicators of autonomous driving systems are particularly important.

[0003] However, the reliability of current autonomous driving systems still needs to be improved. Summary of the Invention

[0004] In a first aspect of this disclosure, a redundancy system for an autonomous vehicle is provided. The system includes: a first computing unit and a corresponding first bus communication unit; and a second computing unit and a corresponding second bus communication unit; wherein the first computing unit is connected via the first bus communication unit to a set of sensors specific to the redundancy system, and the second computing unit is connected via the second bus communication unit to the set of sensors; wherein, in response to the redundancy system taking over the autonomous vehicle, a target computing unit in the first and second computing units is configured to generate control signals for the autonomous vehicle based on perception data from the set of sensors.

[0005] In a second aspect of this disclosure, an electronic device is provided. The device includes a memory and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement a redundant system according to a first aspect of this disclosure.

[0006] In a third aspect of this disclosure, a computer-readable storage medium is provided. This computer-readable storage medium stores a computer program that can be executed by a processor to implement the redundant system of the first aspect.

[0007] In a fourth aspect of this disclosure, a computer program product is provided. The computer program product includes computer-executable instructions that, when executed by a processor, implement the redundant system of the first aspect.

[0008] It should be understood that the content described in this summary section is not intended to limit the key or essential features of the embodiments of this disclosure, nor is it intended to restrict the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0009] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. In the drawings, the same or similar reference numerals denote the same or similar elements, wherein:

[0010] Figure 1 A schematic diagram of an example environment in which embodiments of the present disclosure can be implemented is shown;

[0011] Figure 2 A system block diagram of a redundancy system for an example vehicle according to some embodiments of the present disclosure is shown; and

[0012] Figure 3 A block diagram of an apparatus capable of implementing several embodiments of the present disclosure is shown. Detailed Implementation

[0013] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0014] It should be noted that the headings of any section / subsection provided herein are not limiting. Various embodiments are described throughout this document, and embodiments of any type may be included under any section / subsection. Furthermore, embodiments described in any section / subsection may be combined in any way with any other embodiments described in the same section / subsection and / or different sections / subsections.

[0015] In the description of embodiments of this disclosure, the term "comprising" and similar terms should be understood as open-ended inclusion, i.e., "including but not limited to". The term "based on" should be understood as "at least partially based on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The term "some embodiments" should be understood as "at least some embodiments". Other explicit and implicit definitions may also be included below. The terms "first", "second", etc., may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0016] The embodiments of this disclosure may involve user data, data acquisition, and / or use. All of these aspects comply with applicable laws, regulations, and relevant provisions. In the embodiments of this disclosure, all data collection, acquisition, processing, manipulation, forwarding, and use are conducted with the user's knowledge and confirmation. Accordingly, in implementing the embodiments of this disclosure, the type, scope of use, and usage scenarios of any data or information that may be involved should be communicated to the user and their authorization obtained in accordance with relevant laws and regulations through appropriate means. The specific methods of notification and / or authorization may vary depending on the actual situation and application scenario, and the scope of this disclosure is not limited in this respect.

[0017] In this specification and the embodiments, any processing of personal information will be carried out only under the premise of legality (such as obtaining the consent of the personal information subject, or being necessary for the performance of a contract), and will only be carried out within the scope stipulated or agreed upon. A user's refusal to process personal information other than that necessary for basic functions will not affect the user's use of basic functions.

[0018] As briefly mentioned earlier, autonomous vehicles can drive completely autonomously without human intervention. During autonomous driving, the safety of the vehicle depends on the reliability of the autonomous driving system. That is, the higher the reliability of the autonomous driving system, the safer the autonomous vehicle. However, the reliability of current autonomous driving systems needs improvement.

