Control method and system for coping with new energy vehicle driving incapacity scene

Abstract

The application relates to the technical field of intelligent driving safety of vehicles, and discloses a control method and system for coping with a new energy vehicle driving disability scene, multi-dimensional parallel verification is carried out to preliminarily determine whether a driver is disabled; after it is preliminarily determined that the driver is disabled, true disability determination is carried out based on a preset driver disability determination rollback mechanism; if it is determined that the disability is recovered, the disability emergency process is terminated; if it is determined that the true disability, the disability emergency process is triggered; according to a comparison result of a current real-time vehicle speed and a vehicle speed threshold value, a vehicle power is degraded by adopting a corresponding level strategy until the power is cut off; after the power is cut off, safety linkage operations are sequentially executed until the vehicle reaches a safe state. The application constructs an integrated safety architecture throughout the whole stage of disability determination, power degradation and safety linkage, and on the basis of excluding interference and giving an accurate stage determination result at each stage, the vehicle control response system in the driving disability scene is systematically and highly reliable and safe.

Description

Technical Field

[0001] This invention relates to the field of vehicle intelligent driving safety technology, specifically to a control method and system for addressing driving incapacity scenarios in new energy vehicles. Background Technology

[0002] If a driver suddenly becomes incapacitated during vehicle operation (such as due to sudden illness, severe drowsiness, loss of consciousness, etc.) and loses effective control of the vehicle, and the vehicle cannot slow down and stop in a timely and safe manner, it will directly endanger the life safety of the driver and other road users.

[0003] To address such scenarios, existing technologies have proposed various solutions, but their control logic generally suffers from the following problems: Existing control schemes mostly rely on single physiological or behavioral indicators (such as eye closure duration, abnormal heart rate, and steering wheel grip detection) for disability determination. However, there are many interfering factors in the real driving environment: drivers wearing sunglasses or strong backlighting can prevent the DMS camera from accurately capturing eye status; steering wheel grip force sensors may falsely report that the driver has dropped the steering wheel due to the driver's habit of holding it with one hand; health sensors may experience heart rate signal drift due to poor skin contact; and road bumps may cause data jitter in the head posture sensor. All of these interferences may cause a single indicator to trigger an abnormal determination. Existing schemes lack the ability to cross-verify multi-source signals. Once a single indicator meets the threshold, the disability control process is triggered, resulting in frequent false triggers. This not only interferes with normal driving but also causes drivers to lose trust in the system, thus reducing the effectiveness and acceptability of the system in real disability scenarios.

[0004] Existing solutions often directly apply deceleration or braking after determining incapacity. If the vehicle is traveling at high speed, sudden and forceful braking can easily cause the vehicle to skid and lose control. At the same time, the lack of time for subsequent vehicles to anticipate the situation significantly increases the risk of rear-end collisions, resulting in secondary accidents that are more serious than the incapacity itself.

[0005] Although some existing solutions have set up multi-level safety measures, there is a lack of unified timing coordination between alarm signals and braking, steering and other actions. Simultaneous triggering of alarms and actions or disordered sequence leads to response delays. Various safety actions interfere with each other during execution, making it impossible to form an orderly safety handling process. Summary of the Invention

[0006] The present invention aims to provide a control method and system for dealing with driving disability scenarios of new energy vehicles, so that vehicle control in driving disability scenarios adopts a systematic, highly reliable and safe handling process after eliminating interference at each stage.

[0007] The basic solution provided by this invention is a control method for addressing driving incapacity scenarios in new energy vehicles, comprising: S1, multi-dimensional parallel verification, to initially determine whether the driver is disabled; if all dimensions are judged to be abnormal and the duration meets the first time threshold, the driver is initially judged to be disabled. S2: After a preliminary determination of driver incapacity, a true driver incapacity determination is made based on a preset driver incapacity determination rollback mechanism. If the incapacity is determined to be recoverable, the incapacity emergency procedure is terminated and the process returns to S1; if the incapacity is determined to be true, the incapacity emergency procedure is triggered and the process proceeds to S3. S3 determines the vehicle speed level by comparing the current real-time vehicle speed with the vehicle speed threshold, and adopts a corresponding strategy to downgrade the vehicle power until the power is cut off. S4: After power is cut off, safety linkage operations are performed in sequence until the vehicle reaches a safe stop.

