Intelligent driving control method, device and system

Abstract

A smart driving control method, device, and smart driving control system (100) are disclosed. The smart driving control method is applied to the smart driving control system (100), which includes a main controller (11), a first redundant controller (12), and a second redundant controller (13). The control method includes determining a fail-operable working group based on the states of the main controller (11), the first redundant controller (12), and the second redundant controller (13). When one of the main controller (11), the first redundant controller (12), and the second redundant controller (13) fails, the other two controllers form a fail-operable working group to control the vehicle to perform smart driving operations. This enables the vehicle to perform smart driving operations even when one of the controllers fails, ensuring a high level of smart driving without requiring the driver to take over driving operations.

Description

[0001] This application is a divisional application. The original application has the application number 202180005183.4 and the original application date is April 27, 2021. The entire contents of the original application are incorporated herein by reference. Technical Field

[0002] This application relates to the field of intelligent driving, specifically to an intelligent driving control method, device, and intelligent driving control system. Background Technology

[0003] Intelligent driving technology is key to realizing intelligent driving in vehicles and is an inevitable trend in the future development of vehicles. Currently, the level of intelligent driving that intelligent driving products on the market can achieve is Level 2+. At this level, the driver still needs to monitor the driving environment and be prepared to take over driving operations at any time.

[0004] Higher-level intelligent driving scenarios require almost no driver monitoring of the driving environment: for example, Level 3, conditional automation, where the vehicle can complete all driving actions when conditions permit, without the need for the driver to monitor the driving environment at all times; Level 4, high automation, requires no driver monitoring.

[0005] In advanced intelligent driving scenarios, if the control system malfunctions, it can only be downgraded to a safe state and await driver takeover.

[0006] This demonstrates that supporting advanced intelligent driving scenarios places higher demands on the safety and reliability of the control system. Summary of the Invention

[0007] To meet the safety and reliability requirements of high-level intelligent driving scenarios, this application provides an intelligent driving control method, device, and intelligent driving control system.

[0008] The first aspect of this application provides an intelligent driving control method, which is applied in an intelligent driving control system. The intelligent driving control system includes: a main controller, a first redundant controller, and a second redundant controller. The main controller and the first redundant controller form a failure operation working group for outputting vehicle control signals. The control method includes: acquiring the status of the main controller, the first redundant controller, and the second redundant controller; when one of the main controller and the first redundant controller is in a failed state and the second redundant controller is in a normal state, determining that the one of the main controller and the first redundant controller in a normal state forms a failure operation working group with the second redundant controller.

[0009] With the above settings, the vehicle control system can still ensure vehicle control through dual controllers even if one controller fails. Dual controllers can effectively support L3 to L4 level intelligent driving without requiring the driver to take over driving operations, thus meeting the safety and reliability requirements of high driving level scenarios.

[0010] In one possible implementation, the method further includes: when the main controller, the first redundant controller, and the second redundant controller are all effective, the main controller and the first redundant controller form a fail-safe working group, and the second redundant controller enters a standby state.

[0011] The above settings achieve a higher level of intelligent driving for the vehicle and reduce the power consumption of the second redundant controller.

[0012] In one possible implementation, the computing power of the second redundant controller is lower than that of the main controller or the first redundant controller.

[0013] The above settings achieve a higher level of intelligent driving for the vehicle and reduce the cost of the control system.

[0014] One possible implementation also includes putting the controller in a failure state into a repair mode.

[0015] The above settings enable timely and online repair of malfunctioning controllers, preventing situations where the vehicle cannot achieve intelligent driving and can only park under the control of a single controller when both controllers fail, thus further ensuring the vehicle's intelligent driving level.

[0016] In one possible implementation, the main controller is connected to a first redundant controller and a second redundant controller, and the first redundant controller is connected to the second redundant controller to transmit the status of the main controller, the first redundant controller and the second redundant controller.

[0017] Through the above settings, communication and data interaction between controllers are realized. In the event of failure of one controller, the other two controllers can form a fail-operable working group in a timely manner to control the vehicle to perform intelligent driving operations and ensure the intelligent driving level of the vehicle.

[0018] In one possible implementation, the states of the main controller, the first redundant controller, and the second redundant controller are recorded in a controller state maintenance table, which is stored in the main controller, the first redundant controller, and the second redundant controller, respectively.

[0019] Through the above settings, any controller can obtain the status of other controllers in a timely manner. Thus, when one controller fails, the other two controllers can form a fail-operable working group to control the vehicle to perform intelligent driving operations and ensure the vehicle's intelligent driving level.

[0020] In one possible implementation, when one controller fails and is unable to send a status, the other two controllers, which are connected to the failed controller, update the controller status maintenance table after both controllers have determined that the failed controller has failed.

[0021] In one possible implementation, once the main controller or the first redundant controller is successfully repaired, the successfully repaired controller replaces the failed second redundant controller in the workgroup, and the second redundant controller enters a standby state.

[0022] The above settings can further ensure the vehicle's intelligent driving level, so that the control system can still control the vehicle through the dual controllers when one controller fails. The dual controllers can effectively support L3 to L4 level intelligent driving without the need for the driver to take over driving operations, thus meeting the safety and reliability requirements of high driving level scenarios.

[0023] In one possible implementation, if two of the main controller, the first redundant controller, and the second redundant controller fail, the other controller will stop the vehicle.

[0024] By implementing the above settings, traffic accidents can be avoided in the event of failure of both controllers, thereby ensuring vehicle driving safety.

[0025] One possible implementation also includes sending the status of the failed controller to a remote maintenance system.

[0026] The above settings enable users and / or remote maintenance systems to obtain controller failure information in a timely manner, allowing failed intelligent driving controls to be repaired promptly, thereby further ensuring the vehicle's intelligent driving level.

[0027] One possible implementation also includes sending alert messages to the user.

[0028] In one possible implementation, in the event of failure of the main controller, the first redundant controller, or the second redundant controller, the status of the failed controller is submitted to the remote maintenance system, and an alert message is sent to the user.

[0029] In one possible implementation, in the event of failure of both the main controller, the first redundant controller, and the second redundant controller, the status of the failed controller is submitted to the remote maintenance system, and an alert message is sent to the user. In one possible implementation, in the event of failure of the main controller, the first redundant controller, or the second redundant controller, the status of the failed controller is submitted to the remote maintenance system.

[0030] In one possible implementation, the driving control system further includes a first vision sensor group, a detection sensor group, and a second vision sensor group, wherein the main controller is connected to the first vision sensor group, the detection sensor group, and the second vision sensor group; a first redundant controller is connected to the first vision camera sensor group and the detection sensor group; and a second redundant controller is connected to the detection sensor group and the second vision sensor group.

[0031] With the above settings, it is possible to ensure that the data obtained by the sensors is not lost in the event of failure of either controller, enabling the vehicle to achieve intelligent driving under the control of two controllers and ensuring a high level of intelligent driving.

[0032] A second aspect of this application provides an intelligent driving control device applied in an intelligent driving control system. The intelligent driving control system includes a main controller, a first redundant controller, and a second redundant controller. The main controller and the first redundant controller form a fail-operable working group for outputting vehicle control signals. The control device includes an acquisition module for acquiring the status of the main controller, the first redundant controller, and the second redundant controller; and a determination module for determining that when one of the main controller, the first redundant controller, and the second redundant controller is in a fail state and the second redundant controller is in a normal state, the normal one of the main controller and the first redundant controller forms a fail-operable working group with the second redundant controller.

[0033] In one possible implementation, the determining module is further configured to: when the main controller, the first redundant controller, and the second redundant controller are all effective, enable the main controller and the first redundant controller to form a fail-operable working group, and enable the second redundant controller to enter a standby state.

[0034] In one possible implementation, the computing power of the second redundant controller is lower than that of the main controller or the first redundant controller.

[0035] In one possible implementation, the determining module is also used to: put the controller in a failed state into repair mode.

[0036] In one possible implementation, the main controller is connected to a first redundant controller and a second redundant controller, and the first redundant controller is connected to the second redundant controller to transmit the status of the main controller, the first redundant controller and the second redundant controller.

[0037] In one possible implementation, the states of the main controller, the first redundant controller, and the second redundant controller are recorded in a controller state maintenance table, which is stored in the main controller, the first redundant controller, and the second redundant controller, respectively.

[0038] In one possible implementation, when one controller fails and is unable to send a status, the other two controllers, which are connected to the failed controller, update the controller status maintenance table after both controllers have determined that the failed controller has failed.

[0039] In one possible implementation, the determination module is further configured to: when one of the main controllers or the first redundant controllers is successfully repaired, determine that the successfully repaired controller replaces the second redundant controller in the failed workgroup, and the second redundant controller enters a standby state.

