An autonomous driving redundancy device and vehicle

Abstract

The utility model discloses an automatic driving redundancy device and vehicle, and belongs to the field of automobile electronic technology, and specifically relates to an automatic driving redundancy device and vehicle. The utility model discloses a redundancy framework of double domain module and double image acquisition module is provided, and when the main domain is abnormal, the second image acquisition module data acquisition is directly taken over by the auxiliary domain, avoids the perception link interruption caused by the main domain failure in the traditional scheme, has the advantage that when the main domain module is abnormal, the continuous transmission of the perception data is ensured, the system switching delay is reduced, and the safety of automatic driving is improved.

Description

Technical Field

[0001] This utility model relates to the field of automotive electronics technology, specifically to an autonomous driving redundancy device and vehicle. Background Technology

[0002] In the current field of autonomous driving technology, an architecture design scheme in which the main domain and the secondary domain work together is often adopted to improve system redundancy and safety. However, in some current solutions, the main domain and the secondary domain often share a single sensor system. This design places extremely high demands on the timeliness and stability of sensor switching, making practical implementation quite difficult. Specifically, apart from radar sensors, which can be connected to both the main domain and the secondary domain simultaneously, other cameras are usually only directly connected to the main domain controller. Once the main domain fails, its computing link fails, and the secondary domain must quickly take over the processing and operation of all camera data. This system switching process requires extremely high real-time performance and reliability; otherwise, the secondary domain will be unable to perform Level 3 autonomous driving functions normally, resulting in loss of environmental perception capabilities, failure of dynamic driving tasks, and even jeopardizing the realization of safe parking functions due to image data transmission delays or interruptions.

[0003] Therefore, the existing architecture has obvious technical bottlenecks in domain controller failover, and there is an urgent need for a more robust low-latency redundancy awareness solution to ensure driving safety. Utility Model Content

[0004] In view of the above problems, this utility model provides an autonomous driving redundancy device and vehicle, which solves the problem that in the prior art, the secondary domain cannot perform L3 level autonomous driving functions normally, resulting in loss of environmental perception ability, failure of dynamic driving task execution, and even endangering the realization of safe parking function due to delay or interruption of image data transmission.

[0005] In a first aspect, this utility model provides an autonomous driving redundancy device, comprising at least:

[0006] At least one first image acquisition module;

[0007] At least one second image acquisition module;

[0008] The first domain module is connected to the first image acquisition module;

[0009] And a second domain module, which is connected to the second image acquisition module and the first domain module, and the second domain module is used to transmit the data acquired by the second image acquisition module to the first domain module;

[0010] When the first domain module is functioning normally, it acquires data through the first image acquisition module and the second image acquisition module; when the first domain module is malfunctioning, the second domain module acquires data through the second image acquisition module.

[0011] In some optional implementations, the first domain module is provided with a first controller, a first connector and a second connector, and the second domain module is provided with a second controller, a third connector and a fourth connector;

[0012] The first connector and the second connector are both connected to the first controller, and the first connector is connected to the first image acquisition module; the second controller is connected to the third connector, the third connector is connected to the second image acquisition module, and the third connector is also connected to the second connector through the fourth connector.

[0013] In some alternative implementations, the first connector, the second connector, the third connector, and the fourth connector are all LVDS connectors.

[0014] In some optional implementations, the first image acquisition module includes one or more of a forward-looking telephoto camera, a forward-looking wide-angle camera, a rear-view camera, a side-view camera, an in-cabin camera, and a surround-view camera, and the second image acquisition module includes one or more of a forward-looking telephoto camera, a forward-looking wide-angle camera, a rear-view camera, a side-view camera, an in-cabin camera, and a surround-view camera.

[0015] In some alternative implementations, a first radar acquisition module is also included, which is connected to the first domain module and / or the second domain module.

[0016] In some alternative implementations, the first radar acquisition module is connected to the first controller of the first domain module and / or the second controller of the second domain module via CAN-FD.

[0017] In some optional implementations, the first domain module is further provided with a first Ethernet gateway, and the first radar acquisition module is also connected to the first controller through the Ethernet gateway.

[0018] In some alternative implementations, the second domain module is further provided with a second Ethernet gateway, and the first radar acquisition module is also connected to the second controller through the second Ethernet gateway.

[0019] In some alternative implementations, the first radar acquisition module includes one or more of lidar, angular millimeter-wave radar, front millimeter-wave radar, and rear millimeter-wave radar.

[0020] Secondly, this utility model provides a vehicle equipped with the aforementioned automatic driving redundancy device. When the first domain module is functioning normally, the vehicle connects to the first image acquisition module and the second image acquisition module through the first domain module to collect data. When the first domain module is malfunctioning, the vehicle connects to the second image acquisition module through the second domain module to collect data.

[0021] Compared to existing technologies, the advantages of this invention are as follows: The autonomous driving redundancy device of this invention connects to the first image acquisition module via a first domain module; a second domain module connects to both the second image acquisition module and the first domain module, and the second domain module transmits data acquired by the second image acquisition module to the first domain module. When the first domain module is functioning normally, it acquires data through both the first and second image acquisition modules; when the first domain module malfunctions, the second domain module acquires data through the second image acquisition module. This invention, by setting up a redundant architecture with dual domain modules and dual image acquisition modules, allows the secondary domain to directly take over data acquisition from the second image acquisition module when the primary domain malfunctions, avoiding the interruption of the perception link caused by primary domain failure in traditional solutions. This provides advantages such as ensuring continuous transmission of perception data when the primary domain module malfunctions, reducing system switching latency, and improving the safety of autonomous driving.