[0008] The present invention also provides a control system for responding to driving disability scenarios in new energy vehicles, to execute a control method for responding to driving disability scenarios in new energy vehicles; the system includes: The disability determination unit is used for multi-dimensional parallel verification to initially determine whether the driver is disabled; if all dimensions are judged to be abnormal and the duration meets the first time threshold, the driver is initially determined to be disabled. The backoff determination unit is used to determine the true disability of the driver based on a preset driver disability determination backoff mechanism after the initial determination of driver disability. If the driver is determined to recover, the disability emergency process is terminated and the disability determination unit continues to make determinations; if the driver is determined to be truly disabled, the power control unit is triggered to start the disability emergency process. The power control unit is used to determine the vehicle speed level by comparing the current real-time vehicle speed with the vehicle speed threshold after determining true incapacity, and to take corresponding strategies to degrade the vehicle power until the power is cut off. The safety linkage unit is used to perform safety linkage operations in a timely manner after power is cut off until the vehicle reaches a safe stop.

[0009] The working principle and advantages of this invention are as follows: This invention constructs an integrated safety architecture that spans the entire process of disability assessment, power degradation, and safety linkage. Based on eliminating interference and providing accurate assessment results at each stage, it forms an effective closed loop through accurate state feedback between stages, enabling vehicle control in driver disability scenarios to adopt a systematic, highly reliable, and safe handling process. Its core advantages are: This invention proposes a multi-dimensional parallel verification triggering mechanism in the determination stage, requiring multiple independent dimensions to simultaneously meet the threshold and persist for a specified duration before a preliminary disability determination is made. This fundamentally eliminates false triggers caused by false alarms from a single dimension. At the same time, a two-layer anti-false trigger architecture is constructed. Based on the pre-processing multi-channel verification, a post-processing backoff window is set to determine true disability, enabling the system to correct errors and backoff when faced with fluctuations in driver status, thereby improving the reliability of driver disability determination.

[0010] In the power degradation stage, this invention employs a low-speed strategy and a high-speed strategy execution method determined by comparing the real-time vehicle speed with a first vehicle speed threshold. The high-speed strategy includes a two-stage combination strategy: high-speed speed grading, gradual speed and torque reduction at high speeds, and power cut-off after reducing to low speeds. This differs from the all-or-nothing approach of directly cutting off power after determining disability in existing technologies. Through gradual intervention of speed grading and gradual torque reduction, the invention preserves the vehicle's maneuverability for lane changing, hazard avoidance, and rear-end collision avoidance under high-speed conditions.

[0011] Furthermore, this invention proposes redundant safety measures for the driver's vital signs controller, including independent power supply and direct control of hardware relays. This provides a physical-level fallback mechanism for power cut-off that does not rely on the main controller and main communication bus. Even if the vehicle controller or CAN communication network fails completely, power interruption can still be achieved through an independent hardware link, thereby improving the safety of vehicle disability control execution.

[0012] In the safety linkage process, this invention adopts timing control. By executing actions such as alarm, braking, and steering in a preset order, it avoids execution conflicts and response chaos caused by multiple actions being triggered simultaneously. It ensures that each safety action is initiated only after the previous action has been confirmed, thereby guaranteeing the reliability and predictability of the safety linkage process. Attached Figure Description

[0013] Figure 1 This is a flowchart illustrating the control method for addressing driver incapacity scenarios in new energy vehicles provided in an embodiment of the present invention. Figure 1 ; Figure 2 This is a flowchart illustrating the control method for addressing driver incapacity scenarios in new energy vehicles provided in an embodiment of the present invention. Figure 2 ; Figure 3 This is a schematic diagram of the control system for dealing with driving disability scenarios in new energy vehicles, provided in an embodiment of the present invention. Detailed Implementation

[0014] The following detailed explanation illustrates the specific implementation methods: The basic implementation examples are as follows: Figure 1 and Figure 2As shown: Control methods for addressing driving disability scenarios in new energy vehicles, including: S1, multi-dimensional parallel verification, to initially determine whether the driver is disabled; if all dimensions are judged to be abnormal and the duration meets the first time threshold, the driver is initially judged to be disabled. S2: After a preliminary determination of driver incapacity, a true driver incapacity determination is made based on a preset driver incapacity determination rollback mechanism. If the incapacity is determined to be recoverable, the incapacity emergency procedure is terminated and the process returns to S1; if the incapacity is determined to be true, the incapacity emergency procedure is triggered and the process proceeds to S3. S3 determines the vehicle speed level by comparing the current real-time vehicle speed with the vehicle speed threshold, and adopts a corresponding strategy to downgrade the vehicle power until the power is cut off. S4: After power is cut off, safety linkage operations are performed in sequence until the vehicle reaches a safe stop.

