Intelligent driving safety control method and device, control device and vehicle

Abstract

The present disclosure provides a kind of intelligent driving safety control method, device, control device and vehicle, it is related to intelligent driving system safety technical field, can improve the safety and reliability of intelligent driving system.The method comprises: obtaining first driving decision, second driving decision, vehicle-mounted system operating state and model monitoring information;According to model monitoring information, vehicle-mounted system operating state and scene deviation degree, the first driving decision and second driving decision are fused, and target driving decision is determined;Control vehicle executes target driving decision.

Description

Technical Field

[0001] This disclosure relates to the field of intelligent driving system safety technology, and in particular to intelligent driving safety control methods, devices, control devices, and vehicles. Background Technology

[0002] With the rapid development of intelligent driving technology, the requirements for the operational safety of vehicle intelligent driving systems are increasing. To cope with complex driving environments and ensure system stability, related technologies generally adopt safety monitoring mechanisms based on preset rules and static thresholds to provide basic safety protection for vehicles.

[0003] However, the static judgment mechanism upon which the relevant technologies rely is often prone to deviations in safety strategy response, making it difficult to effectively ensure the safe operation of vehicles. Summary of the Invention

[0004] This disclosure provides intelligent driving safety control methods, devices, control devices, and vehicles, aiming to improve the safety and reliability of intelligent driving systems.

[0005] In a first aspect, this application provides an intelligent driving safety control method, comprising: acquiring a first driving decision, a second driving decision, an onboard system operating status, and model monitoring information; the first driving decision being generated by a first model based on environmental perception data; the second driving decision being generated by a second model based on preset safety rules; the onboard system operating status characterizing the operation of the vehicle's computing platform, sensors, and communication links; model monitoring information being used to identify inherent risks in the first model; fusing the first driving decision and the second driving decision based on the model monitoring information, the onboard system operating status, and the scene deviation to determine a target driving decision; the scene deviation characterizing the degree to which the environmental perception data exceeds the operating conditions supported by the vehicle's intelligent driving function; and controlling the vehicle to execute the target driving decision.

[0006] The intelligent driving safety control method provided in this application acquires first driving decisions, second driving decisions, onboard system operating status, and model monitoring information, enabling the fusion judgment of driving decisions to simultaneously incorporate four types of criteria: model decision, rule-based decision, system status, and model risk. Furthermore, based on model monitoring information, onboard system operating status, and scene deviation, the first and second driving decisions are fused to determine the target driving decision. This allows model risk, system health, and scene boundaries to jointly participate in the decision-making process, enabling the selection of a safer driving decision in cases of system anomalies, model anomalies, or scene exceeding boundaries. Finally, the vehicle is controlled to execute the target driving decision, improving the safety and reliability of the intelligent driving system.

[0007] In some possible implementations, the first model may also output a confidence level of the first driving decision; the model monitoring information includes at least one of the following: first monitoring information, which characterizes the deviation between the confidence level output by the first model within a sliding time window and the decision adoption rate corresponding to the first driving decision; second monitoring information, which characterizes the magnitude of change in the first driving decision output by the first model when the environmental perception data input to the first model is disturbed; and third monitoring information, which characterizes the physical consistency between the first driving decisions output by the first model in adjacent time frames.

[0008] In some possible implementations, the first monitoring information is obtained by: obtaining the confidence level of the first model output within a sliding time window, and the target driving decision corresponding to each first driving decision within the sliding time window; determining the decision adoption rate of the first driving decision within the sliding time window based on the matching result of each first driving decision and the corresponding target driving decision; and determining the first monitoring information based on the deviation between the average confidence level and the decision adoption rate within the sliding time window.

[0009] In some possible implementations, the second monitoring information is obtained by: applying a disturbance to the environmental perception data input to the first model to obtain disturbance data; inputting the disturbance data into the first model to obtain a disturbance driving decision; and determining the second monitoring information based on the degree of difference between the disturbance driving decision and the first driving decision.

[0010] In some possible implementations, the third monitoring information is obtained by: obtaining the first driving decision output by the first model in adjacent time frames; determining the rate of change of acceleration and / or the rate of change of yaw rate between adjacent time frames based on the first driving decision in adjacent time frames; and determining the third monitoring information based on the rate of change of acceleration and / or the rate of change of yaw rate.

[0011] In some possible implementations, the first driving decision and the second driving decision are fused based on model monitoring information, the operating status of the vehicle system, and the scene deviation to determine the target driving decision. This includes: determining a comprehensive risk value based on model monitoring information, the operating status of the vehicle system, and the scene deviation; and fusion of the first driving decision and the second driving decision based on the comprehensive risk value to determine the target driving decision.

[0012] In some possible implementations, a comprehensive risk value is determined based on model monitoring information, the operating status of the vehicle system, and the scene deviation. This includes: determining the model credibility of the first model based on model monitoring information; determining the degree of anomaly of the vehicle system based on the operating status of the vehicle system; determining the level of scene risk based on the scene deviation; and determining the comprehensive risk value based on model credibility, the degree of anomaly of the vehicle system, and the level of scene risk. The comprehensive risk value is positively correlated with the degree of anomaly of the vehicle system and the level of scene risk, and negatively correlated with model credibility.

[0013] In some possible implementations, the first driving decision and the second driving decision are fused based on the comprehensive risk value to determine the target driving decision, including: determining the risk level corresponding to the current driving scenario based on the comprehensive risk value; if the risk level is level one, determining the first driving decision as the target driving decision; if the risk level is level two, fusing the first driving decision and the second driving decision to obtain the target driving decision; if the risk level is level three, determining the target driving decision based on the minimum risk strategy; wherein, level two is higher than level one, and level three is higher than level two.

[0014] In some possible implementations, the first driving decision and the second driving decision are fused to obtain the target driving decision, including: determining the fusion weight allocation of the first driving decision and the second driving decision based on at least one of model monitoring information, vehicle system operating status and scene deviation; and fusing the first driving decision and the second driving decision according to the fusion weight allocation to obtain the target driving decision.

[0015] In some possible implementations, the minimum risk strategy includes controlling the vehicle to perform at least one of smooth deceleration, pulling over to the side of the road, or issuing a takeover prompt.

[0016] In some possible implementations, the second model generates a second driving decision based on preset safety rules, including: acquiring traffic regulations, vehicle dynamics constraints, and vehicle functional safety supervision rules; matching the current driving scenario according to the priority order of the traffic regulations, vehicle dynamics constraints, and vehicle functional safety supervision rules; and generating a second driving decision based on the matched rules.

[0017] In some possible implementations, the method further includes: after the vehicle executes the target driving decision, acquiring and storing the actual driving state data corresponding to the target driving decision; and, under the condition of satisfying preset optimization conditions, optimizing the first model and / or the second model based on the target driving decision and the actual driving state data to obtain the optimized first model and / or the optimized second model.

[0018] In some possible implementations, the first model and / or the second model are optimized based on the target driving decision and actual driving state data to obtain the optimized first model and / or the optimized second model. This includes: obtaining multiple scene feature vectors from the target driving decision and actual driving state data; clustering the multiple scene feature vectors to obtain clustering results; identifying outlier data points in the clustering results and scene features corresponding to clusters with a sample size less than a set number as potential target scenes; and optimizing the first model and / or the second model based on the potential target scenes to obtain the optimized first model and / or the optimized second model.

[0019] Secondly, this application provides an intelligent driving safety control device, comprising: a data acquisition module, a decision determination module, and a decision execution module. The data acquisition module is used to acquire a first driving decision, a second driving decision, the operating status of the vehicle system, and model monitoring information; the first driving decision is generated by a first model based on environmental perception data; the second driving decision is generated by a second model based on preset safety rules; the operating status of the vehicle system represents the operation of the vehicle's computing platform, sensors, and communication links; the model monitoring information is used to identify the inherent risks of the first model; the decision determination module is used to fuse the first and second driving decisions based on the model monitoring information, the operating status of the vehicle system, and the scene deviation to determine the target driving decision; the scene deviation represents the degree to which the environmental perception data exceeds the operating conditions supported by the vehicle's intelligent driving function; the decision execution module is used to control the vehicle to execute the target driving decision.

[0020] In some possible implementations, the first model may also output a confidence level of the first driving decision; the model monitoring information includes at least one of the following: first monitoring information, which characterizes the deviation between the confidence level output by the first model within a sliding time window and the decision adoption rate corresponding to the first driving decision; second monitoring information, which characterizes the magnitude of change in the first driving decision output by the first model when the environmental perception data input to the first model is disturbed; and third monitoring information, which characterizes the physical consistency between the first driving decisions output by the first model in adjacent time frames.

[0021] In some possible implementations, the first monitoring information is obtained by: obtaining the confidence level of the first model output within a sliding time window, and the target driving decision corresponding to each first driving decision within the sliding time window; determining the decision adoption rate of the first driving decision within the sliding time window based on the matching result of each first driving decision and the corresponding target driving decision; and determining the first monitoring information based on the deviation between the average confidence level and the decision adoption rate within the sliding time window.