[0022] The above description is merely an overview of the technical solutions of the present utility model embodiments. In order to better understand the technical means of the present utility model embodiments and to implement them in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the present utility model embodiments more obvious and understandable, specific embodiments of the present utility model are described below. Attached Figure Description

[0023] The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0024] Figure 1 This invention provides a schematic diagram of the structure of an automated driving redundancy device according to Embodiment 1.

[0025] Figure 2 A schematic diagram of the structure of the autonomous driving redundancy device provided in Embodiment 2 of this utility model is shown;

[0026] Figure 3 This invention provides a schematic diagram of the data acquisition range of the first domain module in Embodiment 3.

[0027] Figure 4 A schematic diagram of the data acquisition range of the second domain module provided in Embodiment 3 of this utility model is shown.

[0028] Figure label:

[0029] 100, First domain module; 110, First controller; 120, First connector; 130, Second connector; 140, First Ethernet gateway;

[0030] 200, Second Domain Module; 210, Second Controller; 220, Third Connector; 230, Fourth Connector;

[0031] 300. First image acquisition module;

[0032] 400. Second image acquisition module;

[0033] 500. First radar acquisition module. Detailed Implementation

[0034] Exemplary embodiments of the present invention will now be described in more detail with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention may be implemented in various forms and should not be limited to the embodiments set forth herein.

[0035] In existing technologies, the connection path of a typical camera is divided into a control path and a data path. Normally, the control path involves the DCU1 configuring the camera (such as resolution, frame rate, and exposure) via its I2C controller and generating an FSYNC (frame synchronization) signal via its GPIO. The data path includes the camera's MIPI data stream being directly input to the domain controller for processing. Due to the specific nature of the camera's connection path, current camera MIPI data streams are all single-channel.

[0036] Example 1:

[0037] Figure 1 This illustration shows an embodiment of an autonomous driving redundancy device according to the present invention. This embodiment includes at least one first image acquisition module 300, at least one second image acquisition module 400, a first domain module 100 connected to the first image acquisition module 300, and a second domain module 200 connected to both the second image acquisition module 400 and the first domain module 100. The second domain module 200 is used to transmit data acquired by the second image acquisition module 400 to the first domain module 100. When the first domain module 100 is functioning normally, it acquires data through the first image acquisition module 300 and the second image acquisition module 400; when the first domain module 100 malfunctions, the second domain module 200 acquires data through the second image acquisition module 400.

[0038] In this embodiment, the first image acquisition module 300 and the second image acquisition module 400 refer to independently deployed sensor groups, which can be implemented using one or more combinations of a front-view telephoto camera, a front-view wide-angle camera, a rear-view camera, and a side-view camera, respectively, to provide raw image data to the first domain module 100 and the second domain module 200. The first domain module 100 and the second domain module 200 refer to controller units with data processing capabilities, which can be implemented through embedded hardware integrating a processor and a communication interface. The second domain module 200 establishes a data channel with the first domain module 100 through a physical link to ensure data synchronization between the two domains when the primary domain is normal.

[0039] Specifically, when the first domain module 100 is operating normally, it acquires data through the directly connected first image acquisition module 300 and simultaneously receives data from the second image acquisition module 400 through the second domain module 200, forming dual-channel data input to enhance sensing redundancy. When the first domain module 100 malfunctions, the second domain module 200 immediately disconnects the data transmission link with the first domain module 100 and directly processes the independent data from the second image acquisition module 400, avoiding an interruption of the overall sensing link due to a primary domain failure. During this process, the second image acquisition module 400 maintains a direct connection with the second domain module 200, completing data acquisition and processing without going through the primary domain, thereby shortening the fault switching response time.

[0040] Compared with existing technologies, this invention addresses the issue that existing solutions rely on the primary domain controller as the sole data processing node, requiring secondary domains to re-establish sensor connections after the primary domain fails, resulting in switching delays. This invention, by configuring independent sensors and direct connection channels for secondary domains, enables them to synchronously acquire sensor data when the primary domain is functioning normally. In the event of a primary domain failure, there is no need to re-initialize sensor connections; the system directly switches to its own data processing link, significantly reducing the complexity and time consumption of system switching.

[0041] Through the above technical solution, this invention can ensure that the secondary domain controller immediately takes over the environmental perception task when the primary domain controller fails, through pre-set independent sensors and direct data transmission paths. This avoids delays caused by image transmission link reconstruction and maintains the continuity of autonomous driving functions. Simultaneously, the dual-domain module shares two sets of sensor data during normal operation of the primary domain, further enhancing the redundancy and fault tolerance of the perception system.

[0042] Example 2:

[0043] Based on Example 1, Figure 2This illustration shows an embodiment of an autonomous driving redundancy device according to the present invention, which further defines the autonomous driving redundancy device. Specifically, the first domain module 100 is provided with a first controller 110, a first connector 120, and a second connector 130; the second domain module 200 is provided with a second controller 210, a third connector 220, and a fourth connector 230; the first connector 120 and the second connector 130 are both connected to the first controller 110, and the first connector 120 is connected to the first image acquisition module 300; the second controller 210 is connected to the third connector 220, the third connector 220 is connected to the second image acquisition module 400, and the third connector 220 is also connected to the second connector 130 through the fourth connector 230.