[0040] In one possible implementation, the determining module is also used to: in the event of failure of two of the main controller, the first redundant controller, and the second redundant controller, cause the other controller to stop the vehicle.

[0041] In one possible implementation, the determination module is also used to: submit the status of the failed controller to a remote maintenance system.

[0042] One possible implementation also includes sending alert messages to the user.

[0043] In one possible implementation, in the event of failure of the main controller, the first redundant controller, or the second redundant controller, the status of the failed controller is submitted to the remote maintenance system, and an alert message is sent to the user.

[0044] In one possible implementation, in the event of failure of both the main controller, the first redundant controller, and the second redundant controller, the status of the failed controller is submitted to the remote maintenance system, and an alert message is sent to the user. In one possible implementation, in the event of failure of the main controller, the first redundant controller, or the second redundant controller, the status of the failed controller is submitted to the remote maintenance system.

[0045] In one possible implementation, the driving control system also includes sensors comprising a first vision sensor group, a detection sensor group, and a second vision sensor group, wherein the main controller is connected to the first vision sensor group, the detection sensor group, and the second vision sensor group; a first redundant controller is connected to the first vision sensor group and the detection sensor group; and a second redundant controller is connected to the detection sensor group and the second vision sensor group.

[0046] The technical effects of the intelligent driving control device provided by the second aspect of this application and any possible implementation thereof are the same as the technical effects of the intelligent driving control method provided by the first aspect of this application and any possible implementation thereof, and will not be repeated here for the sake of brevity.

[0047] A third aspect of this application provides an intelligent driving control system, comprising: a main controller, a first redundant controller, and a second redundant controller; the main controller is connected to a first vision sensor group and a second vision sensor group, acquiring first vision sensor data from the first vision sensor group and second vision sensor data from the second vision sensor group; the first redundant controller is connected to the first vision sensor group and acquires the first vision sensor data from the first vision sensor group; the second redundant controller is connected to the second vision sensor group and acquires the second vision sensor data from the second vision sensor group; wherein the first vision sensor data includes forward-looking data, surround-view data, and rear-view data, and the second vision sensor data includes forward-looking data, side-looking data, and rear-view data; the intelligent driving control system outputs control signals based on data acquired by at least two of the main controller, the first redundant controller, and the second redundant controller. In one possible implementation, the main controller, the first redundant controller, and the second redundant controller are all connected to the detection sensor group and acquire detection sensor data from the detection sensor group.

[0048] In one possible implementation, the detection sensor data includes ultrasonic radar detection data and millimeter-wave radar detection data.

[0049] In one possible implementation, when the main controller, the first redundant controller, and the second redundant controller are all effective, the main controller and the first redundant controller form a fail-safe working group, while the second redundant controller is in standby mode.

[0050] One possible implementation also includes: the failed controller is in a repair state.

[0051] In one possible implementation, the computing power of the second redundant controller is lower than that of the main controller or the first redundant controller.

[0052] In one possible implementation, the main controller is connected to a first redundant controller and a second redundant controller, and the first redundant controller is connected to the second redundant controller to transmit the status of the main controller, the first redundant controller and the second redundant controller.

[0053] In one possible implementation, the states of the main controller, the first redundant controller, and the second redundant controller are recorded in a controller state maintenance table, which is stored in the main controller, the first redundant controller, and the second redundant controller, respectively.

[0054] In one possible implementation, when one controller fails and is unable to send a status, the other two controllers, which are connected to the failed controller, update the controller status maintenance table after both controllers have determined that the failed controller has failed.

[0055] In one possible implementation, when one of the main controllers or the first redundant controllers is successfully repaired, the successfully repaired controller replaces the failed second redundant controller in the workgroup, and the second redundant controller is in standby mode.

[0056] In one possible implementation, the vehicle is stopped by another controller in the event of failure of either the main controller, the first redundant controller, or the second redundant controller.

[0057] One possible implementation also includes submitting the status of the failed controller to a remote maintenance system.

[0058] One possible implementation involves sending an alert message to the user.

[0059] The technical effects of the intelligent driving control device provided by the third aspect of this application and any possible implementation thereof are the same as the technical effects of the intelligent driving control method provided by the first aspect of this application and any possible implementation thereof, and will not be repeated here for the sake of brevity.

[0060] A fourth aspect of this application provides a vehicle comprising: an intelligent driving control system provided in the third aspect of this application and any possible implementation thereof, and / or an intelligent driving control device provided in the second aspect of this application and any possible implementation thereof.

[0061] A fifth aspect of this application provides a computing device, comprising: a bus; a communication interface connected to the bus; at least one processor connected to the bus; and at least one memory connected to the bus and storing program instructions, which, when executed by the at least one processor, cause the at least one processor to perform the intelligent driving control method provided by the first aspect of this application and any possible implementation thereof.

[0062] A sixth aspect of this application provides a computer-readable storage medium having program instructions stored thereon, which, when executed by a computer, cause the computer to perform the intelligent driving control method provided by the first aspect of this application and any possible implementation thereof.

[0063] These and other aspects of this application will become more apparent in the description of the following embodiments(s). Attached Figure Description

[0064] The following description, with reference to the accompanying drawings, further illustrates the various features of this application and the relationships between them. The drawings are exemplary; some features are not shown to scale, and some drawings may omit conventional features in the field of this application that are not essential to it, or additional features that are not essential to this application may be shown. The combination of features shown in the drawings is not intended to limit this application. Furthermore, throughout this specification, the same reference numerals refer to the same things. Specific descriptions of the drawings are as follows: Figure 1A This is a schematic diagram of the modules of an intelligent driving control system with an intelligent driving level of L2+ and below; Figure 1B This is a schematic diagram of the modules of an intelligent driving control system with intelligent driving levels of L4 to L5. Figure 2A A schematic diagram of an intelligent driving control system provided in an embodiment of this application is shown; Figure 2B A schematic diagram of an intelligent driving control system according to another embodiment of this application is shown; Figure 2C A schematic diagram of the controller module provided in an embodiment of this application is shown; Figure 3A This illustration shows the signal connections between the main controller, the first redundant controller, and the second redundant controller provided in this application embodiment, as well as with other control units (systems) of the vehicle; Figure 3B This illustration shows a schematic diagram of the signal connections between the main controller, the first redundant controller, and the second redundant controller, as well as with other control units (systems) of the vehicle, according to another embodiment of this application. Figure 4AA schematic diagram of a camera with dual POC serializer interfaces is shown. Figure 4B A schematic diagram of a camera with a single POC serializer interface and a dual-interface adapter box connected to the camera with the single POC serializer interface is shown. Figure 5A A schematic diagram of the power supply structure of the intelligent driving control system provided in an embodiment of this application is shown; Figure 5B A schematic diagram of the power supply structure of an intelligent driving control system according to another embodiment of this application is shown; Figure 6A A flowchart of an intelligent driving control method provided in an embodiment of this application is shown; Figure 6B A flowchart of an intelligent driving control method according to another embodiment of this application is shown; Figure 7 This paper shows a schematic diagram of a module of an intelligent driving control device provided in an embodiment of this application; Figure 8 A schematic diagram of a computing device provided in an embodiment of this application is shown. Detailed Implementation

[0065] The terms "first," "second," "third," and similar terms used in the specification and claims are used only to distinguish similar objects and do not represent a specific ordering of objects. It is understood that, where permissible, a specific order or sequence may be interchanged so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0066] In the following description, the labels of the steps, such as S10, S21, etc., do not necessarily indicate that the steps will be executed in this manner. The order of the steps can be interchanged or executed simultaneously, where permissible.

[0067] The term "comprising" as used in the specification and claims should not be construed as limiting itself to what follows; it does not exclude other elements or steps. Therefore, it should be interpreted as specifying the presence of the mentioned feature, integral, step, or component, but does not exclude the presence or addition of one or more other features, integrals, steps, or components, or groups thereof. Thus, the statement "device comprising means A and B" should not be limited to a device consisting solely of components A and B.

[0068] The terms "an embodiment" or "an embodiment" as used in this specification mean that a particular feature, structure, or characteristic described in conjunction with that embodiment is included in at least one embodiment of this application. Therefore, the terms "in one embodiment" or "in an embodiment" appearing throughout this specification do not necessarily refer to the same embodiment, but may refer to the same embodiment. Furthermore, in one or more embodiments, the particular features, structures, or characteristics can be combined in any suitable manner, as will be apparent to those skilled in the art from this disclosure.

