Control method and device for a vehicle

Abstract

The application discloses a control method and device of a vehicle. The method comprises the following steps: obtaining running state data of the vehicle, a mapping result between a driving scene of the vehicle and a quadrant to which the driving scene belongs, and a migration path identifier of the vehicle entering the quadrant, wherein the migration path identifier is used for identifying a type of a source quadrant of the vehicle entering the quadrant and a migration direction; generating a control strategy of the vehicle based on the running state data, the mapping result and the migration path identifier, wherein the control strategy is used for representing a control rule set configured by different migration sources for the same quadrant, and there is one valid control strategy at the same time; generating a linkage control instruction of the vehicle based on the control strategy; and controlling an execution unit to execute a cooperative safety regulation action or a defensive degradation action of a risk level in which the vehicle currently locates in response to the linkage control instruction. The application solves the technical problem of low effectiveness of vehicle control.

Description

Technical Field

[0001] This application relates to the field of vehicle control technology, and more specifically, to a vehicle control method and apparatus. Background Technology

[0002] Currently, the following deficiencies exist in the field of vehicle-road-cloud-star collaborative safety during vehicle control.

[0003] First, existing standards, such as the four-quadrant model of the expected functional safety standard (ISO 21448), serve only as an analysis tool during the design phase. They lack strategies for managing dynamic changes in vehicle operating risks and do not define how to adjust control measures when driving scenarios dynamically shift between different quadrants. Second, existing risk classification methods are mostly static designs, lacking mechanisms for managing the dynamic migration of collaborative safety risks. They cannot address issues such as when to migrate, how to verify migration safety, and how to roll back in case of migration failure. This makes them ill-suited to the real-time safety risk management needs arising from multi-entity collaboration and dynamic communication changes in vehicle-road-cloud-star systems. Therefore, the technical problem of low vehicle control effectiveness persists.

[0004] There is currently no effective solution to the aforementioned technical problems. Summary of the Invention

[0005] This application provides a vehicle control method and apparatus to at least address the technical problem of low vehicle control effectiveness.

[0006] According to one aspect of the embodiments of this application, a vehicle control method is provided. The method may include: acquiring vehicle operating state data, a mapping result between the vehicle's driving scenario and the quadrant to which the driving scenario belongs, and a migration path identifier for the vehicle entering the quadrant, wherein the migration path identifier is used to identify the type of the source quadrant from which the vehicle enters the quadrant and the migration direction; generating a vehicle control strategy based on the operating state data, the mapping result, and the migration path identifier, wherein the control strategy represents a set of control rules configured for the same quadrant through different migration sources, and that an effective control strategy exists at any given time; generating a vehicle linkage control command based on the control strategy, wherein the linkage control command is used to control the vehicle's execution unit to perform a collaborative safety control action or a defensive degradation action; and responding to the linkage control command, controlling the execution unit to perform a collaborative safety control action or a defensive degradation action based on the risk level currently in which the vehicle is located.

[0007] Optionally, a vehicle control strategy is generated based on operational status data, mapping results, and migration path identifiers, including: determining the sufficiency of the vehicle's individual capabilities and the sufficiency of the vehicle's cooperative system capabilities based on operational status data and mapping results; determining the target quadrant to which the vehicle's current driving scenario belongs based on the sufficiency of the individual capabilities and the sufficiency of the cooperative system capabilities; determining the source quadrant for entering the target quadrant based on the target quadrant and migration path identifiers, wherein the source quadrant is used to represent the historical quadrant before the migration occurs; and generating a control strategy based on the target quadrant and / or the migration relationship between the source quadrant and the target quadrant.

[0008] Optionally, based on the sufficiency of individual vehicle capabilities and the sufficiency of collaborative system capabilities, the target quadrant to which the current driving scenario of the vehicle belongs is determined, including: in response to the sufficiency of individual vehicle capabilities being higher than a sufficiency threshold and the sufficiency of collaborative system capabilities being higher than a sufficiency threshold, the target quadrant is determined as the first quadrant; in response to the sufficiency of individual vehicle capabilities being higher than a sufficiency threshold and the sufficiency of collaborative system capabilities being lower than a sufficiency threshold, the target quadrant is determined as the second quadrant; in response to the sufficiency of individual vehicle capabilities being lower than a sufficiency threshold and the sufficiency of collaborative system capabilities being higher than a sufficiency threshold, the target quadrant is determined as the third quadrant; in response to the sufficiency of individual vehicle capabilities being lower than a sufficiency threshold and the sufficiency of collaborative system capabilities being lower than a sufficiency threshold, the target quadrant is determined as the fourth quadrant.

[0009] Optionally, based on the target quadrant and / or the migration relationship between the source quadrant and the target quadrant, a control strategy is generated, including: in response to the target quadrant being the first quadrant, determining the control strategy as a first control strategy, wherein the first control strategy is a continuous monitoring strategy; in response to the target quadrant being the second quadrant, and / or the migration relationship being a migration from the source quadrant to the second quadrant, determining the control strategy as a second control strategy, wherein the second control strategy is an enhancement control strategy; in response to the target quadrant being the third quadrant, and / or the migration relationship being a migration from the source quadrant to the third quadrant, determining the control strategy as a third control strategy, wherein the third control strategy is a runtime control strategy; and in response to the target quadrant being the fourth quadrant, and / or the migration relationship being a migration from the source quadrant to the fourth quadrant, determining the control strategy as a fourth control strategy, wherein the fourth control strategy is a degradation triggering strategy.

[0010] Optionally, based on the control strategy, a linkage control command for the vehicle is generated, including: in response to the target quadrant moving from the first quadrant to the second quadrant, determining the rate of change of the vehicle's cooperative safety index; in response to the rate of change being lower than a rate of change threshold, determining the target quadrant moving to the fourth quadrant; and based on the control strategy, generating a first linkage control command, wherein the first linkage control command is used to indicate a preparatory action for performing degradation trend monitoring.

[0011] Optionally, based on the control strategy, a linkage control command for the vehicle is generated, including: in response to the target quadrant moving from the third quadrant to the second quadrant, a second linkage control command is generated based on the control strategy, wherein the second linkage control command is used to indicate the execution of a verification action to resolve cooperative dependencies.

[0012] Optionally, based on the control strategy, a linkage control command for the vehicle is generated, including: in response to the target quadrant moving from the fourth quadrant to the second quadrant, a third linkage control command is generated based on the control strategy, wherein the third linkage control command is used to indicate the execution of a step-by-step recovery action.

[0013] Optionally, based on the control strategy, the vehicle's linkage control commands are generated, including: in response to the target quadrant moving from the first quadrant to the third quadrant, a fifth linkage control command is generated based on the control strategy, wherein the fifth linkage control command is used to represent a verification action for performing collaborative compensation; in response to the target quadrant moving from the second quadrant to the third quadrant, a sixth linkage control command is generated based on the control strategy, wherein the sixth linkage control command is used to represent a verification action for performing dual-dimensional switching stability; and in response to the target quadrant moving from the fourth quadrant to the third quadrant, a seventh linkage control command is generated based on the control strategy, wherein the seventh linkage control command is used to represent a verification action for the authenticity of collaborative recovery.

[0014] Optionally, based on the control strategy, a linkage control command for the vehicle is generated, including: in response to the target quadrant moving from the first quadrant to the fourth quadrant, or from the third quadrant to the fourth quadrant, an eighth linkage control command is generated based on the control strategy, wherein the eighth linkage control command is used to indicate the execution of a degradation action of full-domain bypass; in response to the target quadrant moving from the second quadrant to the fourth quadrant, a ninth linkage control command is generated based on the control strategy, wherein the ninth linkage control command is used to indicate the execution of a degradation action of progressive bypass.

[0015] According to another aspect of the embodiments of this application, a vehicle control device is also provided. The device may include: an acquisition unit, configured to acquire vehicle operating status data, a mapping result between the vehicle's driving scenario and the quadrant to which the driving scenario belongs, and a migration path identifier for the vehicle entering the quadrant, wherein the migration path identifier identifies the type of the source quadrant from which the vehicle enters the quadrant and the migration direction; a first generation unit, configured to generate a vehicle control strategy based on the operating status data, the mapping result, and the migration path identifier, wherein the control strategy represents a set of control rules configured for the same quadrant through different migration sources, and that an effective control strategy exists at any given time; a second generation unit, configured to generate a linkage control command for the vehicle based on the control strategy, wherein the linkage control command controls the vehicle's execution unit to perform a collaborative safety control action or a defensive degradation action; and a control unit, configured to, in response to the linkage control command, control the execution unit to perform a collaborative safety control action or a defensive degradation action based on the risk level currently in which the vehicle is located.

[0016] According to another aspect of the embodiments of this application, a processor is also provided. The processor is used to run a program, wherein the program executes the methods of the embodiments of this application during runtime.

[0017] According to another aspect of the embodiments of this application, an electronic device is also provided, including: a memory storing an executable program; and a processor for running the program, wherein the program executes the method of the embodiments of this application when it runs.

[0018] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided. The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device where the computer-readable storage medium is located to perform the method of the embodiments of this application.

[0019] According to another aspect of the embodiments of this application, a vehicle is also provided. The vehicle includes a memory and a processor. The memory stores an executable program; the processor is used to run the program, which, when running, implements the methods described in the embodiments of this application.

[0020] In this embodiment, vehicle operating status data, the mapping result between the vehicle's driving scenario and the quadrant to which the driving scenario belongs, and the migration path identifier of the vehicle entering the quadrant can be obtained. Since the migration path identifier is used to identify the type of the source quadrant from which the vehicle enters the quadrant and the migration direction, the dynamic process of risk evolution during vehicle operation can be revealed. Subsequently, based on the operating status data, mapping result, and migration path identifier, a set of control rules differentiated according to different historical sources can be generated for the same quadrant; that is, a control strategy is generated. The control strategy can be transformed into specific linkage control commands to drive the execution unit to perform coordinated safety control actions or defensive degradation actions. This overcomes the limitations of static risk classification in related technologies, thereby improving safety, response speed, and control effectiveness in complex dynamic scenarios, solving the technical problem of low vehicle control effectiveness, and achieving the technical effect of improving vehicle control effectiveness. Attached Figure Description

[0021] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0022] Figure 1 This is a flowchart of a vehicle control method according to an embodiment of this application;

[0023] Figure 2 This is a schematic diagram illustrating the result of a collaborative security risk classification according to an embodiment of this application;

[0024] Figure 3 This is a flowchart of a vehicle-road-cloud-star cooperative safety risk classification and control method according to an embodiment of this application;

[0025] Figure 4 This is a schematic diagram of a hierarchical control device according to an embodiment of this application;

[0026] Figure 5 This is a schematic diagram of a vehicle control device according to an embodiment of this application;

[0027] Figure 6 This is a structural diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] According to an embodiment of this application, an embodiment of a vehicle control method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0031] Figure 1 This is a flowchart of a vehicle control method according to an embodiment of this application, such as... Figure 1 As shown, the method may include the following steps.