[0044] In this embodiment, the first controller 110 refers to the computing unit for processing data from the first image acquisition module 300, and can be implemented using an embedded processor or an automotive-grade chip. Its function is to independently control the sensor signals received by the first connector 120. The second controller 210 refers to the computing unit for processing data from the second image acquisition module 400, and can be implemented using the same or a different computing chip as the first controller 110. Its function is to establish a data processing link independent of the first controller 110. The first connector 120 refers to the physical interface for transmitting data from the first image acquisition module 300, and can be implemented using an LVDS connector. Its function is to ensure low latency and high bandwidth characteristics for image data transmission. The second connector 130 refers to the data interaction interface between the first domain module 100 and the second domain module 200, and can be implemented using an LVDS connector. Its function is to achieve redundant signal transmission between the main domain and the secondary domain. The third connector 220 refers to the direct connection interface between the second domain module 200 and the second image acquisition module 400, and the fourth connector 230 refers to the cross-domain connection interface between the second domain module 200 and the first domain module 100. Both of them use LVDS connectors, and their function is to build a backup data transmission channel independent of the main domain controller.

[0045] Specifically, the first domain module 100 receives raw data from the first image acquisition module 300 through the first connector 120 and transmits processed data to the second domain module 200 through the second connector 130. When the first controller 110 is working normally, the third connector 220 of the second domain module 200 continuously receives data from the second image acquisition module 400, and simultaneously forwards the data to the second connector 130 through the fourth connector 230 for fusion processing by the first controller 110. When the first controller 110 fails, the second controller 210 immediately takes over the data from the second image acquisition module 400 received by the third connector 220, and maintains data transmission continuity through the physical link between the fourth connector 230 and the second connector 130, avoiding sensor signal interruption due to main domain failure.

[0046] Compared with existing technologies, in traditional solutions, the main domain controller connects to the camera through only a single interface, and the secondary domain controller needs to re-establish sensor connections after the main domain fails, resulting in a switching delay. This solution establishes two connectors in the first domain module 100 and two independent connectors in the second domain module 200, forming a dual physical link between the main and secondary domains. This allows the secondary domain controller to immediately acquire sensor data through the preset cross-domain connectors when taking over, without needing to re-initialize the communication protocol.

[0047] Through the above technical solution, this utility model realizes physical layer signal redundancy between the main domain and the secondary domain controllers. In the event of a main domain failure, sensor data is directly transmitted through a pre-established cross-domain connector, eliminating the time loss of re-establishing the communication link when the secondary domain takes over in the traditional solution, and ensuring that the autonomous driving system can continue to acquire environmental perception data during the domain controller switching process.

[0048] In some alternative embodiments, the present invention proposes that the first connector 120, the second connector 130, the third connector 220 and the fourth connector 230 are all LVDS connectors.

[0049] The LVDS connector refers to a physical interface component based on low-voltage differential signaling technology. Specifically, it can be implemented using a connector conforming to the IEEE 1596.3 standard, which features strong electromagnetic interference resistance, high transmission rate, and low power consumption. This connector establishes a stable and reliable high-speed data transmission channel between the domain controller and the image acquisition module, ensuring that the secondary domain can fully receive and process image data in the event of a primary domain failure.

[0050] Specifically, LVDS connectors are deployed as key transmission nodes between the first domain module 100 and the first image acquisition module 300, between the first domain module 100 and the second domain module 200, and between the second domain module 200 and the second image acquisition module 400. When the primary domain fails, the second domain module 200 continuously receives the data stream from the second image acquisition module 400 through the third connector 220, and simultaneously transmits the data completely to the second domain controller through the LVDS link between the fourth connector 230 and the second connector 130. The low-voltage differential characteristics of the LVDS interface effectively suppress signal attenuation and noise interference during long-distance transmission, ensuring the integrity of real-time transmission of high-resolution image data.

[0051] Compared with existing technologies, traditional solutions often use parallel interfaces or ordinary serial interfaces to connect the camera and controller. These interfaces are susceptible to electromagnetic interference and consume a lot of power during high-speed data transmission. LVDS technology, through a differential signal transmission mechanism, reduces the voltage swing to one-tenth that of traditional interfaces at the same transmission rate, thus reducing both the risk of signal crosstalk and system power consumption.

[0052] Through the above technical solution, this utility model effectively solves the technical defects of image data transmission link interruption or delay when the primary domain controller fails. The high-speed, low-noise transmission channel constructed by the LVDS connector ensures that the secondary domain controller can continuously acquire complete perception data during takeover, providing a hardware foundation for the autonomous driving system to maintain environmental perception capabilities and dynamic driving task execution capabilities.

[0053] In some optional embodiments, the present invention proposes an autonomous driving redundancy device, wherein the first image acquisition module 300 includes any one or more of a forward-looking telephoto camera, a forward-looking wide-angle camera, a rear-view camera, a side-view camera, an in-cabin camera, and a surround-view camera, and the second image acquisition module 400 includes any one or more of a forward-looking telephoto camera, a forward-looking wide-angle camera, a rear-view camera, a side-view camera, an in-cabin camera, and a surround-view camera.

