A large model driven sweeper self-evolution unmanned control method and system

Abstract

The application discloses a large model driven sweeper self-evolution unmanned control method and system, belongs to the field of unmanned vehicle control and road sweeping operation optimization, and aims at solving the problem that fixed navigation rules and preset control parameters are difficult to be closed-loop optimized with the changes of roads, garbage, adhesion, positioning and obstacles. The application constructs a work event package with road segment identification and obstacle avoidance event identification, realizes self-evolution closed loop through confirming coverage arrears, background large model structured processing, constrained offline layered reinforcement learning, same event pairing verification, limited domain vehicle end execution, independent safety filtering, and event-by-event volume release or rollback, and realizes path regression and sweeping strategy continuous optimization under safety constraints.

Description

Technical Field

[0001] This invention relates to the field of unmanned vehicle control and road sweeping operation optimization, and in particular to a large-model-driven self-evolving unmanned driving control method and system for sweepers. Background Technology

[0002] Low-speed unmanned sweeping vehicles typically rely on fixed navigation rules, preset control parameters, and sweeping paths configured according to road templates to complete their operations. The vehicle perception system, navigation system, onboard control system, and back-end management platform handle obstacle recognition, path planning, speed and steering control, and log management, respectively. However, actual sweeping footprints, control responses, coverage results, energy consumption, and human feedback are often not uniformly correlated with the same road segment or the same obstacle avoidance event, making it difficult for the back-end to continuously correct strategies using real operational results.

[0003] When road boundary morphology, garbage density, road surface adhesion conditions, positioning errors, and dynamic obstacles change, fixed parameters struggle to simultaneously coordinate target speed, steering changes, obstacle avoidance clearance, edge spacing, obstacle avoidance path, and return path. After avoiding an obstacle, the vehicle may not be able to reliably return to its original sweeping route. Positioning uncertainty can also cause discrepancies between the nominal sweeping area and the actual confirmed coverage area, resulting in missed sweeps, repeated sweeping, edge fluctuations, frequent turning, ineffective parking, and increased energy consumption per unit coverage area. Furthermore, the current strategy update process lacks a complete mechanism for safely verifying, limiting, gradually increasing, and automatically rolling back baseline and candidate strategies under the same historical event and consistent evaluation criteria.

[0004] Therefore, there is a need for a method and system for the self-evolving unmanned driving control of sweepers that can overcome the shortcomings of the existing technologies. Summary of the Invention

[0005] One objective of this invention is to propose a large-model-driven self-evolving unmanned driving control method and system for sweepers. Addressing the problems in existing technologies where vehicle operation data, actual sweeping results, and strategy updates are disconnected, and fixed navigation rules and preset control parameters are difficult to adapt to environmental changes, this invention proposes a technical solution that associates operational events with road segment identifiers and obstacle avoidance event identifiers, generates confirmation coverage deficits based on positioning uncertainty, forms structured scene labels and parameter dependency masks from a large-scale backend model, generates candidate strategies using a constrained offline hierarchical reinforcement learner, and forms a signed strategy package through counterfactual pairing verification of the same events. At the vehicle end, after matching the applicable domain, the navigation system, unified control system, and independent safety filter work together to execute the system. Then, the actual control response and sweeping results are used to complete event-by-event evaluation, scaling up, or rollback. This invention achieves the technical effect of continuously optimizing obstacle avoidance regression, edge navigation, and sweeping coverage within safety boundaries.

[0006] This invention provides a large-model-driven self-evolving unmanned driving control method for sweepers, comprising: S1. Link vehicle operation data and cleaning feedback with road segment identifiers and obstacle avoidance event identifiers to generate operation event packages; Based on the uncertainty of the location, the actual scanning footprint is reduced and the difference is calculated with the planned coverage area to obtain the confirmed coverage deficit; S2. The background big model generates structured scene labels, abnormal reasons, measurable target components, and parameter dependency masks that limit adjustable strategy parameters and dependencies based on the operation event package and the confirmed overdue payment. The constrained offline hierarchical reinforcement learner optimizes the parameters under safety constraints to generate a candidate policy package. S3. Based on the same historical event and counterfactual perturbation, pair and run the baseline policy package and the candidate policy package; If the candidate policy package meets the security index threshold and its cleaning index confidence lower bound is not lower than the corresponding cleaning index confidence lower bound of the baseline policy package, a signature policy package is generated. S4. When the scene features corresponding to the structured scene label match the applicable domain parameters of the signature strategy package, the navigation system generates the obstacle spatiotemporal envelope and candidate regression anchor points from the operation event package, and generates the operation path in conjunction with the confirmation coverage arrears. The vehicle-mounted unified control system generates vehicle control commands based on the parameter range of the signature strategy package, and the execution is constrained by an independent safety filter. S5. Write the control response and cleaning results back to the job event package, evaluate the signature strategy package accordingly and perform incremental scaling or rollback, and use the evaluation results and failure events as optimization samples.

[0007] Optionally, S1 includes: collecting environmental point clouds, environmental images, road boundaries, road segment attribute records associated with road segment identifiers, garbage density, vehicle positioning results and positioning covariance, road surface adhesion estimation, vehicle trajectory, target speed and actual speed, target turning angle and actual turning angle, sweeper start and stop status and effective sweeper width, residue before and after sweeping, coverage area, overlap area, energy consumption, parking events, takeover events and human feedback according to a unified time reference; The collected results are time-aligned using the road segment identifier and obstacle avoidance event identifier as a common index, and the time-aligned collected results, their data source, collection time, and validity flag are encapsulated into the operation event package. Furthermore, it also includes: The overdue payment manager records the off-track anchor point when the vehicle leaves the original sweeping path to bypass the obstacle. Based on the vehicle's position, the start and stop status of the sweeping brush, and the effective width of the sweeping brush, the actual sweeping brush motion envelope is generated, and the actual sweeping brush motion envelope is determined as the actual sweeping brush footprint. The footprint shrinkage boundary is determined based on the positioning covariance. The actual sweeping footprint is then subjected to confidence shrinkage. The actual sweeping footprint after shrinkage is used as the confirmed coverage area. The area in the planned coverage area that does not fall into the confirmed coverage area is defined as the confirmed coverage deficit. The confirmed coverage area, confirmed coverage deficit, and off-track anchor point are written into the same operation event package.

[0008] Optionally, S2 includes: the background big model encodes the road boundary morphology, garbage density range, road surface adhesion range, positioning uncertainty range, dynamic obstacle type and control response deviation into the structured scene label based on the data source, validity mark and human feedback in the operation event package; and encodes missed sweeping, repeated sweeping, edge spacing deviation, steering reversal, invalid parking, safety intervention and unit confirmed coverage area energy consumption into the abnormal cause and measurable target component. The parameter dependency mask is generated based on the correlation between the cause of the anomaly and the measurable target component; The constrained offline hierarchical reinforcement learner selects adjustable strategy parameters from the target velocity, acceleration boundary, deceleration boundary, steering rate of change boundary, obstacle avoidance clearance, edge spacing, obstacle bypass cost weight, regression cost weight, and replanning threshold according to the parameter dependency mask. With the safety cost not exceeding the safety cost upper limit as a constraint, the confirmation coverage increment and confirmation coverage arrears reduction are regarded as long-term reward items, and the repeated coverage area, steering reversal number, invalid parking time, and energy consumption per unit confirmation coverage area are regarded as long-term reward penalty items. The output is the candidate strategy package containing version identifier, applicable domain parameters, baseline values ​​and parameter ranges of each adjustable strategy parameter, validity period, exit conditions, and rollback version identifier. The applicable domain parameter consists of a field identifier, a mandatory flag, a value range, and a data source pointing to the corresponding field in the job event package.

[0009] Optionally, S3 includes: the cleaning event pairing verifier determines the policy version that is stably running in the target applicable domain and has been safely confirmed when the candidate policy package is generated as the baseline policy package, and freezes the version identifier, vehicle configuration, applicable domain parameters, parameter values, evaluation time domain and rollback version identifier of the baseline policy package; Read historical operation events with the same road segment identifier and obstacle avoidance event identifier, and determine the data obtained by applying a perturbation within a value range to at least one of obstacle trajectory, positioning covariance, road surface adhesion estimation or garbage density as the counterfactual perturbation; The baseline strategy package and the candidate strategy package are executed in parallel under the same initial vehicle state, vehicle configuration, planned coverage area and evaluation time domain. The minimum obstacle clearance and braking margin are compared with the lower limit of clearance and lower limit of margin that have been confirmed for safety, respectively. The positioning reliability is compared with the lower limit of reliability. The vehicle stability is compared with the allowable stability range. The actuator output is compared with the upper limit of actuator capability to obtain the safety index. The confirmed coverage increment and confirmed coverage deficit reduction are used as revenue components, and the overlapping coverage area, edge spacing variance, invalid parking time and energy consumption per unit confirmed coverage area are used as penalty components. Each component is converted into a cleaning score with a larger value as better according to the scale and weight recorded in the evaluation configuration in advance, and the confidence lower bounds of the candidate cleaning score and the baseline cleaning score are determined respectively. When each security indicator meets the corresponding lower limit, allowable range or capability upper limit and the confidence lower bound of the candidate cleaning score is not lower than the confidence lower bound of the baseline cleaning score, a subset of allowable parameters is determined from the adjustable policy parameters of the candidate policy package to generate the signature policy package. The signature policy package inherits and freezes the version identifier, applicable domain parameters, baseline values ​​and parameter ranges of each parameter in the allowed parameter subset, validity period, exit conditions and rollback version identifier of the candidate policy package, and includes the initial adjustment range and the gradual increase conditions. Parameters that do not enter the allowed parameter subset use the frozen parameter values ​​of the baseline policy package.

[0010] Optionally, S4 includes: the navigation system generates the obstacle spatiotemporal envelope based on the obstacle perception data in the operation event package, generates candidate regression anchor points along the original cleaning path after the obstacle spatiotemporal envelope, and determines a candidate evaluation vector for each candidate regression anchor point, consisting of safety margin, kinematic feasibility indicator, expected confirmed coverage deficit, expected repeated coverage area, expected number of turning and reversing times, and regression distance. Based on vehicle kinematic constraints, the candidate evaluation vector is evaluated by combining the obstacle avoidance cost weight and regression cost weight corresponding to the allowed parameter subset of the signature strategy package. When an obstacle occupies the original cleaning path, an obstacle bypass path is generated. When bypassing the obstacle, a candidate regression anchor point that satisfies the safety margin constraint and kinematic feasibility constraint is selected to generate a regression path. Based on the confirmed coverage deficit, an edge-following path or a replanning path is generated, so that the operation path includes at least one of the obstacle bypass path, regression path, edge-following path and replanning path. When the obstacle bypass cost weight or regression cost weight is not included in the allowed parameter subset, the corresponding frozen parameter value in the baseline strategy package is used. Furthermore, it also includes: The current scene features are generated based on the structured scene tags and the road segment attribute records, obstacle types, positioning uncertainty intervals and road surface attachment intervals in the operation event package, and the current scene features are compared item by item with the applicable domain parameters of the signature strategy package; The allowed parameter subset is enabled only when all applicable field parameters marked as required have valid data and meet the corresponding value range. If any required applicable field parameter is missing, invalid, or does not meet the corresponding value range, it is determined as a mismatch. Upon initial activation, the changes of each allowed parameter relative to the corresponding frozen parameter value in the baseline policy package are limited to the initial adjustment range; The vehicle-mounted unified control system, based on the work path, vehicle status, and permissible parameters after activation, solves for the target speed, driving amount, braking amount, and target steering angle through model predictive control. The independent safety filter verifies the vehicle control command according to the lower limit of net distance, lower limit of margin, lower limit of confidence, allowable range of stability and upper limit of actuator capability. If any safety indicator fails to meet the corresponding boundary, the vehicle control command is rejected and replaced with a deceleration, braking, steering angle limit or stopping command that meets the corresponding boundary, while recording the safety intervention event. When the safety indicator input is invalid, replacement instructions that meet all corresponding boundaries cannot be obtained, or the actuator refuses to execute, enter the independent fault-safe mode, prohibit policy parameter updates, control the available actuators to perform the minimum risk shutdown, and record the reasons for non-replacement and manual takeover requests.

