Mcu+soc architecture confidence reconfiguration and minimum risk degradation method
By monitoring the MCU to collect independent state vectors to construct deviation representations, correcting confidence levels, generating risk envelopes, and performing graded degradation, the problem of the MCU+SoC architecture being unable to identify systemic risks in ADAS and other scenarios in existing technologies is solved, achieving a balance between security and functional continuity.
Patent Information
- Application Number
- CN202610578682.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-04-29
- Publication Date
- 2026-07-03
AI Technical Summary
Existing technical solutions are difficult to adapt to complex ADAS, LiDAR and other scenarios in high-security MCU+SoC architectures, cannot effectively identify systemic risks, and are difficult to perform graded degradation to maintain functional continuity and security after a failure occurs.
By monitoring the MCU to collect independent state vectors, constructing a deviation quantification representation, correcting the original confidence level, generating a risk envelope and matching degradation actions, performing graded downgrading, and leaving observable evidence.
It achieves system-level credibility reconstruction, accurately identifies systemic risks, maintains the hierarchical degradation of execution functions to balance driving safety and functional continuity, and provides standardized external representations and evidence chains.
Smart Images
Figure CN122332349A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of intelligent vehicle technology, specifically to a method for confidence reconstruction and minimum risk degradation of MCU+SoC architecture. Background Technology
[0002] With the widespread deployment of ADAS, LiDAR, forward-looking integrated systems, and ADCU platforms, the perception, fusion, prediction, planning, and control algorithms undertaken by the main SoC are becoming increasingly complex, while the safety MCU is responsible for functional safety, monitoring, and restricted operation. New-generation high-safety MCUs and domain control platforms are beginning to cover scenarios such as ADAS, LiDAR, area control, and cockpit-driver fusion. The pain points in mass production have shifted from whether the system can output raw confidence levels to whether it can reconstruct system confidence using independent safety channels combined with mechanical actuators and vehicle kinematics information, and whether it can perform graded degradation in abnormal situations and leave verifiable external representations. Existing related technical solutions can be divided into the following three categories, but all of them have shortcomings in adapting to the above-mentioned mass production requirements: 1. The first type of solution mainly belongs to the main / auxiliary computer or main SoC / supervisory MCU architecture. The supervisory side makes simple approval or rejection based on the confidence level or threshold output by the main computer. Although this type of solution forms a two-layer judgment, it usually takes the original confidence level of the main SoC as the core and is difficult to cover the systemic risks caused by time synchronization anomalies, bus delay anomalies, actuator response anomalies and cross-sensor geometric inconsistencies. 2. The second type of solution mainly belongs to sensor health monitoring and fault diagnosis solutions. Its focus is on detecting sensor offline, occlusion, drift or bus faults. This type of solution can identify local faults, but it does not integrate these states with the main SoC model output, vehicle chassis physical feedback and geometric constraint residuals to form a unified system-level reliability metric. 3. The third type of solution mainly belongs to the minimum risk action or failure-operable control solution. Its focus is on stopping, speed limiting or switching modes after the system fails. However, for the actual mass-produced L2+ / L3 / high-level ADAS platform, it is difficult to take into account the function maintenance, driving experience and gradual degradation, and it is also difficult to form an externally observable evidence collection interface. Summary of the Invention
[0003] The purpose of this invention is to provide a method for confidence reconstruction and minimum risk degradation of MCU+SoC architecture to solve the problems mentioned in the background art.
