Intelligent networked automobile domain controller integration function intelligent control method and system

Abstract

The application relates to the technical field of intelligent networked vehicles, and provides an intelligent networked vehicle domain controller integration function intelligent control method and system, which comprises the following steps: interrupting the execution of a continuous automatic driving task at a suitable interrupt point, and recovering the control resources occupied by the continuous automatic driving task; cleaning up a to-be-sent instruction queue of the continuous automatic driving task, and performing compensatory processing on irreversible instructions that have entered a sending process to obtain a compensatory processing result; generating a time-sequenced emergency control instruction sequence according to an emergency control request, the recovered control resources and the compensatory processing result; and issuing the time-sequenced emergency control instruction sequence to a vehicle execution mechanism to realize execution, and generating an emergency control execution result according to execution feedback. The application has the effect of improving the response speed and controllability of the intelligent networked vehicle.

Description

Technical Field

[0001] This invention relates to the technical field of intelligent connected vehicles, and specifically to an intelligent control method and system for integrating domain controller functions in intelligent connected vehicles. Background Technology

[0002] In the normal execution of domain controllers in intelligent connected vehicles, to achieve coordinated control and dynamic resource allocation of multi-functional modules, commands are typically sent sequentially to interfaces such as the powertrain and chassis according to predetermined control cycles and task categories to maintain stable vehicle operation under normal conditions. In real-world scenarios such as high-speed lane changing, where the vehicle is in the process of autonomous driving and following another vehicle, the domain controller continuously receives and processes continuous control requests such as path tracking, longitudinal acceleration / deceleration, and lateral steering fine-tuning. At this point, task priority determination and preemption occur at the intersection of continuous autonomous driving control tasks and potential emergencies. If the preceding vehicle suddenly decelerates or a neighboring vehicle encroaches on the lane, the vehicle's risk level increases rapidly, and the system needs to immediately generate control requests related to emergency braking and vehicle stability.

[0003] However, since the existing continuous trajectory and longitudinal control tasks still occupy the processing chain, when an emergency task enters, if the priority determination is still executed according to the order of acceptance of regular cycle tasks, or if the preemption and transfer conditions do not cover the ongoing control chain, the nominally higher-priority emergency task will not be able to immediately obtain an execution entry point. This causes emergency braking requests to wait for the current control cycle to end, or to wait for the trajectory control chain that has been sent but not yet completed to release resources, resulting in braking commands, steering stability correction commands, and the original continuous control commands coexisting in a short window with a mismatch in sequence, leading to priority reversal. Existing conventional methods usually rely on static task priority division and lack a dynamic identification and interruption mechanism for the status of ongoing continuous control chains, making it difficult to quickly identify and rearrange the acceptance order of critical tasks when multiple tasks are concurrent. One specific technical problem arising from this is that during high-speed lane change, when the continuous trajectory control task of autonomous driving has occupied the domain controller's execution chain and the vehicle in front suddenly decelerates and triggers an emergency braking request, the original control sequence is not interrupted in time due to the failure of task priority reordering. This results in the emergency braking and vehicle stability control being placed later in the execution chain, which in turn affects the domain controller's coordinated control of power, chassis and autonomous driving tasks.

[0004] To address the aforementioned issues, existing technologies urgently need improvement. Summary of the Invention

[0005] This application discloses an intelligent control method and system for integrated functions of a domain controller in intelligent connected vehicles, aiming to solve the technical problem that emergency control tasks cannot be executed in a timely manner due to priority reversal in the prior art.

[0006] The technical solution of this application is as follows:

[0007] In a first aspect, this application discloses an intelligent control method for integrated functions of a domain controller in a smart connected vehicle, comprising:

[0008] Acquire vehicle motion status information, external environment information, and domain controller task running status information; the domain controller task running status information includes the running status, resource usage status, and command sending status of each task within the domain controller;

[0009] Based on external environmental information and vehicle motion status information, assess the risk level faced by the vehicle, and generate an emergency control request when the risk level reaches a preset risk threshold.

[0010] Based on the domain controller task running status information, identify the continuously automated driving task currently occupying control resources, and identify the execution stage of the continuously automated driving task;

[0011] By combining vehicle motion status information, the execution stage of the continuous autonomous driving task, resource occupancy status, and risk level, the appropriate time to interrupt the continuous autonomous driving task is determined.

[0012] At an appropriate time to interrupt, the execution of the continuous autonomous driving task is interrupted, and the control resources occupied by the continuous autonomous driving task are reclaimed.

[0013] The queue of pending instructions for continuous autonomous driving tasks is cleared, and compensatory processing is performed on irreversible instructions that have entered the sending process to obtain the compensatory processing result.

[0014] Based on the emergency control request, the recovered control resources, and the results of compensatory processing, a time-sequential sequence of emergency control instructions is generated.

[0015] The time-sequenced emergency control command sequence is sent to the vehicle actuators for execution, and the emergency control execution result is generated based on the execution feedback.

[0016] This technical solution enables dynamic identification of the execution status of continuous autonomous driving tasks, accurately determines the time of task interruption and recovers control resources when an emergency risk occurs, effectively solves the priority reversal problem between emergency control requests and continuous autonomous driving tasks, and ensures rapid preemption and coordinated control of emergency control resources.

[0017] Secondly, this application also discloses an intelligent control system with integrated domain controller functions for intelligent connected vehicles, comprising:

[0018] The multi-source information acquisition module is used to acquire vehicle motion status information, external environment information, and domain controller task running status information; the domain controller task running status information includes the running status, resource occupancy status, and command sending status of each task within the domain controller.

[0019] The control request generation module is used to assess the risk level faced by the vehicle based on external environmental information and vehicle motion status information, and generate an emergency control request when the risk level reaches a preset risk threshold.

[0020] The task phase identification module is used to identify the continuously automated driving task currently occupying control resources and to identify the execution phase of the continuously automated driving task based on the domain controller task running status information.

[0021] The interruption timing determination module is used to determine the appropriate interruption timing for the continuous autonomous driving task by combining vehicle motion state information, execution stage of the continuous autonomous driving task, resource occupancy status, and risk level.

[0022] The interruption timing execution module is used to interrupt the execution of the continuous autonomous driving task at an appropriate interruption time and reclaim the control resources occupied by the continuous autonomous driving task.

[0023] The compensation processing execution module is used to clear the queue of instructions to be sent for continuous autonomous driving tasks and to perform compensatory processing on irreversible instructions that have entered the sending process to obtain the compensation processing result.

[0024] The instruction sequence generation module is used to generate a time-arranged emergency control instruction sequence based on the emergency control request, the reclaimed control resources, and the results of compensatory processing.

[0025] The execution result generation module is used to send the time-sequenced emergency control command sequence to the vehicle actuator for execution, and generate emergency control execution results based on the execution feedback.

[0026] This technical solution enables real-time monitoring of domain controller task status and dynamic preemption of emergency control resources through modular design, providing reliable system architecture support for the aforementioned methods, ensuring the timely generation and execution of emergency control commands, and improving the system's real-time response capability and control reliability.

[0027] Beneficial Effects: This application effectively solves the problem in existing technologies where emergency control tasks cannot be executed in a timely manner due to priority reversal by acquiring domain controller task running status information, dynamically identifying the execution stage and resource consumption of continuous autonomous driving tasks, and determining appropriate interruption points based on vehicle motion status and risk level. By clearing the queue of instructions to be sent and compensating for irreversible instructions that have already entered the sending process, conflicts between emergency braking and original control instructions are avoided, ensuring the stability and safety of the vehicle when performing emergency avoidance operations. Simultaneously, by generating an emergency control instruction sequence through timing orchestration, coordinated control of the vehicle's actuators is achieved, improving the response speed and controllability of intelligent connected vehicles in sudden risk scenarios. Attached Figure Description

[0028] Figure 1 This is a flowchart of a method for intelligent control of an integrated function of a domain controller for intelligent connected vehicles, as described in one embodiment of the present invention.

[0029] Figure 2 This is a schematic diagram of the overall architecture of the intelligent control method for the integrated function of the intelligent connected vehicle domain controller in this invention;

[0030] Figure 3 This is a system block diagram of an intelligent control system for an intelligent connected vehicle domain controller with integrated functions, as described in another embodiment of the present invention.

[0031] Explanation of reference numerals in the attached figures:

[0032] 1. Intelligent connected vehicle domain controller integrated intelligent control system; 11. Multi-source information acquisition module; 12. Control request generation module; 13. Task stage identification module; 14. Interruption time point determination module; 15. Interruption time point execution module; 16. Compensation processing execution module; 17. Instruction sequence generation module; 18. Execution result generation module. Detailed Implementation

[0033] The technical solutions of this application will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this application, and not all embodiments. The components of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0034] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0035] This application proposes an intelligent control method for integrated functions of a domain controller in intelligent connected vehicles, combining... Figure 1 and Figure 2 As shown, it includes:

[0036] S1, acquire vehicle motion status information, external environment information, and domain controller task running status information; the domain controller task running status information includes the running status, resource occupancy status, and command sending status of each task within the domain controller;

[0037] S2 assesses the risk level faced by the vehicle based on external environmental information and vehicle motion status information, and generates an emergency control request when the risk level reaches a preset risk threshold.

[0038] S3, based on the domain controller task running status information, identifies the currently occupying continuous autonomous driving task and identifies the execution stage of the continuous autonomous driving task;

[0039] S4. Based on the vehicle motion status information, the execution stage of the continuous autonomous driving task, the resource occupancy status, and the risk level, determine the appropriate time to interrupt the continuous autonomous driving task.