[0032] Step S102: Obtain the vehicle's operating status data, the mapping result between the vehicle's driving scenario and the quadrant to which the driving scenario belongs, and the migration path identifier for the vehicle entering the quadrant.

[0033] In the technical solution provided by step S102 of this application, the migration path identifier can be used to identify the type of the source quadrant into which the vehicle enters the quadrant and the migration direction.

[0034] In this embodiment, vehicle operating status data can be collected in real time through the vehicle's sensors, communication module, and positioning module. This operating status data can include vehicle speed, acceleration, steering angle, perception data from onboard sensors (cameras, millimeter-wave radar, lidar, etc.), GNSS positioning accuracy, and quality parameters of the Vehicle-to-Everything (V2X) communication link, such as Reference Signal Receiving Power (RSRP), Signal-to-Noise Ratio (SNR), and latency. Simultaneously, the vehicle-road-cloud-star cooperative system (referred to as the cooperative system) can perform real-time evaluation of the current driving scenario based on the Cooperative Safety Sufficiency Framework (C-SSF) four-quadrant model.

[0035] Optionally, the aforementioned four-quadrant model can map driving scenarios to one of the four quadrants using both individual vehicle capability sufficiency and collaborative system capability sufficiency as two dimensions. For example, the first quadrant (both sufficiency, safe) can be represented by Q1. The second quadrant (sufficient individual vehicle capability but insufficient collaborative capability) can be represented by Q2. The third quadrant (insufficient individual vehicle capability but sufficient collaborative capability) can be represented by Q3. The fourth quadrant (both inadequacy, dangerous) can be represented by Q4.

[0036] Optionally, the aforementioned vehicle-road-cloud-satellite cooperative system serves as an enhancement for vehicles. Vehicles can be intelligent connected vehicles equipped with perception, decision-making, and control capabilities. The road can be roadside units, traffic lights, roadside sensors, etc., used to provide static environment and collaborative perception data. The cloud can be a cloud platform (e.g., the cloud itself), responsible for big data processing, traffic scheduling, high-precision map updates, and remote monitoring. The satellites can be satellite navigation systems, such as BeiDou, the Global Positioning System (GPS), and low-Earth orbit satellite communication, used to provide high-precision positioning and wide-area communication coverage.

[0037] Optionally, the migration path identifier can include not only the target quadrant of the current driving scenario, but also the specific source quadrant from which the vehicle migrated (i.e., the type of the source quadrant) and the direction of migration (i.e., the migration direction). For example, if the vehicle is currently in quadrant Q2, the migration path identifier could be Q1→Q2 (representing a migration from the normal state to the enhanced control state), Q3→Q2 (representing a migration from the cooperative dependency removal state to the enhanced control state), or Q4→Q2 (representing a migration from the emergency degrade recovery state to the enhanced control state). Similarly, if the vehicle is currently in quadrant Q3, the migration path identifier could be Q1→Q3, Q2→Q3, or Q4→Q3, etc. This process can be generated by comparing the quadrant states of historical periods with the quadrant states of the current period, combined with specific triggering conditions (e.g., communication quality degradation, sensor failure, cooperative data interruption, etc.).

[0038] Optionally, since the vehicle-road-cloud-star cooperative system is a dynamic and complex system, the same quadrant (e.g., Q2) evolves from different initial states, and the underlying risk causes, system states, and potential hazards vary significantly. For example, Q1→Q2 signifies a gradual deterioration of communication links or perception coverage, with relatively controllable risks; while Q3→Q2 indicates that the vehicle has just lost its critical collaborative compensation capabilities, accompanied by a drastic shift in perception weights, making the risks more sudden; Q4→Q2 involves recovery from an emergency degraded state, requiring verification of the recovery's authenticity to prevent oscillations. If a uniform control strategy (e.g., a management strategy) is implemented based solely on the current quadrant, it cannot accurately address the specific risks brought about by different migration paths. Therefore, by obtaining migration path identifiers, the specific sources and evolution trends of risks can be identified, laying the foundation for the generation of subsequent targeted and differentiated control strategies, ensuring that the management measures implemented by the control strategy match the actual driving scenario with current risks.

[0039] In this embodiment, the above steps enable refined control over different paths and strategies within the same quadrant. This allows the collaborative system to implement targeted control measures such as degradation trend monitoring, collaborative dependency removal verification, or step-by-step recovery gating for different migration paths, such as Q1→Q2 and Q3→Q2, thereby improving the targeting and effectiveness of the control strategy.

[0040] Step S104: Based on the operating status data, mapping results, and migration path identifiers, generate the vehicle control strategy.

[0041] In the technical solution provided in step S104 of this application, the control strategy can be used to represent a set of control rules configured for the same quadrant through different migration sources, and there is an effective control strategy at the same time.

[0042] In this embodiment, based on the acquired operational status data, the quadrant to which the driving scenario belongs (corresponding to the mapping result), and the migration path identifier of the vehicle entering that quadrant, a unique and effective control strategy is generated through a preset control strategy engine. This control strategy is not a single fixed instruction, but a collection of multi-level and multi-dimensional control rules.

[0043] Optionally, the current quadrant (e.g., Q2, Q3, or Q4) is first determined, and then the corresponding dedicated measure configuration set is looked up or called in combination with the migration path identifier (e.g., Q1→Q2, Q3→Q2, etc.).

[0044] For example, when the mapping result is in quadrant Q2 and the migration path is Q1→Q2, an enhanced control strategy can be generated that includes a degradation trend monitor. The focus is on monitoring the rate of change of the Sufficiency Index (SI) to predict further deterioration, and fully enabling enhanced measures of the data layer, decision layer and communication layer of the collaborative system, such as raising the credibility threshold, performing dual-source confirmation, delaying decision-making and shortening timeout.

[0045] Optionally, when the mapping result is in quadrant Q2 and the migration path is Q3→Q2, an enhanced control strategy containing a collaborative dependency removal verifier can be generated. The focus is on implementing a progressive weight switching mechanism to verify the consistency between onboard independent decision-making and collaborative decision-making, prevent control jumps caused by abrupt changes in perception weights, and enable other enhancement measures.

[0046] Optionally, when the mapping result is in quadrant Q2 and the migration path is Q4→Q2, an enhanced control strategy containing step-by-step recovery gating can be generated. The focus is on restoring collaborative functions in the order of dependencies (e.g., first location, then communication, then perception, and finally decision-making). Each function must pass N consecutive evaluations within an independent verification window before proceeding to the next step, ensuring the safety and stability of the recovery process.

[0047] Optionally, when the mapping result is in the Q3 quadrant, depending on the source (Q1→Q3, Q2→Q3, Q4→Q3), a collaborative compensation verifier, a two-dimensional switching stability verifier, or a collaborative recovery authenticity verifier can be configured to deal with specific risks such as sudden drop in single-vehicle capability, two-dimensional switching, or short-term collaborative recovery.

[0048] Optionally, when the mapping result is in the Q4 quadrant, a defensive degradation triggering strategy can be generated, and a full-domain bypass (scope=all) or a progressive bypass (scope=partial) can be selected according to the source (Q1 / Q3→Q4 or Q2→Q4), directly outputting the degradation triggering signal to the vehicle cooperative safety system in the vehicle-road-cloud-star cooperative system.

[0049] Since different migration paths represent different risk evolution mechanisms and collaborative system states (e.g., gradual deterioration, sudden failure, recovery verification, etc.), a unified control strategy cannot simultaneously guarantee safety and availability. This application's embodiments generate a vehicle control strategy based on operational status data, mapping results, and migration path identifiers. This strategy can configure appropriate parameters and measures for specific risk scenarios (e.g., gradual weight switching from Q3 to Q2 vs. degradation monitoring from Q1 to Q2), thereby maximizing the normal operation of vehicle functions while ensuring safety. Simultaneously, ensuring that only one control strategy is in effect at any given time avoids control chaos caused by conflicts between multiple control strategies, guaranteeing the safety and determinism of the vehicle's control system.

[0050] Step S106: Based on the control strategy, generate the vehicle's linkage control command.

[0051] In the technical solution of step S106 of this application, the linkage control command can be used to control the vehicle's execution unit to perform coordinated safety regulation actions or defensive degradation actions.

[0052] In this embodiment, based on the control strategy, the parameters of control measures scattered across various levels can be logically integrated and synthesized to generate a unified set of linkage control instructions. For example, based on the dependency relationship of "data layer → decision layer → communication layer" or the bypass mechanism in the Q4 emergency scenario, collaborative packaging can be performed to obtain linkage control instructions.

[0053] Optionally, for the Q2 enhanced control scenario, the coordinated control commands can include collaborative parameters for the data layer, decision layer, and communication layer. For example, data layer commands include adaptively adjusted reliability thresholds and dual-source consistency deviation thresholds; decision layer commands include decision delay time or weight switching function parameters; and communication layer commands include adaptively shortened timeout limits. These coordinated control commands are uniformly distributed to the vehicle's decision module (e.g., perception fusion algorithm, planning and control algorithm), communication module (e.g., V2X protocol stack, timeout manager), and positioning module (e.g., GNSS) through a security gateway. The coordinated control commands can specify the specific values ​​to be adjusted and the execution sequence for different units, ensuring the synchronization of the three layers in time and their logical dependencies (e.g., a decrease in communication layer feedback quality triggers tightening of the data layer threshold).