[0019] Embodiments of this disclosure propose a redundancy system for an autonomous vehicle. The system includes: a first computing unit and a corresponding first bus communication unit; and a second computing unit and a corresponding second bus communication unit; wherein the first computing unit is connected via the first bus communication unit to a set of sensors specific to the redundancy system, and the second computing unit is connected via the second bus communication unit to the set of sensors; wherein, in response to the redundancy system taking over the autonomous vehicle, a target computing unit in the first and second computing units is configured to generate control signals for the autonomous vehicle based on perception data from the set of sensors.

[0020] In this manner, embodiments of the present disclosure can generate control signals for the autonomous vehicle based on perception data collected by an independent set of sensors when a redundant system takes over the autonomous vehicle. The use of both the first and second computing units ensures control of the autonomous vehicle, thereby improving the reliability of the autonomous driving system.

[0021] The following section, in conjunction with the accompanying drawings, details various example implementations of this scheme.

[0022] Example Environment

[0023] Figure 1 A schematic diagram of an example environment 100 in which embodiments of the present disclosure can be implemented is shown. For example... Figure 1 As shown, the example environment 100 may include an autonomous vehicle 110 and a main control system 120 for controlling the autonomous vehicle 110.

[0024] In some embodiments, the autonomous vehicle 110 may provide a main control system 120 based on a device such as a local vehicle infotainment system. The autonomous vehicle 110 may use a set of sensors 130-1 configured thereon to acquire perception data of the physical environment in which the autonomous vehicle 110 is located. As an example, the set of sensors 130-1 may include, for example, cameras and radar. Further, the autonomous vehicle 110 may send the perception data to the main control system 120 to control the autonomous vehicle 110. For example, the main control system 120 may make decisions based on the perception data sent by the autonomous vehicle 110 to output control signals, and use control information such as control commands to control the movement of the autonomous vehicle 110. For example, the main control system 120 may generate a trajectory of the autonomous vehicle 110 based on the positions of obstacles in the physical environment captured by the camera, and control the autonomous vehicle 110 to drive according to the trajectory to achieve the autonomous driving function of the autonomous vehicle 110.

[0025] like Figure 1 As shown, in some embodiments, the main control system 120 may include a main system 122, an MRC risk minimization system, a software redundancy system, and a hardware redundancy system 124. The main system 122 can be used to implement the aforementioned functions. When the detection system 140 of the autonomous vehicle 110 detects a fault in the autonomous vehicle 110, it can determine from the main control system 120 which systems can take over the autonomous vehicle 110 based on the fault type and its impact. As an example, the systems taking over the autonomous vehicle 110, in descending order of priority, are: the MRC risk minimization system, the software redundancy system, and the hardware redundancy system 124.

[0026] For example, when the detection system 140 detects a fault in the main system 122, affecting both the MRC risk minimization system and the software redundancy system, the hardware redundancy system 124 takes over the autonomous vehicle 110. In one specific example, when the main system 122 is normally controlling the autonomous vehicle 110, a loose chassis-related wiring harness occurs, preventing the nodes communicating with the autonomous vehicle 110's chassis from sending control signals from the main system 122 to the autonomous vehicle 110. The detection system 140 detects this fault and, based on the fault classification, determines that neither the MRC risk minimization system nor the software redundancy system can take over the autonomous vehicle 110. Therefore, the hardware redundancy system 124 takes over the autonomous vehicle 110. In another specific example, when the main system 122 is normally controlling the autonomous vehicle 110, a positioning offset problem occurs. The detection system 140 detects this fault and, based on the fault classification, determines that both the MRC risk minimization system and the software redundancy system need to utilize the attitude information output by the positioning system for planning and control. Therefore, only the hardware redundancy system 124 can take over the autonomous vehicle 110.

[0027] For example, if the detection system 140 detects a specific fault after the autonomous vehicle 110 is involved in a collision, the fault will prevent the main system 122, the MRC risk minimization system, and the software redundancy system from controlling the autonomous vehicle 110. In this case, the hardware redundancy system 124 will take over the autonomous vehicle 110.

[0028] In some scenarios, depending on the specific implementation of the autonomous driving system, the hardware redundancy system 125 can also be triggered to take over the autonomous vehicle under other appropriate conditions.