[0040] S5, at an appropriate interruption point, interrupts the execution of the continuous autonomous driving task and reclaims the control resources occupied by the continuous autonomous driving task;

[0041] S6, clear the queue of instructions to be sent for the continuous autonomous driving task, and perform compensatory processing on irreversible instructions that have entered the sending process to obtain the compensatory processing result.

[0042] S7 generates a time-series-arranged sequence of emergency control instructions based on the emergency control request, the recovered control resources, and the results of compensatory processing.

[0043] S8 sends the time-series emergency control command sequence to the vehicle actuators for execution, and generates emergency control execution results based on the execution feedback.

[0044] To make the technical solution of this application easier and clearer to understand, some key terms involved will be explained first.

[0045] "Vehicle motion status information" refers to data describing the current motion of a vehicle, such as vehicle speed, acceleration, yaw rate, lateral acceleration, and steering angle. This information can be obtained through sensors inside the vehicle (such as wheel speed sensors and inertial measurement units, IMUs).

[0046] "External environment information" refers to data about the vehicle's surroundings, such as distance to obstacles ahead, relative speed, lane markings, traffic signs, and the positions of other vehicles. This information can be acquired using environmental perception sensors such as LiDAR, millimeter-wave radar, and cameras.

[0047] "Domain controller task running status information" refers to the running status of various tasks within the domain controller, including the running status of tasks (such as running, paused, completed), resource usage status (such as CPU usage, memory usage, and communication bandwidth usage), and instruction sending status (such as whether the instruction has been sent or has entered the execution mechanism).

[0048] "Continuous autonomous driving tasks" refer to functional tasks that require continuous use of control resources to maintain the vehicle's automatic driving in autonomous driving mode, such as highway navigation, automatic parking, and adaptive cruise control.

[0049] "Irreversible commands" refer to control commands that, once sent to the vehicle's actuators, cannot be directly revoked or immediately stopped in their physical effect. Examples include braking commands that have entered the brake line pressurization process or steering commands that have entered the steering motor execution process.

[0050] "Compensatory processing" refers to generating additional control commands to offset or correct the physical effects of irreversible commands that have already been sent, in order to avoid adverse effects on emergency control.

[0051] "Timing orchestration" refers to prioritizing and scheduling multiple control commands based on emergency control needs and the real-time status of the vehicle to ensure that they are executed in the optimal order and at the right time.

[0052] This application provides an intelligent control method for integrated functions of a domain controller in intelligent connected vehicles, the main features of which can be implemented in the following ways:

[0053] There are multiple methods for acquiring vehicle motion status information, external environment information, and domain controller task operation status information. For example, vehicle motion status information can be obtained in real time by reading data from wheel speed sensors and inertial measurement units (IMUs) via the vehicle's CAN bus; external environment information can be obtained by fusing data from multiple environmental perception sensors such as LiDAR, millimeter-wave radar, and cameras; and domain controller task operation status information can be queried and monitored through the task scheduling and resource management modules within the domain controller. Alternatively, this information can be subscribed to from a vehicle data platform via a unified data interface, where it undergoes preliminary processing and integration.

[0054] To assess the risk level faced by a vehicle based on external environmental information and vehicle motion status information, and to generate an emergency control request when the risk level reaches a preset risk threshold, a rule-based approach can be adopted. For example, a series of risk assessment rules can be preset, such as current distance to the vehicle being less than a safe distance, excessive relative speed, or severe lane departure. When any of these rules is met, the risk level is determined to have reached the preset risk threshold, and an emergency braking request is generated. As another implementation method, a machine learning-based model can be used. By training on a large amount of driving scenario data, the model learns the mapping relationship between vehicle motion status, external environmental information, and risk level, thereby more accurately assessing the risk level.

[0055] To identify continuously automated driving tasks currently consuming control resources based on domain controller task running status information, and to identify the execution phase of these tasks, a task scheduler within the domain controller can maintain a task list, recording each task's ID, status, CPU, memory, communication bandwidth, and other resource information. When a task is marked as "running" and continuously occupies critical control resources, it is identified as a continuously automated driving task. Its execution phase can be identified through the task's internal state machine; for example, an automated lane-changing task might include a "decision-making phase," a "path planning phase," and a "trajectory tracking phase." Alternatively, the execution phase can be inferred by monitoring the frequency and content of commands sent by the task to specific actuators (such as steering motors and braking systems).

[0056] To determine the appropriate timing for interrupting a continuous autonomous driving task by combining vehicle motion state information, the execution phase of the task, resource occupancy status, and risk level, a decision tree-based or state machine-based approach can be used. For example, when the risk level reaches a preset threshold, the system checks whether the continuous autonomous driving task is in the "decision-making phase" or "path planning phase." In this case, interruption has minimal impact on vehicle dynamics and can be stopped immediately. If the task is in the "trajectory tracking phase" and some instructions have already been sent, then it is necessary to combine the vehicle's current speed, steering angle, and other motion state information, as well as resource occupancy, to select a timing that minimizes the impact of interruption. Alternatively, a reinforcement learning model can be used. By training in a simulation environment, the optimal interruption timing strategy can be learned under different vehicle states, task phases, and risk levels.

[0057] To interrupt the execution of a continuous autonomous driving task at an appropriate time and reclaim the control resources it occupies, the domain controller task scheduler can send an interrupt signal to the task, causing it to enter a paused or terminated state. Simultaneously, the resource management module will reclaim the CPU, memory, communication bandwidth, and other control resources previously occupied by the task and mark them as available. Alternatively, the interrupt can be achieved by forcibly terminating the task process, with the operating system or hypervisor automatically reclaiming its occupied resources.

[0058] In clearing the queue of pending commands for continuous autonomous driving tasks and performing compensatory processing on irreversible commands that have already entered the sending process, the domain controller communication module can freeze the command queue corresponding to the task and delete commands that have not yet been sent. For commands that have been sent but have not yet produced physical effects, cancellation can be attempted by sending a cancellation command. For irreversible commands that have entered the sending process and cannot be directly cancelled, such as braking commands that have entered the brake line pressurization process, it is necessary to generate reverse or corrective compensation commands based on their type and expected physical effects. For example, a reverse steering torque command could be sent to counteract the effects of the irreversible command.

[0059] In generating a time-sequential sequence of emergency control commands based on emergency control requests, recovered control resources, and compensatory processing results, the emergency control module can time-sequence emergency braking commands, steering stability control commands, etc., according to the priority and timeliness of emergency control requests (such as emergency braking and emergency steering), combined with currently available control resources and compensatory processing results for irreversible commands. For example, emergency braking commands usually have the highest priority and need to be sent immediately; if there is an irreversible steering command, the compensatory steering command may need to be sent simultaneously with or slightly earlier than the emergency braking command to ensure vehicle attitude stability.

[0060] In terms of sending the time-programmed emergency control command sequence to the vehicle actuators for execution and generating emergency control execution results based on execution feedback, the domain controller communication module can send the time-programmed emergency control command sequence to vehicle actuators such as the braking system, steering system, and powertrain system via CAN bus or other high-speed communication interfaces. After receiving and executing the commands, the actuators will provide feedback on the actual execution status (such as actual braking pressure and actual steering angle) through sensors. Based on this feedback information, the domain controller evaluates the execution effect of the emergency control and generates emergency control execution results, such as whether a collision was successfully avoided and whether the vehicle is stable.

[0061] Optionally, the steps of clearing the queue of pending commands for continuous autonomous driving tasks and performing compensatory processing on irreversible commands that have already entered the transmission process to obtain a compensatory processing result; and generating a time-arranged emergency control command sequence based on the emergency control request, the reclaimed control resources, and the compensatory processing result include:

[0062] Freeze the queue of instructions to be sent corresponding to the continuous autonomous driving task, and identify the instructions to be sent that have not yet been written to the sending buffer and the irreversible instructions that have entered the sending process; among them, the irreversible instructions that have entered the sending process are control instructions that have been written to the sending buffer or have entered the actuator interface and cannot be directly revoked.

[0063] Delete the pending instructions that have not yet been written to the sending buffer from the pending instruction queue corresponding to the continuous autonomous driving task to obtain a cleaned pending instruction queue, and determine the writing order of emergency control instructions based on the cleaned pending instruction queue;

[0064] When there is an irreversible command that has entered the sending process, the control dimension of the irreversible command is parsed and the lateral target turning angle information in the irreversible command is extracted. The control dimension is used to characterize the vehicle control direction or execution object corresponding to the irreversible command, including one or more of the following: longitudinal braking control dimension, lateral steering control dimension, yaw stability control dimension or vehicle attitude control dimension.

[0065] Determine whether the absolute value of the lateral target turning angle information is greater than the linear stable steering angle threshold at the current vehicle speed;

[0066] When the absolute value of the lateral target turning angle information is less than or equal to the linear stable turning angle threshold, the first emergency braking command is allowed to be written into the transmission buffer according to the normal emergency braking timing.

[0067] When the absolute value of the lateral target turning angle information is greater than the linear stable turning angle threshold, the boost gradient of the first emergency braking command to be written to the transmission buffer is limited, and the maximum allowable braking pressure of the first emergency braking command is set to the remaining braking force margin after subtracting the lateral force required for the current irreversible angle from the tire friction limit.

[0068] Based on the limited boost gradient and the maximum permissible braking pressure, a limited emergency braking command is generated;

[0069] Based on the direction and magnitude of the irreversible command, the reverse compensation torque is calculated and converted into an asymmetric single-sided wheel pre-braking command. The asymmetric single-sided wheel pre-braking command is a pre-braking control command that causes different braking force distributions on the left and right sides of the vehicle, which is used to generate a compensation torque that is opposite to the yaw trend generated by the irreversible command.