[0069] Explanation of terms used in this application: Lidar (Light Detection and Ranging) works by using a laser to emit light pulses and a receiver to receive the light pulses reflected from the target. By calculating the propagation time of the light pulse from the laser to the receiver and combining the speed of light and the parameters of the lidar, the distance between the target and the vehicle, the target's orientation, height, speed, attitude, and shape can be obtained.

[0070] Millimeter-wave radar (Radio Detection and Ranging, RADAR) works by using high-frequency circuits to generate electromagnetic waves with a specific modulation frequency, and using antennas to transmit and receive electromagnetic waves reflected from the target. By combining the parameters of the millimeter-wave radar, it calculates the distance between the target and the vehicle, the target's speed, and the target's azimuth.

[0071] An ultrasonic sensor (USS), also known as ultrasonic radar, works by emitting ultrasonic signals using an ultrasonic transmitter. Timing begins simultaneously with the emission of the ultrasonic wave. The waves propagate through the air, reflecting back immediately upon encountering an obstacle. The receiver stops timing when it receives the reflected wave. By recording the time it takes for the ultrasonic wave to travel from emission to reflection, the distance between the emission point and the obstacle can be determined.

[0072] A Global Navigation Satellite System (GNSS) is a navigation and positioning system that provides users with all-weather three-dimensional coordinate information, velocity information, and time information at any location on the Earth's surface or in near-Earth space. Currently, there are four global navigation satellite systems: China's BeiDou Navigation Satellite System (BDS), the United States' Global Positioning System (GPS), the European Union's Galileo Navigation Satellite System (Galileo), and Russia's GLONASS.

[0073] An inertial measurement unit (IMU) works by using inertial sensing elements such as gyroscopes and accelerometers, along with a computer, to measure the acceleration of a vehicle relative to the ground in real time, thereby determining the vehicle's position and a combination of Earth's gravitational field parameters.

[0074] An electronic control unit (ECU), also known as a "vehicle computer," typically consists of a microprocessor, memory, input / output interface, analog-to-digital converter, and integrated circuits. Its working principle is to process and calculate the data obtained from various sensors, and output control signals to control the controlled object to perform corresponding driving operations.

[0075] Advanced Driver Assistance Systems (ADAS) work by using sensors (millimeter-wave radar, lidar, monocular / dual-lens cameras, and global navigation satellite systems) installed on the vehicle to obtain data on targets in the surrounding environment, processing the data, and outputting driving operation commands to allow the driver to be aware of potential dangers in advance, thereby increasing the comfort and safety of driving.

[0076] Power over Coax (POC) is a technology that combines signal transmission and power supply on a single coaxial cable.

[0077] The Body Control Module (BCM), also known as the "body computer," is used to control the electronic components of the vehicle body (such as power windows, power mirrors, air conditioning, headlights, turn signals, anti-theft locking system, central locking, and defrosting device) to perform corresponding operations. The Body Control Module can be connected to other ECUs via a bus.

[0078] Electronic Stability Program (ESP) is a general term for systems or programs that prevent loss of control when a vehicle reaches its dynamic limits. Its working principle is as follows: it processes and calculates data obtained from sensors (such as steering sensors, wheel sensors, sideslip sensors, lateral acceleration sensors, and steering wheel, accelerator, and brake pedal sensors), compares the calculated results with preset values, and controls various actuators (such as electronic brake force distribution system, anti-lock braking system, traction control system, and vehicle dynamic control system) to maintain the dynamic balance of the vehicle when the calculated result exceeds or approaches the preset value.

[0079] Electric Power Steering (EPS) systems typically include sensors (such as torque sensors, steering angle sensors, and vehicle speed sensors), steering assist mechanisms (such as motors, clutches, and reduction gears), and an ECU (Electronic Control Unit). Its working principle is as follows: when the driver turns the steering wheel, the torque and steering angle sensors generate corresponding voltage signals based on the input torque and steering angle. The vehicle speed sensor detects the vehicle speed signal. The ECU, based on the voltage and vehicle speed signals, generates control commands to operate the motor, assisting the driver in steering.

[0080] A brake-by-wire system (IBS) may include: a power-assisted motor, a power-assisted transmission mechanism, a pushrod mechanism, a stroke sensor, a master cylinder, and a controller. When the driver depresses the brake pedal, the pushrod mechanism is displaced. The stroke sensor detects this displacement and sends the signal to the controller. The controller calculates the torque that the motor should produce based on the displacement signal and controls the power-assisted transmission mechanism to convert the torque into servo braking force. This servo braking force, together with the pushrod force generated by the pedal input, works to achieve braking through the fluid pressure in the master cylinder.

[0081] An in-vehicle infotainment (IVI) system is a system that provides infotainment functions for drivers and passengers. It can provide multimedia playback, navigation, Bluetooth / Wi-Fi connectivity, mirroring (e.g., mirroring a mobile phone screen directly onto the vehicle screen), human-vehicle interaction (e.g., touch screen, button, voice interaction, gesture recognition, and facial recognition), vehicle information display and control, intelligent driving, and social networking functions.

[0082] The Vehicle Control Unit (VCU) collects data on motor status, battery status, accelerator pedal signals, brake pedal signals, and sensor signals. It analyzes the driver's intentions, outputs corresponding control commands, and controls the lower-level controllers to perform the appropriate operations. The VCU is used to control normal vehicle operation, regenerative braking, energy management of the engine and battery, fault diagnosis and handling, and vehicle status monitoring, ensuring the vehicle operates normally and stably with good power, high fuel economy, and high reliability.

[0083] The Telematics box (T-box) provides a remote communication interface for vehicles via 4G / 5G wireless communication, global navigation satellite system, inertial measurement system, and CAN communication. It offers services such as driving data collection, driving trajectory recording, vehicle fault monitoring, remote vehicle query and control (locking and unlocking, air conditioning control, window control, engine torque limiting and engine start-stop), driving behavior analysis, and 4G / 5G wireless hotspot sharing.

[0084] A microcontroller unit (MCU) is a chip-level computer that integrates components such as memory, counters, interfaces, and CPU onto a single chip, allowing for different combinations of control for various applications.

[0085] The Camera Serial Interface-2 (CSI-2) is an interface specification developed by the Mobile Industry Processor Interface (MIPI) consortium.

[0086] Controller Area Network (CAN) is a technology used for data transmission between various ECUs within a vehicle, enabling communication between them. Its maximum data transmission rate is 1 Mbps.

[0087] Controller Area Network (CAN FD) with Flexible Data-Rate (CAN FD) supports higher data transmission rates compared to Controller Area Network (CAN), with a maximum data transmission rate of 5 Mbps. It also supports the transmission of longer data bytes, with the longest data byte being 64 bytes.

[0088] In the field of intelligent driving, to demonstrate the vehicle's own actions and reactions, intelligent driving levels can be divided into the following categories: Level L1: The vehicle can achieve driver assistance functions such as controlling steering wheel steering or vehicle speed through the ADAS platform, but the driver needs to monitor the driving environment and be ready to take over driving operations at any time.

[0089] Level L2: The vehicle can achieve driver assistance functions such as simultaneously controlling steering wheel steering and vehicle speed through the ADAS platform, but the driver needs to monitor the driving environment and be ready to take over driving operations at any time.

[0090] Level L2+: Level L2+ is an upgrade of Level L2. Under suitable conditions, the vehicle can perform all driving operations through the ADAS platform, but the driver still needs to monitor the driving environment and be ready to take over driving operations at any time.

[0091] Level 3: The vehicle can perform all driving operations and can alert the driver. Under suitable conditions, driver monitoring of the driving environment is not required, but the driver needs to take over driving operations to handle situations that the artificial intelligence may not be able to handle.

[0092] Level L4: The vehicle can perform all driving operations, and in certain scenarios, no driver is required in the vehicle.

[0093] Level L5: The vehicle can perform all driving operations, and no driver is required in the vehicle in any scenario.

[0094] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. In case of any inconsistency, the meaning set forth in this specification or derived from the content described herein shall prevail. Furthermore, the terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit the scope of this application.

[0095] It should be noted that in this application, "vehicle" can include one or more different types of means of transport, and can also include one or more different types of transport vehicles or movable objects that operate or move on land (e.g., highways, roads, railways, etc.), water (e.g., waterways, rivers, oceans, etc.), or in space. For example, a vehicle can include automobiles, bicycles, motorcycles, trains, subways, airplanes, ships, aircraft, and / or other types of means of transport or movable objects.