[0015] Specifically: In S1, sensors and other devices are deployed to collect multi-dimensional driver and vehicle status data in real time. Within each verification dimension, based on the comparison results of a set of corresponding sub-indicators with preset anomaly thresholds, it is independently determined whether that dimension is in an abnormal state, i.e., multi-dimensional parallel verification: In terms of driver vital signs, when the vital signs sensor detects that the driver's vital signs information (including health sensor signals such as heart rate, heart rate variability, and skin conductance response, and DMS image features such as eye closure duration, gaze direction, head posture, and mouth opening and closing frequency) exceeds the corresponding threshold and lasts for more than the first preset duration, the driver's vital signs are determined to be abnormal. In terms of steering wheel operation behavior, when the steering wheel angle input value and torque input value collected by the steering wheel sensor are both lower than the corresponding threshold and the duration exceeds the second preset duration, it is determined that the driver has no steering control behavior and an abnormality is identified. In terms of driving operation, when the accelerator pedal opening fluctuation is detected to be less than the corresponding threshold and continues for more than the third preset time, and there is no brake pedal pressing signal, it is determined that the driver has no braking operation behavior, and an anomaly is identified.

[0016] Driver incapacity is only determined and S2 is triggered when all dimensions simultaneously indicate anomalies and the duration exceeds the first time threshold t1. If a single dimension meets the standard, the subsequent incapacity emergency procedure is not initiated, and S1 continues.

[0017] It should be noted that the anomaly detection for each of the above dimensions is determined using existing models and empirical statistical data to determine the anomaly detection model, empirical anomaly threshold, and preset duration, without specifying the exact method.

[0018] In S2, in response to the false triggering of the driver incapacitation scenario safety linkage process due to the initial determination of driver incapacitation, when incapacitation is initially determined, an incapacitation determination fallback mechanism is activated to verify the driver's state and confirm whether it is true incapacitation. The preset driver incapacitation determination fallback mechanism includes: After all dimensions are determined to be abnormal, a certain time t2 is reserved as a fallback window period, and the reserved certain time t2 is less than the first time threshold t1 (t2<t1); within the fallback window period, if any dimension is determined to return to normal (for example, the driver resumes steering wheel operation), it is determined that the driver has recovered from incapacitation, and all emergency processes are immediately terminated, otherwise it is true incapacitation.

[0019] Based on the S1 preposed multi-channel verification threshold combined with the S2 postposed fallback window period, a two-layer anti-misoperation design is formed, which enables the driver incapacitation determination to automatically eliminate interferences, making the determination more accurate and ensuring the safe execution of the subsequent emergency intervention process.

[0020] In S3, a graded and refined power degradation strategy based on vehicle speed thresholds is adopted. A first vehicle speed demarcation threshold V1 for high-speed working conditions and low-speed working conditions is set, and two processing modes, namely a high-speed strategy and a low-speed strategy, are executed in combination with the current real-time vehicle speed: When the real-time vehicle speed ≤ V1 (urban roads, congested road sections), the low-speed strategy is executed: after the driver is determined to be truly incapacitated, software power limiting is immediately started and timed, and after T time, the hardware relay cuts off the power output of the drive motor / engine to remove the vehicle power.

[0021] When the real-time vehicle speed > V1 (high-speed roads, expressways), the high-speed strategy is executed: instantaneous power cut-off is prohibited, and stepwise power cut-off is adopted. In the first step, the vehicle software system gradually reduces the drive power output, for example, the power torque decreases by 20% per second, to smoothly reduce the vehicle speed below the second vehicle speed threshold (V1-5km / h); in the second step, after the vehicle speed is lower than the second vehicle speed threshold (V1-5km / h), the actions of the low-speed strategy are executed. Through the comprehensive application of the high-speed and low-speed strategies, the risks of vehicle tail swing and rear-end collision caused by sudden power stop at high speed are avoided. A hysteresis vehicle speed of 5km / h is set to prevent frequent switching between the high-speed strategy and the low-speed strategy when the vehicle speed fluctuates near V1.

[0022] In S3, a power hardware redundant safety strategy is adopted: Independent safety relays are arranged on the vehicle power circuits (the control circuit of the high-voltage positive electrode of the power battery, the fuel injection control circuit of the engine). The safety relays are powered and driven independently by the controller corresponding to the driver's vital sign sensor, and are not controlled by the vehicle controller. When the power degradation executed by the vehicle software system fails, the controller corresponding to the driver's vital sign sensor independently controls the safety relays to cut off the corresponding power.

[0023] In this redundant safety strategy, the controllers corresponding to the driver's vital signs sensors are directly and independently powered and control the hardware safety relays, bypassing the vehicle's main control system. In scenarios where the driver is disabled, even if the vehicle controller malfunctions, the human-machine interface screen goes black, or the vehicle communication network fails, the controllers corresponding to the driver's vital signs sensors can still cut off power through the safety relays. This achieves decoupling of software logic and hardware execution, improving the effectiveness of safety control in scenarios where the driver is disabled.

[0024] In S4, the preset safety linkage sequence for early warning and response is as follows: automatically issuing audible and visual alarm signals and automatically illuminating the vehicle's hazard lights, automatically applying the brakes in stages, automatically locking the doors, and automatically calling for help remotely.