[0070] Insert the asymmetric single-sided wheel pre-braking command into the transmission buffer before the restricted emergency braking command;

[0071] The deviation between the actual yaw rate and the target yaw rate corresponding to the expected avoidance trajectory is monitored to obtain the yaw rate deviation.

[0072] When it is detected that the physical effect of the irreversible command has been canceled by the asymmetric single-sided wheel pre-braking command, and the yaw rate deviation has fallen back to the safe range, the boost gradient restriction on the restricted emergency braking command is lifted, and the issuance of full maximum braking pressure is restored, resulting in the lifting of the boost gradient restriction. The physical effect of the irreversible command is the actual impact on the vehicle dynamics after the irreversible command enters the actuator, including one or more of the following: yaw tendency corresponding to the target turning angle, lateral force change, lateral acceleration change, or actual yaw rate change.

[0073] Based on the cleaned queue of commands to be sent, the order of emergency control commands written, the restricted emergency braking commands, the asymmetric single-sided wheel pre-braking commands, and the release result of the boost gradient limitation, a compensatory processing result is generated for the state of irreversible commands.

[0074] Based on the emergency control request, the reclaimed control resources, and the compensatory processing results under the condition of irreversible command, the emergency braking command, steering stability control command, and vehicle attitude control command are time-sequenced to generate the time-sequenced emergency control command sequence.

[0075] When there are no irreversible instructions that have entered the transmission process, a compensatory processing result for the state without irreversible instructions is generated based on the cleaned-up queue of instructions to be sent, the writable position of the transmission buffer, and the writable timing. Based on the emergency control request, the reclaimed control resources, the writing order of the emergency control instructions, and the compensatory processing result for the state without irreversible instructions, the emergency braking instructions, steering stability control instructions, and vehicle attitude control instructions are time-series arranged to generate a time-series arranged emergency control instruction sequence.

[0076] Specifically, freezing the queue of pending commands for a continuous autonomous driving task means suspending the transmission of new control commands to the vehicle's actuators to ensure that the domain controller can maintain full control of the vehicle in an emergency. This process requires identifying pending commands in the command queue that have not yet been received by the transmission buffer, as well as irreversible commands that have already entered the transmission process or have even been partially executed but cannot be directly revoked. Irreversible commands that have entered the transmission process typically refer to those that have been written to the transmission buffer or have passed through the actuator interface, and whose physical effects have begun or are about to affect the vehicle, such as a steering command that is currently being executed.

[0077] Furthermore, any pending commands that have not yet been written to the transmit buffer will be directly removed from the pending command queue to prevent them from interfering with emergency control procedures. The cleaned-up pending command queue will be used to determine the writing order of subsequent emergency control commands, ensuring the priority of emergency commands.

[0078] When an irreversible command has entered the transmission process, it needs to be analyzed in detail. First, its control dimension needs to be analyzed, such as longitudinal braking, lateral steering, yaw stabilization, or vehicle attitude control. In particular, if the irreversible command contains lateral target angle information, this information needs to be extracted, because the lateral angle is closely related to the vehicle's lateral stability.

[0079] Subsequently, it is determined whether the absolute value of the extracted lateral target steering angle information is greater than the linear stable steering angle threshold at the current vehicle speed. This threshold is used to distinguish whether the vehicle will maintain a linear stable response when steering at the current speed. If the steering angle is small and the vehicle is still in the linear stable region, the first emergency braking command is allowed to be written to the transmission buffer according to the normal emergency braking timing, that is, braking can be applied relatively quickly.

[0080] However, when the absolute value of the lateral target steering angle information exceeds the linear stable steering angle threshold, it indicates that the vehicle may be in a nonlinear or unstable steering state. In this case, to avoid vehicle instability caused by a conflict between braking and steering, it is necessary to limit the pressure gradient of the first emergency braking command to be written into the transmission buffer, i.e., slow down the rate of increase in braking pressure. Simultaneously, the maximum permissible braking pressure of the first emergency braking command is set to the remaining braking force margin after subtracting the lateral force required by the current irreversible angle from the tire friction limit. This means that during emergency braking, a portion of tire adhesion needs to be reserved to maintain the vehicle's lateral stability to offset the lateral force demand generated by the irreversible angle. Thus, a restricted emergency braking command is generated.

[0081] As a compensation measure, a reverse compensation torque is calculated based on the direction and magnitude of the irreversible command's yaw rate. This reverse compensation torque is converted into an asymmetric single-wheel pre-braking command. The asymmetric single-wheel pre-braking command creates a compensation torque that opposes the yaw trend generated by the irreversible command by distributing braking force differently to the left and right wheels of the vehicle, thus actively counteracting the adverse effects of the irreversible command on the vehicle's yaw stability. This asymmetric single-wheel pre-braking command is inserted before the restricted emergency braking command in the transmission buffer to ensure its priority execution, thereby pre-adjusting the vehicle's attitude before emergency braking begins.

[0082] During this process, the deviation between the actual yaw rate and the target yaw rate corresponding to the expected avoidance trajectory is continuously monitored to assess the vehicle's dynamic response in real time. When the physical effects of irreversible commands (such as the yaw trend corresponding to the target turning angle) are effectively offset by asymmetric single-wheel pre-braking commands, and the yaw rate deviation falls back to a safe range, it indicates that the vehicle attitude has stabilized. At this point, the boost gradient restriction on the limited emergency braking command can be lifted, and the full maximum braking pressure can be resumed to achieve the maximum braking effect.

[0083] Finally, based on the cleaned queue of commands to be sent, the order in which emergency control commands are written, the restricted emergency braking commands, the asymmetric single-sided wheel pre-braking commands, and the release result of the boost gradient limitation, a compensatory processing result is generated for the state of irreversible commands. Based on this compensatory processing result, the emergency control request, and the reclaimed control resources, the emergency braking commands, steering stability control commands, and vehicle attitude control commands are time-sequenced, generating the final time-sequenced emergency control command sequence.

[0084] Optionally, the step of monitoring the deviation between the actual yaw rate and the target yaw rate corresponding to the expected avoidance trajectory to obtain the yaw rate deviation includes:

[0085] Obtain the vehicle's actual yaw rate;

[0086] Based on the preset expected avoidance trajectory, determine the target yaw rate corresponding to the expected avoidance trajectory;

[0087] Obtain information on crosswind intensity and road surface unevenness around the vehicle;

[0088] Based on crosswind intensity information, road surface unevenness information, and vehicle dynamics parameters, calculate the expected change in yaw rate caused by external environmental disturbances;

[0089] Subtract the expected change in yaw rate from the actual yaw rate to obtain the yaw rate corrected for environmental disturbances.

[0090] The yaw rate deviation is calculated based on the difference between the yaw rate corrected for environmental disturbances and the target yaw rate.

[0091] Specifically, acquiring the vehicle's actual yaw rate refers to the real-time acquisition of the vehicle's angular velocity data around its vertical axis through the inertial measurement unit (IMU) or yaw rate sensor installed on the vehicle. This data reflects the vehicle's current steering or yaw dynamics. Determining the target yaw rate corresponding to the preset expected avoidance trajectory means that in emergency avoidance scenarios, the system plans a safe avoidance trajectory based on factors such as the current vehicle status, obstacle information, and driver intent. This trajectory includes the vehicle's expected attitude and motion state at different points in time, including the target yaw rate corresponding to the trajectory. This target yaw rate is the yaw dynamics the vehicle should achieve during ideal avoidance. Acquiring crosswind intensity and road surface unevenness information around the vehicle refers to acquiring data on the external environmental influences experienced by the vehicle during driving through onboard environmental perception sensors (such as wind speed sensors, lidar, millimeter-wave radar, or visual sensors combined with road surface recognition algorithms). Crosswind intensity information reflects the impact of wind on the lateral force of a vehicle, while road surface unevenness information reflects the impact of road conditions on the vehicle's suspension and tire grip. Both can cause unexpected changes in the vehicle's yaw rate.

[0092] The calculation of the expected change in yaw rate caused by external environmental disturbances, based on crosswind intensity information, road surface unevenness information, and vehicle dynamics parameters, involves using the vehicle's dynamics model, combined with real-time acquired crosswind intensity and road surface unevenness information, to predict the impact of these external disturbances on the vehicle's yaw rate. Vehicle dynamics parameters include vehicle mass, inertia, suspension stiffness, and tire characteristics; these parameters are used to accurately model the vehicle's response to external disturbances. Through calculation, a quantified expected change in yaw rate, purely caused by environmental disturbances, can be obtained. In practical applications, subtracting the expected change in yaw rate from the actual yaw rate to obtain the environmental disturbance-corrected yaw rate means removing the environmental disturbance component from the actual yaw rate measured by sensors. By subtracting the expected change in yaw rate caused by external environmental disturbances, a yaw rate closer to that of the vehicle under no external disturbance conditions can be obtained—the environmental disturbance-corrected yaw rate. Therefore, calculating the yaw rate deviation based on the difference between the yaw rate corrected for environmental disturbances and the target yaw rate involves comparing the corrected actual yaw rate with the expected target yaw rate after removing the influence of environmental disturbances, thus obtaining a more accurate and realistic yaw rate deviation. This deviation can more accurately reflect whether the physical effects of irreversible commands have been offset by asymmetric unilateral wheel pre-braking commands.