[0011] Optionally, S5 includes: increasing the proportion of operation events controlled by the signature strategy package according to the step-by-step increase conditions, and forming an event evaluation result after each operation event is completed based on the actual sweep footprint, vehicle control response, safety intervention rate, confirmed coverage deficit, and edge spacing variance; When the event evaluation result meets the step-by-step release condition, the adjustment range of each allowed parameter relative to the corresponding frozen parameter value and the proportion of subsequent operation events are increased. When the increase in the safety intervention rate, confirmation coverage deficit, or edge spacing variance relative to the baseline strategy package reaches the rollback threshold under the same vehicle configuration, applicable domain, and evaluation time domain, switch to the strategy package corresponding to the rollback version identifier and generate a failure event. The event evaluation results, failure events, safety intervention events, irreplaceable reasons, and manual takeover results are written into the corresponding job event package and sent back to the background large model and the constrained offline hierarchical reinforcement learner. Furthermore, it also includes: When the current scenario features do not match the applicable domain parameters, the signature policy package expires, the security intervention rate reaches the exit condition, the signature verification fails, or the independent fault-tolerant mode is triggered, the allowed parameter subset is prohibited from being enabled and the policy package corresponding to the rollback version identifier is switched. Write the mismatched applicable domain parameters, the expired version identifier, the security intervention event that triggered the exit condition, the signature verification failure result, or the irreplaceable reason into the failure event; Once manual takeover is complete and security indicator inputs are restored to validity, exiting the independent failsafe mode is only permitted when recompleting applicable domain matching and signature verification.

[0012] On the other hand, the present invention also provides a large-model-driven self-evolving unmanned driving control system for sweepers, comprising: The event building module includes an overdue payment manager, which is used to generate job event packages and confirm overdue payments based on vehicle operation data and cleaning feedback; The strategy generation module includes a background large model and a constrained offline hierarchical reinforcement learner, used to generate candidate strategy packages based on the job event package and the confirmation coverage arrears; The pairing verification module includes a sweep event pairing verifier, used to pair and verify the candidate policy package with the baseline policy package and generate a signed policy package; The vehicle-side execution module includes a navigation system, an in-vehicle unified control system, and an independent safety filter, used to generate operation paths and vehicle control instructions based on the signature policy package and to execute safety constraints. The feedback evolution module is used to write the control response, cleaning result and failure event into the job event package, and feed the job event package back to the strategy generation module.

[0013] The beneficial effects of this invention are: 1. By identifying road segments and obstacle avoidance events, perception, control, sweeping footprints, coverage results, energy consumption, and feedback are associated as operational event packages. The sweeping footprints are then narrowed down according to positioning uncertainty to confirm coverage deficits. This allows obstacle avoidance off-track, candidate return, and actual sweeping coverage to be connected by the same event quantity, reducing missed sweeping and duplicate sweeping caused by inconsistencies between nominal and actual coverage.

[0014] 2. The large backend model only generates structured scene labels, anomaly causes, target components, and parameter dependency masks. The constrained offline hierarchical reinforcement learner forms candidate policy packages under safety cost constraints, and the paired validator compares them with the frozen baseline under the same historical event and counterfactual perturbation, so that policy updates have measurable evaluation, applicable domain limitation, field inheritance, and rollback basis.

[0015] 3. The navigation system, vehicle-mounted unified control system, and independent safety filter sequentially complete the obstacle avoidance return path driven by the coverage deficit, speed and steering constraint control, and fault safety handling. Then, based on real events, the parameter range and operation ratio are expanded or automatic rollback is performed, which helps to reduce edge fluctuations, frequent steering, invalid stops, and energy consumption per unit confirmed coverage area. Attached Figure Description

[0016] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of the large-model-driven self-evolutionary unmanned driving control method for sweepers according to the present invention.

[0017] Figure 2 This is a flowchart of the S3 pairing verification step of the present invention. Detailed Implementation

[0018] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0019] refer to Figures 1-2 A large-model-driven self-evolutionary unmanned driving control method for sweepers includes: S1. Link vehicle operation data and cleaning feedback with road segment identifiers and obstacle avoidance event identifiers to generate operation event packages; Based on the uncertainty of the location, the actual scanning footprint is reduced and the difference is calculated with the planned coverage area to obtain the confirmed coverage deficit; S2. The background big model generates structured scene labels, abnormal reasons, measurable target components, and parameter dependency masks that limit adjustable strategy parameters and dependencies based on the operation event package and the confirmed overdue payment. The constrained offline hierarchical reinforcement learner optimizes the parameters under safety constraints to generate a candidate policy package. S3. Based on the same historical event and counterfactual perturbation, pair and run the baseline policy package and the candidate policy package; If the candidate policy package meets the security index threshold and its cleaning index confidence lower bound is not lower than the corresponding cleaning index confidence lower bound of the baseline policy package, a signature policy package is generated. S4. When the scene features corresponding to the structured scene label match the applicable domain parameters of the signature strategy package, the navigation system generates the obstacle spatiotemporal envelope and candidate regression anchor points from the operation event package, and generates the operation path in conjunction with the confirmation coverage arrears. The vehicle-mounted unified control system generates vehicle control commands based on the parameter range of the signature strategy package, and the execution is constrained by an independent safety filter. S5. Write the control response and cleaning results back to the job event package, evaluate the signature strategy package accordingly and perform incremental scaling or rollback, and use the evaluation results and failure events as optimization samples.