[0004] To achieve the above objectives, this invention provides the following technical solution: a method for confidence reconstruction and minimum risk degradation of MCU+SoC architecture, comprising the following steps: Step 1, obtaining the original results; Step 2, collecting independent states; Step 3, constructing the deviation characterization; Step 4, generating confidence and risk envelopes; Step 5, matching degradation actions; Step 6, performing degradation and retaining observable evidence. In step one above, the main SoC outputs the raw results and the raw confidence level. In step two above, the monitoring MCU collects independent operating status data for verifying the output results of the main SoC and generates an independent status vector. The independent status vector is one or more of the following: sensor health status, time synchronization error, bus delay, steering actuator feedback deviation, wheel speed difference, yaw rate, braking pressure, braking torque feedback, power supply status, thermal status, and diagnostic code. In step three above, a deviation quantification representation is constructed based on the original results, original confidence level, and independent state vector. The deviation quantification representation is one or two of the following: inconsistency representation and physical constraint residual. The inconsistency representation is one or more of the following: inconsistency matrix, difference vector, and deviation set. The physical constraint residual is calculated based on the comparison results of two or more of the following: steering actuator feedback deviation, wheel speed difference, yaw rate, braking pressure feedback, and braking torque feedback with the main SoC output control intention. In step four above, the original confidence level is corrected by deviation quantification, the reconstructed confidence level is calculated, and the risk envelope and downgrade status certificate are generated based on the reconstructed confidence level. In step five above, when the risk envelope is lower than a preset threshold, the corresponding degradation action is matched from the degradation mode library. In step six above, the degradation action obtained from the matching is executed, the corresponding standardized degradation information is output synchronously, and an evidence summary of this degradation event is generated.
[0005] In step one, the main SoC executes one of the perception, fusion, prediction, planning, and control algorithms of intelligent driving, and outputs the original result and the corresponding original confidence level.
[0006] In step one, the original result is one or more of the following: target list, lane lines, free space, planned trajectory, or control command.
[0007] In step three, the deviation quantification is characterized by one or two of the following: inconsistency characterization and physical constraint residual. The inconsistency characterization is one or more of the following: inconsistency matrix, difference vector, and deviation set. The inconsistency matrix is one or more of the following differences: target position deviation between camera and LiDAR, trajectory deviation between adjacent time slices, deviation between prediction result and actuator feedback, and deviation between vehicle body state and perception output. The physical constraint residual is calculated based on the comparison results of two or more of the following: steering actuator feedback deviation, wheel speed difference, yaw rate, braking pressure feedback, and braking torque feedback with the main SoC output control intention.
[0008] In step four, when calculating the reconstruction confidence level, different penalty terms are set for bus risk, actuator risk, and sensor risk, so that the vehicle's mechanical physical feedback directly affects the final reconstruction confidence level value.
[0009] In step four, the reconstructed confidence level is obtained by subtracting two or more of the following from the original confidence level: sensor risk item, actuator risk item, bus risk item, time synchronization risk item, and deviation quantification characterization item. Each risk item is assigned a corresponding penalty coefficient based on the normalized value of the corresponding difference quantity and physical quantity.
[0010] In step four, the risk envelope is the boundary range of the intelligent driving functions that the system can currently maintain safely. When generating the risk envelope, in addition to reconstructing the confidence level, the environmental complexity parameters, vehicle speed, currently enabled intelligent driving function category, software version number, and device thermal state parameters are also combined for joint calculation. The degradation status certificate is one or more of the following: risk envelope level, degradation mode identifier, policy version number, event sequence number, and external degradation reason code identifier. The degradation status certificate can be queried, subscribed to, version compared, and event replayed through one or more of the following: upper-layer operating system, virtualization layer, SDK, middleware, and diagnostic services, so that it can be called by upper-layer applications, verification tools, and operation and maintenance tools.
[0011] In step five, after the degradation action is matched, a consistency check is performed, specifically: checking the consistency between the current degradation mode library version, software version, diagnostic status, OTA status, and hardware topology identifier; for the policy package corresponding to the degradation mode library, its digital signature and the adapted hardware topology identifier also need to be checked, and the corresponding degradation action is only allowed to be executed after all checks pass; wherein, the policy package is generated by one of the cloud or local policy generation modules based on the vehicle platform topology, sensor combination, function category, degradation mode library version, and risk threshold, and is sent to the vehicle end through an encrypted communication channel; the policy package includes one or more of the following: degradation mode library, risk threshold, credential generation rules, and version digest.