[0022] In some possible implementations, the second monitoring information is obtained by: applying a disturbance to the environmental perception data input to the first model to obtain disturbance data; inputting the disturbance data into the first model to obtain a disturbance driving decision; and determining the second monitoring information based on the degree of difference between the disturbance driving decision and the first driving decision.

[0023] In some possible implementations, the third monitoring information is obtained by: obtaining the first driving decision output by the first model in adjacent time frames; determining the rate of change of acceleration and / or the rate of change of yaw rate between adjacent time frames based on the first driving decision in adjacent time frames; and determining the third monitoring information based on the rate of change of acceleration and / or the rate of change of yaw rate.

[0024] In some possible implementations, the decision determination module is specifically used to determine a comprehensive risk value based on model monitoring information, vehicle system operating status, and scenario deviation; and to fuse the first driving decision and the second driving decision based on the comprehensive risk value to determine the target driving decision.

[0025] In some possible implementations, the decision determination module is specifically used to: determine the model credibility of the first model based on model monitoring information; determine the degree of anomaly of the vehicle system based on the operating status of the vehicle system; determine the degree of scenario risk based on scenario deviation; and determine a comprehensive risk value based on model credibility, the degree of anomaly of the vehicle system, and the degree of scenario risk. The comprehensive risk value is positively correlated with the degree of anomaly of the vehicle system and the degree of scenario risk, and negatively correlated with model credibility.

[0026] In some possible implementations, the decision determination module is specifically used to: determine the risk level corresponding to the current driving scenario based on the comprehensive risk value; determine the first driving decision as the target driving decision when the risk level is the first level; merge the first driving decision and the second driving decision to obtain the target driving decision when the risk level is the second level; and determine the target driving decision based on the minimum risk strategy when the risk level is the third level; wherein the second level is higher than the first level, and the third level is higher than the second level.

[0027] In some possible implementations, the decision determination module is specifically used to determine the fusion weight allocation of the first driving decision and the second driving decision based on at least one of model monitoring information, vehicle system operating status and scene deviation; and to fuse the first driving decision and the second driving decision according to the fusion weight allocation to obtain the target driving decision.

[0028] In some possible implementations, the minimum risk strategy includes controlling the vehicle to perform at least one of smooth deceleration, pulling over to the side of the road, or issuing a takeover prompt.

[0029] In some possible implementations, the second model generates a second driving decision based on preset safety rules, including: acquiring traffic regulations, vehicle dynamics constraints, and vehicle functional safety supervision rules; matching the current driving scenario according to the priority order of the traffic regulations, vehicle dynamics constraints, and vehicle functional safety supervision rules; and generating a second driving decision based on the matched rules.

[0030] In some possible implementations, the device further includes a model optimization module, configured to: after the vehicle executes a target driving decision, acquire and store the actual driving state data corresponding to the target driving decision; and, under the condition of satisfying preset optimization conditions, optimize the first model and / or the second model based on the target driving decision and the actual driving state data to obtain the optimized first model and / or the optimized second model.

[0031] In some possible implementations, the model optimization module is specifically used to: obtain multiple scene feature vectors from target driving decision and actual driving state data; cluster the multiple scene feature vectors to obtain clustering results; identify outlier data points in the clustering results and scene features corresponding to clusters with a sample size less than a set number as potential target scenes; and optimize the first model and / or the second model according to the potential target scenes to obtain the optimized first model and / or the optimized second model.

[0032] Thirdly, this application provides a control device, including: a memory and a processor; the memory and the processor are coupled; the memory is used to store a computer program; the processor executes the computer program to implement the intelligent driving safety control method of any of the above embodiments.

[0033] Fourthly, this application provides a computer-readable storage medium storing computer program instructions that, when executed by a processor, implement the intelligent driving safety control method of any of the above embodiments.

[0034] Fifthly, this application provides a computer program product, which includes computer program instructions that, when executed by a processor, implement the intelligent driving safety control method described in any of the above embodiments.

[0035] Sixthly, this application provides a vehicle including the control device of any of the preceding embodiments; or the computer-readable storage medium of any of the preceding embodiments; or the computer program product of any of the preceding embodiments. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in this disclosure, the accompanying drawings used in some embodiments of this disclosure will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings.

[0037] Figure 1 This is a flowchart illustrating an intelligent driving safety control method provided in some embodiments of this disclosure; Figure 2 This is a flowchart illustrating a method for determining a target driving decision, provided in some embodiments of this disclosure. Figure 3 A detailed structural schematic diagram of an intelligent driving safety control method provided in some embodiments of this disclosure; Figure 4 This is a schematic diagram of the structure of an intelligent driving safety control device provided in some embodiments of this disclosure; Figure 5 This is a schematic diagram of the structure of a control device provided in some embodiments of this disclosure. Detailed Implementation

[0038] The technical solutions of this disclosure will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0039] It should be noted that, in this disclosure, the terms "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in this disclosure should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0040] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature.

[0041] In the description of this disclosure, unless otherwise stated, " / " means "or," for example, A / B can mean A or B. "And / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. Furthermore, "at least one" means one or more, and "more than one" means two or more.

[0042] As described in the background section, the safety protection methods in intelligent driving systems mainly fall into the following three categories.

[0043] One type of security protection method is based on fixed rules, anomaly thresholds, or a single monitoring module. This type of method, upon detecting an abnormal state, triggers alarms, degradation, or security takeover processes through preset conditions, providing a certain level of basic security under normal operating conditions. However, as vehicle operating environments become increasingly complex—in open roads, multi-vehicle interactions, complex weather conditions, and edge scenarios—vehicle status, environmental information, and risk factors continuously change. Relying solely on static rules is insufficient to cover all real-world situations, easily leading to problems such as some anomalies not being identified in a timely manner, biased risk assessments, or accidental triggering of security policies.

[0044] One type of security approach treats in-vehicle artificial intelligence (AI) models as independent functional modules. This method trains a deep learning model and deploys it on an in-vehicle computing platform. During vehicle operation, environmental perception data, behavior prediction data, or driving decision data are input into the model, which then outputs environmental perception results, behavior prediction results, or driving decision results, directly used for vehicle control. However, this approach treats the model as an independent functional module, focusing only on the use of the model's output, without continuously verifying the security of the model's training, deployment, and inference processes. For example, during model training, if the training data is contaminated, has label bias, or has an imbalanced sample distribution, the model's output may pose potential risks. During the actual operation of the AI ​​model, it may also be affected by adversarial examples, abnormal sensor data, or input inducements, leading to deviations in recognition results or abnormal control decisions.

[0045] Another type of security protection method is based on fixed processing procedures triggered by risk events. This type of method monitors risk events during vehicle operation and executes fixed processing according to preset alarm, degradation, or takeover procedures after a risk event is triggered. However, as road environments, user driving habits, and vehicle functions continue to change, the original rules and models are prone to gradually deviating from actual operating scenarios, and the overall security capability of the system may lag behind after long-term operation.

[0046] To address the aforementioned technical problems, this disclosure provides an intelligent driving safety control method. The method's approach involves acquiring first driving decisions, second driving decisions, onboard system operating status, and model monitoring information. This allows the fusion judgment of driving decisions to incorporate four types of criteria: model-based decisions, rule-based decisions, system status, and model risk. Furthermore, based on model monitoring information, onboard system operating status, and scene deviation, the first and second driving decisions are fused to determine the target driving decision. This allows model risk, system health, and scene boundaries to jointly participate in the decision-making process, enabling the selection of a safer driving decision in cases of system anomalies, model anomalies, or scene exceeding boundaries. Finally, the vehicle is controlled to execute the target driving decision, improving the safety and reliability of the intelligent driving system.

[0047] The intelligent driving safety control method provided in the embodiments of this disclosure will be described in detail below with reference to the accompanying drawings.

[0048] In this embodiment, the intelligent driving safety control method provided in this application can be applied to vehicles equipped with an intelligent driving computing platform and perception sensors. During vehicle operation, the onboard computing platform inside the vehicle can progressively implement the intelligent driving safety control method provided in this application to fuse first driving decisions, second driving decisions, onboard system operating status, and model monitoring information to determine the target driving decision and control the vehicle to execute it.

[0049] In one possible implementation, the vehicle may be an intelligent connected vehicle, an autonomous vehicle, an assisted driving vehicle, or other types of motor vehicles with onboard computing capabilities and intelligent driving perception conditions. This application does not impose specific restrictions on the specific vehicle model, power type, autonomous driving level, hardware configuration, etc.

[0050] In one possible implementation, the device executing the intelligent driving safety control method can be an on-board computing platform integrated into the vehicle. Examples include an intelligent driving domain controller, a system-on-chip (SoC) based computing platform, or an embedded system based on a graphics processing unit (GPU) or neural processing unit (NPU). This on-board computing platform can communicate with on-board perception devices such as cameras, LiDAR, millimeter-wave radar, and ultrasonic sensors to acquire environmental perception data. The on-board computing platform can also connect with vehicle control modules, communication links, etc., to obtain the operating status of the on-board system and output target driving decisions.