[0054] Among them, the front-view telephoto camera refers to an imaging device with a narrow field of view and high resolution. Specifically, it can be implemented using an optical lens with a focal length range of 25mm to 150mm in conjunction with a CMOS image sensor, used to capture detailed features of distant targets in front of the vehicle. The front-view wide-angle camera refers to an imaging device with a field of view greater than 120 degrees. Specifically, it can be implemented using a fisheye lens with a focal length range of 2mm to 8mm in conjunction with a global shutter sensor, used for real-time monitoring of a large area directly in front of the vehicle. The rear-view camera refers to an imaging device installed at the rear of the vehicle. Specifically, it can be implemented using a wide dynamic range sensor with night vision capabilities, used for reversing assistance and rear obstacle recognition. The side-view camera refers to an imaging device installed at the side mirrors or fenders of the vehicle. Specifically, it can be implemented using a compact camera module with a waterproof structure, used for blind spot monitoring and lane change assistance. The cockpit-facing camera refers to an imaging device facing the driver's cabin. Specifically, it can be implemented using a close-focus lens module with infrared illumination capabilities, used for driver status monitoring. Surround-view cameras refer to wide-angle imaging devices distributed around a vehicle. Specifically, they can be implemented using four 190-degree fisheye cameras in conjunction with image stitching algorithms to generate a 360-degree panoramic view of the vehicle's surroundings.

[0055] Specifically, when the first domain module 100 is functioning normally, the forward-looking telephoto camera and the forward-looking wide-angle camera can work collaboratively. For example, the telephoto camera is responsible for identifying traffic signs 200 meters away, while the wide-angle camera simultaneously monitors pedestrian crossing behavior nearby. The rear-view camera and the side-view camera can form complementary observations. For example, during a lane change, the side-view camera continuously monitors adjacent lanes, while the rear-view camera tracks the dynamics of vehicles approaching from behind. The bird's-eye view generated by the surround-view camera group and the driver's facial data collected by the in-cabin camera can be fused through the first domain module 100. When the first domain module 100 malfunctions, the second domain module 200 can immediately take over the designated camera in the second image acquisition module 400. For example, in nighttime scenarios, the second domain module 200 can prioritize activating the rear-view camera with night vision capabilities while simultaneously utilizing low-light imaging data from the side-view camera to maintain basic environmental perception capabilities.

[0056] Compared to existing technologies, traditional solutions are limited by the deployment of a single type of camera, which can easily lead to blind spots during domain controller switching. This new solution, however, utilizes a combination of multiple camera types, allowing each camera to complement the others in terms of spatial coverage, functional characteristics, and environmental adaptability. For example, in rainy or foggy weather, the forward-looking telephoto camera can switch to a near-field monitoring mode similar to a surround-view camera; in bright light, the forward-looking wide-angle camera can utilize the polarization filtering function of the in-cabin camera. This multi-dimensional sensor configuration strategy effectively avoids the switching failure risk caused by the single function of cameras in traditional architectures.

[0057] Through the above technical solution, this invention can intelligently select the optimal camera combination based on real-time environmental conditions in the event of a main domain controller failure, ensuring the continuity of critical perception data. For example, in a highway scenario, the second domain module 200 can automatically activate the onboard telephoto camera to maintain lane line recognition, while simultaneously calling the side-view camera to monitor the positions of adjacent vehicles, preventing the degraded autonomous driving function due to a main domain failure. This redundant configuration based on multimodal vision sensors significantly improves the system's fault tolerance under complex operating conditions.

[0058] In some alternative embodiments, the present invention proposes that the autonomous driving redundancy device further includes a first radar acquisition module 500, which is connected to a first domain module 100 and / or a second domain module 200.

[0059] In this embodiment, the first radar acquisition module 500 refers to a sensor component used to acquire radar data of the vehicle's surrounding environment. Specifically, it can be implemented by one or more combinations of lidar, angular millimeter-wave radar, front millimeter-wave radar, or rear millimeter-wave radar. Through the coordinated work of different radar types, it can cover the needs of multi-directional environmental perception.

[0060] The first domain module 100 and the second domain module 200 refer to control units that are respectively equipped with data processing capabilities. The first domain module 100 may include a first controller 110 and a matching interface, and the second domain module 200 may include a second controller 210 and a matching interface. The two interact with each other through a communication link.

[0061] The connection relationship refers to the data transmission path between the first radar acquisition module 500 and the domain module. Specifically, it can be implemented through CAN-FD bus or Ethernet communication protocol. For example, the first radar acquisition module 500 can simultaneously establish independent communication channels with the first controller 110 of the first domain module 100 and the second controller 210 of the second domain module 200, or selectively connect to one of the domain modules.

[0062] Specifically, when the first domain module 100 is operating normally, the environmental data collected by the first radar acquisition module 500 can be directly transmitted to the first controller 110 of the first domain module 100 for processing via the CAN-FD bus. Simultaneously, the data can be forwarded to the second controller 210 of the second domain module 200 via an Ethernet gateway for backup or collaborative computation. If the first domain module 100 malfunctions, the second controller 210 of the second domain module 200 can directly receive data from the first radar acquisition module 500 via a pre-established communication link. For example, low-latency switching can be achieved through an independent CAN-FD channel or Ethernet interface, ensuring continuous input of radar data to the effectively operating control unit. In this process, the redundant connection design between the first radar acquisition module 500 and the dual-domain module avoids data interruption caused by the failure of a single communication path, while a multi-protocol transmission mechanism ensures compatibility with bandwidth and real-time requirements in different scenarios.