[0025] The system integrates safety-linked actions such as hazard warning lights, buzzer warnings, gradual braking, door lock control, and remote emergency calls into a precisely timed execution chain. Safety actions following power cutoff are executed strictly according to the prescribed sequence. For example: 0ms (moment of power cutoff): Hazard warning lights are activated, and a high-frequency buzzer is played to warn surrounding vehicles to avoid the area; t3 (N milliseconds): The vehicle stability system is activated, with gradual linear braking, each braking deceleration ≤0.15g, preventing sudden braking and rollover, and slowly parking the vehicle; t4 (vehicle speed reaches 0 and comes to a complete stop): The driver and passenger doors are automatically unlocked, rear child locks are engaged, the tailgate is closed, and all windows are lowered; t5 (preset time after vehicle speed reaches 0 and comes to a complete stop): The vehicle automatically dials emergency assistance, simultaneously uploading real-time GPS location, driver incapacitation time, and road conditions to the vehicle manufacturer's emergency assistance system, the nearest traffic management center, and the nearest medical center.

[0026] like Figure 3 As shown, this embodiment also provides a control system for responding to driving disability scenarios in new energy vehicles, to execute a control method for responding to driving disability scenarios in new energy vehicles; the system includes: The disability determination unit is used for multi-dimensional parallel verification to initially determine whether the driver is disabled; if all dimensions are judged to be abnormal and the duration meets the first time threshold, the driver is initially determined to be disabled. The backoff determination unit is used to determine the true disability of the driver based on a preset driver disability determination backoff mechanism after the initial determination of driver disability. If the driver is determined to recover, the disability emergency process is terminated and the disability determination unit continues to make determinations; if the driver is determined to be truly disabled, the power control unit is triggered to start the disability emergency process. The power control unit is used to determine the vehicle speed level by comparing the current real-time vehicle speed with the vehicle speed threshold after determining true incapacity, and to take corresponding strategies to degrade the vehicle power until the power is cut off. The safety linkage unit is used to perform safety linkage operations in a timely manner after power is cut off until the vehicle reaches a safe stop.

[0027] It is understandable that the above system can fully execute the above method, with the same process and effect, so it will not be described in detail here.

[0028] The control method and system provided in this embodiment for dealing with driving disability scenarios of new energy vehicles eliminate interference factors through multi-dimensional parallel verification and backoff mechanisms, accurately determine driving disability, and accurately and efficiently trigger the disability emergency process; improve execution safety through speed-based graded strategies and segmented execution strategies in high-speed strategies; and ensure the reliability and predictability of safety linkage processes by utilizing time-series control safety linkage. Under the safety architecture of this invention, the systematic nature and high reliability of safety control in driving disability scenarios can be improved.

[0029] Example 2 Unlike Example 1, the real driving environment is inherently highly dynamic and unpredictable. This unpredictability permeates the entire process of disability safety control. Therefore, based on Example 1, an adaptive interference response strategy based on a dynamic scenario library and a self-learning mechanism is introduced, forming a two-layer architecture of basic disability safety control process and adaptive interference response. In driver disability scenarios, the vehicle safety control system can both complete the main process from disability assessment to safe stopping according to deterministic logic, and adaptively respond to random interference throughout the process, thereby maintaining the reliability and adaptability of safety decisions in the dynamic, complex, and uncertain real driving environment. Specifically: In any of the S1 to S4 stages of the safety control process, when any random interference event occurs that may cause the vehicle to deviate from the preset safety control target or interfere with the normal execution of the preset control logic, an adaptive interference response strategy based on a dynamic scenario library and a self-learning mechanism is executed simultaneously to adaptively respond to the random interference event.

[0030] Random interference events include: driver state fluctuation interference (the initial disability assessment result rises or falls, and the driver fluctuates between the disabled state and the normal state, occurring in S1 and S2), driver recovery interference (the driver regains consciousness and generates a valid operating signal during power downgrading or safety linkage, occurring in S3 and S4), actuator response failure interference (actuators such as VCU, ESP, and EPS do not respond to control commands or the response delay exceeds the preset threshold, occurring in S3 and S4), and environmental risk change interference (such as the sudden appearance of obstacles in front, the rapid approach of vehicles behind, and the sudden change of road surface adhesion coefficient, occurring at random times throughout the entire process from S1 to S4).

[0031] A dynamic scene library is pre-built and continuously updated. This library encodes and stores various random interference events according to their characteristic sequence patterns in the time and amplitude dimensions. Each type of interference event corresponds to an interference feature pattern and a corresponding countermeasure. The interference feature pattern refers to the characteristic sequence pattern of dynamically changing signals in the time and amplitude dimensions, and this pattern corresponds to a specific type of random interference event.