[0051] In some possible examples, the vehicle control module may include at least one of a steering control unit, a braking control unit, and a drive control unit. The vehicle control module may connect to actuators such as electric power steering (EPS), electronic stability program (ESP), and electronic parking brake (EPB) to translate target driving decisions into specific steering, braking, or acceleration commands.

[0052] In some embodiments, the aforementioned in-vehicle computing platform may employ a hardware and software architecture co-designed with a secure kernel and a secure island. The secure kernel monitors the operational status of the in-vehicle computing platform, while the secure island takes over critical vehicle safety functions when the secure kernel detects an anomaly in the main control system.

[0053] For example, the aforementioned security kernel can be used to monitor the operating status of an in-vehicle computing platform, such as monitoring the temperature, voltage, core load rate, and task execution timeout of heterogeneous computing units such as central processing units (CPU), GPUs, and NPUs.

[0054] Optionally, the security kernel can achieve resource isolation based on the virtualization technology of the Type-2 Hypervisor, dividing the computing resources of the in-vehicle computing platform into multiple independent execution partitions, each bound to specific CPU cores, memory regions, and peripheral resources. Among them, critical safety tasks can be assigned to the partition with the highest security level to run, achieving hardware-level isolation from ordinary tasks of the main control system.

[0055] Optionally, the security kernel can also have a built-in hardware watchdog timer to set an independent timeout monitoring period for each execution partition. When a task in a partition fails to complete the heartbeat response within the specified period, the partition is determined to be abnormal and the corresponding fault handling process is triggered.

[0056] For example, the aforementioned safety island can be implemented based on a separate microcontroller unit (MCU), forming a heterogeneous redundancy architecture with the SoC chip in the vehicle computing platform.

[0057] Optionally, the safety island can operate a streamlined fail-safe state machine, which includes three states: normal operation, degraded operation, and fail-safe operation. For example, when the safety kernel detects a serious anomaly in the main control system, the safety island can take over the vehicle's critical safety functions via a hardware interrupt signal, including controlling the EPS system to maintain basic steering capability, performing progressive braking deceleration through the ESP system, and issuing a takeover request to the driver via the instrument panel. The execution cycle of the safety island can be fixed at 1ms to ensure that a safe stop operation can still be completed within 100ms in the event of a complete failure of the main system.

[0058] Optionally, the security island can also achieve physical isolation from the SoC chip in the vehicle computing platform through a hardware-level memory protection unit (MPU), as well as an independent clock source, an independent power supply, and an independent interrupt controller, thereby providing a high-security execution environment for critical security functions such as vehicle status monitoring and secure communication stack.

[0059] Optionally, after detecting the loss of the heartbeat signal of the security kernel, the safety island can directly send safety control commands to actuators such as EPS and ESP through an independent controller area network (CAN) bus.

[0060] This disclosure provides an intelligent driving safety control method, such as Figure 1 As shown, the method includes the following steps S101-S103: S101. Obtain first driving decision, second driving decision, vehicle system operating status and model monitoring information.

[0061] In this embodiment of the application, the first driving decision is generated by the first model based on environmental perception data.

[0062] In some embodiments, the first driving decision may include at least one of the following: road environment perception results obtained by processing environmental perception data by the first model, target recognition results, behavior prediction results, planned trajectory, recommended control instructions, and confidence levels corresponding to each output head.

[0063] In some embodiments, the first model can be an in-vehicle AI intelligent driving model, which can process environmental perception data and output a first driving decision.

[0064] In some embodiments, environmental perception data may include at least one of camera images, lidar point clouds, millimeter-wave radar data, and ultrasonic sensor data.

[0065] In this embodiment, the second driving decision is generated by the second model according to preset safety rules.

[0066] In some embodiments, the second driving decision may include at least one of rule constraint values, safety control instructions, permissible range of actions, and risk warnings.

[0067] In some embodiments, the second model can be a rule-based safety model, which can output a second driving decision through preset safety rules.

[0068] In some embodiments, preset safety rules may include traffic regulations, vehicle dynamics constraints, and vehicle functional safety supervision rules.

[0069] Traffic regulations and rules may include various hard constraints corresponding to road traffic regulations, covering at least one of the following: obeying traffic lights, speed limits, lane keeping, yielding, stopping and yielding, prohibiting U-turns, prohibiting driving against the flow of traffic, and following distance.

[0070] Vehicle dynamics constraint rules may include various safety constraint rules determined based on vehicle physical characteristics and dynamic limits, covering at least one of the following: lateral acceleration, tire slip ratio, longitudinal deceleration, steering wheel angular rate, lateral acceleration, yaw rate, etc.

[0071] Vehicle functional safety supervision rules may include various supervision rules determined based on at least one of the following: sensor performance boundaries, computing platform resource status, actuator response capability, and operating conditions supported by vehicle intelligent driving functions. These rules may cover at least one of the following aspects: sensor confidence, lidar point cloud density, camera overexposure, millimeter-wave radar occlusion, maximum vehicle speed, and minimum following distance.

[0072] For example, the second model can perform rule matching on the current driving scenario according to the priority order of traffic regulations, vehicle dynamics constraints, and vehicle functional safety supervision rules, and generate a second driving decision based on the matched rules.

[0073] It should be noted that the second model can receive information on the operating status of the onboard system and the vehicle status. The vehicle status information can include at least one of the following: vehicle speed, steering angle, yaw rate, steering wheel angle, and braking status. Based on this, the second model can perform rule matching on the current driving scenario layer by layer, according to the highest priority of traffic regulations, followed by vehicle dynamics limits, and finally the lowest priority of expected functional safety supervision. When the triggering condition of a rule is met, the rule outputs the corresponding safety constraint value as the second driving decision.

[0074] The aforementioned safety constraint values ​​can be generated through predefined, interpretable deterministic rules, which can be pre-configured and stored in a rule base by rule engineers or safety engineers based on road traffic regulations, vehicle dynamics calibration data, and expected functional safety analysis results.

[0075] For example, the second model can sequentially match traffic regulations, vehicle dynamics constraints, and vehicle functional safety supervision rules in the current driving scenario. If the speed limit rule in the traffic regulations is matched, the corresponding maximum permissible speed is output as the second driving decision. If the lateral acceleration constraint in the vehicle dynamics constraints is matched, the corresponding lateral acceleration limit is output as the second driving decision. If the sensor confidence constraint in the vehicle functional safety supervision rules is matched, a sensor fusion degradation instruction or a maximum speed limit is output as the second driving decision. If the computational resource utilization rate of the onboard system's operating status indication is too high, the second model can output constraints that restrict some non-critical tasks or reduce the operating frequency of some functions as the second driving decision.

[0076] It should be understood that the output of the above deterministic rules is entirely determined by the input conditions and rule definition, and does not involve the uncertain output of probabilistic reasoning or learning models, thus possessing predictability and verifiability.

[0077] In this embodiment, the vehicle system operating status characterizes the operation of the vehicle computing platform, sensors, and communication links.

[0078] In some embodiments, the operating status of the in-vehicle system may include at least one of the following: temperature, voltage, core load rate, and task execution timeout status of the central processing unit, graphics processing unit, and neural network processor in the vehicle computing platform. It may also include at least one of the following: communication status, data frame integrity, and time synchronization status of cameras, LiDAR, millimeter-wave radar, and ultrasonic sensors; and at least one of the following: bandwidth, latency, packet loss rate, and connection status of the communication link.

[0079] In this embodiment of the application, model monitoring information is used to identify the intrinsic risks of the first model.

[0080] In some embodiments, model monitoring information may include information for identifying a first model intrinsic risk, which may include at least one of model output anomalies, model input anomalies, or model behavior anomalies.

[0081] In one possible implementation, the vehicle computing platform can obtain a first driving decision through the data interface of the first model, obtain a second driving decision through the rule matching interface of the second model, obtain the operating status of the vehicle system through the health monitoring circuit or security kernel in the vehicle computing platform, and obtain model monitoring information through the output monitoring interface of the first model.

[0082] Based on this, when the vehicle is in intelligent driving mode, the on-board computing platform can obtain the first driving decision from the processor running the first model, the second driving decision from the processor running the second model, the sensor communication status from the sensor communication interface, the communication link status from the communication link management circuit, and the model monitoring information from the output monitoring interface of the first model according to a preset cycle.

[0083] For example, after the vehicle is powered on and the intelligent driving function is activated, the on-board computing platform can obtain the first driving decision from the first model and the second driving decision from the second model at a period of 20ms. It can also obtain the temperature, voltage and load rate of the central processing unit, graphics processing unit and neural network processor from the health monitoring circuit of the system-on-a-chip, obtain the communication status of the camera, lidar, millimeter-wave radar and ultrasonic sensor from the sensor communication interface, obtain the communication latency and packet loss rate from the communication link management circuit, and obtain the model monitoring information from the output monitoring interface of the first model. Then, the above information is stored in the shared storage area according to the same timestamp.