[0063] Compared with existing technologies, this invention addresses the limitation that while existing solutions allow radar sensors to simultaneously access both the primary and secondary domains, their connection methods are typically restricted to a single communication protocol or fixed path, necessitating complex route reconstruction during data switching. This solution, however, supports dual-protocol transmission of CAN-FD and Ethernet, along with flexible connection configurations between modules, enabling seamless switching of radar data between different domain controllers while reducing the latency risks introduced by protocol conversion or path switching.

[0064] Through the above technical solution, this invention solves the problem of radar data transmission path interruption or switching delay caused by primary domain failure in existing autonomous driving systems. It ensures that the secondary domain can immediately take over radar data processing tasks and maintain the continuity of environmental perception functions when the primary domain fails. Furthermore, the multi-protocol redundant communication design further reduces the risk of single-point failure in the data transmission link, thereby improving the reliability and safety of the autonomous driving system under complex operating conditions.

[0065] In some alternative embodiments, the present invention proposes that the first radar acquisition module 500 be connected to the first controller 110 of the first domain module 100 and / or the second controller 210 of the second domain module 200 via CAN-FD.

[0066] In this embodiment, CAN-FD refers to the Controller Area Network Flexible Data Rate protocol, which can be implemented using a physical layer interface and data link layer protocol conforming to the ISO 11898-2 standard, offering higher transmission rates and greater data load capacity. The first radar acquisition module 500 refers to a sensor component used to acquire information about the vehicle's surrounding environment, specifically using lidar, millimeter-wave radar, or a combination thereof, to generate point cloud data or target detection signals. The first controller 110 and the second controller 210 refer to computing units integrated into the main domain and sub-domain, respectively, specifically using multi-core processors or microcontroller units, to process sensor data and execute autonomous driving algorithms.

[0067] Specifically, under normal operating conditions, the first radar acquisition module 500 transmits the acquired raw data in parallel to the first controller 110 and the second controller 210 via the CAN-FD channel, enabling the primary and secondary domains to acquire radar information synchronously. When the primary domain experiences an anomaly, the second controller 210 continuously receives radar data via an independent CAN-FD link, preventing data transmission interruption due to primary domain failure. This architecture ensures continuous availability of radar data during domain controller switching through a dual-channel redundancy design, while leveraging the high bandwidth of the CAN-FD protocol to reduce data transmission latency.

[0068] Compared with existing technologies, in traditional solutions, the radar module is typically connected to the main domain only through a single CAN bus, and the secondary domain relies on the main domain to forward data, resulting in transmission delays and reliability risks during handover. This solution eliminates the intermediate forwarding link by directly establishing an independent CAN-FD connection between the radar module and the dual-domain controller, enabling the secondary domain to immediately acquire real-time radar data upon takeover.

[0069] Through the above technical solution, this utility model effectively solves the problem of real-time and reliability of radar data transmission during domain controller switching, ensuring that the autonomous driving system can still maintain stable environmental perception capabilities in fault switching scenarios, thereby ensuring the continuous execution of vehicle safety control functions.

[0070] In some alternative embodiments, the present invention proposes that the first domain module 100 is further provided with a first Ethernet gateway 140, and the first radar acquisition module 500 is further connected to the first controller 110 through the Ethernet gateway.

[0071] In this embodiment, the first Ethernet gateway 140 refers to a hardware module used to convert data between different network protocols. Specifically, it can be implemented using a circuit board with an integrated Ethernet control chip. Its function is to transmit data from the radar acquisition module to the first controller 110 via the high-speed Ethernet protocol, thereby improving data transmission rate and reliability. The Ethernet gateway connection refers to a physical communication link established based on the Ethernet protocol. Specifically, it can be implemented using an RJ45 interface or a fiber optic interface. Its function is to ensure the real-time performance and integrity of radar data through a high-bandwidth, low-latency transmission channel.

[0072] Specifically, the first Ethernet gateway 140 is integrated into the first domain module 100 and forms a data path with the first controller 110. The first radar acquisition module 500 connects to the first controller 110 via a CAN-FD bus and also establishes a redundant communication link through the Ethernet gateway. When the main domain module is operating normally, radar data can be transmitted in parallel via both CAN-FD and Ethernet channels. If CAN-FD experiences communication abnormalities due to interference or hardware failure, the Ethernet gateway can still maintain the transmission of radar data to the first controller 110, thereby reducing reliance on a single communication method.

[0073] Compared with existing technologies, in existing solutions, the radar acquisition module is typically connected to the domain controller only via a CAN-FD bus. A bus failure will result in a complete data interruption. This solution, by adding an Ethernet gateway, forms a dual communication channel. Even when the primary domain module malfunctions, data transmission can still be maintained through the Ethernet gateway, avoiding loss of sensing capabilities due to communication link failure.

[0074] Through the above technical solution, this utility model realizes the redundant transmission capability of radar data in the abnormal state of the main domain module, effectively reducing the risk of perception failure caused by communication interruption. At the same time, it supports the synchronous transmission of multiple types of radar data through the high bandwidth characteristics of the Ethernet protocol, ensuring the continuity of the autonomous driving function during the domain controller switching process.

[0075] In some alternative implementations, the present invention proposes that the second domain module 200 is further provided with a second Ethernet gateway, and the first radar acquisition module 500 is further connected to the second controller 210 through the second Ethernet gateway.

[0076] In this embodiment, the second Ethernet gateway refers to the interface module used to enable high-speed communication between the second domain module 200 and the first radar acquisition module 500. Specifically, it can be implemented using an Ethernet switching chip that supports high-bandwidth data transmission, thereby improving the transmission efficiency and anti-interference capability of radar data. The second controller 210 refers to the core computing unit in the second domain module 200 responsible for processing sensor data. Specifically, it can be implemented using an automotive-grade chip with an integrated multi-core processor, used to analyze the raw data sent by the radar acquisition module in real time and generate environmental perception information.