[0029] In some embodiments, the autonomous vehicle 110 may include a control unit 115. When the main control system 120 sends a control signal, the control unit 115 may receive the control signal. In response to receiving the control signal, the control unit 115 may control the autonomous vehicle 110 to perform actions related to the control signal.

[0030] It should be understood that the structure and function of the various elements in environment 100 are described for illustrative purposes only and do not imply any limitation on the scope of this disclosure.

[0031] The following description will continue with reference to the accompanying drawings, which will provide some exemplary embodiments of this disclosure.

[0032] Example Redundant System

[0033] Figure 2 A system block diagram of the architecture 200 of a redundancy system for an example vehicle according to some embodiments of the present disclosure is shown. It should be understood that the redundancy system here refers to the aforementioned hardware redundancy system 124. Figure 2As shown, the hardware redundancy system 124 may include a first computing unit 210, a second computing unit 220, a first bus communication unit 230, and a second bus communication unit 240.

[0034] In some embodiments, the first computing unit 210 is connected via a first bus communication unit 230 to a set of sensors 130-2 specific to the redundant system, a third computing unit of the autonomous vehicle 110, and a control unit 115. The second computing unit 220 is connected via a second bus communication unit 240 to the set of sensors 130-2, the third computing unit, and the control unit 115.

[0035] In some embodiments, a set of sensors 130-2, distinct from a set of sensors 130-1, is a separate set of sensors independent of the main system 122. These sensors can be used to collect perception data from the driving environment of the autonomous vehicle 110. The set of sensors 130-2 can be installed on the autonomous vehicle 110. The set of sensors 130-2 can serve as a redundant set of sensors. When a set of sensors 130-1 fails, the set of sensors 130-2 collects perception data, thereby enabling the hardware redundancy system 124 to control the normal operation of the autonomous vehicle 110.

[0036] In some embodiments, a group of sensors 130-2 may include, but is not limited to, a camera, a millimeter-wave radar, and an angle radar. Multiple cameras, millimeter-wave radars, and angle radars may be configured as needed. Multiple cameras, multiple millimeter-wave radars, and multiple angle radars can, for example, be used to collect sensing data from different orientations. As an example, one camera, one millimeter-wave radar, and two angle radars may be configured. Correspondingly, the camera may be a forward-looking camera; the millimeter-wave radar may be a forward-looking millimeter-wave radar; and the angle radars may be a left rear-facing angle radar and a right rear-facing angle radar.

[0037] Specifically, the perception data collected by the forward-looking camera may include, but is not limited to, lane line information, curb information, traffic light information, stop line information, speed limit sign information, and target information related to traffic participants. As an example, traffic participants may include targets of appropriate types in the traffic environment, such as different types of vehicles, pedestrians, animals, etc.

[0038] By analyzing lane line information and roadside information, the system controlling the autonomous vehicle 110 can achieve lateral control of the autonomous vehicle 110, specifically enabling the autonomous vehicle 110 to travel along the center of the lane.

[0039] By analyzing target information, the system controlling the autonomous vehicle 110 can predict whether a forward collision will occur. As an example, before analyzing the target information, operations such as processing and filtering can be performed on the target information to more accurately predict forward collisions. In some embodiments, the target information can also be fused with sensing data collected by radar.

[0040] By analyzing traffic light information, stop line information, and speed limit sign information, the system controlling autonomous vehicle 110 can prevent autonomous vehicle 110 from running red lights or speeding.

[0041] By analyzing the aforementioned perception data, the drivable area of ​​the autonomous vehicle 110 can also be determined. The drivable area can assist the system controlling the autonomous vehicle 110 in performing lateral control and predicting forward collisions.