[0096] In the field of intelligent driving, such as Figure 1A As shown, an intelligent driving control system at level L2+ and below may include: a single controller 02 connected to sensor 010. The sensor may include: a camera 011, a millimeter-wave radar 012, and an ultrasonic radar 013. In some embodiments, the sensor may further include: a lidar 014. Figure 1A In the illustrated embodiment, the sensors include: a camera 011, a millimeter-wave radar 012, an ultrasonic radar 013, and a lidar 014. However, this application is not limited to these; different types of sensors can be configured according to the usage scenario. The sensor 010 is used to perform perception processing, fusion processing, positioning processing, and control processing on the data obtained, and outputs vehicle control commands to assist the driver in performing a series of driving operations. When the controller 020 fails, the vehicle cannot drive itself, and the driver must take over the driving operation.

[0097] like Figure 1B The image shows an example of an intelligent driving control system at levels L4 to L5, comprising a main controller 021 and a redundant controller 022. The main controller 021 and the redundant controller 022 are respectively connected to sensors 010. The sensors may include a camera 011, a millimeter-wave radar 012, and an ultrasonic radar 013. In some embodiments, the sensors may further include a lidar 014. Figure 1BIn the illustrated embodiment, the sensors include: a camera 011, a millimeter-wave radar 012, an ultrasonic radar 013, and a lidar 014. However, this application is not limited to these; different types of sensors can be configured according to the usage scenario. When both the main controller 021 and the redundant controller 022 are functioning correctly, the main controller 021 controls the vehicle to perform intelligent driving operations, while the redundant controller 022 remains in standby mode. The main controller 021 processes the data obtained from the sensors through perception processing, fusion processing, localization processing, and control processing, and outputs control commands to the vehicle, thereby controlling the vehicle to perform intelligent driving operations. If the main controller 021 fails, the redundant controller 022 switches from standby mode to operating mode and controls the vehicle to stop at an appropriate location. When the main controller 021 fails, the vehicle is downgraded to L2+, possibly parking under the control of the redundant controller 022 and unable to continue performing L4-L5 level intelligent driving operations.

[0098] In order to enable intelligent driving of the vehicle even in the event of failure of any controller, and to ensure that the vehicle maintains an intelligent driving level of L4 to L5, embodiments of this application provide an intelligent driving control method, an intelligent driving control device, and an intelligent driving control system.

[0099] Example 1: Intelligent Driving Control System Figure 2A An embodiment of the present application illustrates an intelligent driving control system 100, such as... Figure 2A As shown, the intelligent driving control system 100 includes: a main controller 11, a first redundant controller 12, and a second redundant controller 13.

[0100] In some embodiments, the intelligent driving control system 100 may further include multiple sensors connected to the main controller 11, the first redundant controller 12, and the second redundant controller 13. For example, visual sensors and detection sensors, such as… Figure 2BAs shown, the visual sensors may include one or more cameras 22, and the detection sensors may include one or more millimeter-wave radars 21, one or more ultrasonic radars 24, and optionally one or more lidars 23. In one possible implementation, the multiple visual sensors can be divided into two visual sensor groups. The first visual sensor group includes one or more forward-looking cameras, one or more surround-view cameras, and one or more rear-view cameras; the second visual sensor group includes one or more forward-looking cameras, one or more side-view cameras, and one or more rear-view cameras. The forward-looking cameras in the first and second visual sensor groups can be the same or different. For example, the forward-looking cameras may include long-range, medium-range, and short-range cameras. In one possible implementation, the forward-looking cameras in the first visual sensor group may include long-range and short-range cameras, and the forward-looking cameras in the second visual sensor group may include medium-range cameras. In another possible implementation, the forward-looking cameras in the first and second visual sensor groups are the same, both including long-range, medium-range, and short-range cameras. Similarly, the rear-view cameras in the first and second visual sensor groups can be the same or different. The main controller is connected to a first vision sensor group and a second vision sensor group, acquiring first vision sensor data from the first vision sensor group and second vision sensor data from the second vision sensor group. A first redundant controller is connected to the first vision sensor group, acquiring the first vision sensor data from the first vision sensor group; a second redundant controller is connected to the second vision sensor group, acquiring the second vision sensor data from the second vision sensor group. The first vision sensor data includes forward-looking data, surround-view data, and rear-looking data, while the second vision sensor data includes forward-looking data, side-looking data, and rear-looking data. The intelligent driving control system outputs control signals based on the data acquired by at least two of the main controllers: the main controller, the first redundant controller, and the second redundant controller. In this configuration, although the first and second redundant controllers acquire less visual data than the main controller, the visual data acquired by any two controllers forming a working group includes forward-looking data, side-looking data, surround-view data, and rear-looking data. Understandably, if the forward-facing camera in the first vision sensor group and the forward-facing camera in the second vision sensor group are the same, the forward-facing data in the first vision sensor data and the forward-facing data in the second vision sensor data are the same; otherwise, the forward-facing data in the first vision sensor data and the forward-facing data in the second vision sensor data are different. Similarly, if the rear-facing camera in the first vision sensor group and the rear-facing camera in the second vision sensor group are the same, the rear-facing data in the first vision sensor data and the rear-facing data in the second vision sensor data are the same; otherwise, the rear-facing data in the first vision sensor data and the rear-facing data in the second vision sensor data are different.

[0101] In some embodiments, the sensor may further include a detection sensor. The detection sensor may be connected to a main controller, a first redundant controller, and a second redundant controller, respectively, and the main controller, the first redundant controller, and the second redundant controller acquire detection sensor data from the detection sensor group. In some embodiments, the detection sensor data includes ultrasonic radar detection data and millimeter-wave radar detection data. Optionally, it may also include lidar detection data. Figure 2B In the example shown, the detection sensors may include: millimeter-wave radar 21, camera 22, lidar 23, and ultrasonic radar 24. This application does not limit this; different types of sensors can be configured according to the application scenario.

[0102] In some embodiments, such as Figure 2B As shown, the intelligent driving control system may further include: an ECU 32 in the vehicle chassis, a positioning and inertial measurement unit 25, and other ECUs 31 and T-box 41 connected to the controller via a central gateway 50. The positioning and inertial measurement unit 25 may include a global navigation satellite positioning device and an inertial measurement device. Depending on the type of global navigation satellite positioning device it is equipped with, the positioning and inertial measurement unit 25 can connect to a satellite positioning system (BDS, GPS, GNS, or GLONASS) 71 via an antenna 61 and interact with the controller to perform local time service and vehicle positioning calculations.

[0103] The main controller 11, the first redundant controller 12, and the second redundant controller can process and calculate the data obtained through sensors (millimeter-wave radar 21, camera 22, lidar 23, and ultrasonic radar 24), positioning and inertial measurement unit 25, and central gateway, and generate vehicle control commands by combining the status of chassis ECU 32 and other ECUs, thereby controlling the vehicle to perform corresponding intelligent driving operations.

[0104] In some embodiments, the main controller 11, the first redundant controller 12, and the second redundant controller 13 are all controllers with strong computing capabilities; or the main controller is a controller with strong computing capabilities, the first redundant controller is a controller with medium or strong computing capabilities, and the second redundant controller can be a controller with medium or weak computing capabilities. As described above, the first redundant controller and the second redundant controller process less visual data than the main controller, and correspondingly, their computing capabilities can be relatively lower than those of the main controller, thereby reducing the cost of the intelligent control system.

[0105] Figure 2C A schematic diagram of the controller module provided in an embodiment of this application is shown. Figure 2C As shown, Figure 2A and Figure 2B Each of the main controller 11, the first redundant controller 12, and the second redundant controller 13 shown may include: a computing unit 101, an MCU 102, and an interface module 103.

[0106] The computing unit 101 can process and calculate data obtained from sensors, etc., and generate control commands according to the user's driving needs. The computing unit 101 may include a system-on-chip (SOC) 1011 and a memory 1012. The SOC 1011 may include multiple functional modules, such as: an image processing module for image processing, such as a GPU (graphics processing unit); a general computing module for general computing, such as a CPU; an AI computing module for artificial intelligence computing, such as an NPU (neural-network process unit); an interface module for connecting with other devices (e.g., MCU 102); and internal memory. The memory 1012 may store application software (e.g., perception application software, fusion application software, positioning application software, and homing control application software) and other data used to perform intelligent driving operations. When the computing unit 101 is running, the SOC 1101 can execute computer execution instructions in the memory 1012 to perform perception processing, fusion processing, positioning processing and planning processing on the data obtained by sensors such as cameras, lidar, and millimeter-wave radar, and output corresponding control instructions to control the vehicle to perform intelligent driving operations.