[0012] In step five, the degradation action is one or more of the following: reducing perception resolution, reducing model refresh rate, switching to a lightweight model, disabling high-risk assistance functions, speed limit, lane change restriction, requesting driver takeover, and minimum-risk parking. When matching degradation actions, the tiered degradation is performed according to the preset function priority. When multiple intelligent driving functions are simultaneously affected by risks, basic safety functions are retained first, including longitudinal control, basic lane keeping, basic obstacle detection, and emergency braking. Non-basic safety functions are disabled first, including automatic lane change, complex scene avoidance, and high-load visual enhancement.
[0013] In step six, the standardized degradation information is one or more of the following: standardized degradation reason code, status bitmap, risk envelope level, and degradation status certificate. It can be observed through external packet capture, diagnostic reading, and HMI status. The standardized degradation information is synchronously output to one or more of the following: vehicle CAN bus, CAN-FD bus, Ethernet diagnostic channel, UDS diagnostic service, vehicle HMI, upper-layer operating system, virtualization layer, SDK, and middleware interface. The evidence digest needs to be executed through one or two of the following protection operations: digital signature and integrity protection, via hardware security module and trusted execution environment.
[0014] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention does not directly adopt the original confidence level output by the main SoC, but performs secondary verification through independent state vectors obtained by independent MCUs, which is more in line with the engineering design ideas of functional safety and SOTIF; by incorporating sensor health, time synchronization, bus status, actuator feedback and physical constraints into the confidence level reconstruction system, it can more accurately reflect the real risks of the system compared with single-point diagnosis or single-point confidence level judgment; through the linkage of risk envelope and degradation mode library, it performs hierarchical degradation according to function priority, taking into account both driving safety and functional continuity. Attached Figure Description
[0015] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a schematic diagram of the experimental system architecture of the present invention; Figure 3 This is a schematic diagram illustrating the relationship between confidence level and degradation mode. Detailed Implementation
[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0017] Please see the appendix Figure 1 - Appendix Figure 3 The present invention provides an embodiment of a confidence reconstruction and minimum risk degradation method for MCU+SoC architecture, comprising the following steps: Step 1, obtaining the original results; Step 2, collecting independent states; Step 3, constructing the deviation characterization; Step 4, generating confidence and risk envelopes; Step 5, matching degradation actions; Step 6, performing degradation and retaining observable evidence. In step one above, the main SoC outputs the raw results and raw confidence scores. The main SoC outputs the raw results and corresponding raw confidence scores by executing one of the intelligent driving perception, fusion, prediction, planning, and control algorithms. The raw results can be one or more of the following: target list, lane lines, free space, planned trajectory, or control commands. In step two above, the monitoring MCU collects independent operating status data for verifying the output results of the main SoC and generates an independent status vector. The independent status vector is one or more of the following: sensor health status, time synchronization error, bus delay, steering actuator feedback deviation, wheel speed difference, yaw rate, braking pressure, braking torque feedback, power supply status, thermal status, and diagnostic code. In step three above, a deviation quantification representation is constructed based on the original results, original confidence levels, and independent state vectors. This deviation quantification representation is one or more of inconsistency representation and physical constraint residuals. The inconsistency representation is one or more of inconsistency matrix, difference vector, and deviation set. The inconsistency matrix represents one or more differences among the following: target position deviation between the camera and LiDAR, trajectory deviation between adjacent time slices, deviation between prediction results and actuator feedback, and deviation between vehicle body state and perception output. The physical constraint residuals are calculated based on the comparison