[0020] In this specific embodiment, S1 includes: In this specific embodiment, the target of the operation is a low-speed unmanned sweeper with a wheelbase of 2.2m, a maximum operating speed of 2.5m / s, and an effective sweeping width of 1.8m. The vehicle-side event construction module uses 100ms as the main event clock and reads the original records from the LiDAR, forward-looking camera, integrated navigation, wheel speed sensor, corner sensor, drive and brake controller, sweeping controller, and energy consumption metering unit. It also reads the road segment identifier, planned coverage area, and road segment attribute records from the road task library. The environmental point cloud uses three-dimensional point records with timestamps in the vehicle coordinate system. The environmental image uses continuous frames with a resolution of 1280×720. The vehicle pose is represented by the planar position, heading angle, and corresponding positioning covariance in the map coordinate system. The road adhesion estimator reads the longitudinal acceleration from the inertial measurement unit within the integrated navigation system, the wheel speeds from the wheel speedometer, the motor torque percentage and braking pressure percentage from the drive and brake controllers, the vehicle longitudinal speed from the integrated navigation system, and the road category key from the road segment attribute record, all within the same 100ms master clock. The deviation between each input timestamp and the master clock must not exceed 50ms. The estimator first takes the median of five consecutive valid samples, then queries the versioned adhesion calibration table generated from closed-course tests of the same vehicle model using the drive wheel slip ratio range, longitudinal acceleration response range, drive or braking command range, and road category key when the vehicle's longitudinal speed is not less than 0.30m / s. The system performs linear interpolation based on adjacent entries. When both the driving and braking sides are valid, the minimum value of the adhesion estimates from both sides is taken. When only one side is valid, the value from that side is taken. The system outputs a dimensionless road adhesion estimate of 0.10 to 1.00, the calibration table version, the input source, the calculation time, and the quality code, and writes it into the job event package. If any required input is missing or the timeout exceeds 300ms, the speed is lower than the calculation lower limit, the lookup key is missing, or the interpolation result is not finite, the road adhesion estimate quality code is set to invalid. In S2, this event cannot be used for applicable domain matching. In S3, this event cannot be included in the valid pairing. In S4, the system reads the lowest available deceleration for the adhesion gear that has been safely confirmed in the vehicle configuration and requests limited deceleration until five consecutive samples are valid again. The event construction module creates an obstacle avoidance event identifier when it detects that a vehicle has deviated from its original cleaning path due to an obstacle. It records the last path point before derailment that meets the condition of a lateral deviation not exceeding 0.10m as the derailment anchor point. If the same tracking target is continuously detected within the same road segment and the interval between adjacent detections does not exceed 0.5s, the obstacle avoidance event identifier is retained. The event is deactivated after the obstacle disappears and the vehicle returns to its original path or enters a replanned path. Data collection and recording are performed according to the following conditions. Included in the event window, This indicates the acquisition time of the i-th acquisition record, in milliseconds, where i represents the index of the valid acquisition record within the event window, ranging from 1 to... Furthermore, the index unit is not applicable. This indicates the total number of valid records collected within the event window, expressed in records. Indicates the master clock time of the event, in milliseconds (ms). This indicates the allowable time alignment deviation, which is set to 50ms in this specific implementation. Each aligned record is written with data type, data source, acquisition time, coordinate system, value, unit, validity flag, and quality code. When the missing frame of the combined navigation does not exceed 300ms, the pose is extrapolated from the wheel speed and yaw rate, and the quality code is set to extrapolation. When the missing frame exceeds 300ms, the sensor self-test fails, or the time deviation exceeds the allowable time alignment deviation, the corresponding field is set to invalid and does not participate in the coverage confirmation. The garbage density is determined by the road surface segmentation result of the image before sweeping and the proportion of garbage pixels in the unit grid. The residue before and after sweeping, coverage area, overlap area, target speed, actual speed, target turning angle, actual turning angle, sweeper start and stop status, parking event, takeover event, energy consumption, and manual feedback are all written into the same operation event package along with the road segment identifier and obstacle avoidance event identifier. The coverage manager saves the planned coverage area in a map grid with a side length of 50mm. According to the vehicle pose, the sweeping rectangle in the vehicle coordinate system is projected onto the map coordinate system. Sampling is not generated for samples where sweeping is closed, pose field is invalid, or effective sweeping width is less than the calibration lower limit of 1.65m. For other samples, the sweeping rectangles between adjacent poses are linearly swept and merged into the actual sweeping motion envelope. The envelope grid records the first coverage time, the last coverage time, the cumulative number of coverages and the corresponding event identifier. Grids with a cumulative number of coverages greater than 1 are included in the overlap area. The positioning covariance is propagated to the boundary points of the actual swept polygon by the planar position, the intersection of the planar position and the heading angle, and the heading angle variance; let Let K be the finite set of boundary vertices of the actual swept polygon relative to the vehicle pose reference point in the Kth valid sample. For any ,make Let be the coordinates of this vertex in the vehicle coordinate system, and use . Determine the first-order Jacobian matrix from the vehicle's planar pose error to the planar position error of the boundary point; where 'b' represents the finite set of boundary vertices where set units are not applicable, and 'b' represents one of the boundary vertices where index units are not applicable. and These represent the longitudinal and lateral coordinates of the boundary vertex relative to the vehicle pose reference point, respectively, both in meters (m). This represents the two-row, three-column Jacobian matrix, where the first two columns are the translation error sensitivity, and the third column is the boundary point displacement sensitivity caused by the heading error. The heading angle is measured in rad and participates in propagation as a dimensionless quantity. Determine the unique non-negative ,in This represents the 95% confidence footprint shrinkage radius of the Kth valid sample, in meters. The unit is m², and K represents the effective scan sampling index, with values ​​ranging from 1 to... Furthermore, the index unit is not applicable. This represents the total number of valid sweep samples within the obstacle avoidance event, expressed in units of samples. 5.991 represents the dimensionless quantile coefficient of the two-dimensional chi-square distribution at the 95% confidence level. This indicates that the value is maximized on the finite set of boundary vertices, and the unit varies with the compared quantity. This represents a function that acts on a real symmetric positive semi-definite covariance matrix and takes the largest eigenvalue. The output dimension is the same as the matrix elements, in this case, m². express transpose, This represents the 3D pose covariance matrix of the Kth valid sample with respect to the longitudinal position, lateral position, and heading angle in the plane. The position variance is in m², the cross-covariance of position and heading angle is in m, and the heading angle variance is dimensionless. The product... The planar position covariance matrix of the b-th sweep boundary vertex is expressed in m²; the resulting non-negative matrix... The sampling distance is limited to 0.03m to 0.40m. If the distance exceeds the upper limit, the sampling is marked as unreliable. If the pose covariance is not a real symmetric positive semi-definite matrix, the heading angle variance or cross covariance fields are missing, or the timeout or quality code is invalid, the coverage confirmation of the sampling is stopped and the existing failsafe path is entered. The coverage deficit manager only records the length quantity. As the inward erosion radius of the next polygon segment; The coverage manager first erodes the actual sweep polygon formed by each valid sample inward according to the corresponding footprint shrinkage radius. If the center of a planned grid falls into at least one eroded polygon, the grid is recorded as confirmed coverage; otherwise, it is recorded as unconfirmed coverage. Then... Calculate the grid's debt indicator, where Indicates the first The dimensionless confirmation coverage of the outstanding debt binary flag for each grid cell takes a value of 0 or 1. This represents the map grid index of the set of grid cells that will be covered when traversing the current road segment; values ​​range from 1 to... Furthermore, the index unit is not applicable. This indicates the total number of grids in the raster set covered by the plan, expressed in units of grids. Indicates the first A dimensionless binary flag for the planned coverage of each grid cell is assigned, set to 1 if the cell is within the planned coverage area, and 0 otherwise. Indicates the first The dimensionless confirmation coverage binary flag of each grid is set to 1 after the polygon falls into at least one erosion, otherwise it is set to 0. Grids with a debt flag of 1 constitute the confirmed coverage debt, and grids with a confirmed coverage flag of 1 constitute the confirmed coverage area. For confirmed coverage deficits, the deficit partitions are divided according to the connectivity of eight neighboring regions. Each partition records the partition identifier, area, boundary polygon, road distance from the track anchor point, the type of the nearest road boundary, and the time of first formation. Isolated partitions with an area less than 0.10m² and whose surrounding eight grids are all confirmed coverages are deleted by grid quantization noise. Partitions with an area of ​​not less than 0.10m² are written into the deficit queue in ascending order of road distance. The queue also retains the prohibition flag for immediate re-filling when intersecting with the spatiotemporal envelope of dynamic obstacles, which can be used by S4 to generate regression, edge-fitting, or replanning paths. The operation event package adopts a six-segment structure: event header, sensor recording area, control recording area, coverage grid area, manual feedback area, and verification area. The event header stores the road segment identifier, obstacle avoidance event identifier, vehicle configuration, start time, end time, and data version. The control recording area stores the target value, actual value, and actuator status simultaneously with the control cycle as the key. The coverage grid area stores the compressed bitmap and map version of the confirmed coverage and the overdue partition. The backend uses the road segment identifier, obstacle avoidance event identifier, and start time as a unique key to compare the upload summary. When a duplicate upload is received, only the receiving status is updated without appending the duplicate event. The effective sweep width is verified by the vehicle passing through a 10m calibration strip at 0.5m / s before the first task of the day. The sweep width of the day is updated according to the results of three consecutive measurements. When the range of the three effective width measurements does not exceed 0.05m, the median is used. If the range exceeds the limit or the sweep current deviates from the calibration range, confirmation coverage is prohibited and a maintenance mark is generated. The positioning covariance shrinkage result is also compared with the measured lateral error of two fixed map markers. When the measured error of 20 consecutive samples exceeds the 95% shrinkage boundary, the positioning quality code is set to mismatch and the coverage confirmation of the event is stopped. At the end of the event, the event construction module calculates the confirmed coverage increment, the amount of backlog reduction, the area of ​​repeated coverage, the variance of the edge spacing, the number of steering reversals, the duration of invalid parking, the number of safety interventions, and the energy consumption per unit of confirmed coverage area. When the confirmed coverage area is less than 1m², only the total energy consumption is saved and the energy consumption per unit area is set to invalid. Then, the confirmed coverage area, confirmed coverage backlog, backlog queue, off-track anchor point, references to each original data, quality code, and statistics are encapsulated into an append-only operation event package. The package digest is signed using the vehicle certificate and written to the vehicle-side event cache and the background event library. The operation event package serves as the only event-level input object of S2.