[0042] The perception data collected by the forward-looking millimeter-wave radar may include, but is not limited to, target information related to traffic participants and status information related to the automatic emergency braking system. The status information related to the automatic emergency braking system may include, for example, the trigger status of the automatic emergency braking system, the deceleration after triggering the automatic emergency braking system, and the target number of the automatic emergency braking system. By analyzing the target information, the system controlling the autonomous vehicle 110 can predict whether a forward collision will occur. As an example, before analyzing the target information, operations such as processing and filtering can be performed on the target information to more accurately predict forward collisions. In some embodiments, the target information can also be fused with the perception data collected by the forward-looking camera. As an example, the perception data collected by the forward-looking camera can be sent to the forward-looking millimeter-wave radar for fusion processing simultaneously with the data sent to the first computing unit 210 and the second computing unit 220. The forward-looking millimeter-wave radar then sends the fused target information and the status information related to the automatic emergency braking system back to the first computing unit 210 and the second computing unit 220.

[0043] The perception data collected by the left and right rear-facing radars may include, but is not limited to, target information related to traffic participants. By analyzing this target information, the autonomous control system can determine the risk of a rear-end collision.

[0044] In some embodiments, the third computing unit may be a main system 122 that is normally used to control the autonomous vehicle 110. For example, if the main system 122 consists of multiple subsystems that can be used to control the autonomous vehicle 110, and each subsystem is in a usable state (e.g., a fault-free state), the main system 122 will generate control signals for the autonomous vehicle 110 and control the autonomous vehicle 110 accordingly.

[0045] In some embodiments, the control signals generated by the main system 122 can be directly sent to the control unit 115 of the autonomous vehicle 110, or they can be sent to the control unit 115 via forwarding. For example, the main system 122 can send the control signals to the first computing unit 210 or the second computing unit 220 via the first bus communication unit 230 or the second bus communication unit 240, and then forward them to the control unit 115 of the autonomous vehicle 110 via the first computing unit 210 or the second computing unit 220, thereby enabling communication between the main system 122 and the control unit 115. Correspondingly, the status data of the autonomous vehicle 110 during driving can also be forwarded to the main system 122 via the first computing unit 210 or the second computing unit 220.

[0046] In some embodiments, the first computing unit 210 can be used to generate control signals for the autonomous vehicle 110 based on perception data from a set of sensors 130-2. As an example, the process by which the first computing unit 210 generates control signals for the autonomous vehicle 110 based on the perception data can be as follows: the first computing unit 210 first determines vehicle environmental information based on the perception data, and then generates control signals based on the vehicle environmental information. The vehicle environmental information, for example, can indicate the risk of a forward collision or a rear-end collision currently occurring for the autonomous vehicle 110.

[0047] In some embodiments, the second computing unit 220 can be used to generate control signals for the autonomous vehicle 110 based on perception data from a set of sensors 130-2. As an example, the process by which the second computing unit 220 generates control signals for the autonomous vehicle 110 based on the perception data can be as follows: the second computing unit 220 first determines vehicle environmental information based on the perception data, and then generates control signals based on the vehicle environmental information.

[0048] In some embodiments, both the first computing unit 210 and the second computing unit 220 may include a plurality of first processing cores and a plurality of second processing cores. The performance of the first processing cores differs from that of the second processing cores. For example, the computing power of the first processing core may be higher than that of the second processing core, but the security of the first processing core is lower than that of the second processing core.

[0049] As an example, multiple primary processing cores with high computing power can be used to determine vehicle environmental information based on perception data, or to handle tasks with lower reliability requirements, such as data acquisition. Specifically, these multiple primary processing cores can, for example, run a Linux system to improve development and iteration efficiency.

[0050] Multiple secondary processing cores with high security can be used to generate control signals based on vehicle environmental information, and can also be used to deploy algorithms related to the safety of the autonomous vehicle 110. Specifically, the multiple secondary processing cores can, for example, run the AUTSAR CP system to ensure the reliability and real-time performance of the hardware redundancy system 124.