[0093] Optionally, when the physical effect of the irreversible command is detected to have been offset by the asymmetric single-sided wheel pre-braking command, and the yaw rate deviation falls back to the safe range, the steps to release the boost gradient restriction on the restricted emergency braking command and restore the issuance of full maximum braking pressure, resulting in the release of the boost gradient restriction, include:

[0094] Acquire the execution status of the asymmetric single-sided wheel pre-braking command, wheel speed sensor data, and brake line pressure data;

[0095] Based on the yaw rate deviation and the execution status of the asymmetric single-sided wheel pre-braking command, determine whether the attitude stability condition for releasing the boost gradient limitation is met.

[0096] Estimate the road surface adhesion coefficient based on wheel speed sensor data and brake line pressure data;

[0097] Calculate the maximum allowable braking pressure based on the road surface adhesion coefficient;

[0098] When the attitude stability condition is met, a braking pressure recovery request is generated;

[0099] In response to a brake pressure recovery request, the brake pressure is restored in a phased and gradual manner, and the brake pressure increment is limited to the maximum brake pressure limit in each recovery phase.

[0100] Monitor wheel slip ratio;

[0101] When the wheel slip ratio increases abnormally, the restoration of braking pressure is suspended, the road adhesion coefficient is reassessed, and the subsequent braking pressure increment is adjusted.

[0102] When the wheel slip ratio does not increase abnormally and the brake pressure increment remains within the maximum brake pressure limit, the pressure gradient restriction on the restricted emergency braking command is lifted.

[0103] Based on the brake pressure recovery state after the boost gradient limitation is lifted, the maximum full braking pressure is restored, and the result of lifting the boost gradient limitation is obtained.

[0104] Specifically, the system acquires the execution status of the asymmetric single-sided wheel pre-braking command, wheel speed sensor data, and brake line pressure data. These data form the basis for subsequent judgments and control. The execution status of the asymmetric single-sided wheel pre-braking command is used to confirm whether the pre-braking command has been effectively applied, thus assessing its compensation effect on irreversible commands. Wheel speed sensor data is used to calculate the wheel slip ratio and estimate the road surface adhesion coefficient, providing real-time vehicle kinematic information for the braking recovery process. Brake line pressure data is used to understand the current braking intensity and estimate the auxiliary road surface adhesion coefficient, providing direct feedback on the braking system's operating status.

[0105] Furthermore, based on the yaw rate deviation and the execution status of the asymmetric single-sided wheel pre-braking command, it is determined whether the attitude stability conditions for releasing the boost gradient limitation are met. Attitude stability conditions refer to the vehicle's dynamic equilibrium state in the lateral and longitudinal directions. The yaw rate deviation returning to a safe range is a key indicator for judging the vehicle's lateral stability, ensuring that the vehicle has recovered from lateral disturbances before the limitation is released. The execution status of the asymmetric single-sided wheel pre-braking command confirms whether the compensation measures have been fully effective and whether the vehicle has recovered from the effects of irreversible commands, verifying the effectiveness of the compensation.

[0106] In practical applications, the road surface adhesion coefficient is estimated based on wheel speed sensor data and brake line pressure data. The road surface adhesion coefficient is a key parameter for vehicle braking performance, directly affecting the maximum braking pressure. By using wheel speed sensor data (e.g., wheel slip ratio) and brake line pressure data, the current friction limit between the road surface and the tire can be estimated in real time. This provides an accurate physical basis for subsequent brake pressure recovery. Various methods can be used to estimate the road surface adhesion coefficient, such as those based on Kalman filtering, neural networks, or empirical models.

[0107] The maximum permissible braking pressure is calculated based on the road surface adhesion coefficient. The maximum braking pressure a vehicle can withstand varies under different road surface adhesion conditions. Calculating the maximum braking pressure limit is to prevent excessive braking pressure from causing wheel lock-up or vehicle instability, and its purpose is to ensure the safety of the braking recovery process.

[0108] When the attitude stability condition is met, a brake pressure recovery request is generated. Once the vehicle attitude is determined to be stable, the system will send a signal to prepare to resume full braking, the purpose of which is to initiate the brake pressure recovery process.

[0109] In response to a brake pressure recovery request, brake pressure is restored in a phased, gradual manner, with the brake pressure increment limited to the maximum brake pressure limit within each recovery phase. Phased, gradual recovery is a smooth and safe strategy that avoids sudden changes in brake pressure. The brake pressure increment at each stage is limited to the maximum brake pressure limit to ensure that the road surface adhesion limit is not exceeded during recovery, thereby maintaining vehicle stability.

[0110] Simultaneously, monitor wheel slip ratio. Wheel slip ratio is a key indicator for determining whether a wheel is about to lock up or has already locked up. Real-time monitoring of slip ratio can promptly detect potential signs of instability during brake pressure recovery, aiming to provide real-time feedback on braking performance and wheel status.

[0111] When wheel slip ratio increases abnormally, the restoration of braking pressure is paused, and the road surface adhesion coefficient is reassessed, adjusting subsequent braking pressure increments accordingly. This is a protective mechanism to deal with sudden changes in road surface or braking system malfunctions. An abnormally increased slip ratio indicates that the current braking pressure may be too high or the road surface adhesion coefficient may have decreased. Pausing the restoration of braking pressure and reassessing the situation aims to prevent loss of vehicle control and dynamically adjust the braking strategy.

[0112] When the wheel slip ratio does not increase abnormally and the brake pressure increment remains within the maximum brake pressure limit, the boost gradient restriction on the restricted emergency braking command is lifted. This indicates that the brake pressure recovery process is safe and smooth, and the vehicle remains stable. At this point, the previous boost gradient restriction can be completely lifted, with the aim of gradually restoring braking capacity under the premise of confirming safety.

[0113] Finally, based on the brake pressure recovery state after the boost gradient limitation is lifted, the maximum full braking pressure is restored, thus obtaining the result of lifting the boost gradient limitation. Under the premise of confirmed safety and stability, the system will restore to the maximum full braking pressure to achieve the most effective emergency braking. Its purpose is to achieve the maximum braking effect while ensuring safety.

[0114] Optionally, when a wheel slip ratio abnormally increases, the steps of pausing the restoration of braking pressure, reassessing the road adhesion coefficient, and adjusting subsequent braking pressure increments include:

[0115] Acquire wheel slip ratio signal;

[0116] The wheel slip ratio signal is subjected to high-frequency filtering to obtain the filtered slip ratio signal.

[0117] Calculate the average slip ratio and standard deviation of the slip ratio of the filtered slip ratio signal over multiple consecutive sampling periods;

[0118] The average slip ratio is compared with a first preset threshold, and the standard deviation of the slip ratio is compared with a second preset threshold.

[0119] When the average slip ratio continuously exceeds the first preset threshold and the standard deviation of slip ratio is less than the second preset threshold, it is determined that the abnormal increase in wheel slip ratio is caused by a continuous decrease in road surface adhesion coefficient.

[0120] In response to an abnormal increase in wheel slip ratio, the restoration of braking pressure is suspended.

[0121] By fusing data from multiple sensors, the road surface adhesion coefficient is quickly re-estimated to obtain the re-estimated road surface adhesion coefficient.

[0122] Based on the re-estimated road adhesion coefficient, the subsequent braking pressure recovery curve is adjusted, and the subsequent braking pressure increment is determined based on the adjusted braking pressure recovery curve.

[0123] The acquisition of wheel slip ratio signal involves real-time collection of wheel rotation speed data using wheel speed sensors on the vehicle, combined with the vehicle's reference speed, to calculate the wheel slip ratio. High-frequency filtering of the wheel slip ratio signal aims to eliminate high-frequency components in the original signal caused by sensor noise, minor road surface irregularities, or instantaneous disturbances, ensuring the accuracy and stability of subsequent analysis. This filtering can be implemented using digital low-pass filters or moving average filters. Calculating the average slip ratio and standard deviation of the filtered slip ratio signal over multiple consecutive sampling periods involves statistically analyzing the filtered slip ratio data within a preset time window or number of data points to obtain its overall trend and fluctuation. The average slip ratio reflects the central trend of the slip ratio, while the standard deviation characterizes the dispersion or stability of the slip ratio. Comparing the average slip ratio with a preset first threshold and the standard deviation with a preset second threshold aims to quantify abnormal slip ratio conditions by setting reasonable thresholds. The first preset threshold is typically used to define whether the average slip ratio has reached an abnormally high level, while the second preset threshold is used to determine whether the fluctuation of the slip ratio is in a stable or unstable state. When the average slip ratio continuously exceeds the first preset threshold and the standard deviation of the slip ratio is less than the second preset threshold, it is determined that the abnormal increase in wheel slip ratio is caused by a continuous decrease in the road surface adhesion coefficient. This judgment logic is one of the core aspects of this application. It can distinguish between instantaneous disturbances and continuous changes in road conditions. For example, a high average value and a low standard deviation usually indicate that the wheel is operating in a relatively stable high slip state, which is a typical manifestation of a continuous decrease in the road surface adhesion coefficient. Responding to an abnormal increase in wheel slip ratio, pausing the restoration of braking pressure is an immediate safety response of the system after detecting the anomaly to prevent the situation from deteriorating further. The purpose of rapidly re-estimating the road surface adhesion coefficient by fusing multi-sensor data is to utilize the data complementarity of multiple information sources (such as wheel speed sensors, brake line pressure sensors, inertial measurement units, and environmental perception sensors) to improve the accuracy and robustness of the road surface adhesion coefficient estimation, especially in emergency situations where rapid response is required. Adjusting the subsequent braking pressure recovery curve based on the re-estimated road adhesion coefficient and determining the subsequent braking pressure increment based on the adjusted braking pressure recovery curve means that after obtaining a more accurate road adhesion coefficient, the system can dynamically adjust the braking pressure recovery strategy, such as reducing the braking pressure boost gradient or limiting the maximum braking pressure, to adapt to new road conditions and ensure the stability and safety of the braking process.