[0021] In this specific embodiment, S2 includes: The background strategy generation service reads the job event package formed by S1 and whose signature verification is passed, and serializes the road boundary curvature interval, road width, garbage density quantile interval, road surface adhesion interval, positioning uncertainty interval, dynamic obstacle type, control response deviation, confirmed coverage arrears partition statistics, manual feedback and validity flags of each field into a scene record with a fixed field order. Continuous fields are truncated to 0 to 1 after being truncated by the 1% quantile and 99% quantile values ​​of the training set. Category fields are encoded using a versioned code table. Invalid fields retain missing markers instead of being replaced with zero values. The backend big model adopts a 7 billion parameter decoding model fine-tuned by the sweeping operation corpus instructions. The input consists of scene records, human feedback, field data sources and output constraint templates. The output only allows structured scene labels, abnormal reasons, measurable target components and candidate dependencies that conform to the established structure. The structured scene labels are fixed to include six types of fields: road boundary morphology, garbage density range, road surface adhesion range, positioning uncertainty range, dynamic obstacle type and control response deviation. Abnormal reasons and measurable target components are limited to missed sweeping, repeated sweeping, edge spacing deviation, steering reversal, invalid parking, safety intervention and energy consumption per unit confirmed coverage area. The decoding temperature is set to 0 and the output of vehicle control commands or unregistered parameters is prohibited through the structural constraint decoder. The model output first undergoes a field validator to verify the data source, required fields, and value range. Labels involving invalid input are marked as unusable for matching the applicable domain. Candidate dependencies are represented by a quadruple of anomaly cause, target component, strategy parameter, and relationship direction. The dependency validator only retains the target velocity, acceleration boundary, deceleration boundary, steering rate of change boundary, obstacle avoidance clearance, edge-to-edge distance, obstacle avoidance cost weight, regression cost weight, and replanning threshold registered in the parameter whitelist. The dependency validator uses a combination of road boundary morphology, vehicle configuration identifier, road surface adhesion interval, and garbage density interval as the hierarchical key for similar events. Within each layer of no less than 500 valid historical events, partial Spearman correlation is used to calculate the conditional correlation between the target component and parameter changes. Continuous variables are first averaged and standardized according to their rank, while categorical variables are one-hot encoded according to a fixed order of model configuration version. The quantities are fixed as road width, midpoint of garbage density interval, road surface adhesion estimate, midpoint of positioning uncertainty interval, and initial event velocity. The dependency validator uses linear regression with intercept and ridge coefficient fixed at 0.000001 to eliminate the influence of the control variables from the target component rank and parameter change rank, respectively. Then, the Pearson correlation coefficient of the two sets of residuals is calculated, and its sign indicates the direction of the relationship. Events are divided into five parts according to the remainder of the stable hash value of the operation event identifier divided by 5. The coefficient is calculated once on the sample of each part. The relationship is confirmed when at least four parts are consistent with the candidate relationship direction and the median of the absolute value of the coefficients of the five parts is not less than 0.15. Rows with missing required fields are deleted. If the deletion ratio exceeds 10%, the effective samples of any part are less than 100, the residual variance is zero, or the coefficient is not finite, the relationship is not confirmed. The corresponding dependency mask unit is written as zero and the target component and parameter pair are written into the list of samples to be supplemented. Parameter dependency mask according to rules Write the cell corresponding to the confirmation relationship; otherwise, write zero. This flag represents the dimensionless binary dependency between the q-th measurable target component and the j-th adjustable policy parameter, taking a value of 0 or 1. q represents the index of the set of measurable target components registered during the traversal of the model configuration version, with a value ranging from 1 to 1. Furthermore, the index unit is not applicable. This represents the total number of registered target components, and j represents the index of the whitelist set of parameters for the same version, ranging from 1 to... Furthermore, the index unit is not applicable. This indicates the total number of adjustable strategy parameters. The order of the mask rows and columns is fixed according to the model configuration version. Relationships explicitly prohibited by manual review are always set to zero. If no relationship is confirmed for any target component, the baseline parameters are retained and the target component is added to the list of samples to be supplemented. The constrained offline hierarchical reinforcement learner constructs a sequence of states, actions, rewards, next states, and termination flags from the background event library. For each job event, the high-level policy selects adjustable parameter sets and obstacle avoidance, regression, edge-following, or replanning modes. Every 500ms, the low-level policy provides normalized parameter increments within the dimensions allowed by the parameter dependency mask. After parameter interval pruning, the actions are restored to target velocity, acceleration boundary, deceleration boundary, turning rate of change boundary, obstacle avoidance clearance, edge-following distance, obstacle avoidance cost weight, regression cost weight, or replanning threshold with units. Dimensions with zero mask are forced to use baseline frozen values. After training, the high-level policy, low-level policy, state field order, and parameter restoration rules are solidified into a read-only executable policy artifact. Long-term returns Calculation, where This represents the dimensionless long-term return of the h-th job event, where h represents the event return identifier (unit not applicable), and m represents the revenue component index, which takes the value 1 or 2 (index unit not applicable). This represents the m-th dimensionless revenue component after normalization of the confirmed coverage increment and the confirmed coverage debt reduction according to their respective evaluation scales, with a value ranging from 0 to 1. This indicates the m-th dimensionless non-negative return weight given in the corresponding table entry for the evaluation configuration version, satisfying the closed interval constraint from 0 to 1, where n represents the penalty component index, taking values ​​from 1 to 4 with no applicable index unit. This represents the nth dimensionless penalty component, ranging from 0 to 1, after normalization of the repeated coverage area, number of turning reversals, invalid parking time, and energy consumption per unit confirmed coverage area according to their respective evaluation scales. The nth dimensionless non-negative penalty weight given in the corresponding table item of the evaluation configuration version satisfies the closed interval constraint from 0 to 1. The sum of the reward weights and the sum of the penalty weights are both 1. The larger the reward value, the better the cleaning performance. Training employs conservative offline hierarchical reinforcement learning with Lagrange safety constraints, and the policy objective is written as... ,in And h follows the long-term return formula and its complete explanation from the previous period. This represents the dimensionless long-term return of the h-th job event, where h represents the event return identifier and the unit is not applicable. This indicates the candidate hierarchical policy object obtained during training, and the unit is not applicable. This indicates that the operator with the largest objective value is selected from the set of policies defined by the current model configuration version, high-level network structure, and low-level network structure, with no unit applicable. This indicates that the set contains strategy objects to be evaluated and the unit is not applicable. This represents the expected operator for calculating the arithmetic mean of event rewards over all valid events in the independent validation set according to the strategy to be evaluated, without applying units. This represents a dimensionless, non-negative Lagrange multiplier, initially set to 0 with an upper limit of 100. Each round, it is updated and pruned to values ​​between 0 and 100 based on the product of a learning rate of 0.001 and the safety cost exceeding the limit. This indicates that only positive safety cost excesses are retained. This represents the dimensionless expected security cost of the strategy on the independent verification set. This represents the upper limit of the dimensionless security cost. In this specific implementation, the security cost of the 95th percentile of the baseline event that has been confirmed for security is set to 0.08. The conservative value term imposes additional penalties on actions that do not appear sufficiently in the offline dataset. The safety cost is calculated by summing the normalized severity of five types of events: insufficient minimum obstacle clearance, insufficient braking margin, insufficient positioning reliability, vehicle stability exceeding limits, and actuator output exceeding limits, according to the safety configuration weights. When any hard safety boundary is crossed, the sequence is terminated directly and the safety cost is set to 1. The training set is divided into 70% training, 15% calibration, and 15% validation by road segments. Crossing sets for the same road segment is prohibited. When the expected safety cost of the validation set exceeds the safety cost limit, the value estimation diverges in two consecutive rounds, or the candidate action exceeds the parameter whitelist, the current round of model is discarded and the previous training version is used. The large model instruction fine-tuning samples consist of signed job event packages and double-checked annotations. Each sample saves the input field summary, structured labels, anomaly reasons, target components, dependency quadruples, and verification conclusions. 10% of the samples are grouped by road segments and retained as a blind test set. If the accuracy of the required fields in the blind test set is lower than 98%, the illegal parameter output rate is higher than 0, or the dependency direction consistency rate is lower than 95%, the model version will be rejected. When the manual feedback contains control passwords, external links, or unregistered fields, it will only be saved as text to be reviewed and will not be included in the model prompts. The increments of each parameter of the low-level strategy are normalized using the interval width given by the vehicle capability table. The training batch contains no less than 10,000 event sequences. The conservative value coefficient is set to 1.0 in this specific implementation, and the Lagrange multiplier learning rate is set to 0.001. The low-level strategy is updated four times after the high-level strategy is updated once. If the safety cost of the calibration set does not decrease for five consecutive rounds or the difference between the verification reward and the training reward exceeds 0.10, the training is stopped early and the checkpoint with the highest verification reward and qualified safety cost is restored. The restored version and the reason for termination are saved with the candidate strategy package. The strategy packager converts the validated model output into a candidate strategy package. The package records the version identifier, training data summary, model configuration version, applicable domain parameters, adjustable strategy parameter baseline and parameter range, parameter dependency mask, validity period, exit condition, rollback version identifier, and high-level and low-level executable strategy artifacts bound by the model version and SHA-256 summary. The strategy artifact interface reads the scene status fields in a fixed order and outputs the mode identifier and normalized parameter increment every 500ms. The strategy packager trims the output into a unique parameter target vector within the package according to the parameter restoration rules. If there is no valid output, a field is missing, or the summary is inconsistent, the baseline freeze value is used and the rollback reason is recorded. Each record of the applicable domain parameters includes the field identifier, mandatory flag, value range, unit, data source pointing to the corresponding field of the job event package, and missing handling rules. The package also stores the anchor point evaluation five-dimensional weight mapping table and its version. In this specific implementation, the validity period is set to 30 days and no parameter range may exceed the boundaries given by the vehicle capability configuration and safety configuration. The parameter table and evaluation scale table are jointly constructed from historical operation events of the same vehicle model, closed field calibration, and vehicle capability tests. The table records the vehicle configuration identifier, road category key, parameter name, unit, lower limit, upper limit, baseline value, sample size, version, and effective time. The units of obstacle avoidance cost weight and regression cost weight are not applicable, and the lower limit is fixed at 0, the upper limit is fixed at 1, and the baseline value must be a finite non-negative number. Reconstruction is triggered when 200 new events are added to the sample or when the vehicle software version changes. If no completely matching record is found, the most conservative boundary of the same vehicle model is used for backtracking and the range is not allowed to be expanded. After the candidate strategy package is checked for completeness, it is written into the strategy library to be verified and handed over to S3 along with its training data summary. Candidate strategy packages that have not been paired and verified by S3 are not allowed to be sent to the vehicle.