[0051] By setting up a first computing unit 210 and a second computing unit 220, and communicating the first computing unit 210 and the second computing unit 220 with the control unit 115 of the main system 122 and the autonomous vehicle 110 respectively, the problem of the computing unit being unable to send control signals when there is only one computing unit can be avoided. This improves the reliability of the hardware redundancy system 124.

[0052] It should be understood that during the operation of the autonomous vehicle 110, although both the first computing unit 210 and the second computing unit 220 are running in real time, essentially only one of the computing units interacts with the main system 122 and the control unit 115 of the autonomous vehicle 110 in terms of data and information. This computing unit is the target computing unit.

[0053] In some embodiments, the target computing unit can be pre-specified. For example, in one example, either the first computing unit 210 or the second computing unit 220 can be designated as the target computing unit. In another example, the first computing unit 210 and the second computing unit 220 can be divided according to a master-slave working mode. In this case, the master computing unit in the first computing unit 210 and the second computing unit 220 can be designated as the target computing unit.

[0054] In some embodiments, the target computing unit can play different roles in different driving stages of the autonomous vehicle 110. The target computing unit will be further described below in conjunction with different scenarios.

[0055] In some embodiments, when the master system 122 controls the autonomous vehicle 110, the control signals of the autonomous vehicle 110 issued by the master system 122 can be sent to the target computing unit via a bus communication unit corresponding to the target computing unit. Then, the target computing unit forwards the received control signals to the control unit 115 of the autonomous vehicle 110, thereby realizing the control of the autonomous vehicle 110.

[0056] During the phase where the main system 122 controls the autonomous vehicle 110, the target computing unit can establish communication between the main system 122 and the control unit 115. This also includes forwarding status data sent by the control unit 115 to the main system 122.

[0057] In some embodiments, when the autonomous vehicle 110 malfunctions or collides, rendering the main system 122, the MRC risk minimization system, and the software redundancy system unable to take over, the hardware redundancy system 124 can take over the autonomous vehicle 110. At this time, the target computing unit can stop forwarding control signals from the main system 122 to the control unit 115. The target computing unit can further generate control signals to control the autonomous vehicle 110. As an example, the target computing unit can generate control signals for the autonomous vehicle 110 based on perception data from a set of sensors 130-2, and then send the control signals to the control unit 115. Specifically, multiple first processing cores in the target computing unit can determine vehicle environmental information based on the perception data, and then multiple second processing cores in the target computing unit can generate control signals for the autonomous vehicle 110 based on the vehicle environmental information. Additionally, the target computing unit can, for example, combine the detection results of the detection system 140 and the fault handling strategy implemented by the main system 122 to generate control signals.

[0058] For example, when the main system 122 is normally controlling the autonomous vehicle 110, a loose chassis-related wiring harness occurs, preventing the nodes communicating with the autonomous vehicle 110's chassis from sending control signals from the main system 122 to the autonomous vehicle 110. The detection system 140 detects this fault and, based on the fault classification, determines that neither the MRC risk minimization system nor the software redundancy system can take over the autonomous vehicle 110. At this point, the hardware redundancy system 124 takes over the autonomous vehicle 110. Through the perception data collected by a set of sensors 130-2, the target computing unit can determine that the current lane lines are clear and the autonomous vehicle 110's attitude is correct. Based on this, the target computing unit sends a control signal to the control unit 115 to control the autonomous vehicle 110 to stop in its lane.

[0059] For example, when the main system 122 is normally controlling the autonomous vehicle 110, a positioning deviation occurs. The detection system 140 detects this fault and, based on the fault classification, determines that both the MRC risk minimization system and the software redundancy system need to utilize the attitude information output by the positioning system for planning and control. Therefore, at this time, only the hardware redundancy system 124 can take over the autonomous vehicle 110. After the hardware redundancy system 124 takes over the autonomous vehicle 110, the target calculation unit can determine, through the perception data collected by a set of sensors 130-2, that the current lane line is clear and the autonomous vehicle 110 has deviated from the lane. Based on this, the target calculation unit sends a control signal to the control unit 115 to control the autonomous vehicle 110 to brake suddenly.