[0032] Each type of interference event corresponds to a record containing the following fields: interference feature pattern (a time-domain-amplitude joint feature vector generated based on the monitoring signal sequence), response strategy (a one-step or multi-step control action sequence preset for this type of interference, including at least one or a combination of actuator redundancy switching strategy, control command retransmission strategy, control parameter dynamic adjustment strategy, control state maintenance waiting strategy, and control strategy degradation switching strategy), number of calls (the cumulative number of times the record has been called by the system), number of successful matches (the number of times the interference feature was actually detected after the call), number of successful responses (the number of times the interference was effectively eliminated or mitigated after the corresponding strategy was called and executed), and status flag (marking the record as active, dormant, or pending verification).

[0033] Furthermore, the dynamically changing signals monitored in real time are matched with known interference feature patterns in the dynamic scene library. If the matching degree exceeds a preset threshold, it is identified as the corresponding interference type, and the corresponding response strategy is invoked to execute the response; if no match is found, it is marked as an unknown interference type, and the adaptive response process is triggered.

[0034] The adaptive response process includes: (1) Detection signal injection: A low-amplitude detection signal is applied to the interfered component within a preset time period and in a preset detection mode. The amplitude of the detection signal is set to a level that does not affect the vehicle's driving safety. For example, a low-amplitude test command (such as a 0.05g pre-braking pulse) is sent to a suspected malfunctioning actuator, and the specific characteristics of the interference are identified by analyzing the response delay and response curve of the test command.

[0035] (2) Interference feature identification: Based on the response data of the interfered link to the detection signal, identify the specific feature parameters of the interference, including the type of interference, severity, scope of influence and expected duration.

[0036] (3) Adaptive dynamic generation of response strategies: Based on the identification results, one or more basic response strategies are selected from the preset response strategy library and combined to generate specific response strategies for the current interference.

[0037] (4) New strategy verification and database entry: After the generated response strategy is executed, its effect is monitored within the preset verification period. If the detected interference signal fades or weakens to the preset acceptable level, the response strategy is deemed effective and the response strategy along with its corresponding interference feature pattern is added as a new record to the dynamic scenario database; if the effect is not significant within the verification period, an alternative strategy is regenerated and verified again.

[0038] For example, in S4, after the power is cut off, the system executes the following sequentially: First timing sequence (t=0 to t=0.5s): Activate the audible and visual alarm and turn on the hazard lights; Second timing (t=0.5s to t=2.5s): Send a braking command to the braking system and apply a target deceleration of 0.3g; Third timing sequence (t=2.5s to t=5s): Activate the electric power steering system to guide the vehicle toward the emergency lane; Fourth timing sequence (t=5s until vehicle stops): Continue deceleration to a stop and activate electronic parking brake; Fifth step (after the vehicle stops): Broadcast location information and call for assistance.

[0039] Example of actuator response interference: During the execution of the second timing sequence (brake intervention), if the master cylinder does not receive an execution confirmation signal from the ESP within 200ms after issuing the braking command, the adaptive interference perception will match the signal feature sequence of this event with the dynamic scenario library. If a match is found, the corresponding response strategy combination will be directly invoked; otherwise, the adaptive response process will be triggered. In this embodiment, this failure mode has no completely identical record in the dynamic scenario library, triggering the adaptive response: (1) Detection signal injection: The system sends a low-amplitude detection command (requesting 0.05g of braking pressure) to the ESP through a backup communication path and observes the ESP's response. The amplitude of the detection signal is set to a level that does not affect the vehicle's driving safety. The deceleration of 0.05g is approximately equivalent to the natural coasting deceleration after releasing the accelerator, and the occupants will not feel any additional braking sensation.

[0040] (2) Interference feature identification: By analyzing the response delay and response curve of ESP to the detection signal, the system identifies the interference feature of "ESP communication link is normal but the braking pressure establishment delay exceeds 3 times the normal value" within 150ms.

[0041] (3) Dynamic generation of response strategy: Based on the identification results, the system selects the actuator redundancy switching strategy and the control parameter dynamic adjustment strategy from the preset response strategy library and combines them to generate an adaptive strategy: switch the braking command to ESP for direct execution, and activate EPB to provide auxiliary braking force in a pulse manner.

[0042] (4) Strategy Execution and Verification: The system executes the generated strategy. After receiving the braking command, the ESP directly controls the braking cylinders of each wheel, and the EPB provides auxiliary braking force in a pulse mode with a frequency of 0.5Hz (each pulse lasts for 0.3 seconds). The actual deceleration achieved by this combined strategy at a target deceleration of 0.3g is 0.27g, which is within a safe and acceptable range. The strategy verification is successful, and the record is added to the dynamic scenario library.