[0084] As shown in S101, by acquiring the first driving decision, the second driving decision, the vehicle system operating status, and model monitoring information, subsequent fusion judgments are able to simultaneously possess model decision-making basis, rule-based decision-making basis, system status basis, and model risk basis. Specifically, the first model provides intelligent driving decisions based on environmental perception data, while the second model provides deterministic rule constraints through hierarchical matching of traffic regulations, vehicle dynamics constraints, and vehicle functional safety supervision rules. This avoids relying solely on a single source for decision-making and provides a data foundation for selecting safer driving decisions in situations of system anomalies, model anomalies, or scenario exceeding boundaries.

[0085] S102. Based on the model monitoring information, the vehicle system operating status and the scene deviation, the first driving decision and the second driving decision are fused to determine the target driving decision.

[0086] In the embodiments of this application, scene deviation represents the degree to which the environmental perception data exceeds the operating conditions supported by the vehicle's intelligent driving function.

[0087] In some embodiments, scene deviation may include the degree of deviation between environmental perception data and the operating conditions supported by the vehicle's intelligent driving function in at least one of the following aspects: weather conditions, visibility, road curvature, traffic density, light intensity, sensor confidence combination value, vehicle speed range, road geometry, geofencing, and time conditions.

[0088] In some embodiments, the target driving decision may include at least one of the following: control commands, planned trajectory, permissible range of motion, or safety constraints, ultimately used to control the vehicle’s steering, braking, acceleration, or path adjustment.

[0089] In some embodiments, the on-board computing platform can obtain scene deviation by comparing environmental perception data with preset operating condition boundaries. For example, it can obtain weather, visibility, road curvature, traffic density, light intensity, sensor confidence combination value, vehicle position and time information from cameras, lidar, millimeter-wave radar, ultrasonic sensors, positioning devices and communication links, and compare the above information with the operating conditions supported by the vehicle's intelligent driving function to obtain scene deviation.

[0090] In some embodiments, the in-vehicle computing platform can also perform time alignment and validity verification on the first and second driving decisions, eliminating driving decisions that have exceeded the time limit or are invalid. It then determines the weight allocation used during fusion based on model monitoring information, the operating status of the in-vehicle system, and the scene deviation, and compares the fused target driving decision with preset safety constraints. If the target driving decision does not meet the preset safety constraints, it is corrected or restricted.

[0091] In one possible implementation, the vehicle computing platform can comprehensively determine the first weight corresponding to the first driving decision and the second weight corresponding to the second driving decision based on model monitoring information, vehicle system operating status and scene deviation, and then perform weighted fusion of the first driving decision and the second driving decision according to the first weight and the second weight to obtain the target driving decision.

[0092] The first weight can be positively correlated with the model credibility indicated by the model monitoring information, and the second weight can be positively correlated with the system anomaly degree indicated by the vehicle system operating status and the scene risk degree indicated by the scene deviation degree. The sum of the first weight and the second weight can be 1.

[0093] For example, the onboard computing platform can set the base weight of the first driving decision to 0.7 and the base weight of the second driving decision to 0.3. When model monitoring information indicates that the confidence deviation of the first model output is small, the onboard system operating status indicates that the vehicle computing platform and sensors are normal, and the scene deviation is small, the onboard computing platform can maintain the first weight at 0.7 and the second weight at 0.3. When model monitoring information indicates that the first model has an inherent risk, or the onboard system operating status indicates that the vehicle computing platform is abnormal, or the scene deviation is large, the onboard computing platform can reduce the first weight to 0.3 and increase the second weight to 0.7. Subsequently, the onboard computing platform can perform weighted fusion of at least one of the target longitudinal acceleration, target steering angle, and target planned trajectory in the first driving decision with at least one of the corresponding rule constraint value, safety control command, and allowed action range in the second driving decision, according to the adjusted first and second weights, to obtain the target driving decision.

[0094] As shown in S102, by fusing the first driving decision and the second driving decision based on model monitoring information, vehicle system operating status and scene deviation, the model risk, system health and scene boundary jointly influence the fusion result, avoiding reliance on a single source in the first driving decision or the second driving decision. This results in safer driving decisions in the event of system anomalies, model anomalies or scene out-of-bounds conditions, thereby improving the safety and reliability of the intelligent driving system.

[0095] S103, Control the vehicle to execute target driving decisions.

[0096] In some embodiments, controlling a vehicle to execute a target driving decision may include converting at least one of the target deceleration, target steering angle, target drive torque, target planned trajectory, or safety constraints in the target driving decision into execution instructions for at least one of the steering system, braking system, and drive system, and controlling the vehicle to drive according to the execution instructions.

[0097] In some embodiments, the vehicle computing platform can obtain execution status information after the vehicle has executed the target driving decision through the controller local area network bus, such as at least one of the following: steering angle execution value, braking pressure value, wheel speed or vehicle deceleration, and confirm whether the target driving decision has been executed based on the execution status information.

[0098] In some embodiments, the on-board computing platform can also perform a feasibility check on the target driving decision based on the current state of the vehicle before executing the target driving decision, determine the limit value of the execution command, and monitor the actuator feedback during the execution process. If the actuator feedback is inconsistent with the execution command, the execution command is resent or a takeover prompt is output.

[0099] In one possible implementation, the onboard computing platform can convert at least one of the target deceleration, target steering angle, or target driving torque in the target driving decision into specific actuator commands, and send them to at least one of the electronic stability program system, electronic parking brake system, and electric power steering system via the controller area network bus to control the vehicle to perform steering, braking, or acceleration operations.

[0100] For example, when the target driving decision is to decelerate and avoid an obstacle, the on-board computing platform can calculate the required target deceleration as -3m / s², and send the target deceleration to the electronic stability program system and the electronic parking brake system respectively through the controller local area network bus to control the brake wheel cylinder pressure. At the same time, the desired steering angle value is sent to the electric power steering system to achieve steering avoidance.

[0101] As shown in S103, by controlling the vehicle to execute the target driving decision, the upper-level safety decision can be accurately and in real time implemented at the vehicle dynamics level, so that the vehicle can steer, brake or accelerate according to the target driving decision, thereby improving the safety and reliability of the intelligent driving system.

[0102] In this embodiment, the first model also outputs the confidence level of the first driving decision. Therefore, in step S101 above, the model monitoring information includes at least first monitoring information, second monitoring information, and third monitoring information.

[0103] The first monitoring information represents the deviation between the confidence level output by the first model within the sliding time window and the decision adoption rate corresponding to the first driving decision.

[0104] The second monitoring information characterizes the magnitude of change in the first driving decision output by the first model when the environmental perception data input to the first model is disturbed.

[0105] The third monitoring information characterizes the physical consistency between the first driving decisions output by the first model in adjacent time frames.

[0106] For example, the in-vehicle computing platform can obtain the confidence level of the first model output within a sliding time window, and the target driving decision corresponding to each first driving decision within the sliding time window. Then, based on the matching results of each first driving decision and its corresponding target driving decision, the decision adoption rate of the first driving decision within the sliding time window is determined. Finally, based on the deviation between the average confidence level and the decision adoption rate within the sliding time window, the first monitoring information is determined and obtained.

[0107] The sliding time window refers to a time interval extending backwards from the current moment for a predetermined duration. The decision adoption rate can be understood as the proportion of the first driving decision that matches the corresponding target driving decision within the sliding time window.

[0108] For example, an in-vehicle computing platform can maintain a sliding time window, within which it statistically analyzes the deviation between the confidence distribution of the first model's output and the decision adoption rate of the first driving decision. Specifically, the in-vehicle computing platform can quantify this using expected calibration error, dividing the confidence into K equally wide intervals, and calculating the absolute deviation between the built-in confidence average of each interval and the decision adoption rate within that interval. Then, it can perform a weighted summation based on the proportion of samples in each interval to the total sample size, obtaining a weighted average absolute deviation. The in-vehicle computing platform can then define this weighted average absolute deviation as the first monitoring information.

[0109] It should be noted that when the first monitoring information exceeds the preset threshold, it is determined that the first model has an abnormal confidence calibration, triggering a risk alarm and marking the first driving decision of the current frame as low confidence.

[0110] In some embodiments, the length of the sliding time window can be configured according to the output frequency of the first model and the speed of scene change. For example, when the output frequency of the first model is 10Hz, the length of the sliding time window can be configured to 5 seconds, 10 seconds, or 30 seconds. In situations where the scene changes rapidly, such as when the vehicle is in a congested urban area, the time window can be shortened to 5 seconds. In situations where the scene changes slowly, such as on a highway, the time window can be extended to 30 seconds.

[0111] In some embodiments, the value of K can be preset according to the confidence level distribution range and monitoring accuracy requirements. For example, K can be 10, 15, or 20. When the confidence level distribution is relatively concentrated, K can be 10. When the monitoring accuracy requirement is high, K can be 20.

[0112] In some embodiments, the preset threshold can be calibrated based on vehicle model, operating scenario, and safety level. For example, the preset threshold can be set to 0.05, 0.1, or 0.15. In high-speed autonomous driving scenarios, the preset threshold can be set to 0.05. In urban low-speed assisted driving scenarios, the preset threshold can be set to 0.1 or 0.15.