[0022] In this specific embodiment, S3 includes: The cleaning event pairing verifier selects a baseline policy package from policy versions that have been running stably in the target applicable domain for no less than 30 days and have been confirmed by the vehicle safety manager. It freezes the version identifier, vehicle configuration, applicable domain parameters, parameter values, evaluation time domain, and rollback version identifier. It also establishes a pairing index from the event database according to the road segment identifier, obstacle avoidance event identifier, vehicle configuration, and operation date. The applicable domain of the candidate policy package must be covered by the verified applicable domain of the baseline policy package; otherwise, the verification will be terminated. The verifier reads historical operation events with the same road segment identifier and obstacle avoidance event identifier, and applies counterfactual perturbations to the lateral position and velocity of the obstacle trajectory, the positioning covariance, the road surface adhesion estimate or the garbage density, which are still within the corresponding applicable domain range. The perturbation amplitude is determined by the 5% to 95% quantile range of similar historical events. Four sets of perturbation events are generated for each original event using a fixed random seed. The original events and perturbation events retain the same planned coverage area, initial vehicle pose, vehicle configuration, sweeper configuration and evaluation time domain. The validator fixes a primitive event and its four counterfactual perturbations into a primitive event family, and treats the primitive event family as the only independent pairing statistical unit. The baseline policy package and the candidate policy package are run on all five members in the event family. Each member calculates its own cleanup score and performs a hard safety judgment. If any member input is invalid, the simulation fails, or any output on either side is invalid, the entire event family is deleted and not counted in the number of valid pairs. If the hard safety index of any member of the candidate policy package exceeds the limit, the candidate event family is judged as failing and the candidate policy package is rejected. When all five members are valid and hard safety is passed, the arithmetic mean of the dimensionless cleanup scores of the five members on the baseline side and the candidate side is taken to obtain a family-level cleanup score of the primitive event family on the corresponding policy side. The subsequent mean, sample standard deviation, and confidence lower bound only use the family-level cleanup score. The number of valid pairs N only accumulates the number of valid primitive event families and does not treat perturbation members in the same family as independent samples. The baseline strategy package and candidate strategy packages are executed in pairs in parallel on the same version of the vehicle dynamics simulator and the same sensor playback stream. Every 500ms, the candidate side calls the same high-level and low-level executable strategy artifacts bound to the summary in the S2 candidate strategy package. A unique parameter target vector is generated according to the order of fixed state fields in the package, parameter restoration rules and backoff rules. The baseline side calls its frozen strategy artifact. The control cycle is 50ms and the path replanning cycle is 200ms. Each strategy covers at least 300 original events and their counterfactual perturbations. The simulator saves the strategy artifact summary, input state, original output, clipped parameters, obstacle distance, vehicle speed, braking response, pose covariance, lateral acceleration, yaw rate, driving amount, braking amount, target turning angle, actual turning angle, sweep footprint and energy consumption every cycle. Any invalid input will cause the pair of events to exit the statistics at the same time and the result of only one strategy must not be deleted. Braking margin according to Calculation, where This indicates the braking margin for the current cycle, in meters (m). This represents the non-negative available distance (in meters) from the current trajectory to the obstacle's spatiotemporal envelope. If there is no valid envelope distance or the input is negative, the safety indicator input is invalidated and a minimum-risk stop is requested. V represents the non-negative velocity magnitude obtained along the current trajectory direction, in m / s and not less than 0. After time alignment and quality code confirmation, if both the absolute values ​​of the vehicle's longitudinal velocity and the absolute values ​​of the trajectory tangential velocity are valid, V uniquely takes the maximum value of the two. If only one is valid, V takes that valid value. If both are invalid or the reversing trajectory direction is not confirmed, braking margin calculation is prohibited and a minimum-risk stop is requested. This indicates the absolute value of usable deceleration confirmed by closed-course braking tests within the applicable range of vehicle configuration, current speed gear, and road surface adhesion. The unit is m / s² and must be greater than 0.10 m / s². If the calibration is missing, expired, or outside the applicable range, braking margin calculation and entry into the existing fail-safe path are prohibited. This represents the total delay of perception, calculation, and execution, which is taken as 0.25s in this specific implementation. The minimum obstacle clearance and braking margin shall not be lower than 0.60m and 0.20m respectively, as recorded in the safety configuration. First, determine the unique non-negative square root of the largest eigenvalue of the current period's planar position covariance submatrix as the planar positioning standard deviation, then proceed according to... Calculate the location reliability, where This represents the standard deviation of the current period's planar positioning, in meters (m), and is determined by the unique non-negative square root of the largest eigenvalue of the current period's planar position covariance submatrix. 0.20 represents the upper limit of the position standard deviation and the normalized benchmark obtained from the closed-site positioning error calibration in the safety configuration version, also in meters. This indicates the dimensionless positioning reliability for the current period; a larger value indicates a more reliable positioning. This means clipping the dimensionless input to a range of 0 to 1. Following the definition of the maximum eigenvalue function of the planar position covariance in S1, This represents the current periodic planar position covariance submatrix in m²; the covariance is not a real symmetric positive semi-definite matrix, or the field times out or the quality code is invalid. If both the positioning confidence and location confidence are output as invalid, the system will enter a fail-safe path. S3 and S4 read the same safety configuration version and the effective positioning confidence must not be lower than 0.60. The vehicle stability is allowed within the range of absolute lateral acceleration not exceeding 1.2 m / s² and absolute yaw rate not exceeding 0.45 rad / s. The outputs of the drive, braking and steering actuators are compared with the upper limit of the actuator capacity of the same speed level in the vehicle capacity table to obtain the safety index. If any hard safety index exceeds the limit, the candidate event will be judged as failing and the time of exceeding the limit, the input source and the strategy parameter snapshot will be recorded. Cleaning score for each valid event is calculated as follows: Calculation, where This represents the dimensionless cleaning score for the i-th event; a larger value indicates better cleaning performance. i represents the index of the valid paired event, ranging from 1 to N, with no applicable index unit. N represents the total number of valid paired events in the current statistics, expressed as "number". r represents the benefit component index, taking values ​​of 1 or 2, with no applicable index unit. This represents the r-th dimensionless revenue component, normalized according to the evaluation configuration scale, of the confirmed coverage increment and the confirmed coverage debt reduction, taking a value between 0 and 1. This indicates the r-th dimensionless non-negative return weight given in the corresponding table entry for the evaluation configuration version, satisfying the closed interval constraint from 0 to 1. s represents the penalty component index, taking values ​​from 1 to 4, with no applicable index unit. This represents the s-th dimensionless penalty component after normalization of the overlapping coverage area, edge spacing variance, invalid parking duration, and energy consumption per unit confirmed coverage area, with a value ranging from 0 to 1. This indicates that the s-th dimensionless non-negative penalty weight given in the corresponding table item of the evaluation configuration version satisfies the closed interval constraint from 0 to 1, the sum of the benefit weights and the sum of the penalty weights are both 1, and each scale, weight and clipping interval are fixed in the evaluation configuration version. Following the previous definition of dimensionless sweep scoring and all its symbols, candidate strategies and baseline strategies are respectively categorized as follows: Determine the lower confidence bound for the cleaning score, where This represents the dimensionless, one-sided 95% confidence lower bound of policy z, where z represents the policy index of the candidate or baseline policy, and units are not applicable. This represents the dimensionless average sweep score of the strategy across all valid events. This indicates that the degrees of freedom for reading the fixed statistics library according to the evaluation configuration version are: The dimensionless one-sided 95th percentile of the student distribution, where N represents the number of valid paired events and must be no less than 300. This represents the sample standard deviation of the dimensionless cleaning score of the strategy. It is only included in the parameter admission judgment when all hard safety indicators of the candidate strategy pass and the lower bound of the candidate cleaning score is not lower than the lower bound of the baseline cleaning score. The parameter admission determination adopts parameter-by-parameter freeze ablation. The validator restores a candidate parameter to the baseline freeze value in turn and replays the event subset that triggers the parameter. If the safety index still passes after the parameter is restored and the lower confidence bound of the candidate sweep score decreases by no less than 0.005, the parameter is considered to have a stable contribution to the revenue and is included in the allowed parameter subset. When two or more parameters have a dependency mask relationship, they are treated as a group for joint ablation. Parameters that do not reach the contribution threshold, cause the safety index boundary margin to shrink by more than 20%, or lack sufficient triggering events are not included in the allowed parameter subset and the baseline freeze value is used. The vehicle dynamics simulator uses front wheel steering angle step, straight braking, and low-adhesion circular test data collected in a closed field with the same vehicle model to identify tire side slip, braking delay, and longitudinal and lateral coupling parameters. The identification is re-identified each time the vehicle software or tire specifications change. The root mean square error of the speed of the simulator on the independent verification road section shall not exceed 0.08 m / s, the root mean square error of the lateral position shall not exceed 0.12 m, and the stopping distance error shall not exceed 0.20 m. The errors are directly compared in terms of speed and distance units without force conversion. When any error exceeds the limit, strategy pairing is suspended and the simulator version is set to unavailable. The validator also calculates the difference between the safety pass rate and the cleaning score according to the road boundary morphology, garbage density range, road surface attachment range and dynamic obstacle type. If the number of valid events in any mandatory applicable domain layer is less than 30, the layer shall not be written into the signature strategy package. Only when all layers meet the sample size and the candidate strategy safety pass rate is 100%, an admission record is generated. The admission record establishes a traceable association between each allowed parameter and the trigger target component, dependent mask unit, ablation result and applicable domain layer. The pairing results table saves the baseline result reference, candidate result reference, four sets of counterfactual result references, hard safety judgment, two types of sweep scores, and event validity for each original event. When the initial state deviation of any pair member exceeds 0.02m in position, 0.02m / s in velocity, or 0.5° in heading, the entire pairing is deleted and reinitialized. The validator compares the results of the two strategies according to the event index before entering the hierarchical statistics to avoid false score differences caused by different initial conditions. The signing policy package inherits the version identifier, applicable domain parameters, validity period, exit conditions, and rollback version identifier of the candidate policy package. It freezes the baseline value and parameter range of each parameter in the allowed parameter subset, and records the initial adjustment range, gradual release conditions, evaluation configuration version, paired event digest, and verification result digest. In this specific implementation, the parameter change limit for the first use is 10% of the width of the available range relative to the baseline, and the initial operation event ratio is 5%. The package body is signed by the background policy signing certificate after being digested by SHA-256. The vehicle terminal only accepts policy packages with valid certificate chains, consistent digests, and matching vehicle configuration identifiers. If any security metric fails, the lower bound of the candidate cleanup score is below the baseline, there are fewer than 300 valid pairing events, the allowed parameter subset is empty, or signature generation fails, the verifier sets the candidate policy package status to rejected and saves the failure event. It is not allowed to generate a deployable version. When the verification is successful, the signature policy package is written to the controlled policy library and the allowed parameter subset, frozen parameter values, applicable domain parameters, and rollback version identifier are handed over to S4. All original pairing records are kept read-only for S5 to evaluate and trace.