[0124] Optionally, the steps for rapidly reestimating the road surface adhesion coefficient by fusing multi-sensor data to obtain the reestimated road surface adhesion coefficient include:

[0125] Acquire raw sensor data from wheel speed sensors, brake line pressure sensors, inertial measurement units, and environmental sensing sensors;

[0126] Perform data quality assessment on each type of sensor data in the raw sensor data, and assign an initial confidence level to each type of sensor data;

[0127] Detect whether there are conflicts between data from different types of sensors, and obtain sensor data conflict detection results;

[0128] Based on the sensor data conflict detection results, initial confidence level, and preset conflict handling rules, sensor data with low confidence level or poor data quality are downweighted or excluded to obtain the adjusted sensor data confidence level and the set of usable sensor data.

[0129] Based on the adjusted sensor data confidence level and the available sensor data set, the road surface adhesion coefficient is fused and calculated to obtain the re-estimated road surface adhesion coefficient.

[0130] Specifically, acquiring raw sensor data from wheel speed sensors, brake line pressure sensors, inertial measurement units (IMUs), and environmental perception sensors refers to the system receiving real-time data from each of the vehicle's sensing units. Wheel speed sensors provide the rotational speed of each wheel, which is fundamental for determining wheel slip ratio; brake line pressure sensors monitor the pressure applied by the braking system, reflecting the magnitude of braking force; the IMU provides information such as vehicle attitude, acceleration, and angular velocity, characterizing the vehicle's overall motion state; and environmental perception sensors (such as cameras, radar, and lidar) provide information on external environmental factors such as road surface type, slipperiness, and obstacles. These multi-source data collectively constitute the comprehensive input for evaluating the road adhesion coefficient.

[0131] Data quality assessment of each type of sensor data in the raw sensor data, and assignment of an initial confidence level to each type of sensor data, refers to the preliminary judgment of the reliability and accuracy of each type of sensor data before data fusion. Data quality assessment may include checking the data's completeness, real-time performance, noise level, outlier detection, and consistency with historical data or physical models. The initial confidence level is a pre-set trust level based on sensor type, installation location, historical performance, and current operating conditions (such as ambient temperature, humidity, vibration intensity, electromagnetic interference, etc.), used to initially reflect the reliability of that type of sensor data under current conditions.

[0132] Detecting conflicts between different types of sensor data, and obtaining sensor data conflict detection results, involves comparing data from different sensors to determine if there are logical inconsistencies between them. For example, if wheel speed sensor data shows severe wheel lock-up, but IMU data shows the vehicle is still traveling at high speed and the yaw rate is stable, then a data conflict may exist. Conflict detection can employ various methods, such as residual analysis based on model prediction, consistency checks of multi-sensor data, or rule-based logical judgment.

[0133] Based on sensor data conflict detection results, initial confidence levels, and preset conflict handling rules, sensor data with low confidence levels or poor data quality undergoes weight reduction or exclusion processing to obtain adjusted sensor data confidence levels and a usable sensor data set. This means that when data conflicts are detected or poor data quality is assessed, the system processes these data according to preset strategies. Weight reduction processing decreases the weight of the sensor data in subsequent fusion calculations, reducing its impact on the final result; exclusion processing directly removes the sensor data from the usable data set, excluding it from subsequent fusion calculations. Preset conflict handling rules determine specific weight reduction or exclusion strategies based on the type of conflict (e.g., persistent or transient), the severity of the conflict, and the initial confidence level of the sensor. This results in a filtered and weighted sensor data set.

[0134] Based on the adjusted sensor data confidence level and the available sensor data set, the road surface adhesion coefficient is fused and calculated to obtain the re-estimated road surface adhesion coefficient. This means that after quality assessment, collision detection, and corresponding processing of the sensor data, the remaining, confidence-adjusted sensor data is used to comprehensively calculate the estimated value of the current road surface adhesion coefficient through a fusion algorithm (such as Kalman filtering, Bayesian networks, neural networks, etc.). The adjusted confidence level will be used as input to the fusion algorithm, ensuring that high-confidence data plays a greater role in the fusion process, while low-confidence data is weakened or ignored.

[0135] Optionally, the steps of performing a data quality assessment on each type of sensor data in the raw sensor data and assigning an initial confidence level to each type of sensor data include:

[0136] Obtain information about the vehicle's current operating conditions, including ambient temperature, ambient humidity, vehicle vibration intensity, and electromagnetic interference level.

[0137] Based on the operating condition information, determine the expected performance degradation of each type of sensor under the current operating conditions;

[0138] The data of each type of sensor is compared with the corresponding expected performance degradation level to determine whether there are any data anomalies in each type of sensor data that exceed the expected degradation range, and the data anomaly judgment result is obtained.

[0139] Based on the type and degree of data anomalies found in the data anomaly judgment results, generate corresponding data quality assessment results for the sensor data;

[0140] Based on the data quality assessment results, an initial confidence level is assigned to each type of sensor data.

[0141] Operating condition information refers to the environment and operating conditions in which the vehicle operates, which can directly or indirectly affect the accuracy and reliability of sensor data. Specifically, ambient temperature and humidity may affect the physical performance of sensors and the stability of electronic components; vehicle vibration intensity may cause sensor measurement errors or data jitter; and electromagnetic interference levels may introduce noise and degrade signal quality. This operating condition information can be acquired in real time through temperature sensors, humidity sensors, vibration sensors, and electromagnetic field strength detection modules inside the vehicle.

[0142] Furthermore, the expected performance degradation refers to the degree of performance decline that may occur in terms of accuracy, precision, response time, or stability of each type of sensor data under specific operating conditions. This degradation level can be pre-established and stored based on the sensor's factory calibration data, historical operating data, environmental test data, and physical models. For example, in high-temperature and high-humidity environments, the measurement drift of some sensors may increase, and their expected performance degradation level will increase accordingly.

[0143] Specifically, the data from each type of sensor is compared with its corresponding expected performance degradation level to identify whether the sensor data exhibits abnormal behavior outside the normal range. For example, if a sensor's measurement value under a specific operating condition consistently deviates from its expected performance degradation range under the same conditions, a data anomaly can be identified. The data anomaly assessment results will record in detail the type of anomaly (e.g., data drift, missing data, data jumps, etc.) and the degree of the anomaly.

[0144] Therefore, based on the type and severity of data anomalies identified in the data anomaly assessment results, a corresponding data quality evaluation result for the sensor data can be generated. For example, sensor data with slight drift might receive a "moderate" quality evaluation result, while sensors with severe data gaps or persistent errors might receive a "poor" quality evaluation result. Finally, based on this data quality evaluation result, an initial confidence level is assigned to each type of sensor data. The initial confidence level is a quantitative indicator used to represent the system's level of trust in the sensor data at the current moment; for example, it can be a value between 0 and 1, with higher values ​​indicating higher trust.

[0145] Optionally, the steps for detecting whether there are conflicts between different types of sensor data and obtaining sensor data conflict detection results include:

[0146] Read raw sensor data from wheel speed sensors, brake line pressure sensors, inertial measurement units, and environmental sensing sensors;

[0147] The raw sensor data is preprocessed, including time synchronization and unit normalization, to obtain preprocessed sensor data.

[0148] Identify logically related sensor data pairs from the preprocessed sensor data;

[0149] For each logically related pair of sensor data, calculate the difference index of the sensor data pair over multiple consecutive time windows; the difference index is used to reflect the degree of deviation from consistency between the sensor data pairs.

[0150] Calculate the average value and fluctuation of the difference index over multiple consecutive time windows;

[0151] The average value of the difference index is compared with the first preset conflict threshold, and the fluctuation of the difference index is compared with the second preset conflict threshold.

[0152] When the average value of the difference index continuously exceeds the first preset conflict threshold and the fluctuation is less than the second preset conflict threshold, it is determined that there is a persistent conflict in the corresponding sensor data pair.

[0153] When the average value of the difference index exceeds the first preset conflict threshold within a preset short period of time, and the fluctuation is greater than the second preset conflict threshold, it is determined that there is a momentary conflict in the corresponding sensor data pair.

[0154] Generate sensor data conflict detection results based on whether the conflict is persistent or transient.

[0155] Raw sensor data refers to unprocessed initial data directly acquired from the vehicle's wheel speed sensors, brake line pressure sensors, inertial measurement units, and environmental perception sensors. This data may exhibit temporal asynchrony or unit inconsistencies. Therefore, preprocessing of this raw sensor data is necessary before collision detection. The preprocessing process primarily includes time synchronization and unit normalization to ensure comparability in time and dimensions between sensor data from different sources. Time synchronization aims to eliminate differences in sampling time points between different sensors, for example, through interpolation or timestamp alignment; unit normalization converts sensor data of different physical quantities to a unified dimension or range for effective comparison.

[0156] In the preprocessed sensor data, logically related sensor data pairs need to be identified. For example, wheel speed sensor data and inertial measurement unit speed data should logically be consistent, and brake line pressure data and wheel deceleration data are also related. For each logically related sensor data pair, a dissimilarity index is calculated. This dissimilarity index quantifies the degree of deviation from consistency between the two sensor data pairs, and can be represented, for example, by calculating the difference, ratio, or more complex statistical distance between them.