[0113] It should be understood that the first monitoring information can identify the deviation between the confidence and decision adoption rate of the first model within the sliding time window, thereby discovering the anomaly in the confidence calibration of the first model. This provides a basis for reducing the weight of the first driving decision or increasing the weight of the second driving decision during subsequent fusion, thus improving the reliability of intelligent driving decisions.

[0114] For example, the onboard computing platform can apply a perturbation to the environmental perception data input to the first model to obtain perturbation data, and then input the perturbation data into the first model to obtain a perturbation driving decision. Subsequently, based on the degree of difference between the perturbation driving decision and the first driving decision, second monitoring information is determined and obtained.

[0115] In this context, a disturbance refers to a small change superimposed on the environmental perception data. The degree of difference can be characterized by the deviation distance between the disturbed driving decision and the first driving decision, the difference in control quantity, or the change in decision category.

[0116] For example, an onboard computing platform can use the fast gradient sign method (FGSM) to apply a small perturbation to the environmental perception data input to a first model and observe the magnitude of the change in the first model's output. Specifically, the onboard computing platform can calculate the gradient of the first model with respect to the input data, generate perturbation data along the direction of the gradient sign, input the perturbation data into the first model to obtain a perturbation driving decision, and calculate the degree of difference between the perturbation driving decision and the first driving decision. The onboard computing platform can then determine this degree of difference as a second monitoring information.

[0117] It should be noted that when the second monitoring information exceeds the preset threshold, it is determined that the environmental perception data input to the first model is abnormal, and the vehicle computing platform can refuse to use the first driving decision of the current frame.

[0118] In some embodiments, the perturbation amplitude can be configured according to the type of environmental perception data and the input characteristics of the first model. For example, when the environmental perception data is a camera image, the perturbation amplitude can be set to 1%, 2%, or 5% of the pixel value range. When the environmental perception data is a LiDAR point cloud, the perturbation amplitude can be set to 0.01 meters, 0.05 meters, or 0.1 meters of the point cloud coordinates. When the environmental perception data is millimeter-wave radar data, the perturbation amplitude can be set to 0.1%, 0.5%, or 1% of the distance value. The detection frequency can be the same as the inference frequency of the first model. For example, when the inference frequency of the first model is 10Hz, 20Hz, or 30Hz, the detection frequency can be set to 10Hz, 20Hz, or 30Hz accordingly.

[0119] In some embodiments, the preset threshold can be calibrated based on vehicle model, sensor type, operating scenario, and safety level. For example, the preset threshold can be set to 5%, 10%, or 15% of the degree of difference. In high-speed autonomous driving scenarios, the preset threshold can be set to 5%. In urban low-speed assisted driving scenarios, the preset threshold can be set to 10% or 15%.

[0120] It should be understood that the second monitoring information can identify whether the environmental perception data input to the first model is subject to adversarial attacks or abnormal sensor interference, thereby avoiding abnormal input that could lead to incorrect first driving decisions from the first model and improving the security of input data and the reliability of intelligent driving decisions.

[0121] For example, the onboard computing platform can acquire the first driving decision output by the first model in adjacent time frames. Then, based on the first driving decision in adjacent time frames, it determines the rate of change of acceleration and / or the rate of change of yaw rate between adjacent time frames. Finally, based on the rate of change of acceleration and / or the rate of change of yaw rate, it determines and acquires third monitoring information.

[0122] For example, the onboard computing platform can calculate the changes in physical quantities such as the rate of change of acceleration and the rate of change of yaw rate, which are output by the first model, between adjacent time frames based on the vehicle's kinematics model. The onboard computing platform can then determine this rate of change of acceleration and / or the rate of change of yaw rate as third monitoring information.

[0123] It should be noted that when the third monitoring information exceeds the preset threshold, it is determined that there is a timing anomaly in the output of the first model. The vehicle computing platform can mark the first driving decision of the current frame as abnormal and perform safety arbitration, adopting the second driving decision or executing the least risk strategy.

[0124] In some embodiments, the acceleration rate of change threshold and the yaw rate of change threshold can be calibrated according to vehicle type, load, and road adhesion conditions. For example, the acceleration rate of change threshold can be set to 4 m / s³, 5 m / s³, or 6 m / s³. The yaw rate of change threshold can be set to 1.5 rad / s², 2 rad / s², or 2.5 rad / s². The thresholds can be appropriately lowered under low-adhesion road conditions or fully loaded conditions. The thresholds can be appropriately increased under high-adhesion road conditions or unloaded conditions.

[0125] In some embodiments, the in-vehicle computing platform can also reduce the probability of false judgments by confirming multiple consecutive frames. For example, if the rate of change of acceleration or the rate of change of yaw rate corresponding to the first driving decision exceeds a preset threshold for two, three, or five consecutive frames, it is determined that there is a timing anomaly in the output of the first model.

[0126] It should be understood that, through the third monitoring information, the physical consistency between the first driving decisions output by the first model in adjacent time frames can be identified, avoiding abnormal decisions that do not conform to vehicle kinematic constraints, and improving the physical rationality and operational safety of intelligent driving decisions.

[0127] In this embodiment of the application, in step S102 above, the on-board computing platform can first determine a comprehensive risk value based on model monitoring information, the on-board system operating status, and scene deviation. Then, based on the comprehensive risk value, a target driving decision is determined. For example... Figure 2 As shown, the method includes the following steps S201-S202: S201. Determine the comprehensive risk value based on model monitoring information, vehicle system operating status, and scenario deviation.

[0128] In some embodiments, the comprehensive risk value represents the overall risk level of the current driving scenario. This value can comprehensively consider the inherent risk of the first model, the degree of operational anomalies of the vehicle computing platform, sensors, and communication links, and the extent to which environmental perception data exceeds the operating conditions supported by the vehicle's intelligent driving functions.

[0129] In some embodiments, the vehicle computing platform can normalize the model monitoring information, the vehicle system operating status, and the scene deviation, and determine the comprehensive risk value based on the normalized results.

[0130] For example, the vehicle-mounted computing platform can normalize the first monitoring information, the second monitoring information, and the third monitoring information in the model monitoring information to a preset numerical range, and then weight them according to their respective weights to obtain the model credibility.

[0131] For example, the model confidence level S can be determined according to S = 1 - (w11 × e1 + w12 × e2 + w13 × e3). Here, e1 represents the first degree of deviation after normalization of the first monitoring information, e2 represents the second degree of deviation after normalization of the second monitoring information, and e3 represents the third degree of deviation after normalization of the third monitoring information. w11, w12, and w13 are preset weights, and their sum is 1. For example, w11 can be 0.4, w12 can be 0.3, and w13 can be 0.3.

[0132] It should be noted that in high-speed autonomous driving scenarios, w12 can be increased to 0.4 to better address input risk mitigation. In urban low-speed assisted driving scenarios, w11 can be increased to 0.5 to better address confidence calibration risk. These weights can be pre-calibrated and stored in the onboard computing platform.

[0133] For example, the vehicle computing platform can normalize the temperature, voltage, core load rate, task execution timeout, sensor communication status, data frame integrity, time synchronization status, communication latency and packet loss rate of the vehicle system to a preset value range, and then weight them according to their respective weights to obtain the degree of abnormality of the vehicle system.

[0134] For example, the anomaly level H of the vehicle system can be determined according to H = w21×h1 + w22×h2 + w23×h3 + w24×h4 + w25×h5 + w26×h6 + w27×h7 + w28×h8 + w29×h9. Here, h1 to h9 represent the anomaly level after normalization for temperature, voltage, core load rate, task execution timeout, sensor communication status, data frame integrity, time synchronization status, communication latency, and packet loss rate, respectively. w21 to w29 are preset weights, and their sum is 1. For example, w21 can be 0.1, w22 can be 0.1, w23 can be 0.2, w24 can be 0.2, w25 can be 0.15, w26 can be 0.1, w27 can be 0.05, w28 can be 0.05, and w29 can be 0.05.

[0135] For example, the vehicle computing platform can compare the weather conditions, visibility, road curvature, traffic density, light intensity, sensor confidence combination value, vehicle speed range, road geometry, geofence and time conditions in the scene deviation with the preset operating condition boundary and normalize them to the preset numerical range, and then weight them according to their respective weights to obtain the scene risk level.

[0136] For example, the level of scenario risk g(D) can be determined as g(D) = w31×d1 + w32×d2 + w33×d3 + w34×d4 + w35×d5 + w36×d6 + w37×d7 + w38×d8 + w39×d9 + w310×d10. Here, d1 to d10 represent the deviation from the normalized values ​​of weather conditions, visibility, road curvature, traffic density, light intensity, sensor confidence combination, vehicle speed range, road geometry, geofencing, and time conditions, respectively. w31 to w310 are preset weights and their sum is 1. For example, w31 can be 0.1, w32 can be 0.15, w33 can be 0.15, w34 can be 0.1, w35 can be 0.05, w36 can be 0.15, w37 can be 0.1, w38 can be 0.1, w39 can be 0.05, and w310 can be 0.05.