[0043] Example of environmental interference: During the second-sequence braking operation, a rear millimeter-wave radar suddenly detects a large truck rapidly approaching at a relative speed of 20 km / h, with a collision time to collision (TTC) of less than 2.5 seconds. The adaptive interference perception system identifies the rear-end collision risk interference event. This interference characteristic pattern is recorded in the dynamic scenario database. The system directly calls the corresponding response strategy combination: interrupt the current braking action, reduce the deceleration to 0.1g, and replan the stopping position to a distance ahead of the current lane.

[0044] The response was completed within 25ms. The system actively released some braking pressure via ESP to reduce the deceleration from 0.3g to 0.1g, while simultaneously adjusting the stopping target position from the emergency lane to approximately 100m ahead of the current lane. Once the distance to the following vehicle increased to a safe value (confirmed by radar that the following vehicle had decelerated to a safe distance), the system gradually restored the target deceleration to 0.3g and redirected the vehicle back to the emergency lane.

[0045] It should be noted that the strategy selection and generation process can be completed using existing machine learning techniques through pre-trained machine learning models, and there are no restrictions on this.

[0046] Furthermore, an online evolution and self-learning mechanism for the dynamic scene library is introduced. Throughout the process from S1 to S4, the dynamic scene library continuously updates the state parameters and state flags of each record, performing the following: The positive reinforcement of the success strategy is as follows: when the response strategy of a certain record is invoked and the response is successful, the number of invocations, the number of successful matches, and the number of successful responses for that record all increase. When the ratio of the number of successful responses to the number of invocations (i.e. the response success rate) exceeds the first preset threshold (preferably 0.8), the status flag of the record is upgraded from active to high priority, and it gains a longer lifespan and priority invocation privileges. It will also be invoked first when similar interference occurs in the future.

[0047] Inefficient strategies are downgraded and put into dormancy. When the success rate of a record's response falls below a second preset threshold (preferably 0.4), the record's status is downgraded from active to dormant. Records in dormant status will not be prioritized in subsequent interference matching but will remain in the dynamic scenario library. When new evidence shows that the effectiveness of the record's response strategy has been restored, its status can be reactivated to active.

[0048] The continuous generation of new strategies, based on the new response strategies successfully verified in each adaptive response, continuously generates new scenario records and adds them to the dynamic scenario library, so that the dynamic scenario library is continuously enriched and evolved as the system runs.

[0049] The online evolution and self-learning capabilities of the dynamic scenario library, through positive reinforcement of successful strategies (higher success rate, higher priority, longer lifespan), demotion and hibernation of inefficient strategies (entering hibernation when the success rate is below the threshold), and continuous generation of new strategies, enable the system to have adaptive evolution capabilities, continuously accumulate experience in long-term operation, and improve interference handling capabilities and control security.

[0050] Furthermore, an adaptive disturbance response mechanism is triggered based on the different control stages currently in which it is implemented, including: In the S1 phase (disability situation awareness), the trigger threshold for dynamically changing signals is configured with the highest trigger threshold to filter out signal fluctuations under normal driving conditions and avoid misidentifying brief physiological fluctuations of the driver under normal conditions as interference. In the S2 phase (true disability verification), a second configuration is used for the trigger threshold of the dynamically changing signal. This configuration has a lower trigger threshold than the first configuration in order to detect the weak signal that the driver may recover and avoid missing the verification opportunity due to insufficient sensitivity. In the S3 stage (power degradation), the monitoring sensitivity of the actuator response signal adopts the third configuration, which has a higher sensitivity than the default monitoring sensitivity of this dimension, so as to trigger the redundancy switching response in the early stage of actuator failure and avoid control interruption due to failure to detect actuator failure in time. In the S4 phase (safety linkage), the monitoring sensitivity of external environmental risk information adopts the fourth configuration. This configuration has a higher sensitivity than the default monitoring sensitivity of this dimension, so as to quickly adjust the linkage parameters when the external environment changes, and avoid the failure of safety linkage due to environmental changes.

[0051] By configuring the trigger threshold for interference perception differently at different control stages, a deep integration of the adaptive interference response mechanism and the disability control process is achieved. The specific configuration can be adaptively determined based on actual needs and the configuration levels in the automotive field, and is not limited here.

[0052] Furthermore, when multiple types of random interference occur simultaneously, the scheduling strategy of the adaptive interference response mechanism is to schedule interference based on the priority of the interference type, with the priority rules being: First priority (highest): Sudden environmental risks (external threats involving life safety, where delayed response could lead to a collision); Second priority: Driver restores signal (may involve a transfer of control, but verification can be postponed). Third priority: Actuator failure (redundancy switching can be selected, without involving immediate collision threats).

[0053] The system does not process interference sequentially in chronological order, but prioritizes it according to the urgency of the interference type. The highest priority interference is responded to first, the next highest priority interference is processed in parallel, and the lowest priority interference is processed temporarily.