between two or more of the following: steering actuator feedback deviation, wheel speed difference, yaw rate, braking pressure feedback, and braking torque feedback, and the control intent output by the main SoC. In step four above, the original confidence level is corrected through deviation quantification to calculate the reconstructed confidence level, and a risk envelope and degradation status certificate are generated based on the reconstructed confidence level. When calculating the reconstructed confidence level, different penalty terms are set for bus risk, actuator risk, and sensor risk, so that the vehicle's mechanical physical feedback directly affects the final reconstructed confidence level value. The reconstructed confidence level is obtained by subtracting two or more of the following from the original confidence level: sensor risk, actuator risk, bus risk, time synchronization risk, and deviation quantification. Each risk term has a corresponding penalty coefficient set according to the normalized value of the corresponding difference or physical quantity. The risk envelope is... The current safe maintenance boundary range of intelligent driving functions of the system; when generating the risk envelope, in addition to reconstructing the confidence level, it also combines environmental complexity parameters, vehicle speed, currently enabled intelligent driving function category, software version number, and device thermal state parameters for joint calculation; the degradation status certificate is one or more of the following: risk envelope level, degradation mode identifier, policy version number, event sequence number, and external degradation reason code identifier. The degradation status certificate can be queried, subscribed to, version compared, and event replayed through one or more of the following: upper-layer operating system, virtualization layer, SDK, middleware, and diagnostic services, so that it can be called by upper-layer applications, verification tools, and operation and maintenance tools; In step five above, when the risk envelope is lower than a preset threshold, a corresponding degradation action is matched from the degradation mode library. After the degradation action is matched, a consistency check is performed, specifically verifying the consistency between the current degradation mode library version, software version, diagnostic status, OTA status, and hardware topology identifier. For the policy package corresponding to the degradation mode library, its digital signature and the adapted hardware topology identifier must also be verified. Only after all checks pass can the corresponding degradation action be executed. The policy package is generated by either a cloud-based or local policy generation module based on the vehicle platform topology, sensor combination, function category, degradation mode library version, and risk threshold, and is distributed via an encrypted communication channel. To the vehicle end; the strategy package includes one or more of the following: a degradation mode library, risk thresholds, credential generation rules, and version summaries; degradation actions include one or more of the following: reducing perception resolution, reducing model refresh rate, switching to a lightweight model, disabling high-risk assistance functions, speed limit, lane change restriction, requesting driver takeover, and minimum-risk parking; when matching degradation actions, the system performs graded degradation according to the preset function priority; when multiple intelligent driving functions are simultaneously affected by risks, basic safety functions are retained first, specifically including longitudinal control, basic lane keeping, basic obstacle detection, and emergency braking, while non-basic safety functions are disabled first, specifically including automatic lane change, complex scene avoidance, and high-load visual enhancement; In step six above, the matched degradation action is executed, the corresponding standardized degradation information is output synchronously, and an evidence summary of this degradation event is generated. The standardized degradation information is one or more of the following: standardized degradation reason code, status bitmap, risk envelope level, and degradation status certificate. It can be observed through external packet capture, diagnostic reading, and HMI status. The standardized degradation information is synchronously output to one or more of the following: vehicle CAN bus, CAN-FD bus, Ethernet diagnostic channel, UDS diagnostic service, vehicle HMI, upper-layer operating system, virtualization layer, SDK, and middleware interface. The evidence summary needs to be executed through one or two of the following protection operations: digital signature and integrity protection, via hardware security module and trusted execution environment.