[0077] Specifically, when the first radar acquisition module 500 establishes a connection with the second controller 210 through the second Ethernet gateway, the second domain module 200 can directly receive raw point cloud data collected by devices such as lidar and millimeter-wave radar. During the operation of the autonomous driving system, if the main domain module malfunctions, the second domain module 200 can continuously acquire radar data through an independent second Ethernet gateway link, avoiding data transmission interruption caused by the failure of the main domain module. Furthermore, after preprocessing the received radar data, the second controller 210 can fuse it with the visual data from the second image acquisition module 400 to form redundant perception signals to support autonomous driving decisions.

[0078] Compared with existing technologies, traditional solutions transmit radar data to the main domain controller only through a single CAN-FD bus, resulting in bandwidth limitations and latency fluctuations. This invention addresses these issues by adding a second Ethernet gateway to the second domain module 200, enabling radar data to be transmitted simultaneously to both the main and secondary domain controllers with low latency and high reliability, maintaining the integrity of the sensing data during domain controller switching.

[0079] Through the above technical solution, this utility model effectively solves the risk of radar data transmission link interruption when the main domain controller fails, ensures that the secondary domain controller can continuously acquire high-precision radar data, provides stable environmental perception capability for the autonomous driving system, and ensures the reliable execution of the safe parking function.

[0080] In some alternative embodiments, the present invention proposes that the first radar acquisition module 500 includes one or more of lidar, angular millimeter-wave radar, front millimeter-wave radar, and rear millimeter-wave radar.

[0081] In this embodiment, lidar refers to a sensor that detects the three-dimensional spatial information of a target by emitting a laser beam. It can be implemented using a solid-state or mechanically rotating structure and is used to generate high-precision point cloud data for three-dimensional environmental modeling. Corner millimeter-wave radar refers to millimeter-wave radar deployed at the four corners of the vehicle, specifically using 77GHz frequency-modulated continuous wave technology, used to monitor the relative speed and distance of targets in lateral and rear blind spots. Front millimeter-wave radar refers to millimeter-wave radar installed at the front of the vehicle, specifically using a long-range detection mode, used to detect moving objects within a 150-meter range ahead. Rear millimeter-wave radar refers to millimeter-wave radar installed at the rear of the vehicle, specifically using a short-range wide-angle detection mode, used to monitor obstacles in the rear lane-changing area.

[0082] Specifically, the first radar acquisition module 500 uses a combination of multiple types of sensors to form a multi-dimensional detection coverage around the vehicle. When the main domain controller is working normally, the lidar and the front millimeter-wave radar work together to analyze the road structure ahead, while the corner millimeter-wave radar and the rear millimeter-wave radar monitor lateral and rear dynamics respectively. When the main domain controller fails, the secondary domain controller continuously receives raw data from the corner millimeter-wave radar and the rear millimeter-wave radar through an Ethernet gateway or CAN-FD bus to maintain basic environmental perception capabilities.

[0083] In some specific implementations, the lidar can be a 128-line scanning device to improve point cloud density, the front millimeter-wave radar can be configured with a maximum detection range of 250 meters, the angular millimeter-wave radar can be a short-range model with a horizontal field of view of 150 degrees, and the rear millimeter-wave radar can integrate an automatic pitch angle adjustment function to adapt to different loading conditions.

[0084] Compared with existing technologies, traditional solutions often employ a single type of radar or fixed azimuth deployment, which can easily lead to perception blind spots during domain controller switching. This solution, through heterogeneous combination and omnidirectional layout of multiple types of radar, ensures high-precision perception when the main domain is functioning normally, and maintains basic safety functions by retaining lateral and rear radar data when the main domain fails, thus avoiding system crashes caused by the lack of a single sensor type or azimuth.

[0085] Through the above technical solution, this utility model can still maintain the continuous acquisition of key radar data during the domain controller switching process, ensuring that the vehicle maintains basic safety functions such as side obstacle warning and rear collision warning in emergency situations, and effectively reducing the risk of complete failure of environmental perception due to main domain failure.

[0086] Example 3:

[0087] In some alternative embodiments, the present invention proposes a vehicle equipped with an autonomous driving redundancy device as described in Embodiment 1 or Embodiment 2, wherein when the first domain module 100 is normal, the vehicle connects to the first image acquisition module 300 and the second image acquisition module 400 through the first domain module 100 to collect data; when the first domain module 100 is abnormal, the vehicle connects to the second image acquisition module 400 through the second domain module 200 to collect data.

[0088] In this embodiment, the autonomous driving redundancy device refers to a hardware architecture that independently connects different image acquisition modules through dual-domain modules. Specifically, it can be implemented by separately deploying a main domain controller and a secondary domain controller. The main domain controller is responsible for routine data processing, while the secondary domain controller takes over specific sensors in case of failure. The first domain module 100 refers to the control unit that undertakes the main data processing tasks. Specifically, it can be implemented using an embedded system integrating a multi-core processor and a high-speed communication interface, used for real-time processing of data streams from multiple image acquisition modules. The second domain module 200 refers to an auxiliary unit with redundant control capabilities. Specifically, it can be implemented using a computing platform heterogeneous with the main domain module, immediately activating the data acquisition link when an anomaly is detected in the main domain.