[0054] Furthermore, when the adaptive disturbance response mechanism generates a response strategy for driver recovery-type disturbances, this strategy may include a sequence of actions that suspend the current control action and initiate a recovery verification procedure. In this case, the adaptive disturbance response mechanism and the recovery verification procedure work together in the following manner: If the recovery verification passes, the response strategy is marked as successful, and the success counts of the corresponding dynamic scenario library are increased. If the recovery verification fails, or if new interference signals appear during the verification process, the response strategy is marked as partially successful, and the corresponding dynamic scenario library records the deviation information for subsequent strategy optimization. If the strength of the interference signal exceeds the preset danger threshold during the verification process, the adaptive interference response mechanism will interrupt the verification procedure and switch directly to a more conservative backup strategy to ensure that vehicle safety takes precedence over completing the verification.

[0055] The control system provided in this embodiment for dealing with driving disability scenarios of new energy vehicles includes a random disturbance linkage module. When any random disturbance event occurs in any stage of the safety control process from S1 to S4, which may cause the vehicle to deviate from the preset safety control target or interfere with the normal execution of the preset control logic, an adaptive disturbance response strategy based on a dynamic scenario library and a self-learning mechanism is executed simultaneously to adaptively respond to the random disturbance event.

[0056] The specific process and effects are the same as the method, and will not be repeated here.

[0057] The control method and system provided in this embodiment for dealing with driving disability scenarios of new energy vehicles, based on the basic safety control process in Embodiment 1 to ensure the reliability of the main path, breaks through the traditional linear interference handling mode of control pause, verification, and recovery. It introduces a dynamic scenario library and a self-learning mechanism, treating random interference throughout the entire process as dynamic events that need to be identified and dealt with. Through mechanisms such as interference feature pattern recognition, detection signal injection to identify unknown interference, and dynamic generation of response strategies, the system achieves adaptive response to random interference without interrupting the safety control process.

[0058] The above descriptions are merely embodiments of the present invention. Commonly known structures and characteristics of the solutions are not described in detail here. Those skilled in the art are aware of all common technical knowledge in the field prior to the application date or priority date, are aware of all existing technologies in that field, and have the ability to apply conventional experimental methods prior to that date. Those skilled in the art can, under the guidance of this application, improve and implement this solution in combination with their own capabilities. Some typical known structures or methods should not be obstacles for those skilled in the art to implement this application. It should be noted that those skilled in the art can make several modifications and improvements without departing from the structure of the present invention. These should also be considered within the scope of protection of the present invention, and will not affect the effectiveness of the implementation of the present invention or the practicality of the patent.

Claims

1. A control method for addressing driving incapacity scenarios in new energy vehicles, characterized in that, include: S1, multi-dimensional parallel verification, to initially determine whether the driver is disabled; if all dimensions are judged to be abnormal and the duration meets the first time threshold, the driver is initially judged to be disabled. S2, after the driver is initially determined to be incapacitated, the true incapacity of the driver is determined based on the preset driver incapacity determination rollback mechanism. If the incapacity is determined to be recoverable, the incapacity emergency procedure is terminated and the process returns to S1. If the disability is determined to be genuine, the disability emergency procedure will be triggered, and the process will proceed to S3. S3, based on the comparison between the current real-time vehicle speed and the vehicle speed threshold, adopts a speed-appropriate level strategy to downgrade the vehicle's power until the power is cut off; S4: After power is cut off, safety linkage operations are performed in sequence until the vehicle reaches a safe state.

2. The control method for addressing driving disability scenarios in new energy vehicles according to claim 1, characterized in that, In S1, multi-dimensional parallel verification includes: In the driver's vital signs dimension, when the vital signs sensor detects that the driver's vital signs information exceeds the corresponding threshold and the duration exceeds the first preset duration, the driver's vital signs are determined to be abnormal. In terms of steering wheel operation behavior, when the steering wheel angle input value and torque input value collected by the steering wheel sensor are both lower than the corresponding threshold and the duration exceeds the second preset duration, it is determined that the driver has no steering control behavior and an abnormality is identified. In terms of driving operation, when the accelerator pedal opening fluctuation is detected to be less than the corresponding threshold and continues for more than the third preset time, and there is no brake pedal pressing signal, it is determined that the driver has no braking operation behavior, and an anomaly is identified.

3. The control method for addressing driving incapacity scenarios in new energy vehicles according to claim 1, characterized in that, In S2, the preset driver incapacity assessment rollback mechanism includes: After all dimensions are determined to be abnormal, a certain period of time is reserved as a rollback window. The reserved period of time is less than the first time threshold. If any dimension is determined to return to normal within the rollback window, then the disability is determined to be recovered; otherwise, it is considered true disability.