[0060] In some embodiments, while the target computing unit controls the autonomous vehicle 110, the target computing unit can still receive data and information sent by the main system 122, as well as status data sent by the control unit 115, and forward the status data of the control unit 115 to the main system 122.

[0061] In some embodiments, the control signals mentioned above can be used to control the autonomous vehicle 110 to stop.

[0062] In some embodiments, when the target computing unit takes over the autonomous vehicle 110 and enables the autonomous vehicle 110 to operate normally, for some sudden events that the target computing unit cannot respond to quickly, the target computing unit can control unit 115 to send a braking control signal. The braking control signal may be, for example, an immediate stop signal or a rapid stop signal. As an example, in response to the hardware redundancy system 124 receiving an emergency stop command, the target computing unit can generate a braking control signal for the autonomous vehicle 110.

[0063] In some embodiments, the emergency stop command can be generated by the remote system of the autonomous vehicle 110 detecting a target risk. Specifically, during the operation of the autonomous vehicle 110, if the remote system detects a target risk, the remote system can send an emergency stop command to the hardware redundancy system 124. In response to the target computing unit receiving the emergency stop command, the target computing unit can generate a braking control signal to bring the autonomous vehicle 110 to an emergency stop.

[0064] As an example, when the main system 122 is normally controlling the autonomous vehicle 110, a positioning deviation occurs. The detection system 140 detects this fault and, based on the fault classification, determines that both the MRC risk minimization system and the software redundancy system need to utilize the attitude information output by the positioning system for planning and control. Therefore, at this time, only the hardware redundancy system 124 can take over the autonomous vehicle 110. After the hardware redundancy system 124 takes over the autonomous vehicle 110, the target calculation unit can determine that the current lane line is clear and the attitude of the autonomous vehicle 110 is correct through the perception data collected by a set of sensors 130-2. Based on this, the target calculation unit sends a control signal to the control unit 115 to control the autonomous vehicle 110 to stop in its lane. During the stopping process of the autonomous vehicle 110, the remote system detects that the autonomous vehicle 110 is too close to the curb. At this time, the remote system issues an emergency stop command to the hardware redundancy system 124. After receiving the emergency stop command, the target calculation unit sends a brake control signal to the control unit 115 to control the autonomous vehicle 110 to stop urgently.

[0065] In some embodiments, the emergency stop command can also be generated by triggering the emergency stop button on the autonomous vehicle 110. Specifically, during the operation of the autonomous vehicle 110, if the tester or passenger discovers a potential risk to the autonomous vehicle 110, the tester or passenger can trigger the emergency stop button inside the autonomous vehicle 110 to bring the autonomous vehicle 110 to an emergency stop. When the emergency stop button is triggered, the target computing unit receives the emergency stop command and sends a braking control signal to the control unit 115 to control the autonomous vehicle 110 to stop urgently.

[0066] In a scenario where the main system 122 and the control unit 115 can communicate using the first computing unit 210 and the second computing unit 220, by setting the first computing unit 210 and the second computing unit 220, the failure of the main system 122 and the control unit 115 to communicate due to loose wiring harness can be avoided during the operation of the autonomous vehicle 110.

[0067] In some embodiments, when the target computing unit fails to enable communication between the main system 122 and the control unit 115, the target computing unit can be redesignated. The reasons that prevent the main system 122 and the control unit 115 from communicating may include, for example, a loose wiring harness used to connect the main system 122 and the target computing unit, or a malfunction in the target computing unit.

[0068] As an example, if the target computing unit does not receive a message from the master system 122 within a predetermined time period, a new target computing unit can be designated from the first computing unit 210 and the second computing unit 220. Specifically, the computing unit in the first computing unit 210 and the second computing unit 220 that can maintain communication with the master system 122 can be designated as the new target computing unit. The message sent by the master system 122 may be, for example, a heartbeat message.