[0107] MCU102 can be used to monitor the status of the controller, such as monitoring the controller's voltage, temperature, and whether it has failed or malfunctioned; it can also be used for power-on / off control and reset control of the controller; and it can be used to connect with the ECU of the vehicle chassis and other control units of the vehicle, enabling the corresponding ECU to perform various operations. MCU102 may include a processor, memory, and a communication interface. The communication interface can connect to the current controller's SOC, the MCUs of other controllers, and the vehicle chassis ECU, etc., for exchanging data with these components, such as acquiring the status data of the current controller's SOC, the status data of the MCUs and / or SOCs of other controllers, and the status data of the vehicle chassis ECU. The processor can process and calculate the status data acquired through the communication interface to generate corresponding control commands. In some embodiments, the processor can establish a controller status table based on the acquired status data, as exemplified in Table 1, which records the status of the main controller, the first redundant controller, and the second redundant controller. For example, after system startup, all controllers are normal, and the status records are shown in Table 1. The processor determines the fail-operational workgroup based on the controller's state table. In the example shown in Table 1, the primary controller and the first redundant controller form the fail-operational workgroup, while the second redundant controller is in standby mode. It should be noted that this is merely an example and not a limitation. In some embodiments, the controller state table is stored in memory. The memory may include read-only memory and random access memory, providing instructions and data to the processor. A portion of the processor may also include non-volatile random access memory. For example, the processor may also store device type information.

[0108] When the MCU is running, the processor can execute computer-executable instructions stored in memory. For example, when the main controller fails, the MCU of the main controller can trigger a repair mode to perform operations such as power-on, reset, or repair. The MCUs of the first and second redundant controllers can update their own controller status tables based on the obtained status of the main controller, and form a fail-safe working group with the first and second redundant controllers. Optionally, the MCU of the first redundant controller can send warning information to the user via IVI. When both the main controller and the first redundant controller fail, the MCUs of the main controller and the first redundant controller can trigger a repair mode to perform operations such as power-on, reset, or repair. The MCU of the second redundant controller can update its own controller status table based on the obtained status of the main controller, send warning information to the user via IVI, and put the second redundant controller into a safe state, enabling the second redundant controller to stop the vehicle.

[0109]

[0110] The interface module 103 can provide an in-vehicle Ethernet interface, a video serial-to-parallel transceiver interface, a CAN interface and / or a CAN FD interface for connecting to sensor interfaces, vehicle chassis controller interfaces and gateway interfaces, thereby enabling data interaction between the controller and other control units or modules of the vehicle.

[0111] Figure 3A A schematic diagram showing the connections between the main controller 11, the first redundant controller 12, and the second redundant controller 13, as well as with other control units (systems) of the vehicle, is provided. Figure 3A As shown, the main controller 11 can be connected to the first redundant controller 12 and the second redundant controller 13 via vehicle Ethernet signals. The first redundant controller 12 and the second redundant controller 13 can also be connected via vehicle Ethernet signals. The main controller 11, the first redundant controller 12, and the second redundant controller 13 can be connected to other modules in the vehicle, such as the VCU, BCM, IVI, and / or T-box, via a vehicle gateway. The first redundant controller 12 and the second redundant controller 13 are connected to the vehicle gateway via CAN or CAN FD signals. The vehicle gateway can be connected to other modules in the vehicle, such as the VCU, BCM, IVI, and / or T-box, via vehicle Ethernet signals. The VCU can be connected to ESP, EPS, and / or IBS via vehicle Ethernet signals.

[0112] The sensors may include both detection sensors and vision sensors. For example, the sensors may include one or more of millimeter-wave radar 21, camera 22, lidar 23, and ultrasonic radar 24. Figure 3A and 3B In the example shown, the sensors include: millimeter-wave radar 21, camera 22, lidar 23, and ultrasonic radar 24, but this application is not limited to this; the sensors may also include: millimeter-wave radar 21, camera 22, and ultrasonic radar 24. Figure 3A and 3BIn the example shown, the sensors can be divided into sensors for region A, region B, region C, and region D based on their type. The sensors for region A can be cameras 22, including a front-view camera 221, a surround-view camera 222, and a rear-view camera 223, i.e., the first visual sensor group; the sensors for region B can be ultrasonic radar 24 and millimeter-wave radar 21, including a front ultrasonic radar 241 and a front millimeter-wave radar 211, four-corner ultrasonic radars 242 and four-corner millimeter-wave radars 212, and a rear ultrasonic radar 243 and a rear millimeter-wave radar 213, i.e., the ultrasonic radar and millimeter-wave radar sensor group; the sensors for region C can be lidar 23, including a front lidar 231, a side lidar 232, and a rear lidar 233, i.e., the lidar sensor group; the sensors for region D can be cameras, including a front-view camera 224, a side-view camera 225, and a rear-view camera 226, i.e., the second visual sensor group. It should be noted that the lidar in region C may not be deployed, and correspondingly, the second sensor gateway may not be deployed. It should be noted that a certain area here includes sub-areas at different locations on the vehicle. These areas are mainly divided based on the type of sensors deployed or the combination of their coverage locations.

[0113] The main controller 11 can be connected to the camera 22 in area A, the ultrasonic radar 24 and millimeter-wave radar 21 in area B, the lidar 23 in area C, and the camera 22 in area D, respectively; the first redundant controller 12 can be connected to the camera 22 in area A, the ultrasonic radar 24 and millimeter-wave radar 21 in area B, and the lidar 23 in area C, respectively; the second redundant controller 13 can be connected to the ultrasonic radar 24 and millimeter-wave radar 21 in area B, the lidar 23 in area C, and the camera 22 in area D, respectively.

[0114] In some embodiments, the ultrasonic radar 24 and millimeter-wave radar 21 located in region B can transmit signals to the main controller 11, the first redundant controller 12, and the second redundant controller 13 respectively via the first sensor gateway 2401. The ultrasonic radar 24 and millimeter-wave radar 21 can be connected to the first sensor gateway 2401 via CAN, CAN FD, and / or vehicle Ethernet. The main controller 11, the first redundant controller 12, and the second redundant controller 13 can be connected to the first sensor gateway 2401 via vehicle Ethernet. The lidar 23 in region C can transmit signals to the main controller 11, the first redundant controller 12, and the second redundant controller 13 respectively via the second sensor gateway 2301. The lidar 23 can be connected to the second sensor gateway 2301 via CAN, CAN FD, and / or vehicle Ethernet. The main controller 11, the first redundant controller 12, and the second redundant controller 13 can be connected to the second sensor gateway 2301 via vehicle Ethernet. Camera 22 in area A can be connected to the main controller 11 and the first redundant controller 12 via the POC serializer interface; camera 22 in area D can be connected to the main controller 11 and the second redundant controller 13 via the POC serializer interface.

[0115] Figure 3B This diagram illustrates the signal connections between the main controller 11, the first redundant controller 12, and the second redundant controller 13, as well as with other control units (systems) of the vehicle, according to another embodiment of this application. Figure 3A The difference lies in that the sensors in area D can include a forward-facing camera 224 and a side-facing camera 227, forming a second visual sensor group; the computing power of the main controller 11 is greater than or equal to that of the first redundant controller 12, which is greater than that of the second redundant controller 13. In the event of a failure of both the main controller 11 and the first redundant controller 12, the second redundant controller 13 connects to the sensors in areas B, C, and D (forward-facing camera 224 and side-facing camera 227) to control the vehicle to stop. It should be noted that a given area here includes sub-areas at different locations on the vehicle, and the division of these areas is primarily based on the types of sensors deployed.

[0116] In some possible implementations, the sensors included in the second vision sensor group can be further simplified, with correspondingly simplified sensors included in the first vision sensor group. Figure 3BIn the example shown, the side-view camera 227 in region D can be placed in region A. Region D only includes a front-view camera. Correspondingly, both the first redundant controller 12 and the main controller 11 are connected to the first vision sensor group, such as the sensors in region A. The first vision sensor group includes a front-view camera 221, a surround-view camera 222, a rear-view camera 223, a side-view camera 225, and a side-view camera 227. The second redundant controller 13 and the main controller 11 are both connected to the second vision sensor group, such as the sensors in region D. The second vision sensor group includes a front-view camera. The connection method of the detection sensor group is the same. Figure 3A Alternatively, 3B. In this implementation, if the main controller 11 and the first redundant controller 12 fail, the second redundant controller 13, although acquiring less sensor data, can still receive forward-looking data and meet the requirements for controlling the current lane to stop.

[0117] It should be noted that the above are merely examples and are not intended to be limiting.

[0118] Depend on Figure 3A and Figure 3B As shown, since cameras 22 in areas A and D need to be connected to two controllers respectively, the cameras need to have dual POC serializer interfaces. Alternatively, cameras with a single POC serializer interface can be connected to the two controllers respectively through a dual interface adapter box 26.