[0054] Optionally, for the Q3 operational control scenario, the linkage control command focuses on the dynamic adjustment of perception weights. For example, during the Q1→Q3 migration, the linkage control command requires the perception fusion module to gradually or immediately increase the weight of the collaborative perception data from the baseline value in Q1 (e.g., 0.3) to the dominant value in Q3 (e.g., 0.7), while simultaneously initiating the comparison logic of the collaborative compensation verifier. In the Q4 defensive degradation scenario, the linkage control command manifests as a high-priority degradation trigger signal. This degradation trigger signal bypasses the conventional SI calculation pipeline and is directly output by the Q4 degradation trigger module, including a field alarm flag that is true (alert_flag=true), a risk level that is high (risk_level=high), and a scope that is either all or partial (scope=partial). If scope=all, the linkage control command requires freezing the collaborative data channel and switching to vehicle-side independent mode; if scope=partial, the linkage control command requires freezing some data while retaining high-trust data marked as verified during Q2 (trusted_during_q2) as a reference after downgrading, along with a risk snapshot from the Q2 phase.

[0055] In this embodiment, by generating linkage control commands, the collaborative system can coordinate different units, thereby ensuring that they work collaboratively within a unified time window according to predetermined dependencies and logical constraints. Especially in the Q4 emergency scenario, generating a direct degradation trigger signal through a bypass mechanism can reduce the latency caused by conventional calculation processes, ensuring that in dangerous dual-insufficiency driving scenarios, the vehicle can execute the Minimum Risk Maneuver (MRM) at millisecond speeds, thus protecting occupant safety.

[0056] In step S108, in response to the linkage control command, the control execution unit performs a coordinated safety control action or a defensive downgrade action based on the current risk level of the vehicle.

[0057] In the technical solution of step S108 of this application, after the vehicle's execution unit (which may include a perception fusion module, a planning and decision-making module, a communication control module, and underlying execution mechanisms, etc.) receives the linkage control command, it can execute the corresponding linkage control command in real time according to the specific parameters and logic specified in the linkage control command.

[0058] In this embodiment, coordinated safety control actions can be performed for quadrants Q1, Q2, and Q3. For example, at the data layer, the execution unit adjusts the data filtering logic according to the linkage control instructions. For instance, under enhanced control in Q2, the perception fusion module raises the credibility threshold of the coordinated data, accepting only data higher than this threshold; simultaneously, a dual-source confirmation mechanism is activated, requiring roadside perception data to be consistent with vehicle-mounted radar or camera data within the position and speed deviation thresholds; otherwise, it is considered invalid data. At the decision layer, the decision module adjusts the decision timing and weights according to the linkage control instructions. For instance, in the Q2 scenario, the decision result is not executed immediately but waits for dual-source confirmation; if the timeout occurs, the decision is based on the current better data. In the Q3→Q2 or Q1→Q3 migration scenarios, the decision module dynamically adjusts the perception weights, for example, gradually adjusting the coordinated perception weight from 0.3 to 0.7, or vice versa, to ensure a smooth transition of the decision output. At the communication layer, the communication control module adjusts the timeout parameters and link switching strategy according to the linkage control instructions. For example, when communication quality deteriorates and triggers Q2 control, the communication timeout period is shortened to 100ms. If no acknowledgment is received within the timeout period, the data is marked as invalid. It can also trigger the link to switch to the backup channel or degrade to vehicle-side independent mode.

[0059] Optionally, defensive degradation actions can be performed for quadrant Q4. For example, a full-domain freeze and independent mode switching (scope=all) occurs when a degradation trigger signal is received for Q1→Q4 or Q3→Q4. The execution unit immediately freezes all collaborative data channels (roadside perception, cloud commands, satellite augmentation), forcing the vehicle's collaborative safety system to enter an independent vehicle operation mode, ignoring external collaborative inputs and relying on onboard sensors for final risk avoidance decisions. Another example is a progressive freeze and reference retention (scope=partial). When a degradation trigger signal is received for Q2→Q4, the execution unit freezes collaborative data that has not undergone enhanced control verification, but retains the highly reliable dataset marked as trusted_during_q2. It also transmits the risk snapshot (Snap_q2) from the Q2 phase to the degraded decision module as a short-term reference after degradation, assisting the vehicle in implementing a minimum-risk strategy.

[0060] In the embodiments of this application, the above steps can transform the abstract control strategy into the specific physical or logical behavior of the vehicle, ensuring that the vehicle can make a correct, timely and safe response when the vehicle-road-cloud-star cooperative system faces different levels of safety risks.

[0061] Steps S102 to S108 of this application can acquire vehicle operating status data, the mapping result between the vehicle's driving scenario and the quadrant to which the driving scenario belongs, and the migration path identifier of the vehicle entering the quadrant. Since the migration path identifier is used to identify the type of the source quadrant from which the vehicle enters the quadrant and the migration direction, it can reveal the dynamic process of risk evolution during vehicle operation. Subsequently, based on the operating status data, mapping result, and migration path identifier, a set of control rules differentiated according to different historical sources can be generated for the same quadrant; that is, a control strategy can be generated. The control strategy can be transformed into specific linkage control commands to drive the execution unit to perform coordinated safety control actions or defensive degradation actions. This overcomes the limitations of static risk classification in related technologies, thereby improving safety, response speed, and control effectiveness in complex dynamic scenarios, solving the technical problem of low vehicle control effectiveness, and achieving the technical effect of improving vehicle control effectiveness.

[0062] The method described in this embodiment will be further described below.

[0063] As an optional embodiment, step S104, based on the operating status data, mapping results, and migration path identifiers, generates a vehicle control strategy, including: determining the sufficiency of the vehicle's individual capabilities and the sufficiency of the vehicle's cooperative system capabilities based on the operating status data and mapping results; determining the target quadrant to which the vehicle's current driving scenario belongs based on the sufficiency of the individual capabilities and the sufficiency of the cooperative system capabilities; determining the source quadrant for entering the target quadrant based on the target quadrant and the migration path identifiers, wherein the source quadrant is used to represent the historical quadrant before the migration occurs; and generating a control strategy based on the target quadrant and / or the migration relationship between the source quadrant and the target quadrant.

[0064] In this embodiment, the adequacy of a single vehicle's capabilities can be assessed based on the health status, perception accuracy, data confidence level, and positioning accuracy of onboard sensors (e.g., cameras, millimeter-wave radar, lidar, GNSS, etc.). For example, if an onboard camera fails due to heavy rain and there is no effective replacement, or if GNSS signals are lost and there is no high-precision map assistance, the adequacy of a single vehicle's capabilities can be determined as "insufficient." Conversely, if multiple source sensors are functioning normally and the data fusion results are reliable, the adequacy of a single vehicle's capabilities can be determined as "sufficient." The adequacy of the collaborative system's capabilities can be assessed based on the status of the vehicle-road-cloud-satellite network side, including the coverage and perception data quality of roadside units (RSUs), the timeliness and accuracy of cloud-based scheduling commands, the signal strength (RSRP / SNR) and latency of the communication link (V2X), and the availability of satellite augmentation services. For example, if a roadside RSU malfunction results in no collaborative sensing data in the area, or if a communication link interruption prevents cloud commands from reaching the system, the collaborative system's capability adequacy can be determined as "insufficient." Conversely, if the collaborative data is complete and communication is stable, the collaborative system's capability adequacy can be determined as "sufficient."

[0065] Optionally, based on the evaluation results of the above two dimensions, the current driving scenario can be mapped to the target quadrant in the C-SSF four-quadrant model. Specifically, quadrant Q1 indicates sufficient individual vehicle capability and sufficient collaborative capability; quadrant Q2 indicates sufficient individual vehicle capability but insufficient collaborative capability; quadrant Q3 indicates insufficient individual vehicle capability but sufficient collaborative capability; and quadrant Q4 indicates insufficient individual vehicle capability and insufficient collaborative capability. Subsequently, the source quadrant (i.e., the historical quadrant before the migration) can be determined by combining the migration path identifier. This process is achieved by comparing the current quadrant state with the quadrant state of the previous moment (or within the historical backtracking window). For example, if the current quadrant is Q2 and the previous moment was Q1, the source quadrant is Q1, and the migration relationship is "Q1→Q2"; if the current quadrant is Q3 and the previous moment was Q4, the source quadrant is Q4, and the migration relationship is "Q4→Q3". Finally, a control strategy can be generated based on the target quadrant and the migration relationship (the combination of the source and target quadrants). This means that the logic for generating control strategies depends not only on the current static risk level (quadrant), but also on the dynamic evolution path of the risk.

[0066] For example, for the Q2 quadrant, if the migration path is "Q1→Q2", a control strategy focusing on "degradation trend monitoring" and "gradual parameter tightening" can be generated; if the migration path is "Q3→Q2", a control strategy focusing on "cooperative dependency removal verification" and "gradual weight switching" can be generated to cope with the switching impact from cooperative dominance to single-vehicle dominance.

[0067] For the Q4 quadrant, if the migration path is "Q1→Q4", a control strategy of "full-domain bypass freeze" can be generated; if the migration path is "Q2→Q4", a control strategy of "progressive bypass retaining high-confidence data" can be generated.

[0068] Traditional risk management often relies solely on fixed measures based on the current static risk level, neglecting the dynamic process and historical state of risk evolution. This application's embodiments, by introducing source quadrants and migration relationships, can identify the causes and evolution trends of risks, thereby generating control strategies based on target quadrants and migration relationships. This achieves precise adaptation to different risk scenarios, avoiding a one-size-fits-all approach to management, and maximizing the availability of the collaborative system while ensuring security.

[0069] As an optional implementation method, the target quadrant to which the current driving scenario of the vehicle belongs is determined based on the sufficiency of the individual vehicle capability and the sufficiency of the collaborative system capability, including: determining the target quadrant as the first quadrant in response to the individual vehicle capability sufficiency being higher than the sufficiency threshold and the collaborative system capability sufficiency being higher than the sufficiency threshold; determining the target quadrant as the second quadrant in response to the individual vehicle capability sufficiency being lower than the sufficiency threshold and the collaborative system capability sufficiency being higher than the sufficiency threshold; determining the target quadrant as the third quadrant in response to the individual vehicle capability sufficiency being lower than the sufficiency threshold and the collaborative system capability sufficiency being lower than the sufficiency threshold; and determining the target quadrant as the fourth quadrant in response to the individual vehicle capability sufficiency being lower than the sufficiency threshold and the collaborative system capability sufficiency being lower than the sufficiency threshold.

[0070] In this embodiment, by quantifying and evaluating the specific values ​​or states of the adequacy of individual vehicle capabilities and the adequacy of collaborative system capabilities, and combining them with preset adequacy thresholds, the current complex driving scenario can be mapped to four specific quadrants in the C-SSF four-quadrant model.