[0137] It should be noted that the above weights are just examples. The specific values ​​can be pre-calibrated based on the vehicle model, sensor configuration, computing platform capabilities, operating scenarios, and security levels. The sum of all weights can be normalized to 1.

[0138] In one possible implementation, the onboard computing platform can determine the model credibility of the first model based on model monitoring information, determine the degree of anomaly of the onboard system based on the onboard system's operating status, and determine the level of scenario risk based on scenario deviation. Then, a comprehensive risk value is determined based on the model credibility, the degree of anomaly of the onboard system, and the level of scenario risk.

[0139] Among them, the comprehensive risk value is positively correlated with the degree of anomaly of the vehicle system and the degree of risk of the scenario, and negatively correlated with the model credibility.

[0140] For example, one way to represent the overall risk value R is as follows: R = a × g(D) + β × (1-S) + γ × H; Wherein, a, β, and γ are preset weighting coefficients, and in this embodiment, a=0.4, β=0.35, and γ=0.25.

[0141] As shown in S201, by determining the comprehensive risk value based on model monitoring information, vehicle system operating status, and scenario deviation, the three types of risks—model-inherent risk, system operating anomaly, and scenario exceeding operating conditions—can be uniformly quantified into a single value. This provides a unified risk basis for the subsequent fusion of first-drive and second-drive decisions, avoiding reliance on a single risk source for judgment and improving the safety and reliability of the intelligent driving system.

[0142] S202. Based on the comprehensive risk value, the first driving decision and the second driving decision are integrated to determine the target driving decision.

[0143] In some embodiments, the in-vehicle computing platform can obtain a comprehensive risk value through S201, obtain a first driving decision through the data interface of the first model, and obtain a second driving decision through the rule matching interface of the second model. When the vehicle is in intelligent driving mode, the in-vehicle computing platform can obtain the comprehensive risk value, the first driving decision, and the second driving decision according to a preset period, for example, once every 20ms.

[0144] In one possible implementation, the onboard computing platform can determine the risk level corresponding to the current driving scenario based on the comprehensive risk value.

[0145] For example, in the case of a risk level of Level 1, the onboard computing platform can determine the first driving decision as the target driving decision.

[0146] For example, when the comprehensive risk value R is less than the first threshold T1, the vehicle computing platform determines the risk level as the first level. At this time, the intrinsic risk of the first model is low, the vehicle system is operating normally, the scenario deviation is small, and the vehicle computing platform can directly adopt the first driving decision as the target driving decision.

[0147] For example, in the case of a risk level of Level 2, the on-board computing platform can fuse the first driving decision and the second driving decision to obtain the target driving decision.

[0148] For example, the onboard computing platform can determine the fusion weight allocation for the first driving decision and the second driving decision based on at least one of the following: model monitoring information, onboard system operating status, and scene deviation. Then, based on the fusion weight allocation, the first driving decision and the second driving decision are fused to obtain the target driving decision.

[0149] For example, when the comprehensive risk value R is greater than or equal to the first threshold T1 and less than the second threshold T2, the vehicle computing platform determines the risk level to be the second level. At this time, the weight of the second driving decision can be increased. For example, the weight of the first driving decision can be set to 0.3 and the weight of the second driving decision can be set to 0.7. At least one of the target longitudinal acceleration, target steering angle and target planned trajectory in the first driving decision is weighted and fused with at least one of the corresponding rule constraint value, safety control command and allowable action range in the second driving decision to obtain the target driving decision.

[0150] Alternatively, the onboard computing platform can assess the risk levels of the first and second driving decisions based on the rate of change of acceleration and steering angle, the degree of deviation from the vehicle's current motion state, and whether the hard constraint rules in the second model are triggered, respectively. Then, it can compare the risk levels of the first and second driving decisions and select the instruction with lower risk as the target driving decision.

[0151] For example, in the case of a risk level of three, the onboard computing platform can determine the target driving decision based on a minimum risk strategy.

[0152] The minimum risk strategy may include at least one of the following: controlling the vehicle to perform a smooth deceleration, pulling over to the side of the road, or issuing a takeover prompt.

[0153] For example, when the comprehensive risk value R is greater than or equal to the second threshold T2, the on-board computing platform determines the risk level to be the third level, and outputs at least one of the following as the target driving decision: smooth deceleration, pulling over to the side of the road, or taking over the control prompt, based on the minimum risk strategy.

[0154] It should be noted that the first threshold T1 is less than the second threshold T2, and both can be pre-calibrated based on vehicle type, operating scenario, safety level, and historical operating data. For example, in a highway autonomous driving scenario, the first threshold T1 can be set to 0.3, and the second threshold T2 can be set to 0.7. In a city low-speed assisted driving scenario, the first threshold T1 can be set to 0.4, and the second threshold T2 can be set to 0.8.

[0155] In some embodiments, the onboard computing platform may also record the risk level, first driving decision, second driving decision, and target driving decision used in each fusion for subsequent analysis.

[0156] As shown in S202, by fusing the first driving decision and the second driving decision based on the comprehensive risk value to determine the target driving decision, the system can dynamically select to adopt the first driving decision, conservatively fuse the first driving decision and the second driving decision, or execute the minimum risk strategy according to the risk level. This avoids erroneous control caused by a single decision source in abnormal scenarios and improves the safety and reliability of the intelligent driving system.

[0157] In this embodiment, the on-board computing platform can also acquire and store the actual driving state data corresponding to the target driving decision after the vehicle executes the target driving decision. And, under preset optimization conditions, it can optimize the first model and / or the second model based on the target driving decision and the actual driving state data to obtain the optimized first model and / or the optimized second model.

[0158] The preset optimization conditions may include at least one of the following: the amount of stored actual driving status data reaches a preset quantity; the number of times a conflict between the first driving decision and the second driving decision is detected reaches a preset number; the number of times the scene deviation exceeds a preset threshold reaches a preset number; the cumulative driving time of the vehicle reaches a preset time; or the time since the last optimization exceeds a preset time.

[0159] For example, the in-vehicle computing platform can acquire multiple scene feature vectors from target driving decisions and actual driving state data. These scene feature vectors are then clustered to obtain clustering results. Outlier data points in the clustering results, as well as scene features corresponding to clusters with fewer than a set number of samples, are identified as potential target scenes. Finally, the first model and / or the second model are optimized based on the potential target scenes to obtain optimized first and / or optimized second models.

[0160] For example, when optimizing the first model, the in-vehicle computing platform can add scene data corresponding to the potential target scene to the training dataset of the first model, and perform incremental learning or retraining on the first model. For instance, the in-vehicle computing platform can use knowledge distillation to train a teacher model using a large dataset containing potential target scenes, and then use the teacher model to guide a lightweight student model, thereby improving the first model's adaptability to potential target scenes while controlling the complexity of the first model.

[0161] For example, when optimizing the second model, the onboard computing platform can update the rule base of the second model based on potential target scenarios, including adding rules, adjusting rule thresholds, or eliminating redundant rules. For instance, when the potential target scenario is the detection of unidentified obstacle debris on the road, the onboard computing platform can add detour or deceleration rules to the second model. When the potential target scenario is that an existing rule has not been triggered for a long time and is highly consistent with the first driver's decision, the onboard computing platform can archive or delete that rule.

[0162] In some embodiments, the onboard computing platform can also upload target driving decision and actual driving status data to a cloud analysis platform. The cloud analysis platform centrally analyzes the data uploaded by multiple vehicles and distributes the optimized first model and / or optimized second model to the vehicles via over-the-air differential upgrade packages. The vehicles can complete the upgrade and replacement before the next start-up or under safe conditions during driving.

[0163] In some embodiments, the vehicle computing platform can also evaluate the effectiveness of the rules in the second model based on the number of times each rule in the second model is triggered, the proportion of rules adopted by the target driving decision after being triggered, the proportion of risk events that actually occur after being triggered, and the frequency of occurrence of the corresponding scenarios of the rules, and add, modify or eliminate the rules based on the evaluation results.

[0164] For example, the vehicle computing platform can count the number of times each rule in the second model is triggered (Ntrigger) within a preset time window, the proportion of the rule adopted by the target driving decision after being triggered (Padopt), the proportion of risk events that actually occur after being triggered (Prisk), and the frequency of occurrence of the corresponding scenario (Fscene) for each rule.

[0165] The preset time window refers to the time interval used to statistically analyze the performance of the rules. It can be preset according to the amount of data and the speed of change in the scenario, such as the last 7 days, 14 days, or 30 days.

[0166] The preset minimum sample size refers to the minimum number of triggers required to determine whether a rule has statistical evaluation value, such as 30, 50, or 100 times. The validity score of the rule is calculated only when Ntrigger is greater than the preset minimum sample size; otherwise, the data continues to accumulate.