[0157] To differentiate between different types of conflicts, the average value and fluctuation of the difference index over multiple consecutive time windows are calculated. The average value reflects the long-term trend of the difference, while the fluctuation reflects the instantaneous severity of the change. By comparing these statistics with a first and a second preset conflict threshold, two main conflict types can be identified. When the average value of the difference index consistently exceeds the first preset conflict threshold and the fluctuation is less than the second preset conflict threshold, it indicates a stable and persistent inconsistency between the sensor data, which is classified as a persistent conflict. Conversely, when the average value of the difference index exceeds the first preset conflict threshold for a short period of time and the fluctuation is greater than the second preset conflict threshold, it indicates a brief and severe inconsistency between the sensor data, which is classified as a transient conflict. Finally, based on the identified persistent or transient conflicts, sensor data conflict detection results are generated, providing a basis for subsequent data fusion and confidence adjustment.

[0158] Optionally, based on the sensor data conflict detection results, the initial confidence level, and preset conflict handling rules, the steps of downweighting or excluding sensor data with low confidence or poor data quality to obtain the adjusted sensor data confidence level and the set of usable sensor data include the following:

[0159] Read the sensor data conflict detection results, the initial confidence level of each type of sensor data, and the data quality assessment results of each type of sensor data;

[0160] Based on the sensor data conflict detection results, identify the conflicting sensor data pairs and their corresponding conflict types; conflict types include persistent conflicts and transient conflicts.

[0161] When the conflict type is persistent conflict, based on the preset conflict handling rules, initial confidence level and data quality assessment results, the sensor data with lower confidence level or poorer data quality in the sensor data pair is identified, and weight reduction or exclusion processing is performed to obtain the result of weight reduction or exclusion processing; weight reduction processing is a processing method that continuously reduces the confidence level of the corresponding sensor data under persistent conflict.

[0162] When the conflict type is transient, the sensor data of the conflicting sensor is temporarily downweighted according to the preset conflict handling rules and conflict duration, and the result of the temporary downweighting is obtained. The temporary downweighting is a processing method that reduces the confidence of the corresponding sensor data during the duration of the transient conflict or within a preset recovery window.

[0163] Based on the results of the downweighting or exclusion process, as well as the results of the temporary downweighting process, the adjusted sensor data confidence level and the set of available sensor data are generated.

[0164] Specifically, before performing sensor data fusion, it is necessary to first read the sensor data conflict detection results, the initial confidence level for each type of sensor data, and the data quality assessment results for each type of sensor data. This information forms the basis for subsequent conflict handling and confidence level adjustment. The sensor data conflict detection results indicate which sensor data are inconsistent and what type of inconsistency exists. The initial confidence level reflects the reliability of the sensors under ideal conditions, while the data quality assessment results consider the impact of current operating conditions on sensor performance.

[0165] Furthermore, based on the sensor data conflict detection results, the system identifies the conflicting sensor data pairs and determines their corresponding conflict types. Conflict types are further categorized into persistent conflicts and transient conflicts. Persistent conflicts refer to inconsistencies between sensor data that persist for an extended period, potentially indicating a sensor malfunction or long-term drift. Transient conflicts, on the other hand, refer to non-persistent data inconsistencies that occur within a short period, possibly caused by temporary external interference or brief sensor malfunctions.

[0166] When a persistent conflict is identified, the system determines the sensor data with lower confidence or poorer quality within the conflicting data pair based on preset conflict handling rules, the initial confidence level of the sensors, and data quality assessment results. These data will then undergo either weight reduction or exclusion. Weight reduction involves continuously lowering the confidence level of the corresponding sensor data in a persistent conflict state, thus reducing its weight in subsequent fusion calculations. Exclusion involves directly removing the sensor data from the available dataset when the data quality is extremely poor or the conflict is severe. This approach effectively suppresses the negative impact of persistently poor data on the fusion results.

[0167] As a preferred implementation, when a transient conflict is identified, the system temporarily downweights the conflicting sensor data according to preset conflict handling rules and conflict duration. Temporary downweighting refers to temporarily reducing the confidence level of the corresponding sensor data during the duration of the transient conflict or within a preset recovery window. This approach aims to avoid over-penalizing or completely excluding sensor data due to brief data anomalies, allowing the sensor's confidence level to recover after it returns to normal, thereby maintaining data availability and system robustness.

[0168] Finally, based on the results of the downweighting or exclusion processing, as well as the results of temporary downweighting, the system generates adjusted sensor data confidence levels and a set of available sensor data. This adjusted information will serve as input for subsequent pavement adhesion coefficient fusion calculations, ensuring the accuracy and reliability of the fusion results.

[0169] This application also proposes an intelligent control system for integrated functions of a domain controller in intelligent connected vehicles, used to execute intelligent control of integrated functions of a domain controller in intelligent connected vehicles, combined with... Figure 3 As shown, the intelligent connected vehicle domain controller integrated intelligent control system 1 includes:

[0170] The multi-source information acquisition module 11 is used to acquire vehicle motion status information, external environment information, and domain controller task operation status information; the domain controller task operation status information includes the operation status, resource occupancy status, and command sending status of each task within the domain controller.

[0171] The control request generation module 12 is used to assess the risk level faced by the vehicle based on external environmental information and vehicle motion status information, and generate an emergency control request when the risk level reaches a preset risk threshold.

[0172] The task phase identification module 13 is used to identify the currently occupying continuous autonomous driving task based on the domain controller task running status information, and to identify the execution phase of the continuous autonomous driving task.

[0173] The interruption timing determination module 14 is used to determine the appropriate interruption timing for interrupting the continuous autonomous driving task by combining vehicle motion state information, execution stage of the continuous autonomous driving task, resource occupancy status and risk level.

[0174] The interruption timing execution module 15 is used to interrupt the execution of the continuous autonomous driving task at an appropriate interruption timing and reclaim the control resources occupied by the continuous autonomous driving task.

[0175] The compensation processing execution module 16 is used to clear the queue of instructions to be sent for the continuous autonomous driving task, and to perform compensatory processing on irreversible instructions that have entered the sending process to obtain the compensation processing result.

[0176] The instruction sequence generation module 17 is used to generate a time-arranged emergency control instruction sequence based on the emergency control request, the recovered control resources, and the results of compensatory processing.

[0177] The execution result generation module 18 is used to send the time-sequenced emergency control command sequence to the vehicle actuator for execution, and generate emergency control execution results based on the execution feedback.

[0178] Regarding the multi-source information acquisition module, this module performs the functions described in the above embodiments for acquiring vehicle motion state information, external environment information, and domain controller task operation status information, which will not be repeated here. It is important to emphasize that this module can be configured to acquire data in real time from various sensors in the vehicle and internal components of the domain controller via standardized data interfaces, such as CAN bus interfaces, Ethernet interfaces, or dedicated sensor interfaces. For example, hardware devices such as wheel speed sensors, inertial measurement units, lidar, millimeter-wave radar, and cameras can be used, and the raw data can be transmitted to this module for preliminary processing and integration through corresponding drivers and data acquisition protocols. As a preferred embodiment, this module may also include a data buffer for temporarily storing the acquired data to cope with data transmission delays or load fluctuations.

[0179] Regarding the control request generation module, this module performs the function described in the above embodiments: assessing the risk level faced by the vehicle based on external environmental information and vehicle motion state information, and generating an emergency control request when the risk level reaches a preset risk threshold. This will not be repeated here. It is important to emphasize that this module can be implemented as an independent software component, containing a risk assessment algorithm and emergency request triggering logic. For example, the risk assessment algorithm can analyze the input information in real time based on a preset rule set, such as a safe distance threshold, relative speed threshold, and lane departure degree. When the analysis result meets the emergency conditions, the module generates an emergency control request signal with a specific priority and command type and sends it to the subsequent processing module. As a specific implementation, this module can use a finite state machine to manage different risk levels and corresponding request generation strategies.

[0180] Regarding the task phase identification module, this module performs the functions described in the above embodiments: identifying the currently occupying continuous autopilot task based on the domain controller's task running status information, and identifying the execution phase of the continuous autopilot task; these will not be repeated here. It is important to emphasize that this module can be designed as a task monitoring agent, interacting with the domain controller's task scheduler and resource manager. For example, this module can periodically query the task scheduler to obtain a list of all running tasks and their status information, and identify the continuous autopilot task by analyzing the task ID or task type. For the identified continuous autopilot task, this module can further determine its specific execution phase, such as whether it is in the decision-making, planning, or tracking phase, by parsing its internal state variables or monitoring its sending patterns of instructions to specific actuators. As a preferred implementation, this module can maintain a task status database, updating and storing detailed running information for each task in real time.

[0181] Regarding the interruption timing determination module, this module performs the function described in the above embodiments, which combines vehicle motion state information, the execution stage of the continuous autonomous driving task, resource occupancy status, and risk level to determine the appropriate interruption timing for the continuous autonomous driving task, and will not be repeated here. It is important to emphasize that this module can be implemented as a decision engine, containing a complex set of decision logic or models. For example, this decision logic can comprehensively consider the current vehicle's speed, acceleration, steering angle, and other motion states; the impact of the execution stage of the continuous autonomous driving task on the vehicle's dynamics; the current system resource occupancy; and the risk level faced by the vehicle. Through weighted analysis of these multi-dimensional information, the module can calculate an interruption utility function and select the timing that minimizes the impact of the interruption on vehicle stability and safety as the appropriate interruption timing. As a specific implementation, this module can employ methods based on fuzzy logic or expert systems to handle uncertain information, thereby determining the interruption timing more flexibly.