[0071] Optionally, the adequacy of a single vehicle's capabilities can be assessed based on the health status of onboard sensors (cameras, radar, lidar, etc.), the confidence level of perceived data, positioning accuracy (GNSS error range), and the load on the computing unit. These indicators can be compared with preset adequacy thresholds. If all indicators are higher than the adequacy threshold (e.g., no sensor failures, positioning error less than 1 meter, high confidence level of fused data), then the vehicle's capability adequacy can be determined to be higher than the adequacy threshold. Conversely, if key sensors fail, positioning is ambiguous, or data conflicts are severe, then the vehicle's capability adequacy can be determined to be lower than the adequacy threshold.

[0072] Optionally, the adequacy of the collaborative system's capabilities can be assessed, primarily considering the status of the vehicle-road-cloud-satellite network side, including the communication signal quality of roadside units (RSUs) (e.g., RSRP, SNR), data transmission latency, coverage and consistency of roadside sensing data, timeliness of cloud-based scheduling instructions, and availability of satellite augmentation services. These network and collaborative indicators can be compared with preset adequacy thresholds. If communication is stable, data is complete, and latency is within acceptable limits, the collaborative system's capabilities are considered adequacy above the threshold. If communication is interrupted, data is missing, latency is too high, or there are serious deviations in the collaborative data, the collaborative system's capabilities are considered adequacy below the threshold.

[0073] Optionally, based on the judgment results of the above two dimensions, the following four logical judgments can be performed to determine the target quadrant.

[0074] Optionally, when the sufficiency of a single vehicle's capabilities is higher than the sufficiency threshold and the sufficiency of the cooperative system's capabilities is higher than the sufficiency threshold, the target quadrant can be determined as the first quadrant (Q1). This indicates that the vehicle's own perception and decision-making capabilities are sufficient, and the vehicle-road-cloud-star cooperative system provides strong compensation and enhancement, which is a "double sufficiency" safety state.

[0075] Optionally, when the sufficiency of a single vehicle's capabilities is higher than the sufficiency threshold and the sufficiency of the collaborative system's capabilities is lower than the sufficiency threshold, the target quadrant can be determined as the second quadrant (Q2). This indicates that the single vehicle has the ability to operate independently and safely, but the collaborative system fails to provide sufficient compensation or enhancement, and may even introduce additional risks due to poor collaborative data quality, which is a state of "sufficient single vehicle capabilities but insufficient collaboration".

[0076] Optionally, when the sufficiency of a single vehicle's capabilities is below the sufficiency threshold while the sufficiency of the collaborative system's capabilities is above the sufficiency threshold, the target quadrant can be determined as the third quadrant (Q3). This means that the capabilities of the single vehicle itself are limited (e.g., sensor failure), but it can maintain safe operation by relying on a powerful collaborative system (e.g., roadside perception, cloud-based high-precision maps) for capability compensation, which belongs to the state of "insufficient single vehicle but sufficient collaboration".

[0077] Optionally, when the sufficiency of a single vehicle's capabilities is below the sufficiency threshold and the sufficiency of the collaborative system's capabilities is also below the sufficiency threshold, the target quadrant can be determined as the fourth quadrant (Q4). This indicates that the single vehicle cannot operate safely independently, and the collaborative system cannot provide effective compensation, placing it in the highest-risk state of "double insufficiency," requiring immediate triggering of defensive degradation.

[0078] In this embodiment, the above steps transform abstract, multi-dimensional system operating states (sensor status, communication quality, positioning accuracy, etc.) into structured, discrete risk level identifiers (i.e., four-quadrant identifiers). By setting clear sufficiency thresholds, an objective and quantifiable standard is established to define the safety boundaries between single-vehicle intelligence and collaborative intelligence at specific times.

[0079] As an optional implementation, a control strategy is generated based on the target quadrant and / or the migration relationship between the source quadrant and the target quadrant, including: in response to the target quadrant being a first quadrant, determining a first control strategy, wherein the first control strategy is a continuous monitoring strategy; in response to the target quadrant being a second quadrant, and / or the migration relationship being a migration from the source quadrant to the second quadrant, determining a second control strategy, wherein the second control strategy is an enhanced control strategy; in response to the target quadrant being a third quadrant, and / or the migration relationship being a migration from the source quadrant to the third quadrant, determining a third control strategy, wherein the third control strategy is a runtime control strategy; and in response to the target quadrant being a fourth quadrant, and / or the migration relationship being a migration from the source quadrant to the fourth quadrant, determining a fourth control strategy, wherein the fourth control strategy is a degradation triggering strategy.

[0080] In this embodiment, a control strategy is generated based on the target quadrant and / or the migration relationship between the source quadrant and the target quadrant, which can ensure that the corresponding control mode can be switched in a timely manner when the quadrant state changes dynamically.

[0081] Optionally, the continuous monitoring strategy can be a continuous monitoring strategy. The enhanced control strategy can be an enhanced management and control strategy. The runtime control strategy can be a runtime management and control strategy.

[0082] Optionally, when the target quadrant is detected as the first quadrant (Q1), regardless of whether the vehicle migrated from another quadrant or its initial state was Q1, the control strategy can be determined as the first control strategy. Q1 represents a dual-sufficient safety state of "sufficient individual vehicle capability" and "sufficient collaborative capability." At this time, there is no need to implement complex enhanced control or degraded measures; instead, a continuous monitoring strategy is implemented. The core of this continuous monitoring strategy is to maintain normal collaborative perception and decision-making processes while sampling and evaluating the operating status in real time to promptly detect abnormal signals that cause quadrant migration (such as communication quality degradation, sensor failure, etc.). Under the continuous monitoring strategy, the linkage control commands (which can be simply referred to as control commands) are mainly manifested as normal driving assistance functions such as conventional data fusion and the execution of the Autonomous Emergency Braking (AEB) system.

[0083] Optionally, when the target quadrant is detected to be the second quadrant (Q2), or when the migration relationship is detected to be from the source quadrant (Q1, Q3, or Q4) to the second quadrant, the control strategy can be determined to be the second control strategy, i.e., the enhanced control strategy. Q2 represents a state where "single-vehicle capability is sufficient" but "cooperative capability is insufficient," indicating a known but unsafe risk. Under the enhanced control strategy, the data layer can adaptively increase the confidence threshold, requiring cooperative data to undergo cross-confirmation from at least two independent sensing sources (e.g., roadside + vehicle-mounted). The decision layer can introduce a decision delay execution mechanism (τ_delay) to wait for the dual-source confirmation results; if a timeout occurs, a decision is made based on single-vehicle data. The communication layer can adaptively shorten the communication timeout limit (T_timeout) to quickly eliminate invalid data.

[0084] Optionally, when the target quadrant is detected to be the third quadrant (Q3), or when the migration relationship is detected to be from the source quadrant (Q1, Q2, or Q4) to the third quadrant, the control strategy can be determined to be the third control strategy, i.e., the operational control strategy. Q3 represents a state of "insufficient single-vehicle capability" but "sufficient collaborative capability," where the vehicle is highly dependent on the collaborative system. Under the operational control strategy, collaborative compensation verification can be performed. For example, during the Q1→Q3 migration, the deviation between the collaborative perception data and the on-board data before the fault can be verified to confirm that the collaborative data can replace the single-vehicle data. Dynamic weight adjustment can be performed, for example, increasing the weight of collaborative perception data in decision-making (e.g., from 0.3 to 0.7) to make it dominant. Stability monitoring can be performed, for example, during the Q2→Q3 or Q4→Q3 migration, the stability of the dual-dimensional switching or the authenticity of collaborative recovery can be monitored to prevent migration oscillations or reliance on false collaborative data.

[0085] Optionally, when the target quadrant is detected to be the fourth quadrant (Q4), or when the migration relationship is detected to be from the source quadrant (Q1, Q2, or Q3) to the fourth quadrant, the control strategy can be determined to be the fourth control strategy, i.e., the degradation trigger strategy. Q4 represents a "double deficiency" dangerous state of "insufficient single-vehicle capability" and "insufficient collaborative capability". Under the degradation trigger strategy, a bypass mechanism can be adopted to bypass the conventional calculation, and the degradation trigger module of Q4 can directly output the degradation trigger signal to the vehicle collaborative safety system. For example, differentiated scope selection can be performed, and the freezing range can be selected according to the migration relationship. If it is from Q1 / Q3 to Q4, scope=all is executed, the collaborative data is frozen in the entire domain, and the vehicle-side independent mode is switched; if it is from Q2 to Q4, scope=partial is executed, and the highly reliable data verified by enhanced control is retained as a reference to accelerate subsequent recovery. The vehicle collaborative safety system can execute the minimum risk strategy according to this signal, such as emergency braking, parking on the side of the road, etc.

[0086] In this embodiment, the above steps establish a closed-loop mapping mechanism from risk status identification to control action execution. By binding the four-quadrant states to specific control strategies, different levels of security risks can be responded to automatically and quickly.

[0087] As an optional embodiment, step S106, based on the control strategy, generates a linkage control command for the vehicle, including: in response to the target quadrant moving from the first quadrant to the second quadrant, determining the rate of change of the vehicle's cooperative safety index; in response to the rate of change being lower than a rate of change threshold, determining the target quadrant moving to the fourth quadrant; and based on the control strategy, generating a first linkage control command, wherein the first linkage control command is used to indicate a preparatory action for performing degradation trend monitoring.

[0088] In this embodiment, the collaborative system not only focuses on the quadrant state at the current moment, but also introduces a dynamic prediction mechanism for the evolution trend of risks. For example, for driving scenarios that migrate from the first quadrant (Q1, fully safe in both aspects) to the second quadrant (Q2, fully safe in one vehicle but insufficient in collaboration).

[0089] Optionally, the rate of change of the collaborative safety index can be monitored and calculated in real time. The collaborative safety index can be the Collaborative Safety Adequacy Index (SI), which is a quantitative value that measures the safety adequacy of the vehicle-road-cloud-star collaborative system. The rate of change (i.e., the rate of change of SI) reflects the speed at which collaborative safety deteriorates. For example, if SI drops rapidly from 0.9 to 0.6, the absolute value of the rate of change is large; if it drops slowly from 0.9 to 0.8, the absolute value of the rate of change is small.

