Automatic drive kit

Abstract

To execute non-redundant control when communication in the non-redundant control is abnormal in a constitution where redundant control is possible.SOLUTION: An ADK is provided with a computer, and communication modules 111A, B. A VP is provided with: a non-redundant control system executing a non-redundant control function; a first bus 411; a second bus 412; a first VCIB 41 configured to be communicable via the communication module 111A and the first bus 411 and issuing control instruction to the non-redundant control system in accordance with a non-redundant control command for controlling the non-redundant control system from the ADK; a second VCIB 42 configured to be communicable via the communication module 111B and the second bus 412; and a third bus 401 connecting the VCIBs 41, 42. The computer controls the communication module 111B to send the non-redundant control command to the VCIB 41 via the second bus 412 and the third bus 401 when the communication via the first bus 411 is abnormal.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present disclosure relates to an autonomous driving kit, and in particular to an autonomous driving kit that is detachable from a vehicle platform configured to enable autonomous driving and that issues autonomous driving instructions. [Background technology]

[0002] Conventionally, there have been systems in which a vehicle and an autonomous driving kit work together to perform autonomous driving (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2019-177808 A Summary of the Invention [Problem to be solved by the invention]

[0004] It is possible to provide redundancy by using a dual system for communication between the vehicle and the autonomous driving kit to control the vehicle's running, steering, and braking. In such a configuration, it is possible to provide non-redundant control rather than a dual system for body control such as control of headlamps and hazard lights in order to reduce the communication burden. In such a case, if an abnormality occurs in the communication for body control from the autonomous driving kit to the vehicle, it will not be possible to transmit control commands from the autonomous driving kit to the vehicle.

[0005] This disclosure has been made to solve the above-mentioned problems, and its purpose is to provide an autonomous driving kit that is capable of executing non-redundant control when communication for non-redundant control is abnormal in a configuration where redundant control is possible. [Means for solving the problem]

[0006] The autonomous driving kit according to the present disclosure is detachably attached to a vehicle platform configured to enable autonomous driving, and issues autonomous driving instructions. The autonomous driving kit includes a processor, a first communication module, and a second communication module. The vehicle platform includes a non-redundant control system that executes a non-redundant control function of the vehicle platform, a first bus, a second bus, a first vehicle control interface box that is configured to be able to communicate with the first communication module via the first bus and issues a control instruction to the non-redundant control system according to a non-redundant control command for controlling the non-redundant control system from the autonomous driving kit, a second vehicle control interface box that is configured to be able to communicate with the second communication module via the second bus, and a third bus that connects the first vehicle control interface box and the second vehicle control interface box. When communication via the first bus is abnormal, the processor controls the second communication module to transmit the non-redundant control command to the first vehicle control interface box via the second bus and the third bus.

[0007] According to this configuration, if communication via the first bus used to normally transmit a non-redundant control command from the processor of the autonomous driving kit to the first vehicle control interface box is abnormal, the non-redundant control command is transmitted from the processor to the first vehicle control interface box via the second bus, the second vehicle control interface box, and the third bus. As a result, in a configuration capable of redundant control, it is possible to provide an autonomous driving kit capable of executing non-redundant control when communication for non-redundant control is abnormal.

[0008] The processor may control the first communication module to transmit a non-redundant control command to the first vehicle control interface box via the first bus when communication via the first bus is normal. With this configuration, the non-redundant control command can be transmitted efficiently over a short path under normal circumstances.

[0009] The vehicle platform may further include a redundant control system that executes a redundant control function different from a non-redundant control function of the vehicle platform, and the processor may control the first communication module to transmit a redundant control command for controlling the redundant control function to a first vehicle control interface box via a first bus, and control the second communication module to transmit the redundant control command to a second vehicle control interface box via a second bus. With this configuration, the redundant control command can be transmitted from the autonomous driving kit to the vehicle platform in a dual system.