[0182] Regarding the interruption timing execution module, this module performs the functions described in the above embodiments: interrupting the execution of the continuous autonomous driving task at an appropriate interruption timing and reclaiming the control resources occupied by the continuous autonomous driving task; these will not be repeated here. It is important to emphasize that this module can be designed as a task control interface, working closely with the domain controller's task scheduler and resource manager. For example, when receiving an interrupt command from the interruption timing determination module, this module sends an interrupt signal to the target continuous autonomous driving task, ensuring that the task can safely and orderly stop execution. Simultaneously, this module coordinates with the resource manager to reclaim critical control resources previously occupied by the task, such as CPU time slices, memory space, and communication bandwidth, and re-mark them as available so that urgent tasks can immediately obtain these resources. As a preferred implementation, this module can support both soft interrupt and hard interrupt modes to adapt to interruption requirements of different urgency levels and task types.

[0183] Regarding the compensation processing execution module, this module performs the functions described in the above embodiments: clearing the queue of pending commands for the continuous autonomous driving task and performing compensatory processing on irreversible commands that have entered the sending process to obtain the compensation processing result. These functions will not be elaborated further here. It is important to emphasize that this module can be implemented as a command management and compensation logic unit. For example, this module first accesses the command sending queue of the continuous autonomous driving task, freezes the queue, and deletes any commands that have not yet been sent. For commands that have entered the sending process but have not yet produced a physical effect, this module can attempt to send a cancellation command. For irreversible commands that have entered the sending process and cannot be directly cancelled, such as braking commands that have entered the brake line pressurization process or steering commands that have entered the steering motor execution process, this module will generate corresponding reverse or corrective compensation commands based on their type and expected physical effect. For example, if the irreversible command is a steering command, this module can generate a reverse steering torque command to counteract its effect. As a specific implementation, this module can maintain an irreversible command type library and a corresponding compensation strategy library to quickly generate suitable compensation commands.

[0184] Regarding the instruction sequence generation module, this module performs the function described in the above embodiments of generating a time-arranged emergency control instruction sequence based on the emergency control request, the reclaimed control resources, and the results of compensatory processing, which will not be repeated here. It is important to emphasize that this module can be designed as an intelligent scheduler, internally containing priority management, timing optimization, and instruction fusion algorithms. For example, this module will time-arrange emergency braking instructions, steering stability control instructions, etc., based on the type (e.g., emergency braking, emergency steering) and priority of the emergency control request, combined with the currently available control resources and the compensatory processing results provided by the compensation processing execution module. This arrangement process considers the dependencies between instructions and the execution timing requirements, ensuring that emergency instructions are issued in the optimal order and at the optimal time, while also taking into account the effectiveness of compensatory instructions. As a preferred implementation, this module can employ a task scheduling mechanism based on a real-time operating system (RTOS) to ensure deterministic execution of instructions.

[0185] Regarding the execution result generation module, this module performs the functions described in the above embodiments: sending the time-sequentially arranged emergency control command sequence to the vehicle actuators for execution, and generating emergency control execution results based on execution feedback; these details will not be repeated here. It is important to emphasize that this module can be implemented as an execution interface and feedback analysis unit. For example, this module can send the time-sequentially arranged emergency control command sequence to vehicle actuators such as the braking system, steering system, and powertrain system via the vehicle's communication bus (such as CAN, FlexRay, or in-vehicle Ethernet). During command execution, this module continuously receives feedback information from the actuators, such as sensor data on actual braking pressure, actual steering angle, and wheel speed. Through real-time analysis of this feedback data, this module can evaluate the actual execution effect of the emergency control commands, such as whether a collision was successfully avoided, whether the vehicle remained stable, and whether the braking distance met expectations, and generate a corresponding emergency control execution result report. As a specific implementation, this module can integrate fault diagnosis functions to detect and report any abnormalities during execution.

[0186] The above are merely embodiments of this application and are not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. An intelligent control method integrating domain controller functions for intelligent connected vehicles, characterized in that, include: Acquire vehicle motion status information, external environment information, and domain controller task operation status information; The domain controller task running status information includes the running status, resource usage status, and command sending status of each task within the domain controller; Based on the external environment information and the vehicle motion status information, assess the risk level faced by the vehicle, and generate an emergency control request when the risk level reaches a preset risk threshold. Based on the domain controller task running status information, identify the currently occupying continuous autonomous driving task and identify the execution stage of the continuous autonomous driving task; By combining the vehicle motion state information, the execution stage of the continuous autonomous driving task, the resource occupancy status, and the risk level, a suitable interruption point for interrupting the continuous autonomous driving task is determined. At the appropriate interruption point, the execution of the continuous autonomous driving task is interrupted, and the control resources occupied by the continuous autonomous driving task are reclaimed. The queue of instructions to be sent for the continuous autonomous driving task is cleared, and compensatory processing is performed on irreversible instructions that have entered the sending process to obtain the compensatory processing result. Based on the emergency control request, the recovered control resources, and the compensation processing results, a time-series-arranged emergency control instruction sequence is generated. The time-sequenced emergency control command sequence is sent to the vehicle actuators for execution, and the emergency control execution result is generated based on the execution feedback.

2. The intelligent control method for integrated functions of a domain controller for intelligent connected vehicles according to claim 1, characterized in that, The process involves clearing the queue of instructions to be sent for the continuous autonomous driving task and performing compensatory processing on irreversible instructions that have already entered the sending process to obtain a compensatory processing result. The steps for generating a time-series-arranged emergency control instruction sequence based on the emergency control request, the reclaimed control resources, and the compensatory processing results include: Freeze the queue of instructions to be sent corresponding to the continuous autonomous driving task, and identify the instructions to be sent that have not yet been written into the sending buffer and the irreversible instructions that have entered the sending process; wherein, the irreversible instructions that have entered the sending process are control instructions that have been written into the sending buffer or have entered the actuator interface and cannot be directly revoked. Delete the pending instructions that have not yet been written to the sending buffer from the pending instruction queue corresponding to the continuous autonomous driving task to obtain a cleaned pending instruction queue, and determine the writing order of emergency control instructions based on the cleaned pending instruction queue; When there is an irreversible instruction that has entered the sending process, the control dimension of the irreversible instruction is parsed, and the lateral target turning angle information in the irreversible instruction is extracted; wherein, the control dimension is used to characterize the vehicle control direction or execution object corresponding to the irreversible instruction, including one or more of the following: longitudinal braking control dimension, lateral steering control dimension, yaw stability control dimension or vehicle posture control dimension. Determine whether the absolute value of the lateral target steering angle information is greater than the linear stable steering angle threshold at the current vehicle speed; When the absolute value of the lateral target turning angle information is less than or equal to the linear stable turning angle threshold, the first emergency braking command is allowed to be written into the transmission buffer according to the normal emergency braking timing. When the absolute value of the lateral target turning angle information is greater than the linear stable turning angle threshold, the boost gradient of the first emergency braking command to be written into the transmission buffer is restricted, and the maximum allowable braking pressure of the first emergency braking command is set to the remaining braking force margin after subtracting the lateral force required for the current irreversible angle from the tire friction limit. Based on the limited boost gradient and the maximum permissible braking pressure, a limited emergency braking command is generated; Based on the turning direction and size of the irreversible command, a reverse compensation torque is calculated, and the reverse compensation torque is converted into an asymmetric single-sided wheel pre-braking command; wherein, the asymmetric single-sided wheel pre-braking command is a pre-braking control command that causes different braking force distributions on the left and right sides of the vehicle, used to generate a compensation torque opposite to the yaw trend generated by the irreversible command. Insert the asymmetric single-sided wheel pre-braking command into the transmission buffer before the restricted emergency braking command; The deviation between the actual yaw rate and the target yaw rate corresponding to the expected avoidance trajectory is monitored to obtain the yaw rate deviation. When it is detected that the physical effect of the irreversible command has been canceled by the asymmetric single-sided wheel pre-braking command, and the yaw rate deviation has fallen back to the safe range, the pressure gradient restriction on the restricted emergency braking command is lifted, and the issuance of full maximum braking pressure is restored, resulting in the lifting of the pressure gradient restriction; wherein, the physical effect of the irreversible command is the actual impact generated in the vehicle dynamics state after the irreversible command enters the actuator, including one or more of the following: yaw tendency corresponding to the target turning angle, lateral force change, lateral acceleration change, or actual yaw rate change; Based on the cleaned queue of instructions to be sent, the order in which the emergency control instructions are written, the restricted emergency braking instructions, the asymmetric single-sided wheel pre-braking instructions, and the result of releasing the boost gradient limitation, a compensatory processing result is generated for the state of irreversible instructions. Based on the emergency control request, the recovered control resources, and the compensatory processing results under the irreversible command state, the emergency braking command, steering stability control command, and vehicle attitude control command are time-sequenced to generate a time-sequenced emergency control command sequence. When there are no irreversible instructions that have entered the transmission process, a compensatory processing result for the state without irreversible instructions is generated based on the cleaned-up queue of instructions to be transmitted, the writable position of the transmission buffer, and the writable timing. Based on the emergency control request, the reclaimed control resources, the writing order of the emergency control instructions, and the compensatory processing result for the state without irreversible instructions, the emergency braking instructions, steering stability control instructions, and vehicle attitude control instructions are time-series arranged to generate a time-series arranged emergency control instruction sequence.