[0090] Optionally, the rate of change threshold can be a negative value, representing the critical rate of SI decline. When the system detects that it is currently in the Q2 quadrant and the calculated SI rate of change is lower than this threshold (i.e., the SI decline is too rapid, and the deterioration trend is severe), it can be determined that this deterioration is not gradual or sporadic, but rather has a tendency to evolve into a more dangerous state. Based on this prediction, it can be determined in advance that the target quadrant will migrate to the fourth quadrant (Q4, double deficiency, danger), even if the current physical state may still be in Q2 or is deteriorating towards Q3. The collaborative system has already identified the risk signal of entering Q4. Then, based on the control strategy, the first linkage control command can be generated. For example, executing the preparatory action for degradation trend monitoring, that is, the Q4 preparatory action or preheating the degradation pipeline.

[0091] In this embodiment, by monitoring the SI change rate and predicting the Q4 migration in advance, some time-consuming operations in Q4 (such as parameter loading and data preprocessing) can be moved to the Q2 stage for execution, compressing the response window when Q4 is triggered, and ensuring that when the actual Q4 moment arrives, the collaborative system can perform degradation actions with zero additional computational latency or a short latency, thereby gaining valuable reaction time in emergency situations.

[0092] As an optional embodiment, step S106, based on the control strategy, generates a linkage control command for the vehicle, including: in response to the target quadrant moving from the third quadrant to the second quadrant, generating a second linkage control command based on the control strategy, wherein the second linkage control command is used to indicate the execution of a verification action to resolve cooperative dependencies.

[0093] In this embodiment, for the specific scenario of migrating from the third quadrant (Q3) to the second quadrant (Q2), a specific second linkage control instruction is generated to perform the verification action of cooperative dependency removal.

[0094] Optionally, when a vehicle is detected migrating from Q3 (insufficient individual vehicle capability but sufficient collaboration, highly dependent on collaborative data) to Q2 (sufficient individual vehicle capability but insufficient collaboration, requiring enhanced control), this means the vehicle has just lost a critical collaborative compensation capability, or the collaborative data channel has been interrupted / its quality has drastically degraded. At this point, the vehicle switches from collaborative-dominated mode back to individual-dominated or high-confidence collaborative-assisted mode. This switch carries significant risks. If collaborative data is directly cut off and complete reliance on onboard sensors is implemented, the perception confidence may be insufficient to support safety decisions, as the onboard sensors may have been in a standby or low-weight state for a long time. Alternatively, if the collaborative data is not completely invalidated but the weight switching is inappropriate, it can lead to abrupt changes in the perception fusion results, thereby triggering abrupt changes in vehicle control commands (e.g., braking, steering), causing passenger discomfort or even accidents. Therefore, the validator performs a collaborative dependency removal verification process at the migration time.

[0095] For example, the risk of collaborative interruption: In Q3, collaborative perception data has a dominant weight in decision-making (e.g., roadside perception weight 0.7, vehicle perception weight 0.3). When the collaborative data channel is interrupted during the migration from Q3 to Q2, if the system directly switches to vehicle-dominated (weight reversal), the decision result may jump due to the sudden change in perception source, resulting in a sudden change in vehicle control commands.

[0096] Optionally, a gradual weight switching mechanism is used: instead of directly reversing the sensing weights at the transition time, the weights are gradually switched over a time interval τ_transition. The sensing weight function is W_collaborative(t) = W_q3 × max(0, 1-t / τ_transition), where W_q3 is the collaborative sensing weight in state Q3 (e.g., 0.7), and τ_transition is the weight switching transition time (e.g., 500ms). The vehicle sensing weight W_vehicle(t) = 1 - W_collaborative(t) gradually increases from 0.3 to 1.0 as t increases.

[0097] Optionally, decision continuity verification: During the τ_transition period, continuously compare the deviation ΔD between the collaborative decision-making result D_collab and the vehicle-independent decision result D_vehicle. If ΔD < ΔD_threshold (e.g., position deviation < 1m, speed deviation < 0.5m / s), confirm that the vehicle-independent decision and the collaborative decision are consistent, and the migration is safe; if ΔD ≥ ΔD_threshold, delay the migration and initiate dual-source verification to investigate the root cause of the deviation.

[0098] In this embodiment, during the Q3→Q2 transition, the vehicle faces a dramatic shift from relying on an external system to relying on its own senses. By generating a second linkage control command that includes progressive weight switching and decision continuity verification, a smooth transition can be achieved: through progressive weight adjustment, abrupt changes in sensory input and control output are avoided, ensuring driving smoothness and thus preventing sudden changes in vehicle control caused by decision jumps when the collaborative data channel is interrupted, ensuring decision continuity during the Q3→Q2 transition.

[0099] As an optional embodiment, step S106, based on the control strategy, generates a linkage control command for the vehicle, including: in response to the target quadrant moving from the fourth quadrant to the second quadrant, generating a third linkage control command based on the control strategy, wherein the third linkage control command is used to indicate the execution of a step-by-step recovery action.

[0100] In this embodiment, for the migration scenario from the fourth quadrant (Q4, double deficiency, most dangerous) to the second quadrant (Q2, single vehicle sufficient but coordination insufficient), a specific third linkage control command is generated to execute the step-by-step recovery action.

[0101] Optionally, when it is determined that the vehicle can recover from state Q4 to state Q2, it means that some of the root causes of Q4 (such as communication link interruption or roadside RSU failure) have been initially resolved, and some cooperative functions have become available. However, since Q4 is a "double-deficient" state, the stability and security of the cooperative system are relatively fragile. If all cooperative functions are restored at this time (e.g., simultaneously restoring positioning enhancement, communication cooperation, cooperative perception, and cooperative decision-making), the recovery impact may occur because the root causes have not been completely eliminated or the cooperative system is unstable, causing the cooperative system to fall back to Q4 or even triggering more serious failures.

[0102] Optionally, the step-by-step recovery action can be a step-by-step recovery gating. Cooperative functions are ordered by dependency into a recovery sequence, and each function must pass Ni consecutive evaluations within an independent verification window before the next function can be recovered.

[0103] Optionally, the sequence F is restored: F = {f1, f2, ..., fm}, where fi is the i-th restored collaborative function, ordered from bottom to top according to dependency. For example, F = {f1 = location enhancement, f2 = communication collaboration, f3 = collaborative perception, f4 = collaborative decision-making} (location is restored first, because location is the foundation of collaborative security; collaborative decision-making is restored last, because decision-making depends on the first three).

[0104] Optionally, Ni represents the number of consecutive assessment passes required to restore the i-th function, determined based on the risk level of function fi. The higher the risk level, the larger Ni becomes. Specifically, N1=20 (positioning enhancement, basic function), N2=30 (communication collaboration), N3=40 (collaborative perception), and N4=50 (collaborative decision-making, highest risk) are only examples and no specific limitations are imposed here.

[0105] Optionally, τ_recover_i is the independent verification window length of the i-th function, satisfying the constraint τ_recover_i ≥ k_i × T_period × Ni, where T_period is the single sufficiency assessment period (e.g., 100ms), and k_i is the safety margin coefficient of function fi, with k_i ≥ 1. k_i increases with the depth of function dependency: basic functions (e.g., positioning) k_i = 1.0, intermediate functions (e.g., communication, sensing) k_i = 1.2, and top-level functions (e.g., collaborative decision-making) k_i = 1.5. τ_recover_1 = 2s, τ_recover_2 = 3.6s, τ_recover_3 = 4.8s, and τ_recover_4 = 7.5s are merely illustrative examples and no specific restrictions are imposed here.

[0106] In this embodiment of the application, the above steps ensure the stability and safety of the collaborative system during the recovery process from the critical state (Q4), avoiding recovery shocks and repeated oscillations.

[0107] As an optional embodiment, step S106, based on the control strategy, generates vehicle linkage control commands, including: in response to the target quadrant moving from the first quadrant to the third quadrant, generating a fifth linkage control command based on the control strategy, wherein the fifth linkage control command is used to represent a verification action of performing collaborative compensation; in response to the target quadrant moving from the second quadrant to the third quadrant, generating a sixth linkage control command based on the control strategy, wherein the sixth linkage control command is used to represent a verification action of performing dual-dimensional switching stability; and in response to the target quadrant moving from the fourth quadrant to the third quadrant, generating a seventh linkage control command based on the control strategy, wherein the seventh linkage control command is used to represent a verification action of collaborative recovery authenticity.

[0108] In this embodiment, for the target quadrant (Q3, insufficient individual vehicle capability but sufficient coordination), specific linkage control commands are generated based on the different migration paths (i.e., source quadrants) of vehicles entering this quadrant to execute targeted verification actions. The core characteristic of the third quadrant is that individual vehicle capabilities are insufficient (e.g., sensor failure, harsh environment), requiring reliance on collaborative systems (roadside perception, cloud commands, etc.) for capability compensation. However, migration from different sources implies different risk backgrounds, thus requiring differentiated verification mechanisms to ensure the safety and effectiveness of collaborative compensation.

[0109] Optionally, in the transition from Q1 to Q3 (transfer of vehicle capability drop), both vehicle capability and collaborative capability are sufficient in state Q1. A sudden drop in vehicle capability occurs (e.g., a sudden malfunction of the onboard camera or sensor failure due to heavy rain), but the collaborative system remains sufficient (roadside perception covers the area). The operational state then migrates from Q1 to Q3. The risk lies in the vehicle abruptly changing from a self-sufficient state to a collaboratively dependent state, where collaborative data, before verification, becomes the primary decision-maker. In this case, generating a fifth linkage control command can execute specific measures to assess collaborative compensation capabilities. For example, comparing the deviation ΔC between the collaborative perception data C_collab and the onboard perception data C_vehicle_history before the malfunction. If ΔC < deviation threshold ΔC_threshold (e.g., position deviation < 1.5m, speed deviation < 0.8m / s), it is confirmed that collaborative data can replace onboard data, and the migration is safe. If ΔC ≥ ΔC_threshold, the migration is delayed, and the collaborative data is marked as pending verification. The dual-source verification process of Q2 enhanced control is then initiated to investigate the deviation. To enhance the collaborative perception weight, for example, at the transition time, the collaborative perception weight is increased from W_q1 in state Q1 (e.g., 0.3) to W_q3 in state Q3 (e.g., 0.7), after which collaborative data dominates the decision-making process.