[0018] Experimental example: To verify the effectiveness of this invention, the following experiment was conducted: This experimental example was applied to an ADAS forward-looking integrated machine scenario, where the ADAS forward-looking integrated machine was equipped with a system built based on this invention; the main SoC executed perception and planning algorithms, outputting a target list and a planned trajectory, corresponding to a relatively high initial confidence level; three types of fault stimuli were sequentially injected into the ring test bench via hardware: the LiDAR point cloud echo intensity was reduced from 8-100dB under normal operating conditions to 30-40dB to simulate a decrease in echo quality; the time synchronization error between the main SoC and the LiDAR was increased from less than 1ms to 15-20ms; and the angle feedback hysteresis of the steering actuator was increased from less than 50ms to 200-250ms; the monitoring MCU independently collected and detected the abnormal states of decreased LiDAR echo quality, increased time synchronization error, and hysteresis in steering actuator feedback; the system constructed an inconsistent system based on the above abnormal information. The residuals of characterization and physical constraints are used to correct the original confidence level, resulting in a lower reconstructed confidence level and generating a risk envelope with a narrower scope. The system performs graded degradation based on the risk envelope and functional retention priority, disabling the automatic lane change function while retaining basic longitudinal control and emergency braking functions. Simultaneously, it outputs degradation reason codes, risk envelope levels, and degradation status credentials to the vehicle bus, diagnostic interface, and HMI, and generates an evidence digest, completing the external characterization and evidence collection for degradation decisions. Experimental results show that this invention does not directly accept the high original confidence level output by the main SoC, but instead completes system-level confidence reconstruction through multi-source physical quantities collected via an independent secure channel. It accurately identifies systemic risks not perceived by the main SoC, executes graded degradation actions that balance safety and functional continuity, and all degradation decisions have standardized externally observable characterizations and verifiable evidence chains, verifying the effectiveness of this invention.
[0019] Based on the above, the advantages of this invention are as follows: When in use, it performs secondary verification by independently collecting physical quantities such as actuator feedback, wheel speed difference, yaw rate, and braking feedback through an MCU, which is more in line with functional safety and SOTIF engineering principles; by unifying sensor health, time synchronization, bus status, actuator feedback, and physical constraints into the reconstructed confidence level, it better reflects the real system risk compared to single-point diagnosis or single-point confidence level judgment; through the linkage of risk envelope and degradation mode library, it does not simply perform fixed actions, but executes graded degradation according to functional priority, balancing safety and functional continuity; by outputting standardized degradation reason codes, status bitmaps, and evidence summaries, it makes external diagnosis, HIL testing, and infringement evidence collection easier.
[0020] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.
Claims
1. Confidence reconstruction and minimum risk degradation method for MCU+SoC architecture, including the following steps: Step 1: Obtaining raw results; Step 2: Collecting independent states; Step 3: Constructing bias characterization; Step 4: Generating confidence and risk envelope; Step 5: Matching degraded actions; Step 6: Degradation execution and observable evidence retention; Its characteristics are: In step one above, the main SoC outputs the raw results and the raw confidence level. In step two above, the monitoring MCU collects independent operating status data for verifying the output results of the main SoC and generates an independent status vector. The independent status vector is one or more of the following: sensor health status, time synchronization error, bus delay, steering actuator feedback deviation, wheel speed difference, yaw rate, braking pressure, braking torque feedback, power supply status, thermal status, and diagnostic code. In step three above, a deviation quantification representation is constructed based on the original results, original confidence level, and independent state vector. The deviation quantification representation is one or two of the following: inconsistency representation and physical constraint residual. The inconsistency representation is one or more of the following: inconsistency matrix, difference vector, and deviation set. The physical constraint residual is calculated based on the comparison results of two or more of the following: steering actuator feedback deviation, wheel speed difference, yaw rate, braking pressure feedback, and braking torque feedback with the main SoC output control intention. In step four above, the original confidence level is corrected by deviation quantification, the reconstructed confidence level is calculated, and the risk envelope and downgrade status certificate are generated based on the reconstructed confidence level. In step five above, when the risk envelope is lower than a preset threshold, the corresponding degradation action is matched from the degradation mode library. In step six above, the degradation action obtained from the matching is executed, the corresponding standardized degradation information is output synchronously, and an evidence summary of this degradation event is generated.
2. The MCU+SoC architecture confidence reconstruction and minimum risk degradation method according to claim 1, characterized in that: In step one, the main SoC executes one of the perception, fusion, prediction, planning, and control algorithms of intelligent driving, and outputs the original result and the corresponding original confidence level.
3. The MCU+SoC architecture confidence reconstruction and minimum risk degradation method according to claim 1, characterized in that: In step one, the original result is one or more of the following: target list, lane lines, free space, planned trajectory, or control command.