3. The intelligent control method for integrated functions of a domain controller for intelligent connected vehicles according to claim 2, characterized in that, The step of monitoring the deviation between the actual yaw rate and the target yaw rate corresponding to the expected avoidance trajectory to obtain the yaw rate deviation includes: Obtain the vehicle's actual yaw rate; Based on the preset expected avoidance trajectory, determine the target yaw rate corresponding to the expected avoidance trajectory; Obtain information on crosswind intensity and road surface unevenness around the vehicle; Based on the crosswind intensity information, the road surface unevenness information, and vehicle dynamics parameters, calculate the expected change in yaw rate caused by external environmental disturbances; Subtracting the expected change in yaw rate from the actual yaw rate yields the yaw rate corrected for environmental disturbance. The yaw rate deviation is calculated based on the difference between the yaw rate corrected for environmental disturbances and the target yaw rate.

4. The intelligent control method for integrated functions of a domain controller for intelligent connected vehicles according to claim 2, characterized in that, The step of releasing the pressure gradient restriction on the restricted emergency braking command and restoring the issuance of full maximum braking pressure when the physical effect of the irreversible command is detected to have been offset by the asymmetric single-sided wheel pre-braking command, and the yaw rate deviation falls back to the safe range, includes: The execution status of the asymmetric single-sided wheel pre-braking command, wheel speed sensor data, and brake line pressure data are obtained. Based on the yaw rate deviation and the execution status of the asymmetric single-sided wheel pre-braking command, determine whether the attitude stability condition for releasing the boost gradient limitation is met. The road surface adhesion coefficient is estimated based on the wheel speed sensor data and the brake line pressure data. Calculate the maximum allowable braking pressure based on the road surface adhesion coefficient; When the attitude stability condition is met, a braking pressure recovery request is generated; In response to the brake pressure recovery request, the brake pressure is restored in a phased and gradual manner, and the brake pressure increment is limited within the maximum brake pressure limit in each recovery phase. Monitor wheel slip ratio; When the wheel slip ratio increases abnormally, the recovery of braking pressure is suspended, the road adhesion coefficient is reassessed, and the subsequent braking pressure increment is adjusted. When the wheel slip ratio does not increase abnormally and the braking pressure increment remains within the maximum braking pressure limit, the pressure gradient restriction on the restricted emergency braking command is lifted. Based on the brake pressure recovery state after the boost gradient limitation is lifted, the maximum full braking pressure is restored, and the result of lifting the boost gradient limitation is obtained.

5. The intelligent control method for integrated functions of a domain controller for intelligent connected vehicles according to claim 4, characterized in that, The steps of pausing the recovery of braking pressure and reassessing the road adhesion coefficient when the wheel slip ratio abnormally increases, and adjusting the subsequent braking pressure increment, include: Acquire wheel slip ratio signal; The wheel slip ratio signal is subjected to high-frequency filtering to obtain the filtered slip ratio signal; Calculate the average slip ratio and standard deviation of the filtered slip ratio signal over multiple consecutive sampling periods; The average slip ratio is compared with a first preset threshold, and the standard deviation of the slip ratio is compared with a second preset threshold. When the average slip ratio continuously exceeds the first preset threshold and the standard deviation of the slip ratio is less than the second preset threshold, it is determined that the abnormal increase in wheel slip ratio is caused by a continuous decrease in the road surface adhesion coefficient. In response to the abnormal increase in wheel slip ratio, the restoration of braking pressure is suspended; By fusing data from multiple sensors, the road surface adhesion coefficient is quickly re-estimated to obtain the re-estimated road surface adhesion coefficient. Based on the re-estimated road adhesion coefficient, the subsequent braking pressure recovery curve is adjusted, and the subsequent braking pressure increment is determined based on the adjusted braking pressure recovery curve.

6. The intelligent control method for integrated functions of a domain controller for intelligent connected vehicles according to claim 5, characterized in that, The step of fusing multi-sensor data to quickly re-estimate the road surface adhesion coefficient and obtain the re-estimated road surface adhesion coefficient includes: Acquire raw sensor data from wheel speed sensors, brake line pressure sensors, inertial measurement units, and environmental sensing sensors; Perform a data quality assessment on each type of sensor data in the raw sensor data, and assign an initial confidence level to each type of sensor data; Detect whether there are conflicts between data from different types of sensors, and obtain sensor data conflict detection results; Based on the sensor data conflict detection results, the initial confidence level, and the preset conflict handling rules, sensor data with low confidence or poor data quality are downweighted or excluded to obtain the adjusted sensor data confidence level and the set of usable sensor data. Based on the adjusted sensor data confidence level and the available sensor data set, the road surface adhesion coefficient is fused and calculated to obtain the re-estimated road surface adhesion coefficient.

7. The intelligent control method for integrated functions of a domain controller for intelligent connected vehicles according to claim 6, characterized in that, The step of performing data quality assessment on each type of sensor data in the raw sensor data and assigning an initial confidence level to each type of sensor data includes: Obtain the vehicle's current operating condition information; the operating condition information includes ambient temperature, ambient humidity, vehicle vibration intensity, and electromagnetic interference level; Based on the operating condition information, determine the expected performance degradation degree of each type of sensor under the current operating conditions; The data of each type of sensor is compared with the corresponding expected performance degradation level to determine whether there are any data anomalies in each type of sensor data that exceed the expected degradation range, and the data anomaly judgment result is obtained. Based on the type and degree of the data anomalies found in the data anomaly judgment results, a data quality assessment result for the corresponding sensor data is generated. Based on the data quality assessment results, an initial confidence level is assigned to each type of sensor data.

8. The intelligent control method for integrated functions of a domain controller for intelligent connected vehicles according to claim 6, characterized in that, The steps for detecting whether there is a conflict between different types of sensor data and obtaining the sensor data conflict detection result include: Read raw sensor data from wheel speed sensors, brake line pressure sensors, inertial measurement units, and environmental sensing sensors; The raw sensor data is preprocessed, including time synchronization and unit normalization, to obtain preprocessed sensor data. Identify logically related sensor data pairs from the preprocessed sensor data; For each pair of logically related sensor data, a difference index is calculated for the sensor data pair over multiple consecutive time windows; the difference index is used to reflect the degree of deviation from consistency between the sensor data pairs. Calculate the average value and fluctuation of the difference index over multiple consecutive time windows; The average value of the difference index is compared with a first preset conflict threshold, and the fluctuation level of the difference index is compared with a second preset conflict threshold. When the average value of the difference index continuously exceeds the first preset conflict threshold and the fluctuation level is less than the second preset conflict threshold, it is determined that there is a persistent conflict in the corresponding sensor data pair. When the average value of the difference index exceeds the first preset conflict threshold within a preset short period of time, and the fluctuation degree is greater than the second preset conflict threshold, it is determined that there is a momentary conflict in the corresponding sensor data pair. Based on the persistent conflict or the transient conflict, a sensor data conflict detection result is generated.

9. The intelligent control method for integrated functions of a domain controller for intelligent connected vehicles according to claim 6, characterized in that, The step of performing weight reduction or exclusion processing on sensor data with low confidence or poor data quality based on the sensor data conflict detection results, the initial confidence level, and preset conflict handling rules to obtain the adjusted sensor data confidence level and the set of usable sensor data includes: Read the sensor data conflict detection results, the initial confidence level of each type of sensor data, and the data quality assessment results of each type of sensor data; Based on the sensor data conflict detection results, identify the conflicting sensor data pairs and their corresponding conflict types; the conflict types include persistent conflicts and transient conflicts. When the conflict type is a persistent conflict, according to the preset conflict handling rules, the initial confidence level, and the data quality assessment results, the sensor data with low confidence or poor data quality in the sensor data pair is identified, and weight reduction or exclusion processing is performed to obtain the result of weight reduction or exclusion processing; the weight reduction processing is a processing method that continuously reduces the confidence level of the corresponding sensor data under persistent conflict. When the conflict type is a transient conflict, the sensor data of the conflicting sensor is temporarily downweighted according to the preset conflict handling rules and the duration of the conflict, and the result of the temporary downweighting is obtained; wherein, the temporary downweighting is a processing method that reduces the confidence of the corresponding sensor data during the duration of the transient conflict or within a preset recovery window. Based on the results of the weight reduction or exclusion process and the results of the temporary weight reduction process, an adjusted sensor data confidence level and a set of available sensor data are generated.

10. An intelligent control system integrating the domain controller functions of an intelligent connected vehicle, used to execute intelligent control integrating the domain controller functions of an intelligent connected vehicle, characterized in that, include: The multi-source information acquisition module is used to acquire vehicle motion status information, external environment information, and domain controller task operation status information; The domain controller task running status information includes the running status, resource usage status, and command sending status of each task within the domain controller; The control request generation module is used to assess the risk level faced by the vehicle based on the external environment information and the vehicle motion state information, and generate an emergency control request when the risk level reaches a preset risk threshold. The task phase identification module is used to identify the continuously automated driving task currently occupying control resources and to identify the execution phase of the continuously automated driving task based on the task running status information of the domain controller. The interruption timing determination module is used to determine an appropriate interruption timing for interrupting the continuous autonomous driving task by combining the vehicle motion state information, the execution stage of the continuous autonomous driving task, the resource occupancy status, and the risk level. The interruption timing execution module is used to interrupt the execution of the continuous autonomous driving task at the appropriate interruption timing and reclaim the control resources occupied by the continuous autonomous driving task. The compensation processing execution module is used to clear the queue of instructions to be sent for the continuous autonomous driving task, and to perform compensatory processing on irreversible instructions that have entered the sending process to obtain the compensation processing result. The instruction sequence generation module is used to generate a time-arranged emergency control instruction sequence based on the emergency control request, the reclaimed control resources, and the compensatory processing results. The execution result generation module is used to send the time-sequenced emergency control command sequence to the vehicle actuator for execution, and generate emergency control execution results based on the execution feedback.

Images