[0167] Based on this, the effectiveness score E can be determined using the formula E = Padopt × (1 + Prisk) / Fscene. When the effectiveness score E is below the lower threshold, the in-vehicle computing platform can determine that the rule may be outdated or redundant, and mark it as a rule to be phased out. When the effectiveness score E is above the upper threshold, the in-vehicle computing platform can determine that the rule contributes significantly to system safety, and mark it as a core rule. When Prisk is above the risk threshold and Padopt is below the low adoption rate threshold, the in-vehicle computing platform can determine that the rule has a vulnerability, meaning that although the rule is triggered, it is not adopted by the target driving decision, resulting in the risk not being effectively handled, and mark it as a rule to be corrected.

[0168] It should be noted that the lower threshold mentioned above refers to the scoring threshold for determining whether a rule is outdated or redundant, and its reference value can be 0.3. The upper threshold refers to the scoring threshold for determining whether a rule is a core rule, and its reference value can be 0.8. The risk threshold refers to the threshold for determining whether the risk correlation of a rule is too high, and its reference value can be 0.2. The low adoption rate threshold refers to the threshold for determining whether a rule is effectively adopted by the target driving decision, and its reference value can be 0.6.

[0169] In this embodiment of the application, by obtaining actual driving state data after executing the target driving decision, and optimizing the first model and / or the second model based on the target driving decision and actual driving state data when the preset optimization conditions are met, the safety capability of the intelligent driving system can be continuously iterated with the accumulation of vehicle operation data, constantly adapting to complex traffic environments and new target scenarios, thereby improving the safety and reliability of the intelligent driving system in long-term operation.

[0170] In summary, see Figure 3 This is a detailed flowchart illustrating an intelligent driving safety control method provided in some embodiments of this disclosure. Figure 3 As shown, the onboard computing platform can acquire the first driving decision and model monitoring information output by the first model, and the second driving decision output by the second model, while simultaneously acquiring the onboard system's operating status. Furthermore, the onboard computing platform can perform decision fusion based on the first driving decision, model monitoring information, second driving decision, and onboard system operating status to determine the target driving decision and perform vehicle control. After vehicle control is executed, the onboard computing platform can acquire actual driving status data through data collection and upload the collected data to the cloud for analysis. The cloud analysis results can be used for model optimization, and the model optimization can be fed back to the first and second models to update subsequent driving decisions.

[0171] The foregoing primarily describes the solutions of the embodiments of this disclosure from a methodological perspective. It is understood that, in order to achieve the aforementioned functions, the intelligent driving safety control device includes at least one of the hardware structures and software modules corresponding to the execution of each function. Those skilled in the art should readily recognize that, in conjunction with the units and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this disclosure can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the embodiments of this disclosure.

[0172] This disclosure embodiment can divide the intelligent driving safety control device into functional modules according to the above method embodiment. For example, each function can be divided into a separate functional module, or two or more functions can be integrated into one functional module. The integrated module can be implemented in hardware or software. It should be noted that the module division in this disclosure embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods. The following description uses the example of dividing each functional module according to each function.

[0173] Figure 4 This is a schematic diagram of the structure of an intelligent driving safety control device provided in an embodiment of this disclosure. This intelligent driving safety control device can be applied to a vehicle and can execute the intelligent driving safety control method provided in the above-described method embodiments. Figure 4 As shown, the intelligent driving safety control device includes: a data acquisition module 401, a decision determination module 402, and a decision execution module 403. The data acquisition module 401 is used to acquire a first driving decision, a second driving decision, the vehicle system operating status, and model monitoring information; the first driving decision is generated by a first model based on environmental perception data; the second driving decision is generated by a second model based on preset safety rules; the vehicle system operating status represents the operation of the vehicle's computing platform, sensors, and communication links; the model monitoring information is used to identify the inherent risks of the first model; the decision determination module 402 is used to fuse the first and second driving decisions based on the model monitoring information, the vehicle system operating status, and the scene deviation to determine the target driving decision; the scene deviation represents the degree to which the environmental perception data exceeds the operating conditions supported by the vehicle's intelligent driving function; the decision execution module 403 is used to control the vehicle to execute the target driving decision.

[0174] In some embodiments, the first model also outputs a confidence level of the first driving decision; the model monitoring information includes at least one of the following: first monitoring information, which characterizes the deviation between the confidence level output by the first model within a sliding time window and the decision adoption rate corresponding to the first driving decision; second monitoring information, which characterizes the magnitude of change in the first driving decision output by the first model when the environmental perception data input to the first model is disturbed; and third monitoring information, which characterizes the physical consistency between the first driving decisions output by the first model in adjacent time frames.

[0175] In some embodiments, the first monitoring information is obtained by: obtaining the confidence level of the first model output within a sliding time window, and the target driving decision corresponding to each first driving decision within the sliding time window; determining the decision adoption rate of the first driving decision within the sliding time window based on the matching result of each first driving decision and the corresponding target driving decision; and determining the first monitoring information based on the deviation between the average confidence level and the decision adoption rate within the sliding time window.

[0176] In some embodiments, the second monitoring information is obtained by: applying a perturbation to the environmental perception data input to the first model to obtain perturbation data; inputting the perturbation data into the first model to obtain a perturbation driving decision; and determining the second monitoring information based on the degree of difference between the perturbation driving decision and the first driving decision.

[0177] In some embodiments, the third monitoring information is obtained by: obtaining the first driving decision output by the first model in adjacent time frames; determining the rate of change of acceleration and / or the rate of change of yaw rate between adjacent time frames based on the first driving decision in adjacent time frames; and determining the third monitoring information based on the rate of change of acceleration and / or the rate of change of yaw rate.

[0178] In some embodiments, the decision determination module 402 is specifically used to determine a comprehensive risk value based on model monitoring information, vehicle system operating status, and scene deviation; and to fuse the first driving decision and the second driving decision based on the comprehensive risk value to determine the target driving decision.

[0179] In some embodiments, the decision determination module 402 is specifically used to: determine the model credibility of the first model based on model monitoring information; determine the degree of anomaly of the vehicle system based on the operating status of the vehicle system; determine the degree of scenario risk based on scenario deviation; and determine a comprehensive risk value based on model credibility, the degree of anomaly of the vehicle system, and the degree of scenario risk; wherein the comprehensive risk value is positively correlated with the degree of anomaly of the vehicle system and the degree of scenario risk, and negatively correlated with model credibility.

[0180] In some embodiments, the decision determination module 402 is specifically used to: determine the risk level corresponding to the current driving scenario based on the comprehensive risk value; determine the first driving decision as the target driving decision when the risk level is the first level; fuse the first driving decision and the second driving decision to obtain the target driving decision when the risk level is the second level; and determine the target driving decision based on the minimum risk strategy when the risk level is the third level; wherein the second level is higher than the first level, and the third level is higher than the second level.

[0181] In some embodiments, the decision determination module 402 is specifically used to determine the fusion weight allocation of the first driving decision and the second driving decision based on at least one of model monitoring information, vehicle system operating status and scene deviation; and to fuse the first driving decision and the second driving decision according to the fusion weight allocation to obtain the target driving decision.

[0182] In some embodiments, the minimum risk strategy includes controlling the vehicle to perform at least one of smooth deceleration, pulling over to the side of the road, or issuing a takeover prompt.

[0183] In some embodiments, the second model generates a second driving decision based on preset safety rules, including: acquiring traffic regulations, vehicle dynamics constraints, and vehicle functional safety supervision rules; performing rule matching on the current driving scenario according to the priority order of the traffic regulations, vehicle dynamics constraints, and vehicle functional safety supervision rules; and generating a second driving decision based on the matched rules.

[0184] In some embodiments, the apparatus further includes a model optimization module, configured to: after the vehicle executes a target driving decision, acquire and store the actual driving state data corresponding to the target driving decision; and optimize the first model and / or the second model based on the target driving decision and the actual driving state data, under the condition of satisfying preset optimization conditions, to obtain the optimized first model and / or the optimized second model.

[0185] In some embodiments, the model optimization module is specifically used to: obtain multiple scene feature vectors from target driving decision and actual driving state data; cluster the multiple scene feature vectors to obtain clustering results; identify outlier data points in the clustering results and scene features corresponding to clusters with a sample size less than a set number as potential target scenes; and optimize the first model and / or the second model according to the potential target scenes to obtain the optimized first model and / or the optimized second model.

[0186] In implementing the above-described intelligent driving safety control method in hardware, this disclosure provides a possible structure for the control device involved in the above embodiments. For example... Figure 5As shown, the control device 500 includes a processor 502 and a bus 504. Optionally, the control device 500 may also include a memory 501; alternatively, the control device 500 may also include a communication interface 503.

[0187] Processor 502 may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with embodiments of this disclosure. Processor 502 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with embodiments of this disclosure. Processor 502 may also be a combination that implements computing functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0188] Communication interface 503 is used to connect to other devices via a communication network. This communication network can be Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0189] The memory 501 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0190] In one possible implementation, the memory 501 can exist independently of the processor 502. The memory 501 can be connected to the processor 502 via a bus 504 and is used to store instructions or program code. When the processor 502 calls and executes the instructions or program code stored in the memory 501, it can implement the intelligent driving safety control method provided in this embodiment. In another possible implementation, the memory 501 can also be integrated with the processor 502.