[0110] Optionally, in the Q2→Q3 (dual-dimensional switching migration) state, individual vehicle capabilities are sufficient but coordination is insufficient in Q2. When individual vehicle capabilities decrease to insufficient and coordination increases to sufficient (both dimensions change simultaneously), the operating state migrates from Q2 to Q3. The risk lies in the simultaneous switching of both dimensions, resulting in poor migration stability. At this time, a sixth linkage control command can be generated to execute specific measures. During the Q2→Q3 migration, it is verified whether the individual vehicle capability downgrade and coordination capability upgrade are synchronized and stable to prevent asynchrony in the dual-dimensional switching from causing a control gap. At this time, the dual-dimensional switching timing constraint is: the time difference Δt_switch between the individual vehicle capability downgrade time (t_vehicle_drop) and the coordination capability upgrade time (t_collab_rise) is Δt_switch = |t_vehicle_drop - t_collab_rise|, with the constraint Δt_switch ≤ Δt_switch_max (e.g., 200ms). If Δt_switch > Δt_switch_max, the dual-dimensional switching is asynchronous, the migration is delayed, and Q2 control is maintained. Two-dimensional verification window: After migration, continuously monitor the stability of single-vehicle capability and collaborative capability within the τ_verify_switch window (e.g., 1 second). If both remain stable (no fluctuations exceeding the threshold), the migration is confirmed; if fluctuations occur in either dimension, revert to Q2.

[0111] Optionally, during the Q4→Q3 (cooperative recovery migration), both individual vehicle capability and cooperative capability are insufficient in state Q4. When cooperative capability recovers from insufficient to sufficient (e.g., roadside RSUs restore communication) but individual vehicle capability remains insufficient, the operating state migrates from Q4 to Q3. The risk is that the recovery of cooperative capability may be temporary (e.g., RSU signal is unstable), and premature reliance on cooperative capability may lead to repeated migrations. At this time, generating a seventh linkage control command can execute specific measures. During the Q4→Q3 migration, verify whether the cooperative capability recovery is real and stable to prevent false migrations caused by temporary recovery of cooperative capability. Cooperative recovery verification window: After the cooperative capability recovery signal appears, continuously monitor the cooperative data quality within the τ_verify_recovery window (e.g., 3s). If the cooperative data quality continuously meets the sufficiency requirement within the window (passes evaluation N_recover times consecutively, N_recover, for example, 30), confirm that the cooperative recovery is real and allow the Q4→Q3 migration; if the cooperative data quality decreases again within the window, maintain state Q4. Gradual collaborative trust building: After migration, the collaborative awareness weight is not immediately increased to the full weight W_q3 (0.7) of Q3 state, but is gradually increased within the τ_trust_build window (e.g., 5s). W_collaborative(t) = W_q3 × min(1, t / τ_trust_build), gradually increasing from 0 to 0.7.

[0112] In the embodiments of this application, precise risk isolation and verification can be implemented for different sources of risk entering the third quadrant (the state dominated by collaborative compensation) to ensure the reliability of collaborative compensation and the smoothness of the transition.

[0113] As an optional embodiment, step S106, based on the control strategy, generates a linkage control command for the vehicle, including: in response to the target quadrant moving from the first quadrant to the fourth quadrant, or from the third quadrant to the fourth quadrant, generating an eighth linkage control command based on the control strategy, wherein the eighth linkage control command is used to indicate the execution of a degradation action of full-domain bypass; in response to the target quadrant moving from the second quadrant to the fourth quadrant, generating a ninth linkage control command based on the control strategy, wherein the ninth linkage control command is used to indicate the execution of a degradation action of progressive bypass.

[0114] In this embodiment, for the migrating driving scenario entering the fourth quadrant (Q4, double deficiency, most dangerous state), two distinctly different degradation trigger commands are generated based on the source quadrant: the eighth linkage control command (full-domain bypass) and the ninth linkage control command (progressive bypass). The core difference between these two linkage control commands lies in the processing strategy for the collaborative data channel (i.e., the selection of the scope field) and the strategy for retaining the reference data after degradation.

[0115] Optionally, Q4 is a scenario of dual deficiencies: insufficient safety capabilities of both the individual vehicle and the collaborative system. The vehicle cannot make autonomous safety decisions, and the collaborative system cannot compensate for the vehicle's capability shortfall. The system is considered to enter Q4 when one of the following conditions is detected during operation: The individual vehicle's capability is reduced to inadequacy (e.g., multiple sources of onboard sensor failure) and the collaborative system is simultaneously reduced to inadequacy (e.g., roadside RSU interruption, communication link anomaly); there is severe conflict in multi-source perception data (deviation > 3σ), and neither the individual vehicle nor the collaborative system data can be confirmed as reliable; or there is a sudden change in positioning accuracy (deviation > 10m within 1 second), and satellite augmentation signals are unavailable.

[0116] Optionally, the core idea of ​​Q4 dynamic risk management is that in a dual-deficiency scenario, if the vehicle cannot operate safely on its own and the collaborative system cannot provide compensation, a degradation trigger signal must be immediately output to the vehicle collaborative safety system, which will then execute the degradation strategy to switch the vehicle to a lower-risk operating mode.

[0117] Optionally, a degrade trigger signal bypass output (Q4 bypass mechanism): Immediately after Q4 detection, a degrade trigger signal is output to the vehicle cooperative safety system, bypassing the conventional calculation pipeline of the sufficiency index (SI). Bypass mechanism: After the Q4 anomaly detection module detects the dual insufficiency conditions, it directly outputs a degrade trigger signal to the vehicle cooperative safety system, without going through the conventional evaluation process of the SI calculation module. Conventional SI calculation requires waiting for multi-source data fusion to complete (50-100ms), while the bypass mechanism can complete detection and signal output within 10ms. Output fields: alert_flag=true, risk_level=high, detection_source=q4_dual_insufficient, scope=all / partial, timestamp. Where detection_source=q4_dual_insufficient indicates that the detection source = Q4 quadrant (insufficient single-vehicle capability and insufficient cooperative capability). timestamp can be used to represent a timestamp. Delay constraint: Output delay <10ms and less than 1 / 5 of the conventional SI calculation cycle, thereby avoiding collaborative decision-making based on tampered data and handing over the decision-making power to the vehicle collaborative safety system to execute the minimum risk strategy (MRM) / degradation.

[0118] Optionally, within the same quadrant Q4, the downgrade triggering strategy may differ depending on the migration source. These are described below according to each migration path.

[0119] Optionally, Q1→Q4 / Q3→Q4 (full-domain bypass trigger) is triggered under the risk background of a sudden emergency event in either the normal state or Q3 state, where the capabilities of both the individual vehicle and the collaborative system are simultaneously and instantly degraded, with no pre-verified data available. The degradation trigger strategy is full-domain bypass triggering, immediately freezing all collaborative data and switching all functions to vehicle-side independent mode. The specific measure is full-domain bypass: the degradation trigger signal's scope field: scope=all, indicating a full-domain freeze. Data freezing mechanism: freezing collaborative data channels (roadside perception, cloud scheduling, satellite positioning enhancement), and switching each function to vehicle-side independent mode. Collaborative data is not retained for reference because it is impossible to determine which data has been contaminated. It can also record all data within the Δt_log window before and after the Q4 trigger time (raw sensor data, communication messages, intermediate SI calculation values). Δt_log can be 30 seconds (15 seconds before + 15 seconds after).

[0120] Optionally, Q2→Q4 (progressive bypass triggering) is triggered when the risk scenario is that the enhanced control state in Q2 is in operation, and the risk further deteriorates to Q4. For example, communication quality in Q2 continues to deteriorate to the point of complete interruption. The degradation triggering strategy is progressive bypass triggering. High-reliability data that has passed enhanced control verification in Q2 is retained as a reference after degradation, and the remaining collaborative data is frozen. A specific measure is progressive bypass: the degradation trigger signal's scope field: scope=partial, indicating progressive freezing. High-reliability data retention mechanism: Collaborative datasets that have passed dual-source verification in Q2 are marked as trusted_during_q2 (C_data≥T_enhanced and dual-source consistency deviation≤consistency threshold D_consistency). This dataset is retained as a reference for vehicle-side decision-making after degradation when Q4 is triggered. Here, C_data≥T_enhanced indicates that the collaborative data reliability (or confidence level) is greater than or equal to the enhanced control threshold. T_enhanced can be used to represent the reliability threshold. The trust period is Δt_trust (which can be 5 seconds), after which it is marked as invalid. The Q2 risk assessment snapshot includes a degradation trigger signal with Snap_q2={SI_q2, T_enhanced_q2, Q_comm_q2}, for subsequent Q4→Q2 recovery, accelerating the recovery process. Recovery path: Recovery can skip post-analysis and directly proceed to Q2→Q1, as Q2 already has some verification foundation (trusted_during_q2 and Snap_q2). Q_comm can be used to represent the communication quality level.

[0121] In this embodiment, vehicle operating status data, the mapping result between the vehicle's driving scenario and the quadrant to which the driving scenario belongs, and the migration path identifier of the vehicle entering the quadrant can be obtained. Since the migration path identifier is used to identify the type of the source quadrant from which the vehicle enters the quadrant and the migration direction, the dynamic process of risk evolution during vehicle operation can be revealed. Subsequently, based on the operating status data, mapping result, and migration path identifier, a set of control rules differentiated according to different historical sources can be generated for the same quadrant; that is, a control strategy is generated. The control strategy can be transformed into specific linkage control commands to drive the execution unit to perform coordinated safety control actions or defensive degradation actions. This overcomes the limitations of static risk classification in related technologies, thereby improving safety, response speed, and control effectiveness in complex dynamic scenarios, solving the technical problem of low vehicle control effectiveness, and achieving the technical effect of improving vehicle control effectiveness.

[0122] The technical solutions of the embodiments of this application will be illustrated below with reference to preferred embodiments.

[0123] Currently, the relevant technologies have the following shortcomings.

[0124] Deficiency 1: The ISO 21448 four-quadrant model lacks a definition of operational control strategies. The ISO 21448 four-quadrant model is an analytical tool used in the design phase to guide how to reduce the Q4 and Q2 areas during design. However, in operation, the cooperative safety risks faced by vehicles are dynamically changing. A scenario may be in Q1 (known safe) at one moment, but may migrate to Q2 (known unsafe) at the next moment due to communication degradation. The existing standard does not define how the system should adjust its control strategies when a scenario dynamically migrates from one quadrant to another, lacking specific safety assurance strategies and measures.