[0089] Specifically, when the vehicle is in normal operation, the first domain module 100 simultaneously receives raw data from the first image acquisition module 300 via an independently connected LVDS interface, and achieves multi-source information fusion by forwarding data from the second image acquisition module 400 through the second domain module 200. At this time, the second domain module 200 operates solely as a data relay node. When the first domain module 100 triggers an abnormal state due to hardware failure or software crash, the data transmission link of the second image acquisition module 400 automatically switches to direct control by the second domain module 200. The second domain module 200 independently completes data acquisition and preprocessing, and transmits the processing results to the actuators via the vehicle network. During this process, the first image acquisition module 300 stops working due to a physical link disconnection, but the second image acquisition module 400 continues to operate.

[0090] In one specific embodiment, the first domain module 100 is the main domain, and the second domain module 200 is the subdomain.

[0091] The main domain employs a minimum risk strategy, with a sensor set including LiDAR, a front-view telephoto camera, a side-view camera, and a rear-view camera. The first image acquisition module 300 consists of two groups: Group 1 and Group 2. Group 1 includes a front-view telephoto camera, front left / right side view cameras, and a rear-view camera; Group 2 includes a front left / right side view camera plus a DMS camera. The data acquisition range of the first domain module 100 is as follows... Figure 3 As shown.

[0092] The secondary domain employs a minimum risk strategy, with a sensor set including a forward-looking wide-angle camera, surround-view cameras, a front millimeter-wave radar, and an angular millimeter-wave radar. The second image acquisition module 400 consists of two groups: group 3 and group 4. Group 3 includes front / rear surround-view cameras; group 4 includes a forward-looking wide-angle camera and left / right surround-view cameras.

[0093] This redundant camera grouping design ensures that even if any single camera or group fails, other camera groups can still provide valid information such as target objects and lane markings. Combined with target object information from multiple sources such as radar and lidar, the system can execute a minimum-risk strategy for safe parking. Based on the minimum-risk strategy sensor set optimization design, the further refined architecture diagram of this patent based on sensor arrangement is shown below. Figure 2 As shown. The data acquisition range of the second domain module 200 is as follows. Figure 4 As shown.

[0094] like Figure 2 As shown, the first controller 110 of the main domain can be integrated with SOC-1 and MCU-1, where SOC-1 can be a THOR series chip and MCU-1 can be a TC397XX or U2A16 chip. The second controller 210 of the sub-domain can be integrated with SOC-2 and MCU-2, where SOC-2 can be an Orin series, A1000 series, or J6 series chip and MCU-2 can be a TC397XX or U2A16 chip. The first connector 120 of the main domain can be a MAX96712 or MAX96722 connector, connected to the first image acquisition module 300 via a Gigabit Multimedia Serial Link (GMSL) interface; the second connector 130 of the main domain can be a MAX96792 connector, connected to the fourth connector 230 of the sub-domain via a Gigabit Multimedia Serial Link (GMSL) interface. The third connector 220 of the subdomain can be a connector of model MAX96724 or MAX96722, and is connected to the second image acquisition module 400 via the Gigabit Multimedia Serial Link (GMSL) interface. The fourth connector 230 of the subdomain can be a connector of model MAX96793 or MAX96793, and is connected to the second connector 130 of the main domain via the Gigabit Multimedia Serial Link (GMSL) interface.

[0095] Through the design of this utility model, architectural redundancy is ensured by the redundancy design of two complete computing links in the main and secondary domains. If one computing link fails, there is still another complete computing link to ensure that the system can execute the minimum risk strategy. The main computing link redundancy strategy is designed as follows:

[0096] Both primary and secondary computing links are intact: When a certain type of fault occurs, but it does not cause the primary or secondary domain computing links to fail (i.e., both primary and secondary domain computing links are intact), the minimum risk strategy is executed based on the primary domain computing link. For example, the failure of a sensor falls into this category. In this case, the system executes the minimum risk strategy based on the primary domain computing link.

[0097] Primary computing link intact, secondary computing link failed: When a secondary domain failure leads to the failure of the secondary computing link, the minimum risk strategy is executed based on the primary domain computing link. Examples of such failures include secondary domain SOC / MCU failures or secondary domain computing module failures. In this case, the system performs a safe shutdown based on the primary domain computing link.

[0098] Secondary computing link intact, primary computing link failed: When a primary domain failure causes the primary computing link to fail, a minimum-risk strategy is executed based on the secondary domain computing link. Examples of such failures include primary domain SOC / MCU failure or primary domain computing module failure. In this case, the system performs a safe shutdown based on the secondary domain computing link.

[0099] Differentiated Computing Power Design for Primary and Secondary Domains: In L3 system design, the computing power of the primary domain needs to support various complex scenarios within the design's operating range. Therefore, the primary domain needs to access all sensor data and perceive the surrounding environment from all angles, thus requiring a correspondingly high computing power to handle various scenario conditions. The computing power requirements for the secondary domain, based on meeting at least the minimum risk strategy capability requirement, can be differentiated with lower computing power. Compared to the primary domain's computing power capable of handling 11V5R1L, the secondary domain's computing power, as long as it meets the minimum risk strategy capability, can choose an appropriate low-computing-power solution. The current architecture design allows the secondary domain to at least meet 5V5R processing capabilities, supporting the minimum risk strategy of parallel parking. This low-computing-power secondary domain solution helps reduce the design cost of the L3 system. It enables a feasible L3 architecture that can be expanded and improved based on the current L2 assisted driving sensor set of 11V5R, while maintaining cost-effectiveness.