[0069] like Figure 2 As shown, in a specific example, the process of re-determining the target computing unit can be as follows: when the target computing unit does not receive a message from the master system 122 within a predetermined time period, the target computing unit sends a takeover request to another computing unit through the bus communication unit 250, requesting that computing unit to become the target computing unit. After accepting the takeover request, the computing unit becomes the new target computing unit, enabling the master system 122 and the control unit 115 to communicate normally. For example, two bus communication units 250 can be provided, corresponding to the first computing unit 210 and the second computing unit 220 respectively.

[0070] It should be understood that although reassigning the target computing unit enables the main system 122 and the control unit 115 to communicate normally, the main control system 120 already has a fault or potential fault at this time. In order to ensure the driving safety of the autonomous vehicle 110, after the target computing unit is reassigned, the new target computing unit can generate a braking control signal and send the braking control signal to the control unit 115 to control the autonomous vehicle 110 to stop.

[0071] In some embodiments, the first bus communication unit 230 can facilitate the transmission and exchange of data and information between a group of sensors 130-2, the main system 122, the control unit 115, and the first computing unit 210. Specifically, the first bus communication unit 230 can transmit the sensing data collected by the group of sensors 130-2 to the first computing unit 210, transmit the control signals of the main system 122 to the first computing unit 210, transmit the control signals of the first computing unit 210 to the control unit 115, and transmit the status data of the control unit 115 to the first computing unit 210 and the main system 122.

[0072] In some embodiments, the second bus communication unit 240 can facilitate the transmission and exchange of data and information between a group of sensors 130-2, the main system 122, the control unit 115, and the second computing unit 220. Specifically, the second bus communication unit 240 can transmit the sensing data collected by the group of sensors 130-2 to the second computing unit 220, transmit the control signals of the main system 122 to the second computing unit 220, transmit the control signals of the second computing unit 220 to the control unit 115, and transmit the status data of the control unit 115 to the second computing unit 220 and the main system 122.

[0073] Example device

[0074] Figure 3 A block diagram of a computing device 300 in which one or more embodiments of the present disclosure may be implemented is shown. It should be understood that... Figure 3 The computing device 300 shown is merely exemplary and should not be construed as limiting the functionality and scope of the embodiments described herein. Figure 3 The computing device 300 shown can be used to implement Figure 1 Hardware redundancy system 124.

[0075] like Figure 3As shown, computing device 300 is in the form of a general-purpose computing device. Components of computing device 300 may include, but are not limited to, one or more processors or processing units 310, memory 320, storage devices 330, one or more communication units 340, one or more input devices 350, and one or more output devices 360. Processing unit 310 may be a physical or virtual processor and is capable of performing various processes according to programs stored in memory 320. In a multiprocessor system, multiple processing units execute computer-executable instructions in parallel to improve the parallel processing capability of computing device 300.

[0076] Computing device 300 typically includes multiple computer storage media. Such media can be any accessible media that is accessible to computing device 300, including but not limited to volatile and non-volatile media, removable and non-removable media. Memory 620 can be volatile memory (e.g., registers, cache, random access memory (RAM)), non-volatile memory (e.g., read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory), or some combination thereof. Storage device 330 can be removable or non-removable media and can include machine-readable media, such as flash drives, disks, or any other media that can be used to store information and / or data (e.g., training data for training) and can be accessed within computing device 300.

[0077] The computing device 300 may further include additional removable / non-removable, volatile / non-volatile storage media. Although not explicitly stated... Figure 3 As shown, disk drives for reading from or writing to removable, non-volatile disks (e.g., "floppy disks") and optical disk drives for reading from or writing to removable, non-volatile optical disks can be provided. In these cases, each drive can be connected to a bus (not shown) via one or more data media interfaces. Memory 320 may include computer program product 325 having one or more program modules configured to perform various methods or actions of various embodiments of this disclosure.