[0119] Figure 4A A schematic diagram of the structure of a camera 22 with dual POC serializer interfaces 2208 is shown. Figure 4A As shown, the camera 22 with dual POC serializer interfaces may include: an internal power module 2201, a power combining module 2202, a camera sensor 2203, and a dual-interface serializer 2204. One end of the camera sensor 2203 can be connected to one end of the dual-interface serializer 2204 via a CSI-2 interface 2210. One end of the internal power module 2201 can be connected to one end of the power combining module 2202. The other end of the dual-interface serializer 2204 and the other end of the power combining module 2202 can be connected to the controller via a dual POC serializer interface 2208, thereby enabling signal transmission and power connection with the controller.

[0120] Figure 4B A schematic diagram is shown of a camera 22 with a single POC serializer interface 2209 and a dual-interface adapter box 26 connected to the camera 22 with the single POC serializer interface 2209. (See diagram for reference.) Figure 4BAs shown, a camera 22 with a single POC serializer interface 2209 may include: an internal power module 2205, a single-interface serializer 2206, and a camera sensor 2207. The camera sensor 2207 can be connected to the single-interface serializer 2206 via a CSI-2 interface 2210. The single-interface serializer 2206 and the internal power module 2205 can be connected to a dual-interface adapter box 26 via the single POC serializer interface. The dual-interface adapter box 26 may include a first serializer 261, a second serializer 262, a deserializer 263, and a combining power supply module 264. One end of the first serializer 261 and the second serializer 262 are respectively connected to the controller through the dual POC serializer interface 2208. The other end of the first serializer 261 and the second serializer 262 are connected to the deserializer 263. One end of the power combining module 264 is respectively connected to the dual POC serializer interface 2208. The other end of the power combining module 264 is used to connect to the single POC serializer interface 2209, thereby realizing the signal transmission and power connection between the camera 22 with the single POC serializer interface 2209 and the controller.

[0121] Depending on the type of sensor, its power supply method varies. In some embodiments, the camera does not have a power regulator module and is powered by the vehicle's power supply via the controller's power regulator module; ultrasonic radar, millimeter-wave radar, and lidar have power regulator modules and can be powered by the vehicle's power supply. In some embodiments, ultrasonic radar, millimeter-wave radar, and lidar can also be powered by the vehicle's power supply via the power regulator module. To ensure that the power supply to any sensor is not affected when any controller fails, embodiments of this application provide a method for powering an intelligent driving control system, such as... Figure 5A and Figure 5B As shown.

[0122] Figure 5A The diagram illustrates the power supply structure of the intelligent driving control system provided in this embodiment. The system can supply power to the first redundant controller 12, the main controller 11, and the second redundant controller 13 via vehicle power bus A, vehicle power bus B, and vehicle power bus C, respectively. It also supplies power to the ultrasonic radar 24 and millimeter-wave radar 21 in region B and the lidar 23 in region C via vehicle power bus A and vehicle power bus B, respectively.

[0123] The camera 22 in area A can be powered by the main controller power supply regulator module 11A of the main controller 11 and the first redundant controller power supply regulator module 12A of the first redundant controller 12. The camera 22 in area D can be powered by the main controller power supply regulator module 11A of the main controller 11 and the second redundant controller power supply regulator module 13A of the second redundant controller 13. The voltage regulator module is a power supply device used to provide stable AC or DC power to the load device; in some embodiments, the voltage regulator module can be integrated into the controller. For clarity, Figure 5A Only the first redundant controller power supply regulator module 12A, the main controller power supply regulator module 11A, and the second redundant controller power supply regulator module 13A of the first redundant controller 12, the main controller 11, and the second redundant controller 13 are shown.

[0124] Figure 5B A schematic diagram of the power supply structure of an intelligent driving control system according to another embodiment of this application is shown. Figure 5A The difference is that the sensors in area D can include a front-view camera 224 and a side-view camera 227, i.e., a second camera sensor group. The remaining power supply methods are the same as... Figure 5A The power supply structure of the intelligent driving control system shown is the same.

[0125] Example 2: Intelligent Driving Control Method Figure 6A A flowchart illustrating an intelligent driving control method provided in an embodiment of this application is shown. In some embodiments, the intelligent driving control method provided in this application can be implemented by the processor of an MCU executing computer-executable instructions stored in memory. Figure 6A As shown in the figure, a control method for an intelligent driving control system provided in this application embodiment may include the following steps: Step S1: Obtain the status of the main controller, the first redundant controller, and the second redundant controller.

[0126] The intelligent driving control system may include a main controller, a first redundant controller, and a second redundant controller. Each controller is connected in pairs to acquire the status of the other controllers. After the intelligent driving control system is powered on and initialized, the MCU can determine that the main controller and the first redundant controller form a fail-safe working group to output vehicle control signals, and determine that the second redundant controller enters standby mode.

[0127] In some embodiments, the driving control system further includes a first vision sensor group, a detection sensor group, and a second vision sensor group, wherein the main controller is connected to the first vision sensor group, the detection sensor group, and the second vision sensor group; the first redundant controller is connected to the first vision sensor group and the detection sensor group; and the second redundant controller is connected to the detection sensor group and the second vision sensor group.

[0128] In some embodiments, the computing power of the main controller may be higher than that of the first redundant controller and the second redundant controller.

[0129] Step S2: When one of the main controller and the first redundant controller is in a failed state and the second redundant controller is in a normal state, the one of the main controller and the first redundant controller that is in a normal state forms a failed but operable working group with the second redundant controller.

[0130] In some embodiments, each controller can obtain the status of other controllers through a heartbeat mechanism. Each controller's MCU can send its own status information to other controllers at preset intervals. Each controller updates its own controller status table based on the status information provided by other controllers. When a controller does not obtain status information from other controllers or obtains status information indicating that another controller has failed, the MCU determines that the controller has failed and updates its status table. Alternatively, each controller's MCU can detect the status of other controllers at preset intervals. When it does not detect the status of a certain controller or detects that a certain controller has failed, the MCU determines that the controller has failed and updates its status table.

[0131] In some embodiments, each controller can also obtain the status of other controllers via alarm lights. In some failure scenarios, the controller can identify the failed controller by sending alarm messages to other controllers and update the controller's status table. If the controller is unable to send alarm messages due to failure, the MCU can obtain the status of other controllers through a combination of heartbeat mechanism and alarm lights, thereby updating the controller status table and identifying the failed workgroup.

[0132] In some embodiments, if one of the main controller, the first redundant controller, and the second redundant controller fails but successfully self-repairs before the failure is detected by other valid controllers, step S2 can be omitted. The fail-operable working group composed of the main controller and the first redundant controller continues to perform intelligent driving control and output vehicle control signals, while the second redundant controller remains in standby mode. In some embodiments, if one of the main controller and the first redundant controller is in a failed state and the second redundant controller is in a normal state, the other of the main controller and the first redundant controller is upgraded to a new main controller and forms a fail-operable working group with the second redundant controller. Based on this, if either the new main controller or the second redundant controller fails, the only valid controller acts as the new main controller to control the vehicle to stop.

[0133] In some embodiments, when one of the main controller and the first redundant controller is in a failed state and the second redundant controller fails, the only valid controller acts as the new main controller to control the vehicle to stop.

[0134] In some embodiments, the intelligent driving control method further includes: when the main controller, the first redundant controller, and the second redundant controller are all effective, the main controller and the first redundant controller form a fail-operable working group, and the second redundant controller enters a standby state.

[0135] In some embodiments, the intelligent driving control method further includes: in the event that two of the main controller, the first redundant controller, and the second redundant controller fail, the other controller controls the vehicle to stop.

[0136] In some embodiments, if a controller fails and repair fails, and one of the two controllers that make up the failed workgroup also fails but self-repairs successfully before the failure is detected by the other controllers, the intelligent driving operation can continue to be performed without degrading the vehicle and without stopping the vehicle.

[0137] In some embodiments, the intelligent driving control method may further include: putting a controller in a malfunctioning state into a repair mode.

[0138] In some embodiments, the intelligent driving control method may further include: when one of the main controller or the first redundant controller is successfully repaired, the successfully repaired controller replaces the second redundant controller in the failed workgroup, and the second redundant controller enters a standby state.

[0139] In some embodiments, the intelligent driving control method further includes: submitting the status of a failed controller to a remote maintenance system.

[0140] In some embodiments, the intelligent driving control method may further include: sending warning information to the user. For example, when one of the main controller, the first redundant controller, and the second redundant controller fails, the status of the failed controller is submitted to a remote maintenance system, and a warning message may be sent to the user. When both of the main controller, the first redundant controller, and the second redundant controller fail, the status of the failed controller is submitted to the remote maintenance system, and a warning message is sent to the user.