[0023] In this specific embodiment, S4 includes: After receiving the signed policy package generated by S3, the vehicle-side policy manager first verifies the certificate chain, package digest, vehicle configuration, validity period, and rollback version. Then, it constructs the current scene features based on the structured scene label, road segment attribute record, obstacle type, positioning uncertainty interval, and road surface attachment interval. It reads the field identifier, mandatory flag, value range, and data source of the applicable domain parameters one by one. Only when all mandatory fields are valid and fall into the corresponding closed interval is the allowed parameter subset enabled. If any mandatory field is found to be missing, invalid, or out of bounds by the quality code and time alignment rules in the first control cycle, it is determined to be a mismatch. The allowed parameter subset is immediately prohibited and the baseline frozen parameters are used. In the next control cycle, it atomically switches to the rollback version and generates a failure event. Single-cycle transient fluctuations that have not yet been confirmed by the quality code are only marked as pending confirmation and the baseline frozen parameters are continued to be used. The allowed parameter subset is not enabled. The navigation system takes the laser point cloud and target tracking records in the S1 operation event package as input. In the map coordinate system, it uses a uniform acceleration Kalman predictor to predict the obstacle center position and position covariance in the next 5 seconds at 0.2s intervals. The target circumscribed contour is expanded according to the corresponding 95% position confidence ellipse and a static safety expansion of 0.30m. The expanded contours at each prediction time are then connected in chronological order to form the obstacle spatiotemporal envelope. When the tracking confidence is lower than 0.60, the envelope is expanded using the nearest effective velocity upper bound. If there is no effective tracking for 1 second, the relevant section of the original cleaning path is marked as impassable and a replanning is requested. After the obstacle spatiotemporal envelope leaves the original cleaning path, the navigation system searches forward 15m from the end of the envelope along the original path at 0.50m arc length intervals to generate candidate regression anchor points. Each anchor point records the map pose, path arc length, minimum safety margin with the envelope, kinematic feasibility indicator, expected confirmed coverage deficit, expected repeated coverage area, expected number of turning and reversing, and regression distance. Kinematic feasibility is jointly determined by the minimum turning radius of 3.8m, the maximum rate of curvature change of 0.12m⁻², and the current velocity boundary of the signature strategy packet. Candidates with a safety margin less than the lower limit of the net distance within the packet or kinematically infeasible are directly deleted. For each reserved anchor point, first press Calculate the safety margin gap, where This represents the dimensionless safety margin gap for the a-th candidate regression anchor point; a smaller value indicates a more sufficient safety margin. This represents the minimum obstacle net distance obtained along the candidate regression path at this anchor point, in meters. This represents the lower limit of the hard minimum obstacle clearance recorded in the safety configuration; in this specific implementation, it is taken as 0.60m. This indicates the net obstacle distance for the anchor point evaluation configuration record; in this specific implementation, it is taken as 1.00m. Must be greater than , This means clipping the dimensionless input to a range of 0 to 1; Less than or equal to If the input is invalid or the evaluation configuration does not meet the aforementioned size relationship, the anchor point will be deleted before the combined cost calculation. Greater than or equal to hour Set to 0; for retained anchor points, use Calculate the combined cost, where represents the dimensionless combined cost of the a-th candidate regression anchor point; a smaller value is better. 'a' represents the index of the current set of retained anchor points, and the index unit is not applicable. 'w' represents the dimensionless column vector generated by the five-dimensional weight mapping table of the signature strategy package. Let $a$ be a five-dimensional dimensionless column vector representing the $a$-th candidate anchor point. The components of $a$ and $a$ are, in order: safety margin gap, expected confirmed coverage deficit, expected overlapping coverage area, expected number of steering reversals, and regression distance. The obstacle avoidance cost weight and regression cost weight must be taken from the S2 parameter table and are both finite non-negative dimensionless numbers between 0 and 1. If any weight is out of bounds or not finite, the baseline frozen weight corresponding to the same vehicle configuration and road category key is read first. If the baseline frozen weight is still invalid, the combined cost of that anchor point is set to invalid, the anchor point is deleted, and the reason for the rollback is recorded. The mapping table specifies that the five pre-normalized weights are sequentially taken as a fixed safety weight of 0.35 plus the obstacle avoidance cost. The sum of the following five factors must be finite and not less than 0.35: 0.15 times the cost weight, 0.20 times the regression cost weight, 0.15 times the obstacle avoidance cost weight, and 0.10 times the regression cost weight. Dividing this sum by the sum of the five factors yields w, ensuring each component is non-negative and the sum is 1. If the sum of the five factors is less than 0.35 or not finite, the aforementioned baseline freeze weight rollback is performed and recalculated. If the relevant policy parameters are not included in the allowed parameter subset, the baseline freeze value is directly read and expanded using the same mapping table. The mapping table version is written to the path record. T represents vector transpose operation and units are not applicable. Each component is normalized to 0 to 1 according to the upper limit of the evaluation configuration. When the costs are the same, the anchor point with the smallest regression distance is selected first; if they are still the same, the anchor point with the smallest path arc length is selected. The navigation system retains the set of components. The minimum value is used as the dimensionless replanning criterion. When the replanning threshold of the signature strategy package enters the allowed parameter subset, its pruned value is read. When it is not admitted, the output is invalid, or the applicable domain does not match, the baseline freezing threshold is read. In this specific embodiment, the baseline threshold is 0.70 and the allowed range is 0 to 1. When the minimum combination cost is greater than the replanning threshold, the regression anchor point is abandoned and the relevant debt partition is sent to the replanning queue. Branches with empty anchor points, unsatisfied hard safety constraints, timeouts, or path verification failures are prioritized over this threshold and directly enter the subsequent specified replanning or parking branches. When an obstacle occupies the original cleaning path, the navigation system uses the obstacle's spatiotemporal envelope as a hard constraint to generate an obstacle avoidance path within the drivable road area using a hybrid A-satellite mapping. After bypassing the obstacle, it selects the candidate regression anchor point with the minimum combined cost to generate a fifth-order polynomial regression path. If the anchor point set is empty, no regression path is generated. The relevant segments of the original path and the overdue zones are set to pending replanning and a state of no feasible anchor points is published. For the overdue zones, those adjacent to the road boundary and with an area of ​​not less than 0.30m² are confirmed to generate edge-fitting paths, while the remaining overdue zones are entered into the replanning queue based on the grid cost map. The time limit for each solution of obstacle avoidance, edge following, or replanning is 200ms, and there are a maximum of two retries. If the time limit or retry limit is exceeded, the old path cache is invalidated, a restricted deceleration and stop request is issued to the unified control system, the reason for planning failure, obstacle envelope and debt partition are recorded, and a failure event and manual takeover request are generated and handed over to S5. This branch takes priority over continuing to execute the old path. The operation path is spliced ​​according to the order of obstacle avoidance, regression, edge following and replanning segments only when there is a solution for each segment, and the source event, target speed limit, sweeping status and corresponding debt partition identifier of each segment are recorded. The vehicle-mounted unified control system reads the work path and vehicle status at 50ms intervals and then... Predict vehicle status, among which These represent the four-dimensional dimensionless state column vectors for the next and current cycles, respectively. The components are in the order of lateral error, heading error, longitudinal velocity, and yaw rate. The original units are m, rad, m / s, and rad / s, respectively, and are normalized to a positive scale according to the vehicle calibration configuration. K represents the control cycle index, and its unit is not applicable. This represents a three-dimensional dimensionless control column vector, with components in the order of driving quantity, braking quantity, and target front wheel steering angle. The original units are, in order, motor torque percentage, braking pressure percentage, and rad, and are normalized according to the vehicle's capability range width. This represents a two-dimensional dimensionless path reference column vector, with components in the order of curvature and target velocity. The original units are m⁻¹ and m / s, respectively, and the vector is normalized to an upper limit according to the path configuration. These represent the 4x4 state transition matrix, the 4x3 control input matrix, and the 4x2 path input matrix, respectively. All of them are dimensionless matrices under the above normalized scale. They are calculated by linearizing the current speed online and combining the vehicle calibration parameters. When the linearized input is invalid, the matrix dimension is incorrect, or the value is unstable, the matrix that has been verified most recently is used and deceleration is requested. When there is no valid matrix for two consecutive cycles, the minimum risk stop is entered. The model predictive controller jointly solves the 20-step dimensionless target velocity sequence and the 5-step dimensionless three-dimensional control sequence, and minimizes... Where J represents the dimensionless model's predicted control objective function value, with smaller values ​​indicating better performance, and h represents the index of the prediction or control step, with no applicable unit for the index. This represents the four-dimensional dimensionless state vector at the h-th prediction step. Indicates and The four-dimensional dimensionless reference state vectors of the same order have their lateral error, heading error, and yaw rate components given by the working path, while the longitudinal velocity components are taken from the same solution. , This represents the dimensionless target velocity to be solved in the h-th prediction step. This represents the dimensionless value of the target speed limit for the work path, normalized to the same speed scale. This represents the difference in target velocity between adjacent prediction steps. When h equals 1, the previous value is taken as the actual target velocity output in the previous control cycle. These represent the dimensionless positive velocity deviation weight and velocity change weight, respectively. In this specific implementation, they are taken as 1.0 and 0.2. Let represent the three-dimensional dimensionless control change vector of the h-th control step, obtained by subtracting the previous control vector from the current control vector. When h equals 0, the previous control vector takes the previous actual control quantity. Q represents a 4x4 dimensionless symmetric positive semi-definite state error weight matrix, and R represents a 3x3 dimensionless symmetric positive definite control change weight matrix, where all three diagonal elements are not less than 0.05 and the smallest eigenvalue is not less than 0.05. The elements of both matrixes correspond one-to-one with the preceding normalized components and are given by the vehicle calibration configuration. T represents the vector transpose, and the unit is not applicable. Each The constraints are between 0 and the minimum of the target speed limit of the operation path, the target speed boundary allowed by the signature policy package, and the vehicle capability speed limit, and satisfy the acceleration and deceleration boundaries, after controlling the time domain. Maintaining the control input from step 4, the driving and braking inputs for each control step are non-negative. When the driving input is greater than zero, the braking input is fixed at zero; when the braking input is greater than zero, the driving input is fixed at zero. Both are allowed to be zero simultaneously. If the J-difference of multiple feasible control sequences is no greater than 0.000000001, then sequentially select the sequence with the smallest sum of squares of the five-step control vectors, the smallest sum of the five-step driving and braking inputs, and the smallest sum of the absolute values ​​of the five-step target angles. If they are still the same, compare the lexicographical order of the control steps from 0 to 4 and the fixed components of the driving, braking, and target angles for each step, and select the sequence with the smallest numerical value, thus uniquely determining the first control vector. The solver then... After inverse normalization according to the velocity scale, it is used as the target velocity output for this period, making it uniquely determined. After denormalization, the output is used as the driving force, braking force, and target steering angle, and is handed over to the independent safety filter to solve for the steering change rate, obstacle avoidance clearance, edge spacing, and actuator capability. If convergence is not achieved within 15ms, the output is allowed to be used for one cycle and a deceleration request is made only if the generation time of the target speed and control quantity in the previous cycle is no more than 50ms away from the current time, the path version, strategy version, and obstacle spatiotemporal envelope version are all consistent with the current time, and the independent safety filter verifies that all safety boundaries are still met. If the output is not converged for the first time, the controller is restarted, any version is inconsistent, the previous output times out, or the verification fails, a minimum risk stop request is immediately issued to the independent safety filter. If convergence is not achieved for two consecutive control cycles or the cumulative non-convergence time reaches 100ms, the system enters the latter stage independent fault-safe mode, prohibiting strategy parameter updates and incremental increases, and recording the solver status, path version, strategy version, obstacle envelope version, and manual takeover request. When the signature policy package is first enabled, the policy manager calls the same high-level and low-level executable policy artifacts bound to the summary in the signature package every 500ms according to the fixed field order agreed by S2, obtains the mode identifier and parameter target vector, limits the change of each allowed parameter relative to the corresponding frozen parameter value in the baseline policy package to within the initial adjustment range, and sends it to the navigation and model prediction controller after pruning. The input state, policy artifact summary, original output, pruned output and actual parameters are recorded one by one. When there is no valid output, the baseline frozen value is used. When the current scene features show the first confirmed mismatch specified by the previous stage, the policy package expires, or the exit condition is triggered, the allowed parameter subset is immediately prohibited and the system atomically switches to the rollback version in the next control cycle. At the same time, a failure event is generated. The path planner retains the current safe and feasible path but recalculates the speed and control constraints with the rollback parameters to avoid mixing two policy versions within half a cycle. After the work path is generated, an independent path validator checks the road boundaries, obstacle spatiotemporal envelope, maximum curvature, rate of curvature change, and debt partition association at 0.10m arc length intervals. If any point crosses the drivable area or enters the envelope, the entire path is rejected and returned to the replanning queue. If the same path fails to be validated twice consecutively, or if no validated path has passed within 400ms since the first planning, the cache invalidation, restricted deceleration, stopping, failure events, and manual takeover branches specified in the previous stage are executed. Validated paths are written to the versioned path cache, which records the map coordinates of path points, curvature, target speed, sweep status, and strategy. The cache includes the version, generation time, event packet summary used during generation, and obstacle spatiotemporal envelope version, and defines 250ms after the generation time as the valid deadline. The unified control system only reads paths whose current time is no later than the valid deadline, whose event packet summary is consistent, whose policy version is consistent, and whose obstacle spatiotemporal envelope version is consistent. If any of the following conditions occur, such as exceeding the valid deadline, event packet summary change, policy version switch, obstacle spatiotemporal envelope update, or independent path verification failure, the cache is immediately invalidated. If there is no valid cached path, the restricted deceleration, stop, failure event, and manual takeover branch specified in the previous section are executed. The current scene feature matching result, the actual value of the allowed parameter, the actual value of the frozen parameter, the path version, and the model predictive control solution status are written into the vehicle-side execution record for each control cycle. The driving quantity is mapped to the motor torque request, the braking quantity is mapped to the braking pressure request, and the target steering angle is mapped to the steering actuator angle request. The mapping curve is obtained from the vehicle capability table according to the speed gear. When no matching gear is found, the gear with the stricter restriction between the two adjacent gears is used. The execution record serves as the input of an independent safety filter and is written back to the job event package after the event ends. An independent safety filter operates in a process and watchdog channel isolated from the policy controller. It constructs candidate control sets sequentially for the steering angle limiting layer, deceleration layer, braking layer, and parking layer according to a fixed hierarchy of vehicle safety configuration versions. The steering angle limiting layer maintains no increase in drive quantity and tightens the target steering angle; the deceleration layer sets the drive quantity to zero and increases deceleration to no more than the capability limit; the braking layer sets the drive quantity to zero and uses braking pressure within the vehicle capability table; and the parking layer uses the minimum risk parking configuration. For each layer, control vectors that do not meet all hard safety boundaries are first deleted. The safety filter only applies control vectors within the first non-empty layer. The replacement instruction that is closest to the policy instruction is selected, and weighted distance comparisons across layers are no longer used. This represents the filtered, actual 3D vehicle control vector; the model predictive controller first inversely normalizes its dimensionless control output according to the vehicle's capability range. All data use the same unnormalized raw value coordinates and the same component order. The three components are, in order, motor torque percentage, braking pressure percentage, and front wheel target steering angle, with units of %, % and rad, respectively. U represents the candidate three-dimensional vehicle control vector in the first non-empty level feasible control set. This represents the three-dimensional vehicle control vector of the model predictive controller after inverse normalization. This indicates an operator that selects the control vector with the minimum dimensionless weighted distance from the first non-empty feasible control set, and units are not applicable. This represents a 3x3 symmetric positive definite scaling matrix. Its diagonal elements are, in order, the reciprocals of the square of the width of the vehicle's capability range for the driving, braking, and target steering angle ranges, respectively, in %⁻², %⁻², and rad⁻². The off-diagonal elements are zero. This matrix is ​​given by the same vehicle capability configuration version. As a dimensionless scalar, when there are ties for optimal, the control vector with the largest braking amount and the smallest absolute value of the target turning angle is selected first. T represents the vector transpose and the unit is not applicable. The constraint set requires that the predicted minimum obstacle clearance is not lower than the lower clearance limit, the braking margin is not lower than the lower margin limit, the positioning confidence is not lower than the lower confidence limit, the lateral acceleration and yaw rate are within the stability allowable range, and the drive, braking and steering outputs do not exceed the upper limit of the capability. The safety filter rejects any original vehicle control command if it finds that any boundary is not met. It checks the candidate set in a fixed order of turning angle limit layer, deceleration layer, braking layer, and parking layer. In the first non-empty layer, it executes the front-end weighted distance minimization and parallel rules and records the safety intervention event. If all four layers are empty, any safety indicator input is invalid, the layer search is not completed within 15ms, the watchdog times out, or the actuator refuses to execute, it enters an independent fail-safe mode. It prohibits strategy parameter updates and step-by-step expansion, and controls the still available drive, brake, and steering actuators to complete straight deceleration and minimum risk parking. The event records the irreplaceable cause, parking position, available actuator status, and manual takeover request, and hands over the actual issued command and control response to S5.