[0125] Deficiency 2: Existing risk grading methods lack a migration control mechanism between quadrants. Current risk grading is statically designed and remains unchanged throughout the entire lifecycle once determined. However, the C-SSF four-quadrant system is dynamic. Scenario Q3, once identified during testing, should migrate to Q1 or Q2, and scenario Q2 should migrate to Q1 after enhanced control measures. Related technologies lack a mechanism to manage this dynamic migration; that is, when to migrate, how to verify migration safety, and how to roll back if migration fails, all of which affect the dynamic operational safety of the vehicle.

[0126] The reason for the above defects is that the vehicle-road-cloud-star system is a brand new and larger system. The original safety measures were designed for the design stage and provided safety protection for the whole vehicle. However, the vehicle-road-cloud-star system involves many external parts such as inter-system coordination and communication, which cannot be met by existing technology.

[0127] To address the aforementioned issues, this application proposes differentiated control strategies for different quadrants and an adaptive weight configuration method based on Operational Design Domain (ODD) parameters, enabling evaluation results to adapt to different operational scenarios. This allows different stakeholders—vehicles, roads, cloud, and satellite—to understand and manage collaborative safety risks within the same framework, facilitating cross-stakeholder communication and responsibility delineation, improving industry operation and maintenance efficiency, and reducing costs. Furthermore, it supports the automation of safety decisions for vehicle-road-cloud-satellite systems, identifying and mitigating the cascading impact of faults or errors in roadside, cloud, communication, and satellite systems on vehicle safety, reducing false alarm and false negative rates for vehicle-road-cloud-satellite related functions, and improving system availability.

[0128] The embodiments of this application will be further described below.

[0129] Figure 2 This is a schematic diagram illustrating the result of a collaborative security risk classification according to an embodiment of this application, such as... Figure 2As shown, a vehicle-road-cloud-star cooperative safety adequacy framework is proposed, which crosses the two dimensions of single-vehicle capability adequacy and cooperative system capability adequacy. Cooperative safety risks are divided into four quadrants according to the two dimensions: Quadrant 201 (vehicle-side safety is sufficient, cooperative safety is sufficient), Quadrant 202 (vehicle-side safety is sufficient but cooperative safety is insufficient), Quadrant 203 (vehicle-side safety is insufficient but cooperative safety is sufficient), and Quadrant 204 (neither vehicle-side nor cooperative safety is sufficient). A cooperative safety adequacy index is defined as a quantifiable safety metric.

[0130] Figure 3 This is a flowchart of a vehicle-road-cloud-star cooperative safety risk classification and control method according to an embodiment of this application, such as... Figure 3 As shown, the method may include the following steps.

[0131] Step S301: Input quadrant mapping results, collaborative security sufficiency index, and migration path information.

[0132] In this embodiment, quadrant mapping results, collaborative security adequacy index, and migration path information can be input.

[0133] Step S302: Perform quadrant discrimination.

[0134] In this embodiment, quadrant discrimination can be performed. If it is Q2, it corresponds to an enhanced control strategy. If it is Q1, it corresponds to a continuous monitoring strategy. If it is Q3, it corresponds to a runtime control strategy. If it is Q4, it corresponds to a degradation trigger strategy.

[0135] Step S303: Determine the migration path.

[0136] In this embodiment, migration path determination can be performed. If the upper quadrant is Q1, degradation trend monitoring is performed. If the upper quadrant is Q3, collaborative dependency de-verification is performed. If the upper quadrant is Q4, step-by-step recovery gating is performed.

[0137] Step S304: Determine the migration path.

[0138] In this embodiment, migration path determination can be performed. If the upper quadrant is Q1, then collaborative compensation verification is performed. If the upper quadrant is Q3, then dual-dimensional switching stability verification is performed. If the upper quadrant is Q4, then collaborative recovery authenticity verification is performed.

[0139] Step S305: Determine the migration path.

[0140] In this embodiment, migration path determination can be performed. If the upper quadrant is Q1 or Q3, then a global bypass is triggered and a degradation is executed. If the upper quadrant is Q4, then a progressive bypass is triggered and a degradation is executed.

[0141] Step S306: Execute the control instruction generation strategy, and synthesize the parameters of each layer of measures into a linkage instruction set.

[0142] In this embodiment, a control instruction generation strategy can be executed, and the parameters of each layer of measures can be combined into a set of linkage instructions.

[0143] In this embodiment, Q2 enhanced control is constructed using a three-layer system: data input, decision sequence, and communication link, with dependencies between layers. If the data layer fails, the decision layer will not execute collaborative decisions; if the communication layer fails, the data layer will be downgraded to independent vehicle-side perception; the communication layer quality level is fed back to the data layer to trigger parameter tightening. The following measures can be implemented.

[0144] Adaptive enhancement measures for credibility threshold.

[0145] Adaptive determination method: The threshold T_enhanced is adaptively determined based on the degree to which the current SI deviates from the safety threshold T_sufficient. The functional relationship is: T_enhanced = T_normal + α × max(0, T_sufficient - SI_current), where α is the sensitivity coefficient (which can be 0.5), and SI_current is the current real-time sufficiency index. The greater the deviation of SI from the safety threshold (the higher the risk), the greater the increase in T_enhanced, and the more stringent the data screening.

[0146] T_normal: The credibility threshold under Q1 state (normal collaborative mode), which allows collaborative data with lower credibility to participate in decision-making, and can be 0.5.

[0147] T_enhanced: The credibility threshold under Q2 state (enhanced control mode), where only high-credibility collaborative data participates in decision-making, and can be 0.7.

[0148] Constraint: T_enhanced≥T_normal+ΔT_min, where ΔT_min is the minimum threshold increment to ensure the improvement of collaborative data quality (which can be 0.2), ensuring that the data screening in state Q2 is more stringent than that in state Q1.

[0149] The physical meaning of ΔT_min: ΔT_min is the minimum difference in data quality requirements between the enhanced control state and the normal state. If T_enhanced-T_normal<ΔT_min, then there is no substantial difference between the enhanced control state and the normal state, and the control meaning is lost.

[0150] Redundant sensing source dynamic verification measures.

[0151] Definition: In Q2 state, collaborative sensing data must be cross-verified by at least two independent sensing sources before it can be used in decision-making.

[0152] Dual-source pairing rules: Roadside perception data must be cross-confirmed with at least one source of onboard sensors (camera / millimeter-wave radar / liDAR); cloud-based dispatch commands must be cross-confirmed with roadside or vehicle status.

[0153] Dual-source consistency deviation threshold D: includes position deviation threshold D_pos and velocity deviation threshold D_vel. Consistency is determined when the dual-source position deviation is ≤ D_pos and the velocity deviation is ≤ D_vel.

[0154] Adaptive adjustment method: D_consistency is dynamically adjusted based on the current scene's perceived confidence P_conf and communication quality level Q_comm: D_consistency = D_baseline × (1 + β × (1 - P_conf) + γ × (1 - Q_comm)), where D_baseline is the baseline deviation (which can be D_pos = 2m, D_vel = 1m / s), β and γ are weighting coefficients (which can be β = 0.3, γ = 0.2), and P_conf and Q_comm are normalized to [0, 1]. The physical meaning of this function is: the lower the perceived confidence or the worse the communication quality, the tighter the dual-source consistency deviation threshold (requiring the dual sources to be closer).

[0155] Decisions to delay implementation measures.

[0156] Definition: In state Q2, the collaborative decision result is not executed immediately. It is delayed for τ_delay time to wait for potential dual-source confirmation. If dual-source confirmation is received within τ_delay, the collaborative decision is executed; otherwise, the decision is made based on the current better data.

[0157] τ_delay calculation: τ_delay=min(τ_max,τ_confirm), where τ_confirm is the actual time taken for dual-source confirmation (the time from decision generation to completion of dual-source confirmation), and τ_max is the upper limit of decision delay.

[0158] The constraint τ_max is: τ_max ≤ TTC - τ_safety_margin, where TTC (Time to Collision) is the collision time calculated based on the current vehicle speed and the distance to the obstacle ahead, and τ_safety_margin is the safety margin (which can be 200ms to ensure sufficient time for collision avoidance after the decision is executed). The physical meaning of this constraint is that the decision delay cannot exceed the collision time minus the safety margin; otherwise, even if the decision is correct, it cannot be executed in time.

[0159] Timeout adaptive shortening measures.

[0160] In the Q2 state, the communication timeout limit T_timeout is adaptively shortened according to the communication link quality and signal-to-noise ratio, and cooperative data for which no acknowledgment is received upon timeout is marked as invalid.

[0161] T_timeout calculation: T_timeout = T_baseline × (Q_comm / Q_threshold), where T_baseline is the baseline timeout in the Q1 state (which may be 200ms), Q_comm is the current communication quality level (normalized to [0,1]), and Q_threshold is the communication quality threshold at the Q1 / Q2 boundary (which may be 0.6). When Q_comm < Q_threshold, the system enters the Q2 state, and T_timeout is shortened accordingly.

[0162] Feedback from the communication layer to the data layer: After T_timeout is shortened, more cooperative data is marked as invalid due to timeout, which is equivalent to an increase in T_enhanced (the available data is reduced → the screening is stricter). Feedback path: Q_comm at the communication layer → SI_data calculation at the data layer → adaptive increase of T_enhanced.

[0163] Figure 4 is a schematic diagram of a hierarchical management and control apparatus according to an embodiment of the present application, as Figure 4 shown, the cooperative security risk hierarchical management and control apparatus based on the four-quadrant model is deployed on the vehicle side, and implements generation and distribution of the management and control policy in the risk hierarchical management and control policy module 401 through a software module. The apparatus receives the quadrant mapping result and migration path information from the C-SSF framework, outputs management and control policy instructions to the three-layer execution linkage module 402 (decision layer management and control 4021, communication layer management and control 4022, and positioning layer management and control 4023), and outputs a degradation trigger signal to the vehicle cooperative safety system 403 in the Q4 scenario.

[0164] The dynamic migration management and control from Q1 to Q2 at an urban intersection is taken as an example below for further description.

[0165] Scenario description: Vehicle A travels to an urban intersection at 40km / h, and the roadside RSU provides cooperative perception. The communication is good in the initial state (Q1), then the communication link quality decreases due to the occlusion of a large bus, and the scenario migrates from Q1 to Q2.

[0166] The management and control process is shown in Table 1 below. Table 1 is a schematic table of a management and control process according to an embodiment of the present application. As shown in Table 1, the management and control policies for different events in different quadrants at different moments and the execution actions are described.