4. The control method for addressing driving incapacity scenarios in new energy vehicles according to claim 1, characterized in that, In S3, assuming the first vehicle speed threshold is V1, the following strategy is adopted: When the real-time vehicle speed is ≤V1, a low-speed strategy is implemented: after determining that the driver is truly incapacitated, the vehicle software system immediately starts to limit the power and starts timing. After time T, the drive power output is cut off through a hardware relay. When the real-time vehicle speed is greater than V1, a high-speed strategy is implemented: a step-by-step power cut-off is adopted. The first step is to gradually reduce the drive power output by starting the vehicle software system, and smoothly reduce the vehicle speed to below the second speed threshold, which is V1 minus the hysteresis speed. The second step is to implement a low-speed strategy after the real-time vehicle speed is lower than the second speed threshold.

5. The control method for addressing driving incapacity scenarios in new energy vehicles according to claim 1 or 4, characterized in that, In S3, a power hardware redundancy safety strategy is adopted, including: An independent safety relay is installed on the vehicle's power line. The safety relay is powered and driven separately by the controller corresponding to the driver's vital signs sensor. When the vehicle software system fails to perform power degradation, the controller corresponding to the driver's vital signs sensor independently controls the safety relay to cut off the corresponding power line and cut off the drive power output.

6. The control method for addressing driving incapacity scenarios in new energy vehicles according to claim 1, characterized in that, In S4, the preset safety linkage sequence is as follows: automatically issuing audible and visual alarm signals and automatically illuminating the vehicle's hazard lights, automatically applying the brakes in stages, automatically locking the doors, and automatically calling for help remotely.

7. The control method for addressing driving disability scenarios in new energy vehicles according to claim 1, characterized in that, In any stage from S1 to S4, when any random disturbance event occurs that may cause the vehicle to deviate from the preset safety control target or interfere with the normal execution of the preset control logic, the stage-differentiated triggering and execution of an adaptive disturbance response strategy based on a dynamic scenario library and a self-learning mechanism will be carried out to adaptively respond to random disturbance events in any stage. Random disturbance events include driver state fluctuation disturbance, driver recovery disturbance, actuator response failure disturbance, and environmental risk mutation disturbance.

8. The control method for addressing driving disability scenarios in new energy vehicles according to claim 7, characterized in that, A dynamic scene library is pre-built and continuously updated. The dynamic scene library encodes and stores various random interference events according to their characteristic sequence patterns in the time domain and amplitude dimension. Each type of interference event corresponds to an interference feature pattern and a response strategy. The system matches the dynamically changing signals monitored in real time with known interference feature patterns in the dynamic scene library. If the matching degree exceeds a preset threshold, it is identified as the corresponding interference type, and the corresponding response strategy is invoked to execute the response. If no match is found, it is marked as an unknown interference type, and the adaptive response process is triggered. The adaptive response process includes probe signal injection, interference feature identification, adaptive dynamic generation of response strategies, and verification and storage of new strategies.

9. The control method for addressing driving disability scenarios in new energy vehicles according to claim 7, characterized in that, Based on the different control stages currently in which an adaptive disturbance response mechanism is triggered, including: In the S1 phase, the trigger threshold for dynamically changing signals is configured with the highest trigger threshold to filter out signal fluctuations under normal driving conditions. In phase S2, a second configuration is used for the trigger threshold of dynamically changing signals. This configuration has a lower trigger threshold than the first configuration in order to detect weak signals that the driver may recover. In the S3 phase, the monitoring sensitivity of the actuator response signal adopts a third configuration, which has a higher monitoring sensitivity than the corresponding monitoring sensitivity in the first and second configurations, so as to trigger the redundancy switching response in the early stage of actuator failure. In the S4 phase, the monitoring sensitivity of external environmental risk information adopts the fourth configuration, which has the highest monitoring sensitivity, so as to quickly adjust the linkage parameters when the external environment changes abruptly.

10. A control system for addressing driving incapacity scenarios in new energy vehicles, characterized in that, To implement the control method for responding to driving incapacity scenarios in new energy vehicles as described in any one of claims 1-9; the system includes: The disability determination unit is used for multi-dimensional parallel verification to initially determine whether the driver is disabled; if all dimensions are judged to be abnormal and the duration meets the first time threshold, the driver is initially determined to be disabled. The backoff determination unit is used to determine the true disability of the driver based on a preset driver disability determination backoff mechanism after the initial determination of driver disability. If the driver is determined to recover, the disability emergency process is terminated and the disability determination unit continues to make determinations; if the driver is determined to be truly disabled, the power control unit is triggered to start the disability emergency process. The power control unit is used to determine the vehicle speed level by comparing the current real-time vehicle speed with the vehicle speed threshold after determining true incapacity, and to take corresponding strategies to degrade the vehicle power until the power is cut off. The safety linkage unit is used to perform safety linkage operations in a timely manner after power is cut off until the vehicle reaches a safe stop.

Images