[0191] Bus 504 can be an extended industry standard architecture (EISA) bus, etc. Bus 504 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 5 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0192] Some embodiments of this disclosure provide a computer-readable storage medium (e.g., a non-transitory computer-readable storage medium) storing computer program instructions that, when executed on a computer, cause the computer to perform the intelligent driving safety control method as described in any of the above embodiments.

[0193] Exemplary examples of computer-readable storage media may include, but are not limited to: magnetic storage devices (e.g., hard disks, floppy disks, or magnetic tapes), optical discs (e.g., compact disks (CDs), digital versatile disks (DVDs), etc.), smart cards, and flash memory devices (e.g., erasable programmable read-only memory (EPROMs), cards, sticks, or key drives, etc.). The various computer-readable storage media described in this disclosure may represent one or more devices and / or other machine-readable storage media for storing information. The term "machine-readable storage medium" may include, but is not limited to, wireless channels and various other media capable of storing, containing, and / or carrying instructions and / or data.

[0194] This disclosure provides a computer program product containing instructions that, when run on a computer, cause the computer to execute the intelligent driving safety control method in any of the above embodiments.

[0195] This disclosure provides a vehicle including the control device of any of the preceding embodiments; or the computer-readable storage medium of any of the preceding embodiments; or the computer program product of any of the preceding embodiments.

[0196] The vehicle provided in this application may be a passenger vehicle or a freight vehicle, and may also be an electric vehicle or a hybrid vehicle. This application does not limit the specific purpose or power type of the vehicle, and the choice can be made according to actual needs.

[0197] The above description is merely a specific embodiment of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any changes or substitutions within the technical scope disclosed in this disclosure should be included within the scope of protection of this disclosure. Therefore, the scope of protection of this disclosure should be determined by the scope of the claims.

Claims

1. An intelligent driving safety control method, characterized in that, The method includes: The system acquires a first driving decision, a second driving decision, the operating status of the vehicle system, and model monitoring information. The first driving decision is generated by a first model based on environmental perception data. The second driving decision is generated by a second model based on preset safety rules. The operating status of the vehicle system represents the operation of the vehicle's computing platform, sensors, and communication links. The model monitoring information is used to identify inherent risks in the first model. Based on the model monitoring information, the vehicle system operating status, and the scene deviation, the first driving decision and the second driving decision are fused to determine the target driving decision; the scene deviation represents the degree to which the environmental perception data exceeds the operating conditions supported by the vehicle's intelligent driving function. Control the vehicle to execute the target driving decision.

2. The method according to claim 1, characterized in that, The first model will also output the confidence level of the first driving decision; the model monitoring information includes at least one of the following: The first monitoring information represents the deviation between the confidence level output by the first model within the sliding time window and the decision adoption rate corresponding to the first driving decision. The second monitoring information represents the magnitude of change in the first driving decision output by the first model when the environmental perception data input to the first model is disturbed. The third monitoring information characterizes the physical consistency between the first driving decisions output by the first model in adjacent time frames.

3. The method according to claim 2, characterized in that, The first monitoring information was obtained through the following methods: Obtain the confidence level of the first model output within the sliding time window, and the target driving decision corresponding to each first driving decision within the sliding time window; Based on the matching results between each first driving decision and the corresponding target driving decision, the decision adoption rate of the first driving decision within the sliding time window is determined; The first monitoring information is determined based on the deviation between the average confidence level within the sliding time window and the decision adoption rate.

4. The method according to claim 2, characterized in that, The second monitoring information was obtained through the following methods: Perturbation is applied to the environmental perception data input to the first model to obtain perturbation data; The disturbance data is input into the first model to obtain a disturbance driving decision. The second monitoring information is determined based on the degree of difference between the disturbed driving decision and the first driving decision.

5. The method according to claim 2, characterized in that, The third monitoring information is obtained through the following methods: Obtain the first driving decision output by the first model in adjacent time frames; Based on the first driving decision of the adjacent time frames, determine the rate of change of acceleration and / or the rate of change of yaw rate between the adjacent time frames; The third monitoring information is determined based on the rate of change of acceleration and / or the rate of change of yaw rate.

6. The method according to any one of claims 1-5, characterized in that, The step of fusing the first driving decision and the second driving decision based on the model monitoring information, the vehicle system operating status, and the scene deviation to determine the target driving decision includes: The comprehensive risk value is determined based on the model monitoring information, the vehicle system operating status, and the scene deviation. Based on the comprehensive risk value, the first driving decision and the second driving decision are fused to determine the target driving decision.

7. The method according to claim 6, characterized in that, The determination of the comprehensive risk value based on the model monitoring information, the vehicle system operating status, and the scene deviation includes: Based on the model monitoring information, the model credibility of the first model is determined; The degree of abnormality of the vehicle system is determined based on its operating status. The level of scenario risk is determined based on the degree of scenario deviation. A comprehensive risk value is determined based on the model's credibility, the anomaly level of the in-vehicle system, and the risk level of the scenario. The comprehensive risk value is positively correlated with the degree of anomaly of the vehicle system and the degree of risk of the scenario, and negatively correlated with the credibility of the model.

8. The method according to claim 6, characterized in that, The step of fusing the first driving decision and the second driving decision based on the comprehensive risk value to determine the target driving decision includes: Based on the comprehensive risk value, the risk level corresponding to the current driving scenario is determined; If the risk level is Level 1, the first driving decision is determined as the target driving decision; When the risk level is level two, the first driving decision and the second driving decision are fused to obtain the target driving decision. When the risk level is level three, the target driving decision is determined based on the minimum risk strategy; The second level is higher than the first level, and the third level is higher than the second level.

9. The method according to claim 8, characterized in that, The process of fusing the first driving decision and the second driving decision to obtain the target driving decision includes: The fusion weight allocation of the first driving decision and the second driving decision is determined based on at least one of the model monitoring information, the vehicle system operating status, and the scene deviation. Based on the fusion weight allocation, the first driving decision and the second driving decision are fused to obtain the target driving decision.

10. The method according to claim 8, characterized in that, The minimum risk strategy includes controlling the vehicle to perform at least one of the following: smooth deceleration, pulling over to the side of the road, or issuing a takeover prompt.

11. The method according to any one of claims 1-5, characterized in that, The second model generates a second driving decision based on preset safety rules, including: Obtain traffic regulations and rules, vehicle dynamics constraints, and vehicle functional safety supervision rules; According to the priority order of the traffic regulations, vehicle dynamics constraints, and vehicle functional safety supervision rules, rule matching is performed on the current driving scenario; The second driving decision is generated based on the matched rules.

12. The method according to any one of claims 1-5, characterized in that, The method further includes: After the vehicle executes the target driving decision, the actual driving status data corresponding to the target driving decision is acquired and stored; Under the condition of meeting the preset optimization, the first model and / or the second model are optimized according to the target driving decision and the actual driving state data to obtain the optimized first model and / or the optimized second model.

13. The method according to claim 12, characterized in that, The step of optimizing the first model and / or the second model based on the target driving decision and the actual driving state data to obtain the optimized first model and / or the optimized second model includes: Multiple scene feature vectors are obtained from the target driving decision and the actual driving state data; Cluster the multiple scene feature vectors to obtain the clustering results; Outlier data points in the clustering results and scene features corresponding to clusters with fewer than a set number of samples are identified as potential target scenes. Optimize the first model and / or the second model based on the potential target scenario to obtain the optimized first model and / or the optimized second model.

14. An intelligent driving safety control device, characterized in that, The device includes: The data acquisition module is used to acquire first driving decisions, second driving decisions, vehicle system operating status, and model monitoring information; the first driving decision is generated by the first model based on environmental perception data; the second driving decision is generated by the second model based on preset safety rules; the vehicle system operating status represents the operating status of the vehicle computing platform, sensors, and communication links; the model monitoring information is used to identify the inherent risks of the first model. The decision determination module is used to fuse the first driving decision and the second driving decision based on the model monitoring information, the vehicle system operating status, and the scene deviation, to determine the target driving decision; the scene deviation represents the degree to which the environmental perception data exceeds the operating conditions supported by the vehicle's intelligent driving function. The decision execution module is used to control the vehicle to execute the target driving decision.

15. A control device, characterized in that, The control device includes: a memory and a processor; the memory and the processor are coupled; the memory is used to store instructions executable by the processor; when the processor executes the instructions, it performs the intelligent driving safety control method as described in any one of claims 1-13.

16. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed on a processor, cause the processor to perform the intelligent driving safety control method as described in any one of claims 1-13.

17. A computer program product, characterized in that, It includes a computer program; when the computer program is executed, it is able to implement the intelligent driving safety control method as described in any one of claims 1-13.

18. A vehicle, characterized in that, It includes the control device as claimed in claim 15; or the computer-readable storage medium as claimed in claim 16; or the computer program product as claimed in claim 17.

Images