[0167] Table 1 Schematic Table of Management and Control Process

[0168]

[0169] During the Q2 control period (t=3s~t=10s), the system did not interrupt the collaborative function but adopted enhanced control. Compared with directly degrading to single-vehicle mode, the collaborative AEB was still effective (because dual-source confirmation passed), avoiding functional interruption due to temporary communication degradation.

[0170] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0171] According to an embodiment of this application, a vehicle control device is also provided. It should be noted that this vehicle control device can be used to execute the vehicle control method described in the embodiments.

[0172] Figure 5 This is a schematic diagram of a vehicle control device according to an embodiment of this application, such as... Figure 5 As shown, the vehicle control device 500 may include: an acquisition unit 502, a first generation unit 504, a second generation unit 506, and a control unit 508.

[0173] The acquisition unit 502 is used to acquire vehicle operating status data, the mapping result between the vehicle's driving scenario and the quadrant to which the driving scenario belongs, and the migration path identifier of the vehicle entering the quadrant. The migration path identifier is used to identify the type of the source quadrant from which the vehicle enters the quadrant and the migration direction. The first generation unit 504 is used to generate a vehicle control strategy based on the operating status data, mapping result, and migration path identifier. The control strategy represents a set of control rules configured for the same quadrant through different migration sources, and there is an effective control strategy at any given time. The second generation unit 506 is used to generate a linkage control command for the vehicle based on the control strategy. The linkage control command is used to control the vehicle's execution unit to perform collaborative safety control actions or defensive degradation actions. The control unit 508 is used to respond to the linkage control command and control the execution unit to perform collaborative safety control actions or defensive degradation actions based on the risk level of the vehicle currently in the quadrant.

[0174] In this embodiment, the acquisition unit 502 acquires the vehicle's operating status data, the mapping result between the vehicle's driving scenario and the quadrant to which the driving scenario belongs, and the migration path identifier of the vehicle entering the quadrant. The migration path identifier identifies the type of the source quadrant from which the vehicle enters and the migration direction. The first generation unit 504 generates a vehicle control strategy based on the operating status data, mapping result, and migration path identifier. The control strategy represents a set of control rules configured for the same quadrant through different migration sources, and an effective control strategy exists at any given time. The second generation unit 506 generates a vehicle linkage control command based on the control strategy. The linkage control command controls the vehicle's execution unit to perform collaborative safety control actions or defensive degradation actions. The control unit 508 responds to the linkage control command and controls the execution unit to perform collaborative safety control actions or defensive degradation actions based on the current risk level of the vehicle. This solves the technical problem of low vehicle control effectiveness and improves the effectiveness of vehicle control.

[0175] This application also provides an electronic device 60, please refer to... Figure 6 , Figure 6 This is a structural diagram of an electronic device according to an embodiment of the present application, including a processor 610 and a memory 620, wherein the memory 620 is used to store computer programs; the processor 610 is used to execute the programs stored in the memory 620 to implement the methods described in any embodiment of the present application.

[0176] According to another aspect of the embodiments of this application, a processor is also provided. The processor is used to run a program, wherein the program executes the methods of the embodiments of this application during runtime.

[0177] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided. The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device where the computer-readable storage medium is located to perform the method of the embodiments of this application.

[0178] According to another aspect of the embodiments of this application, a vehicle is also provided. The vehicle includes a memory and a processor. The memory stores an executable program; the processor is used to run the program, which, when running, implements the methods described in the embodiments of this application.

[0179] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0180] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0181] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0182] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0183] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0184] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for controlling a vehicle, characterized in that, include: The system acquires the vehicle's operating status data, the mapping result between the vehicle's driving scenario and the quadrant to which the driving scenario belongs, and the migration path identifier of the vehicle entering the quadrant, wherein the migration path identifier is used to identify the type of the source quadrant from which the vehicle enters the quadrant and the migration direction. Based on the operating status data, the mapping result, and the migration path identifier, a control strategy for the vehicle is generated, wherein the control strategy is used to represent a set of control rules configured for the same quadrant through different migration sources, and there is an effective control strategy at any given time; Based on the control strategy, a linkage control command for the vehicle is generated, wherein the linkage control command is used to control the vehicle's execution unit to perform cooperative safety regulation actions or defensive degradation actions. In response to the linkage control command, the execution unit is controlled to perform the coordinated safety control action or the defensive downgrade action based on the current risk level of the vehicle.

2. The method according to claim 1, characterized in that, Based on the operational status data, the mapping result, and the migration path identifier, a control strategy for the vehicle is generated, including: Based on the operational status data and the mapping results, the sufficiency of the vehicle's individual capabilities and the sufficiency of the vehicle's collaborative system capabilities are determined. Based on the sufficiency of the single vehicle's capabilities and the sufficiency of the collaborative system's capabilities, the target quadrant to which the current driving scenario of the vehicle belongs is determined; Based on the target quadrant and the migration path identifier, the source quadrant that enters the target quadrant is determined, wherein the source quadrant is used to represent the historical quadrant before the migration occurs; The control strategy is generated based on the target quadrant and / or the migration relationship between the source quadrant and the target quadrant.

3. The method according to claim 2, characterized in that, Based on the sufficiency of the single vehicle's capabilities and the sufficiency of the collaborative system's capabilities, the target quadrant to which the vehicle's current driving scenario belongs is determined, including: In response to the fact that the sufficiency of the single vehicle's capabilities is higher than the sufficiency threshold, and the sufficiency of the collaborative system's capabilities is higher than the sufficiency threshold, the target quadrant is determined to be the first quadrant; In response to the situation where the sufficiency of the single vehicle's capability is higher than the sufficiency threshold and the sufficiency of the collaborative system's capability is lower than the sufficiency threshold, the target quadrant is determined to be the second quadrant; In response to the fact that the sufficiency of the single vehicle capability is lower than the sufficiency threshold and the sufficiency of the cooperative system capability is higher than the sufficiency threshold, the target quadrant is determined to be the third quadrant; In response to the fact that the sufficiency of the single vehicle capability is lower than the sufficiency threshold, and the sufficiency of the collaborative system capability is lower than the sufficiency threshold, the target quadrant is determined to be the fourth quadrant.

4. The method according to claim 2, characterized in that, Based on the target quadrant, and / or the migration relationship between the source quadrant and the target quadrant, the control strategy is generated, including: In response to the target quadrant being the first quadrant, the control strategy is determined to be a first control strategy, wherein the first control strategy is a continuous monitoring strategy; In response to the target quadrant being the second quadrant, and / or the migration relationship being a migration from the source quadrant to the second quadrant, the control strategy is determined to be a second control strategy, wherein the second control strategy is an enhanced control strategy; In response to the target quadrant being the third quadrant, and / or the migration relationship being a migration from the source quadrant to the third quadrant, the control strategy is determined to be a third control strategy, wherein the third control strategy is a runtime control strategy; In response to the target quadrant being the fourth quadrant, and / or the migration relationship being a migration from the source quadrant to the fourth quadrant, the control strategy is determined to be a fourth control strategy, wherein the fourth control strategy is a degradation triggering strategy.

5. The method according to claim 2, characterized in that, Based on the control strategy, the vehicle's linkage control commands are generated, including: In response to the target quadrant shifting from the first quadrant to the second quadrant, the rate of change of the vehicle's cooperative safety index is determined; In response to the rate of change being lower than a rate of change threshold, the target quadrant is determined to migrate to the fourth quadrant, and a first linkage control instruction is generated based on the control strategy, wherein the first linkage control instruction is used to indicate a preparatory action for performing degradation trend monitoring.

6. The method according to claim 2, characterized in that, Based on the control strategy, the vehicle's linkage control commands are generated, including: In response to the target quadrant moving from the third quadrant to the second quadrant, a second linkage control instruction is generated based on the control strategy, wherein the second linkage control instruction is used to indicate the execution of a verification action to resolve collaborative dependencies.

7. The method according to claim 2, characterized in that, Based on the control strategy, the vehicle's linkage control commands are generated, including: In response to the target quadrant moving from the fourth quadrant to the second quadrant, a third linkage control instruction is generated based on the control strategy, wherein the third linkage control instruction is used to indicate the execution of a step-by-step recovery action.

8. The method according to claim 2, characterized in that, Based on the control strategy, the vehicle's linkage control commands are generated, including: In response to the target quadrant moving from the first quadrant to the third quadrant, a fifth linkage control instruction is generated based on the control strategy, wherein the fifth linkage control instruction is used to indicate the execution of a verification action for collaborative compensation; In response to the target quadrant moving from the second quadrant to the third quadrant, a sixth linkage control instruction is generated based on the control strategy, wherein the sixth linkage control instruction is used to indicate the execution of a verification action for the stability of the two-dimensional switching. In response to the target quadrant moving from the fourth quadrant to the third quadrant, a seventh linkage control command is generated based on the control strategy, wherein the seventh linkage control command is used to represent a verification action for collaborative restoration of authenticity.

9. The method according to claim 2, characterized in that, Based on the control strategy, the vehicle's linkage control commands are generated, including: In response to the target quadrant moving from the first quadrant to the fourth quadrant, or from the third quadrant to the fourth quadrant, an eighth linkage control instruction is generated based on the control strategy, wherein the eighth linkage control instruction is used to indicate the execution of a degradation action of global bypass; In response to the target quadrant shifting from the second quadrant to the fourth quadrant, a ninth linkage control instruction is generated based on the control strategy, wherein the ninth linkage control instruction is used to indicate the execution of a progressive bypass degradation action.

10. A vehicle control device, characterized in that, include: The acquisition unit is used to acquire the vehicle's operating status data, the mapping result between the vehicle's driving scenario and the quadrant to which the driving scenario belongs, and the migration path identifier of the vehicle entering the quadrant, wherein the migration path identifier is used to identify the type of the source quadrant from which the vehicle enters the quadrant and the migration direction. The first generation unit is used to generate the control strategy of the vehicle based on the running status data, the mapping result and the migration path identifier, wherein the control strategy is used to represent a set of control rules configured for the same quadrant through different migration sources, and there is an effective control strategy at any given time; The second generation unit is used to generate linkage control instructions for the vehicle based on the control strategy, wherein the linkage control instructions are used to control the execution unit of the vehicle to perform cooperative safety regulation actions or defensive degradation actions. The control unit is configured to respond to the linkage control command and control the execution unit to perform the coordinated safety control action or the defensive downgrade action based on the current risk level of the vehicle.

Images