[0100] Compared with existing technologies, in existing solutions, the camera is only connected to the main domain controller in one direction, and the secondary domain needs to indirectly acquire data through the main domain link. In this solution, the second image acquisition module 400 achieves data splitting through an independently connected dual-domain architecture, avoiding the data link reconstruction process required for the secondary domain to take over when the main domain fails. At the same time, the physical isolation design between the second domain module 200 and the first image acquisition module 300 eliminates the cascading effects of main domain anomalies on the second image acquisition module 400.

[0101] Through the above technical solution, this invention can maintain the continuous operation of at least one image acquisition module when the main domain controller fails, ensuring the stability of the environmental perception data stream and avoiding the degradation of autonomous driving functions due to the interruption of the main domain computing link. Furthermore, the parallel access capability of the dual-domain module to the second image acquisition module eliminates the need to reinitialize the sensors during the fault switching process, effectively shortening the system recovery time window.

[0102] The algorithms or displays provided herein are not inherently related to any particular computer, virtual system, or other device. Furthermore, the embodiments of this invention are not directed to any particular programming language.

[0103] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of the present invention may be practiced without these specific details. Similarly, for the sake of brevity and to aid in understanding one or more aspects of the invention, in the above description of exemplary embodiments of the invention, various features of the embodiments of the invention are sometimes grouped together in a single embodiment, figure, or description thereof. The claims, which follow the detailed description, are hereby expressly incorporated into that detailed description, wherein each claim itself constitutes a separate embodiment of the invention.

[0104] Those skilled in the art will understand that the modules in the device of the embodiment can be adaptively changed and placed in one or more devices different from that embodiment. Modules, units, or components in the embodiment can be combined into a single module, unit, or component, and further, they can be divided into multiple sub-modules, sub-units, or sub-components, except that at least some of such features and / or processes or units are mutually exclusive.

[0105] It should be noted that the above embodiments are illustrative of the present invention and not restrictive of it, and those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims listing several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names. The steps in the above embodiments, unless otherwise specified, should not be construed as limiting the order of execution.

Claims

1. An autonomous driving redundancy device, characterized in that, At least including: At least one first image acquisition module (300); At least one second image acquisition module (400); The first domain module (100) is connected to the first image acquisition module (300); And a second domain module (200), which is connected to the second image acquisition module (400) and the first domain module (100), and the second domain module (200) is used to transmit the data acquired by the second image acquisition module (400) to the first domain module (100). When the first domain module (100) is normal, the first domain module (100) collects data through the first image acquisition module (300) and the second image acquisition module (400); when the first domain module (100) is abnormal, the second domain module (200) collects data through the second image acquisition module (400).

2. The automatic driving redundancy device according to claim 1, characterized in that, The first domain module (100) is provided with a first controller (110), a first connector (120) and a second connector (130), and the second domain module (200) is provided with a second controller (210), a third connector (220) and a fourth connector (230). The first connector (120) and the second connector (130) are both connected to the first controller (110), and the first connector (120) is connected to the first image acquisition module (300); the second controller (210) is connected to the third connector (220), the third connector (220) is connected to the second image acquisition module (400), and the third connector (220) is also connected to the second connector (130) through the fourth connector (230).

3. The autonomous driving redundancy device according to claim 2, characterized in that, The first connector (120), the second connector (130), the third connector (220) and the fourth connector (230) are all LVDS connectors.

4. The automatic driving redundancy device according to any one of claims 1-3, characterized in that, The first image acquisition module (300) includes any one or more of the following: a front-view telephoto camera, a front-view wide-angle camera, a rear-view camera, a side-view camera, an in-cabin camera, and a surround-view camera. The second image acquisition module (400) includes any one or more of the following: a front-view telephoto camera, a front-view wide-angle camera, a rear-view camera, a side-view camera, an in-cabin camera, and a surround-view camera.

5. The automatic driving redundancy device according to claim 1, characterized in that, It also includes a first radar acquisition module (500), which is connected to the first domain module (100) and / or the second domain module (200).

6. The automatic driving redundancy device according to claim 5, characterized in that, The first radar acquisition module (500) is connected to the first controller (110) of the first domain module (100) and / or the second controller (210) of the second domain module (200) via CAN-FD.

7. The automatic driving redundancy device according to claim 6, characterized in that, The first domain module (100) is also provided with a first Ethernet gateway (140), and the first radar acquisition module (500) is also connected to the first controller (110) through the Ethernet gateway.

8. The automatic driving redundancy device according to claim 6, characterized in that, The second domain module (200) is also provided with a second Ethernet gateway, and the first radar acquisition module (500) is also connected to the second controller (210) through the second Ethernet gateway.

9. The automatic driving redundancy device according to any one of claims 5-8, characterized in that, The first radar acquisition module (500) includes any one or more of lidar, angular millimeter-wave radar, front millimeter-wave radar, and rear millimeter-wave radar.

10. A vehicle, characterized in that, The vehicle is equipped with an autonomous driving redundancy device as described in any one of claims 1-9, and when the first domain module (100) is normal, the vehicle connects with the first image acquisition module (300) and the second image acquisition module (400) through the first domain module (100) to collect data; when the first domain module (100) is abnormal, the vehicle connects with the second image acquisition module (400) through the second domain module (200) to collect data.

Images