[0141] Figure 6B A flowchart of another embodiment of the intelligent driving control method provided in this application is shown. The control method of an intelligent driving control system provided in another embodiment of this application may include the following steps: After the intelligent driving control system is powered on and initialized, step S10 is executed: the main controller and the first redundant controller form a fail-safe working group, and the second redundant controller is in standby mode.

[0142] The fail-operable working group is used to control the vehicle to perform driving operations, and it can ensure that the vehicle can perform intelligent driving operations without being affected even if either the main controller or the first redundant controller fails, thus guaranteeing the level of intelligent driving.

[0143] The controller in standby mode is in a low-power mode, and its microcontroller unit (MCU) can monitor the controller's status. Its computing unit 101 (see...) Figure 2C The microcontroller (MCU) is in a dormant state and does not operate. In standby mode, the MCU monitors the operating status of its own controller and other controllers (such as the main controller, the first redundant controller, and the second redundant controller), including the voltage and temperature of its own controller. When the MCU detects a failure in another controller, the MCU controls the computational unit (see...) Figure 2C It switches from dormant to active state and forms a fail-safe working group with the unceasing controller to control the vehicle to perform intelligent driving operations.

[0144] In some embodiments, any two of the main controller, the first redundant controller, and the second redundant controller may form a fail-safe working group. For example, the main controller and the second redundant controller may form a fail-safe working group, while the other one is in standby mode. This application does not limit this.

[0145] In some embodiments, the main controller, the first redundant controller, and the second redundant controller can be the same controller or different controllers. That is, the main controller, the first redundant controller, and the second redundant controller are all controllers with strong computing capabilities; or the main controller is a controller with strong computing capabilities, the first redundant controller is a controller with medium or strong computing capabilities, and the second redundant controller can be a controller with medium or weak computing capabilities.

[0146] In the event of a failure of the main controller, step S21 is executed: the first redundant controller and the second redundant controller form a fail-operable working group.

[0147] The main controller, the first redundant controller, and the second redundant controller can be interconnected to send or receive status and data from other controllers. In the event of a main controller failure, it can send signals to other controllers, and the first and second redundant controllers will form a fail-safe working group based on these signals. If the main controller is unable to send signals to other controllers due to failure, the other controllers can obtain the main controller's status through its MCU and adjust the type of controller in the fail-safe working group accordingly.

[0148] Step S31: The main controller enters online self-repair mode.

[0149] In some embodiments, a signal indicating a main controller failure can also be sent to the user, for example, by informing the user of the controller failure via IVI, or / or by submitting the status of the failed controller to a remote maintenance system. In the event that the main controller fails to self-repair online, the main controller can be repaired via a remote maintenance system or manually offline.

[0150] Step S41: Determine whether the main controller self-repair is successful. If the main controller self-repair is successful, execute step S10; if the main controller self-repair fails, execute step S21.

[0151] In the event of failure of the first redundant controller, step S22 is executed: the main controller and the second redundant controller form a fail-operable working group.

[0152] Step S32: The first redundant controller enters online self-repair mode.

[0153] In some embodiments, a signal indicating the failure of the first redundant controller can also be sent to the user, for example, by informing the user of the controller failure via IVI, or / and submitting the status of the failed controller to the remote maintenance system. If the online self-repair of the first redundant controller fails, the first redundant controller can be repaired via the remote maintenance system or manually offline. Step S42: Determine whether the self-repair of the first redundant controller is successful. If the self-repair of the first redundant controller is successful, execute step S10; if the self-repair of the first redundant controller fails, execute step S22.

[0154] In the event of failure of the second redundant controller, step S23 is executed: the main controller and the first redundant controller form a fail-operable working group.

[0155] Step S33: The second redundant controller enters online self-repair mode.

[0156] In some embodiments, a signal indicating a failure of the second redundant controller can also be sent to the user, for example, by informing the user of the controller failure via IVI, or / or by submitting the status of the failed controller to a remote maintenance system. If the online self-repair of the second redundant controller fails, it can be repaired via a remote maintenance system or manually offline.

[0157] Step S41: Determine whether the second redundant controller self-repair is successful. If the second redundant controller self-repair is successful, execute step S10; if the first redundant controller self-repair fails, execute step S23.

[0158] In some embodiments, in the event of failure of the main controller, the first redundant controller, or the second redundant controller, the failed controller is put into a self-repair mode, the status of the failed controller is submitted to the remote maintenance system, and a warning message is sent to the user.

[0159] In one possible implementation, in the event of failure of the main controller, the first redundant controller, or the second redundant controller, the failed controller enters a self-repair mode and submits the status of the failed controller to the remote maintenance system.

[0160] In the event of failure of any two of the main controller, the first redundant controller, and the second redundant controller, step S50 is executed: the only normal controller enters the safety mode and controls the vehicle to park in the appropriate position.

[0161] In some embodiments, an alarm message may also be sent to the user in the event of failure of any two of the main controller, the first redundant controller, and the second redundant controller.

[0162] Example 3: Intelligent Driving Control Device Figure 7 A schematic diagram of a module of an intelligent driving control device provided in an embodiment of this application is shown. Figure 7 As shown in the embodiment of this application, the intelligent driving control device is applied in an intelligent driving control system. The intelligent driving control system includes: a main controller, a first redundant controller, and a second redundant controller. The main controller and the first redundant controller form a working group for outputting vehicle control signals. The control device includes: an acquisition module 1000, which is used to acquire the status of the main controller, the first redundant controller, and the second redundant controller; and a determination module 2000, which is used to determine that when one of the main controller, the first redundant controller, and the second redundant controller is in a failed state and the second redundant controller is in a normal state, the one in the normal state of the main controller and the first redundant controller forms a failed but operable working group with the second redundant controller.

[0163] In some embodiments, the determining module is further configured to: when the main controller, the first redundant controller, and the second redundant controller are all effective, to enable the main controller and the first redundant controller to form a fail-operable working group, and to enable the second redundant controller to enter a standby state.

[0164] In some embodiments, the computing power of the second redundant controller is lower than that of the main controller or the first redundant controller.

[0165] In some embodiments, the determining module is further configured to: put the controller in a failure state into a repair mode.

[0166] In some embodiments, the main controller is connected to the first redundant controller and the second redundant controller, and the first redundant controller is connected to the second redundant controller to transmit the status of the main controller, the first redundant controller and the second redundant controller.

[0167] In some embodiments, the states of the main controller, the first redundant controller, and the second redundant controller are recorded in a controller state maintenance table, which is stored in the main controller, the first redundant controller, and the second redundant controller, respectively.

[0168] In some embodiments, when one controller is unable to send a status due to failure, since the other two controllers are respectively connected to the failed controller, after both of the other two controllers determine that the failed controller has failed, the other two controllers update the controller status maintenance table.

[0169] In some embodiments, the determining module is further configured to: when one of the main controller or the first redundant controller is successfully repaired, determine that the successfully repaired controller replaces the second redundant controller in the failed workgroup, and the second redundant controller enters a standby state.

[0170] In some embodiments, the determining module is further configured to: in the event of failure of two of the main controller, the first redundant controller, and the second redundant controller, cause the other controller to control the vehicle to stop.

[0171] In some embodiments, the determining module is further configured to: submit the status of the failed controller to a remote maintenance system.

[0172] In some embodiments, the method further includes sending an alert message to the user.

[0173] In some embodiments, in the event of failure of the main controller, the first redundant controller, or the second redundant controller, the status of the failed controller is submitted to the remote maintenance system, and an alert message is sent to the user.

[0174] In some embodiments, if two of the main controller, the first redundant controller, and the second redundant controller fail, the status of the failed controller is submitted to the remote maintenance system, and an alert message is sent to the user. In some embodiments, in the event of failure of the main controller, the first redundant controller, or the second redundant controller, the status of the failed controller is submitted to the remote maintenance system.

[0175] In some embodiments, the driving control system further includes sensors including a first vision sensor group, a detection sensor group, and a second vision sensor group, wherein the main controller is connected to the first vision sensor group, the detection sensor group, and the second vision sensor group; a first redundant controller is connected to the first vision sensor group and the detection sensor group; and a second redundant controller is connected to the detection sensor group and the second vision sensor group.

[0176] Example 4: Vehicle Embodiment 4 of this application provides a vehicle, including: the intelligent driving control system provided in Embodiment 1 of this application and / or the intelligent driving control device provided in Embodiment 3 of this application.

[0177] Example 5: Computing Device Figure 8 This is a schematic structural diagram of a computing device 1500 provided in an embodiment of this application. The computing device 1500 includes: a processor 1510, a memory 1520, a communication interface 1530, and a bus 1540.