[0024] In this specific embodiment, S5 includes: The feedback evolution module uses the signature strategy package version as the statistical unit to perform step-by-step volume release. In this specific implementation, the proportion of job events is set to 5%, 10%, 25%, 50%, and 100% respectively. At least 300 job events with signature verification passed and applicable domain matching are accumulated at each level and continue for no less than 24 hours. The adjustment range of the parameter relative to the baseline available interval width is limited to 10%, 20%, 40%, 70%, and 100% respectively. The event scheduler selects participating events according to the stable hash bucket of the road segment identifier to ensure that the same strategy version is used for the same road segment within the same volume release level. After each job event, the module reads the actual sweeping footprint, confirmed coverage area, confirmed coverage deficit, target and actual control response, safety intervention event, edge distance sequence, parking event, takeover event and energy consumption from the job event package, forming an event evaluation result that includes confirmed coverage increment, deficit reduction, repeated coverage area, target speed tracking error, target corner tracking error, safety intervention rate, edge distance variance, invalid parking time and energy consumption per unit confirmed coverage area. All indicators use the units, normalized scale and validity rules in the S3 evaluation configuration. Entering the next volume increase level requires that the number of valid events and duration of the current level meet the standards, all hard safety indicators are within limits, the lower confidence limit of the candidate sweep score is not lower than the baseline of the same period, and the one-sided 95% confidence upper limit of the safety intervention rate, confirmed coverage deficit, and edge spacing variance relative to the baseline has not reached the rollback threshold. Only after the conditions are met for two consecutive statistical windows can the allowable parameter adjustment range and the proportion of subsequent operation events be expanded. If the invalidity ratio of any evaluation field exceeds 5%, the current level is frozen and events are collected again without expanding the volume. The safety intervention rate, confirmed coverage of outstanding debts, and variance of edge spacing were respectively calculated as follows: Calculate the relative increase, where Indicates the first The dimensionless relative increase of the degradation index, This indicates a counting index where units are not applicable. When we take 1, 2, and 3, they correspond to the safety intervention rate, the confirmation of overdue payments, and the variance of the edge spacing, respectively. This represents the average metric of the signature strategy package within the current evaluation time domain. This represents the mean of the corresponding indicator for the baseline strategy package within the same vehicle configuration, applicable domain, and evaluation time domain; when When taking 1 and The units are all times / events, when When the value is 2 or 3, the unit for both is m². This indicates the zero-value protection level in the same unit as the indicator. When taking values ​​1, 2, and 3, the values ​​are 0.005 times / event, 0.10m², and 0.0025m² respectively. Max indicates taking the maximum of the two input values. Rollback is triggered when the safety intervention rate, the confirmation coverage of the outstanding debt, or the 95% confidence upper bound of the edge spacing variance reaches 20%, 15%, or 20% of the evaluation configuration record. After triggering a rollback, the policy manager will disable the enabled subset of parameters in the next control cycle, switch to the policy package corresponding to the rollback version identifier in the signed policy package, and keep the independent security filter running continuously. The feedback evolution module will generate a failure event and record the triggering index, evaluation time domain, current and baseline index, confidence interval, scenario characteristics, applicable domain comparison results, policy parameter snapshot, security intervention event, and the last effective control response. If the system has entered the independent failsafe mode, it will prioritize the least risk shutdown and manual takeover without waiting for the version switch to complete. When the current scenario features do not match the applicable domain parameters, the signature policy package expires, the security intervention rate reaches the exit condition, the signature verification fails, or the independent fault safety mode is triggered, it is also prohibited to enable the allowed parameter subset and switch to the rollback version. For mismatched fields, expired version identifiers, events corresponding to exit conditions, signature verification results or non-replaceable reasons for writing failure events, after manual takeover is completed and the security indicator input is restored to validity for 5 consecutive seconds, it is only allowed to exit the independent fault safety mode after re-completing the applicable domain item matching, policy package signature verification and static state control self-check. Event evaluation results, failure events, safety intervention events, irreplaceable reasons, and manual takeover results are appended to the operation event package corresponding to the original road segment identifier and obstacle avoidance event identifier. Each feedback record includes strategy version, rollback version, volume increase level, parameter adjustment range, vehicle configuration, evaluation configuration version, collection time domain, and data summary. After receiving the data, the backend verifies the event package summary and removes duplicates. Records with incomplete fields or invalid signatures are placed in an isolation queue and do not participate in model training or volume increase statistics. Event evaluation uses a rolling window with 300 valid events. After each signed policy's actual operation event, the feedback evolution module calls a closed-loop vehicle dynamics simulator and an environmental sensing simulator that are the same version as the S3 paired verification and whose independent verification error still meets the S3 threshold. The initial vehicle state, vehicle configuration, planned coverage area, road map, static obstacle map, dynamic target trajectory, garbage density map, road surface adhesion sequence, and evaluation configuration version of the event are used as common exogenous inputs. The frozen baseline policy generates control variables cycle by cycle in the same evaluation time domain, and the closed-loop vehicle dynamics simulator updates the baseline vehicle pose and velocity accordingly. The environmental sensor simulator reconstructs laser point clouds, target tracking, localization covariance, and sweep control inputs based on the updated baseline pose, map occlusion relationships, and dynamic target trajector trajector. Then, following the same rules as S1, it generates actual sweep footprints on the baseline side, confirms coverage deficiencies, edge spacing, number of safety interventions, and energy consumption outputs. This forms a synchronous baseline evaluation result that corresponds one-to-one with the signature strategy event and does not involve the vehicle-end actuator. At 100% scale-up levels, the closed-loop synchronous baseline comparison is still retained. If the simulator version is inconsistent, independent verification error exceeds limits, environmental map or dynamic target trajectory is missing, sensor reconstruction fails, or any baseline output is invalid, the pairing is set to "none". The current volume status is frozen; the rolling window only accepts valid pairs in the same evaluation time domain, without using the most recent historical time domain for completion. If there are insufficient matches, the freeze is maintained and matching events are continuously collected; the three degradation indicators are uniformly calculated using the paired bootstrap method to determine the 95% confidence upper bound on one side. 2000 equal-length samples are drawn from the paired event index with replacement using a fixed random seed. For each sample, the same event index is drawn simultaneously for the signature strategy and the corresponding baseline. The mean values ​​of the indicators on both sides are calculated, and the relative increase is calculated based on the same zero-value protection amount in the previous period. The 95th percentile of the 2000 relative increase values ​​is used as the 95% confidence upper bound on one side. The safety intervention rate is calculated based on each... Non-negative integer safety intervention counts of paired event records are entered into resampling. The safety intervention rate of each sample group is equal to the sum of the safety intervention counts of that group divided by the number of valid events in that group. Confirmation of coverage deficit and edge spacing variance are entered into resampling according to event-level continuous values. When the number of valid pairs is less than 300, any one side indicator is invalid, or the resampling result cannot be calculated, the current volume status is set to frozen and cannot be upgraded. When every 20 new events are rolled in, the lower confidence bound of the sweep score and the upper confidence bound of the three degradation indicators are recalculated. The algorithm identifier, simulator version, random seed, number of resampling times, and list of participating events are written into the evaluation configuration version and window results to avoid duplicate counting. The volume expansion state machine only accepts four states: hold, upgrade, freeze, and rollback. After the hold state meets the upgrade criterion twice, it will enter the upgrade state. When the invalid data ratio exceeds the limit or the sample is insufficient, it will enter the freeze state. When any rollback criterion is met, it will directly enter the rollback state with higher priority than the upgrade state. State transitions and parameter magnitude changes are written to the unmodifiable version log. After the background restarts, it will recover from the last signed state without re-executing the completed volume expansion transition. The optimized sample library stores the status sequence, actual control sequence, actual values ​​of allowed parameters, baseline freeze values, event evaluation results, failure labels, applicable domain labels, and data quality codes at the event level. The termination flag for successful events is set when the event ends normally. When a rollback or failsafe event is triggered, the termination flag is set at the trigger period and the record for the 10 seconds before the trigger is retained. The training sampler is layered by road segment and failure type. Any isolated queue record must not enter the sample index until the fields are completed and re-signed. The rolled-back strategy version retains at least 500 valid events for 72 hours. During the retention period, the feedback evolution module continues to use the same evaluation configuration to calculate event metrics, but automatic recovery of the signature strategy package is prohibited. When all hard safety metrics are valid, the three degradation metrics have recovered to the baseline confidence interval, and the manual takeover reason has been closed during the retention period, the original failure event and its signature summary remain unmodifiable. A new state transition record is generated, which includes the original failure event identifier, the previous state, the current state being stable, the judgment time, the retention period evaluation window summary, the state transition sequence number, and the backend signature, and is appended to the corresponding job event package. The backend reconstructs the current state according to the original failure event identifier and the monotonically increasing state transition sequence number. If the sequence number is duplicated, the signature is invalid, or the previous state is inconsistent with the most recent valid transition record, the transition record is rejected. The training sample library retains the original failure facts and transition chain and allows the backend to re-initiate candidate training. The recovery conditions do not directly change the vehicle-side parameters. The version obtained from the retraining still enters the new 5% ramp-up level along the candidate strategy package, pairing verification, and signature distribution link. The evaluation configuration table stores the indicator name, raw unit, normalization scale, benefit or penalty direction, statistical window, confidence level, upgrade boundary, rollback threshold, version, and effective time. One safety intervention rate record uses times / event as the raw unit, 0.05 times / event as the normalization scale, the direction is set to penalty, the rolling window is set to 300 events, and the rollback threshold is set to increase by 20% relative to the baseline. When the vehicle capability configuration or evaluation caliber changes, a new evaluation configuration version is generated and the statistics start again from the 5% operation event ratio. The old version window is not merged with the new version window. The large model in the background updates the structured labeled calibration set using new failure events and human feedback. The constrained offline hierarchical reinforcement learner writes the event evaluation results, failure events and their state transitions before and after into the optimization sample library. When a single policy version adds 1,000 valid events or accumulates 30 similar failure events, a new offline training batch is triggered. Failure events are given five times the sampling weight of ordinary success events during sampling. However, any new model must still be re-verified through S2 candidate packaging and S3 same-event counterfactual pairing. The vehicle parameters cannot be directly updated from the feedback library. After completing the current ramp-up cycle, the feedback evolution module outputs a versioned summary of event evaluations, the status of continued ramp-up or rollback, and a list of newly added optimization samples. It also saves the job event package, signature policy package version chain, and failure event chain to a traceable audit library. This ensures that the actual control response and cleanup results are continuously fed back to the next round of structured analysis and constrained offline optimization, while maintaining the boundaries between candidate generation, alignment, restricted execution, independent security filtering, and step-by-step ramp-up without being bypassed.