[0078] The communication unit 340 enables communication with other computing devices via a communication medium. Additionally, the components of the computing device 300 can function as a single computing cluster or multiple computing machines capable of communicating via communication connections. Therefore, the computing device 300 can operate in a networked environment using logical connections to one or more other servers, network personal computers (PCs), or another network node.

[0079] Input device 350 can be one or more input devices, such as a mouse, keyboard, trackball, etc. Output device 360 ​​can be one or more output devices, such as a monitor, speaker, printer, etc. Computing device 300 can also communicate as needed with one or more external devices (not shown) via communication unit 340. These external devices include storage devices, display devices, etc., and can communicate with one or more devices that enable user interaction with computing device 300, or with any device that enables computing device 300 to communicate with one or more other computing devices (e.g., network card, modem, etc.). Such communication can be performed via input / output (I / O) interfaces (not shown).

[0080] According to an exemplary implementation of this disclosure, a computer-readable storage medium is provided that stores computer-executable instructions thereon, wherein the computer-executable instructions are executed by a processor to implement the methods described above. According to an exemplary implementation of this disclosure, a computer program product is also provided, which is tangibly stored on a non-transitory computer-readable medium and includes computer-executable instructions, which are executed by a processor to implement the methods described above.

[0081] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatuses, devices, and computer program products implemented according to this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0082] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processing unit of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner. Thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0083] Computer-readable program instructions can be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions that execute on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0084] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction, which contains one or more executable instructions for implementing the specified logical function. In some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0085] Various implementations of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed implementations. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described implementations. The terminology used herein is chosen to best explain the principles, practical applications, or improvements to technology in the market, or to enable others skilled in the art to understand the various implementations disclosed herein.

Claims

1. A redundancy system for autonomous vehicles, comprising: The first computing unit and the corresponding first bus communication unit; as well as The second computing unit and the corresponding second bus communication unit; The first computing unit is connected to a group of sensors specific to the redundant system via the first bus communication unit, and the second computing unit is connected to the group of sensors via the second bus communication unit. In response to the redundant system taking over the autonomous vehicle, the target computing unit in the first computing unit and the second computing unit is configured to generate control signals for the autonomous vehicle based on perception data from the set of sensors.

2. The system according to claim 1, wherein the first computing unit is further connected to the third computing unit of the autonomous vehicle and the control unit of the autonomous vehicle via the first bus communication unit, and the second computing unit is further connected to the third computing unit and the control unit via the second bus communication unit, wherein the third computing unit corresponds to the main system of the autonomous vehicle.

3. The system according to claim 2, wherein: In response to the main system being configured to control the autonomous vehicle, the first computing unit and / or the second computing unit are configured to forward control signals from the third computing unit to the control unit.

4. The system according to claim 2, wherein: In response to the redundant system taking over the autonomous vehicle, the first computing unit and / or the second computing unit are configured to stop forwarding control signals from the third computing unit to the control unit.

5. The system according to claim 2, wherein: In response to the redundant system taking over the autonomous vehicle, the target computing unit is configured to send control signals generated by the target computing unit to the control unit.

6. The system according to claim 2, wherein: In response to the redundant system taking over the autonomous vehicle, the first computing unit and / or the second computing unit are configured to forward status data from the control unit to the third computing unit.

7. The system of claim 1, wherein the first computing unit and the second computing unit are further configured to be connected via a bus communication unit.

8. The system of claim 1, wherein the set of sensors includes at least one of the following: a camera, a millimeter-wave radar, and a corner radar.

9. The system of claim 1, wherein the control signal is used to control the autonomous vehicle to stop.

10. An electronic device, comprising: Memory and processor; The memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the redundant system according to any one of claims 1 to 9.

11. A computer-readable storage medium having a computer program stored thereon, the computer program being executable by a processor to implement a redundant system according to any one of claims 1 to 9.

12. A computer program product comprising computer-executable instructions, wherein the computer-executable instructions, when executed by a processor, implement a redundant system according to any one of claims 1 to 9.

Images