[0178] It should be understood that Figure 8 The communication interface 1530 in the computing device 1500 shown can be used to communicate with other devices.

[0179] The processor 1510 can be connected to the memory 1520. The memory 1520 can be used to store the program code and data. Therefore, the memory 1520 can be a storage unit inside the processor 1510, an external storage unit independent of the processor 1510, or a component that includes both the storage unit inside the processor 1510 and the external storage unit independent of the processor 1510.

[0180] Optionally, the computing device 1500 may also include a bus 1540. The memory 1520 and communication interface 1530 can be connected to the processor 1510 via the bus 1540. The bus 1540 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus 1540 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 The symbol is represented by only one line, but this does not mean that there is only one bus or one type of bus.

[0181] It should be understood that in the embodiments of this application, the processor 1510 may be a central processing unit (CPU). The processor may also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor. Alternatively, the processor 1510 may employ one or more integrated circuits to execute relevant programs to implement the technical solutions provided in the embodiments of this application.

[0182] The memory 1520 may include read-only memory and random access memory, and provides instructions and data to the processor 1510. A portion of the processor 1510 may also include non-volatile random access memory. For example, the processor 1510 may also store device type information.

[0183] When the computing device 1500 is running, the processor 1510 executes the computer execution instructions in the memory 1520 to perform the operation steps of the intelligent driving control method provided in the embodiments of this application.

[0184] It should be understood that the computing device 1500 according to the embodiments of this application can correspond to the corresponding subject in executing the methods according to the various embodiments of this application, and the above and other operations and / or functions of each module in the computing device 1500 are respectively for implementing the corresponding processes of the methods of this embodiment. For the sake of brevity, they will not be described in detail here.

[0185] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0186] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0187] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0188] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0189] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0190] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0191] Example 6: Computer-readable storage medium This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, performs an intelligent driving control method, including at least one of the solutions described in the above embodiments.

[0192] The computer storage medium in this application embodiment can be any combination of one or more computer-readable media. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. For example, a computer-readable storage medium can be, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0193] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of sending, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0194] The program code contained on a computer-readable medium may be transmitted using any suitable medium, including, but not limited to, wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0195] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0196] Note that the above are merely preferred embodiments and the technical principles employed in this application. Those skilled in the art will understand that this application is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of this application. Therefore, although this application has been described in detail through the above embodiments, this application is not limited to the above embodiments. Many other equivalent embodiments may be included without departing from the concept of this application, all of which fall within the scope of protection of this application.

Claims

1. An intelligent driving control method, characterized in that, The intelligent driving control method is applied in an intelligent driving control system, which includes a main controller, a first redundant controller, and a second redundant controller. The control method includes: Obtain the status of the main controller, the first redundant controller, and the second redundant controller; When any one of the main controller, the first redundant controller, and the second redundant controller is in a failed state, two of the main controller, the first redundant controller, and the second redundant controller that are in a normal state are determined to form a failed workgroup for outputting vehicle control signals.

2. The control method according to claim 1, characterized in that, Also includes: When the main controller, the first redundant controller, and the second redundant controller are all effective, the main controller and the first redundant controller form a fail-safe working group, and the second redundant controller enters a standby state.

3. The control method according to claim 1 or 2, characterized in that, Also includes: This puts the controller in a faulty state into repair mode.

4. The control method according to any one of claims 1-3, characterized in that, Once either the main controller or the first redundant controller is successfully repaired, the successfully repaired controller replaces the second redundant controller in the failed workgroup, and the second redundant controller enters a standby state.

5. The control method according to any one of claims 1-4, characterized in that, Also includes: In the event of failure of two of the main controller, the first redundant controller, and the second redundant controller, the other controller will be used to stop the vehicle.

6. The control method according to any one of claims 1-5, characterized in that, Also includes: The status of the failed controller is submitted to the remote maintenance system.

7. The control method according to claim 5 or 6, characterized in that, Also includes: Send alert messages to users.

8. The control method according to any one of claims 1-7, characterized in that, The driving control system also includes a first vision sensor group, a detection sensor group, and a second vision sensor group, wherein... The main controller is connected to the first visual sensor group, the detection sensor group and the second visual sensor group; The first redundant controller is connected to the first visual sensor group and the detection sensor group; The second redundant controller is connected to the detection sensor group and the second vision sensor group.

9. The control method according to any one of claims 1-8, characterized in that, The main controller has higher computing power than the first redundant controller and the second redundant controller.

10. An intelligent driving control device, characterized in that, The intelligent driving control device is applied in an intelligent driving control system, which includes a main controller, a first redundant controller, and a second redundant controller. The control device includes: An acquisition module is used to acquire the status of the main controller, the first redundant controller, and the second redundant controller; The determination module is used to determine, when any one of the main controller, the first redundant controller, and the second redundant controller is in a failure state, two of the main controller, the first redundant controller, and the second redundant controller that are in normal state form a failure-operable working group, which is used to output vehicle control signals.

11. The control device according to claim 10, characterized in that, The determining module is further configured to: when the main controller, the first redundant controller, and the second redundant controller are all effective, to enable the main controller and the first redundant controller to form a fail-operable working group, and to enable the second redundant controller to enter a standby state.

12. The control device according to claim 10 or 11, characterized in that, The determining module is also used to: put the controller in a failed state into repair mode.

13. The control device according to any one of claims 10-12, characterized in that, The determining module is further configured to: when one of the main controller or the first redundant controller is successfully repaired, determine that the successfully repaired controller replaces the second redundant controller in the failed workgroup, and the second redundant controller enters a standby state.

14. The control device according to any one of claims 10-13, characterized in that, The determining module is also used to: in the event of failure of two of the main controller, the first redundant controller and the second redundant controller, cause the other controller to control the vehicle to stop.

15. The control device according to any one of claims 10-14, characterized in that, The determination module is also used to: submit the status of the failed controller to the remote maintenance system.

16. The control device according to claim 14 or 15, characterized in that, Also includes: Send alert messages to users.

17. The control device according to any one of claims 10-16, characterized in that, The driving control system also includes sensors including a first vision sensor group, a detection sensor group, and a second vision sensor group, wherein the main controller is connected to the first vision sensor group, the detection sensor group, and the second vision sensor group; The first redundant controller is connected to the first visual sensor group and the detection sensor group; The second redundant controller is connected to the detection sensor group and the second vision sensor group.

18. The control device according to any one of claims 10-17, characterized in that, The main controller has higher computing power than the first redundant controller and the second redundant controller.

19. An intelligent driving control system, characterized in that, include: Main controller, first redundant controller, and second redundant controller: The main controller is connected to the first vision sensor group and the second vision sensor group, and obtains first vision sensor data from the first vision sensor group and second vision sensor data from the second vision sensor group. The first redundant controller is connected to the first vision sensor group and obtains the first vision sensor data from the first vision sensor group; The second redundant controller is connected to the second vision sensor group and acquires the second vision sensor data from the second vision sensor group; The first visual sensor data includes forward-looking data, surround-looking data, and rear-looking data, and the second visual sensor data includes forward-looking data, side-looking data, and rear-looking data. The intelligent driving control system outputs control signals based on data acquired by at least two of the main controller, the first redundant controller, and the second redundant controller.

20. The control system according to claim 19, characterized in that, The main controller, the first redundant controller, and the second redundant controller are all connected to the detection sensor group and acquire detection sensor data from the detection sensor group.

21. The control system according to claim 20, characterized in that, The detection sensor data includes ultrasonic radar detection data and millimeter-wave radar detection data.

22. The control system according to any one of claims 19-21, characterized in that, When the main controller, the first redundant controller, and the second redundant controller are all effective, the main controller and the first redundant controller form a failure operation working group, and the second redundant controller is in standby mode.

23. The control system according to any one of claims 19-22, characterized in that, Also includes: The malfunctioning controller is under repair.

24. The control system according to any one of claims 19-23, characterized in that, When one of the main controllers or the first redundant controllers is successfully repaired, the successfully repaired controller replaces the second redundant controller in the failed workgroup, and the second redundant controller is in standby mode.

25. The control system according to any one of claims 19-24, characterized in that, Also includes: In the event of failure of two of the main controller, the first redundant controller, and the second redundant controller, the vehicle will be stopped by the other controller.

26. The control system according to any one of claims 19-25, characterized in that, Also includes: The status of the failed controller is submitted to the remote maintenance system.

27. The control system according to claim 25 or 26, characterized in that, Also includes: Send alert messages to users.

28. A vehicle, characterized in that, The vehicle includes a control device as described in any one of claims 10-18, or a control system as described in any one of claims 19-27.

Images