[0025] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

[0026] This invention uses job event packages and confirmation coverage overdue accounts as common data objects between backend strategy optimization and vehicle-side path control. This enables the large model to reinforce learning actions by constraining the structured results of logs and human feedback through parameter dependency masking. After being verified by frozen baseline pairing, it is transformed into a signature strategy package that can be executed within a limited domain. This connects strategy evaluation, parameter distribution, navigation regression, unified control, and real result feedback into a repeatable technical closed loop.

[0027] This invention changes the traditional control structure of fixed rules and single parameter tuning: the coverage deficit manager provides coverage status confirmed by location credibility, the sweeping event pairing verifier provides access criteria under consistent initial state and evaluation criteria, the independent safety filter and fail-safe mode maintain the final safety boundary of the vehicle, and the step-by-step expansion and rollback mechanism adjusts the upper limit based on the actual sweeping footprint and control response, thereby improving the stability of strategy evolution under different road and operating environments.

Claims

1. A large-model-driven self-evolutionary unmanned driving control method for a sweeper, characterized in that, include: S1. Link vehicle operation data and cleaning feedback with road segment identifiers and obstacle avoidance event identifiers to generate operation event packages; Based on the uncertainty of the location, the actual scanning footprint is reduced and the difference is calculated with the planned coverage area to obtain the confirmed coverage deficit; S2. The backend big model generates structured scene labels, anomaly causes, measurable target components, and parameter dependency masks that limit adjustable strategy parameters and dependencies based on the job event package and the confirmation coverage of outstanding debts. The constrained offline hierarchical reinforcement learner optimizes the parameters under safety constraints to generate a candidate policy package. S3. Based on the same historical event and counterfactual perturbation, run the baseline policy package and candidate policy package in pairs; If a candidate policy package meets the security index threshold and its cleaning index confidence lower bound is not lower than the corresponding cleaning index confidence lower bound of the baseline policy package, a signed policy package is generated. S4. When the scene features corresponding to the structured scene label match the applicable domain parameters of the signature strategy package, the navigation system generates the obstacle spatiotemporal envelope and candidate regression anchor points from the operation event package, and generates the operation path in combination with the confirmation coverage of overdue accounts. The vehicle-mounted unified control system generates vehicle control commands based on the parameter range of the signature strategy package, and the execution is constrained by an independent safety filter. S5. Write the control response and cleaning results back to the job event package, evaluate the signature strategy package accordingly, and perform incremental scaling or rollback. Use the evaluation results and failure events as optimization samples.

2. The large-model-driven self-evolutionary unmanned driving control method for sweepers according to claim 1, characterized in that, S1 includes: The following data were collected according to a unified time reference: environmental point cloud, environmental images, road boundaries, road segment attribute records associated with road segment identifiers, garbage density, vehicle positioning results and positioning covariance, road surface adhesion estimation, vehicle trajectory, target speed and actual speed, target turning angle and actual turning angle, sweeper start and stop status and effective sweeper width, residue before and after sweeping, coverage area, overlap area, energy consumption, parking events, takeover events and human feedback. The data acquisition results are time-aligned using the road segment identifier and obstacle avoidance event identifier as a common index. The time-aligned data acquisition results, along with their data source, acquisition time, and validity flag, are then encapsulated into the operation event package.

3. The large-model-driven self-evolutionary unmanned driving control method for sweepers according to claim 2, characterized in that, Step S1 also includes: The overdue payment manager records the off-track anchor point when the vehicle leaves the original sweeping path to bypass the obstacle. Based on the vehicle's position, the start and stop status of the sweeping brush, and the effective width of the sweeping brush, the actual sweeping brush motion envelope is generated, and the actual sweeping brush motion envelope is determined as the actual sweeping brush footprint. The footprint shrinkage boundary is determined based on the positioning covariance. The actual sweeping footprint is then subjected to confidence shrinkage. The actual sweeping footprint after shrinkage is used as the confirmed coverage area. The area in the planned coverage area that does not fall into the confirmed coverage area is defined as the confirmed coverage deficit. The confirmed coverage area, confirmed coverage deficit, and off-track anchor point are written into the same operation event package.

4. The large-model-driven self-evolutionary unmanned driving control method for sweepers according to claim 1, characterized in that, S2 include: The background big model encodes road boundary morphology, garbage density range, road surface adhesion range, positioning uncertainty range, dynamic obstacle type and control response deviation as the structured scene label based on the data source, validity mark and human feedback in the operation event package. It also encodes missed sweeping, repeated sweeping, edge spacing deviation, steering reversal, invalid parking, safety intervention and unit confirmed coverage area energy consumption as the abnormal cause and measurable target component. The parameter dependency mask is generated based on the correlation between the cause of the anomaly and the measurable target component; The constrained offline hierarchical reinforcement learner selects adjustable strategy parameters from the target velocity, acceleration boundary, deceleration boundary, steering rate of change boundary, obstacle avoidance clearance, edge spacing, obstacle bypass cost weight, regression cost weight, and replanning threshold according to the parameter dependency mask. With the safety cost not exceeding the safety cost upper limit as a constraint, the confirmation coverage increment and confirmation coverage arrears reduction are regarded as long-term reward items, and the repeated coverage area, steering reversal number, invalid parking time, and energy consumption per unit confirmation coverage area are regarded as long-term reward penalty items. The output is the candidate strategy package containing version identifier, applicable domain parameters, baseline values ​​and parameter ranges of each adjustable strategy parameter, validity period, exit conditions, and rollback version identifier. The applicable domain parameter consists of a field identifier, a mandatory flag, a value range, and a data source pointing to the corresponding field in the job event package.

5. The large-model-driven self-evolutionary unmanned driving control method for sweepers according to claim 4, characterized in that, S3 includes: The cleaning event pairing verifier determines the policy version that is stably running in the target applicable domain and has been safely confirmed when the candidate policy package is generated as the baseline policy package, and freezes the version identifier, vehicle configuration, applicable domain parameters, parameter values, evaluation time domain and rollback version identifier of the baseline policy package; Read historical operation events with the same road segment identifier and obstacle avoidance event identifier, and determine the data obtained by applying a perturbation within a value range to at least one of obstacle trajectory, positioning covariance, road surface adhesion estimation or garbage density as the counterfactual perturbation; The baseline strategy package and the candidate strategy package are executed in parallel under the same initial vehicle state, vehicle configuration, planned coverage area and evaluation time domain. The minimum obstacle clearance and braking margin are compared with the lower limit of clearance and lower limit of margin that have been confirmed for safety, respectively. The positioning reliability is compared with the lower limit of reliability. The vehicle stability is compared with the allowable stability range. The actuator output is compared with the upper limit of actuator capability to obtain the safety index. The confirmed coverage increment and confirmed coverage deficit reduction are used as revenue components, and the overlapping coverage area, edge spacing variance, invalid parking time and energy consumption per unit confirmed coverage area are used as penalty components. Each component is converted into a cleaning score with a larger value as better according to the scale and weight recorded in the evaluation configuration in advance, and the confidence lower bounds of the candidate cleaning score and the baseline cleaning score are determined respectively. When each security indicator meets the corresponding lower limit, allowable range or capability upper limit and the confidence lower bound of the candidate cleaning score is not lower than the confidence lower bound of the baseline cleaning score, a subset of allowable parameters is determined from the adjustable policy parameters of the candidate policy package to generate the signature policy package. The signature policy package inherits and freezes the version identifier, applicable domain parameters, baseline values ​​and parameter ranges of each parameter in the allowed parameter subset, validity period, exit conditions and rollback version identifier of the candidate policy package, and includes the initial adjustment range and the gradual increase conditions. Parameters that do not enter the allowed parameter subset use the frozen parameter values ​​of the baseline policy package.

6. The large-model-driven self-evolutionary unmanned driving control method for sweepers according to claim 5, characterized in that, S4 include: The navigation system generates the obstacle spatiotemporal envelope based on the obstacle perception data in the operation event package, generates candidate regression anchor points along the original cleaning path after the obstacle spatiotemporal envelope, and determines a candidate evaluation vector for each candidate regression anchor point, consisting of safety margin, kinematic feasibility indicator, expected confirmed coverage deficit, expected repeated coverage area, expected number of turning and reversing times, and regression distance. Based on vehicle kinematic constraints, the candidate evaluation vector is evaluated by combining the obstacle avoidance cost weight and regression cost weight corresponding to the allowed parameter subset of the signature strategy package. When an obstacle occupies the original cleaning path, an obstacle bypass path is generated. When bypassing the obstacle, a candidate regression anchor point that satisfies the safety margin constraint and kinematic feasibility constraint is selected to generate a regression path. Based on the confirmed coverage deficit, an edge-following path or a replanning path is generated, so that the operation path includes at least one of the obstacle bypass path, regression path, edge-following path and replanning path. When the obstacle bypass cost weight or regression cost weight is not included in the allowed parameter subset, the corresponding frozen parameter value in the baseline strategy package is used.

7. The large-model-driven self-evolutionary unmanned driving control method for sweepers according to claim 6, characterized in that, Step S4 also includes: The current scene features are generated based on the structured scene tags and the road segment attribute records, obstacle types, positioning uncertainty intervals and road surface attachment intervals in the operation event package, and the current scene features are compared item by item with the applicable domain parameters of the signature strategy package; The allowed parameter subset is enabled only when all applicable field parameters marked as required have valid data and meet the corresponding value range. If any required applicable field parameter is missing, invalid, or does not meet the corresponding value range, it is determined as a mismatch. Upon initial activation, the changes of each allowed parameter relative to the corresponding frozen parameter value in the baseline policy package are limited to the initial adjustment range; The vehicle-mounted unified control system, based on the work path, vehicle status, and permissible parameters after activation, solves for the target speed, driving amount, braking amount, and target steering angle through model predictive control. The independent safety filter verifies the vehicle control command according to the lower limit of net distance, lower limit of margin, lower limit of confidence, allowable range of stability and upper limit of actuator capability. If any safety indicator fails to meet the corresponding boundary, the vehicle control command is rejected and replaced with a deceleration, braking, steering angle limit or stopping command that meets the corresponding boundary, while recording the safety intervention event. When the safety indicator input is invalid, replacement instructions that meet all corresponding boundaries cannot be obtained, or the actuator refuses to execute, enter the independent fault-safe mode, prohibit policy parameter updates, control the available actuators to perform the minimum risk shutdown, and record the reasons for non-replacement and manual takeover requests.

8. The large-model-driven self-evolutionary unmanned driving control method for sweepers according to claim 7, characterized in that, S5 include: The proportion of operation events controlled by the signature strategy package is increased according to the step-by-step increase conditions, and an event evaluation result is formed after each operation event is completed based on the actual scanning footprint, vehicle control response, safety intervention rate, confirmed coverage deficit and edge spacing variance. When the event evaluation result meets the step-by-step release condition, the adjustment range of each allowed parameter relative to the corresponding frozen parameter value and the proportion of subsequent operation events are increased. When the increase in the safety intervention rate, confirmation coverage deficit, or edge spacing variance relative to the baseline strategy package reaches the rollback threshold under the same vehicle configuration, applicable domain, and evaluation time domain, switch to the strategy package corresponding to the rollback version identifier and generate a failure event. The event evaluation results, failure events, safety intervention events, irreplaceable reasons, and manual takeover results are written into the corresponding job event package and sent back to the background large model and the constrained offline hierarchical reinforcement learner.

9. The large-model-driven self-evolutionary unmanned driving control method for sweepers according to claim 8, characterized in that, Step S5 also includes: When the current scenario features do not match the applicable domain parameters, the signature policy package expires, the security intervention rate reaches the exit condition, the signature verification fails, or the independent fault-tolerant mode is triggered, the allowed parameter subset is prohibited from being enabled and the policy package corresponding to the rollback version identifier is switched. Write the mismatched applicable domain parameters, the expired version identifier, the security intervention event that triggered the exit condition, the signature verification failure result, or the irreplaceable reason into the failure event; Once manual takeover is complete and security indicator inputs are restored to validity, exiting the independent failsafe mode is only permitted when recompleting applicable domain matching and signature verification.

10. A large-model-driven self-evolving unmanned driving control system for a sweeper, used to execute the large-model-driven self-evolving unmanned driving control method for a sweeper as described in any one of claims 1 to 9, characterized in that, include: The event building module includes an overdue payment manager, which is used to generate job event packages and confirm overdue payments based on vehicle operation data and cleaning feedback; The strategy generation module includes a background large model and a constrained offline hierarchical reinforcement learner, used to generate candidate strategy packages based on the job event package and the confirmation coverage arrears; The pairing verification module includes a sweep event pairing verifier, used to pair and verify the candidate policy package with the baseline policy package and generate a signed policy package; The vehicle-side execution module includes a navigation system, an in-vehicle unified control system, and an independent safety filter, used to generate operation paths and vehicle control instructions based on the signature policy package and to execute safety constraints. The feedback evolution module is used to write the control response, cleaning result and failure event into the job event package, and feed the job event package back to the strategy generation module.

Images