4. The MCU+SoC architecture confidence reconstruction and minimum risk degradation method according to claim 1, characterized in that: In step three, the inconsistency matrix is one or more of the following: target position deviation between the camera and LiDAR, trajectory deviation between adjacent time slices, deviation between prediction results and actuator feedback, and deviation between vehicle body state and perception output.
5. The MCU+SoC architecture confidence reconstruction and minimum risk degradation method according to claim 1, characterized in that: In step four, when calculating the reconstruction confidence level, different penalty terms are set for bus risk, actuator risk, and sensor risk, so that the vehicle's mechanical physical feedback directly affects the final reconstruction confidence level value.
6. The MCU+SoC architecture confidence reconstruction and minimum risk degradation method according to claim 1, characterized in that: In step four, the reconstructed confidence level is obtained by subtracting two or more of the following from the original confidence level: sensor risk item, actuator risk item, bus risk item, time synchronization risk item, and deviation quantification characterization item. Each risk item is assigned a corresponding penalty coefficient based on the normalized value of the corresponding difference quantity and physical quantity.
7. The MCU+SoC architecture confidence reconstruction and minimum risk degradation method according to claim 1, characterized in that: In step four, the risk envelope is the boundary range of the intelligent driving functions that the system can currently maintain safely. When generating the risk envelope, in addition to reconstructing the confidence level, the environmental complexity parameters, vehicle speed, currently enabled intelligent driving function category, software version number, and device thermal state parameters are also combined for joint calculation. The degradation status certificate is one or more of the following: risk envelope level, degradation mode identifier, policy version number, event sequence number, and external degradation reason code identifier. The degradation status certificate can be queried, subscribed to, version compared, and event replayed through one or more of the following: upper-layer operating system, virtualization layer, SDK, middleware, and diagnostic services, so that it can be called by upper-layer applications, verification tools, and operation and maintenance tools.
8. The MCU+SoC architecture confidence reconstruction and minimum risk degradation method according to claim 1, characterized in that: In step five, after the degradation action is matched, a consistency check is performed, specifically: checking the consistency between the current degradation mode library version, software version, diagnostic status, OTA status, and hardware topology identifier; for the policy package corresponding to the degradation mode library, its digital signature and the adapted hardware topology identifier also need to be checked, and the corresponding degradation action is only allowed to be executed after all checks pass; wherein, the policy package is generated by one of the cloud or local policy generation modules based on the vehicle platform topology, sensor combination, function category, degradation mode library version, and risk threshold, and is sent to the vehicle end through an encrypted communication channel; the policy package includes one or more of the following: degradation mode library, risk threshold, credential generation rules, and version digest.
9. The MCU+SoC architecture confidence reconstruction and minimum risk degradation method according to claim 1, characterized in that: In step five, the degradation action is one or more of the following: reducing perception resolution, reducing model refresh rate, switching to a lightweight model, disabling high-risk assistance functions, speed limit, lane change restriction, requesting driver takeover, and minimum-risk parking. When matching degradation actions, the tiered degradation is performed according to the preset function priority. When multiple intelligent driving functions are simultaneously affected by risks, basic safety functions are retained first, including longitudinal control, basic lane keeping, basic obstacle detection, and emergency braking. Non-basic safety functions are disabled first, including automatic lane change, complex scene avoidance, and high-load visual enhancement.
10. The MCU+SoC architecture confidence reconstruction and minimum risk degradation method according to claim 1, characterized in that: In step six, the standardized degradation information is one or more of the following: standardized degradation reason code, status bitmap, risk envelope level, and degradation status certificate. It can be observed through external packet capture, diagnostic reading, and HMI status. The standardized degradation information is synchronously output to one or more of the following: vehicle CAN bus, CAN-FD bus, Ethernet diagnostic channel, UDS diagnostic service, vehicle HMI, upper-layer operating system, virtualization layer, SDK, and middleware interface. The evidence digest needs to be executed through one or two of the following protection operations: digital signature and integrity protection, via hardware security module and trusted execution environment.