[0010] The non-redundant control function may be a headlamp function or a hazard lamp function. With this configuration, in a configuration capable of redundant control, control of the headlamp function or the hazard lamp function can be executed when communication for controlling the headlamp function or the hazard lamp function is abnormal. Effect of the Invention

[0011] According to this disclosure, it is possible to provide an autonomous driving kit that, in a configuration capable of redundant control, is capable of executing non-redundant control when communication for non-redundant control is abnormal. [Brief description of the drawings]

[0012] [Figure 1] 1 is a diagram showing an overview of a vehicle according to an embodiment of the present disclosure. [Diagram 2] FIG. 2 is a diagram showing the configuration of ADS, VCIB and VP in more detail. [Diagram 3] FIG. 2 is a diagram for explaining communication in body control. [Figure 4] 13 is a flowchart showing the flow of lamp command transmission processing executed by the ADK in this embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] 1 is a diagram showing an overview of a vehicle 1 according to an embodiment of this disclosure. The vehicle 1 includes an autonomous driving kit (ADK) 10 and a vehicle platform (VP) 20. The ADK 10 is configured to be attachable to the VP 20 (to be mounted on the vehicle 1). The ADK 10 and the VP 20 are configured to be able to communicate with each other via a vehicle control interface (VCIB 40 described later).

[0014] The VP20 can perform automatic driving according to control requests from the ADK10. Although the ADK10 is shown in a position separate from the VP20 in FIG. 1, the ADK10 is actually attached to the rooftop of the VP20 or the like. The ADK10 can also be removed from the VP20. When the ADK10 is removed, the VP20 performs driving control in manual mode (driving control according to user operation).

[0015] The ADK10 includes an autonomous driving system (ADS) 11 for autonomously driving the vehicle 1. The ADS11 creates, for example, a driving plan for the vehicle 1. The ADS11 outputs various control requests for driving the vehicle 1 according to the driving plan to the VP20 according to an API (Application Program Interface) defined for each control request. The ADS11 also receives various signals indicating the vehicle state (state of the VP20) from the VP20 according to an API defined for each signal. Then, the ADS11 reflects the vehicle state in the driving plan.

[0016] The VP20 includes a base vehicle 30 and a vehicle control interface box (VCIB) 40. The base vehicle 30 executes various vehicle controls in accordance with control requests from the ADK10 (ADS11). The base vehicle 30 includes various systems and sensors for controlling the base vehicle 30. More specifically, the base vehicle 30 includes an integrated control manager 31, a brake system 32, a steering system 33, a powertrain system 34, an active safety system 35, a body system 36, wheel speed sensors 51, 52, a pinion angle sensor 53, a camera 54, and radar sensors 55, 56.

[0017] The integrated control manager 31 includes a processor and a memory, and controls the above-mentioned systems related to the operation of the vehicle 1 (the brake system 32, the steering system 33, the powertrain system 34, the active safety system 35, and the body system 36) in an integrated manner.

[0018] The brake system 32 is configured to control the braking devices provided on each wheel of the base vehicle 30. Wheel speed sensors 51, 52 are connected to the brake system 32. The wheel speed sensors 51, 52 detect the rotation speeds of the front and rear wheels of the base vehicle 30, respectively, and output the detected rotation speeds to the brake system 32. The brake system 32 outputs the rotation speeds of each wheel to the VCIB 40 as one piece of information included in the vehicle state. The brake system 32 also generates a braking command for the braking device according to a predetermined control request output from the ADS 11 via the VCIB 40 and the integrated control manager 31. The brake system 32 controls the braking device using the generated braking command.

[0019] The steering system 33 is configured to be able to control the steering angle of the steering wheels of the vehicle 1 using a steering device. A pinion angle sensor 53 is connected to the steering system 33. The pinion angle sensor 53 detects a rotation angle (pinion angle) of a pinion gear connected to a rotating shaft of an actuator, and outputs the detected rotation angle to the steering system 33. The steering system 33 outputs the pinion angle to the VCIB 40 as one piece of information included in the vehicle state. The steering system 33 also generates a steering command for the steering device according to a predetermined control request output from the ADS 11 via the VCIB 40 and the integrated control manager 31. The steering system 33 controls the steering device using the generated steering command.

[0020] The powertrain system 34 controls an electric parking brake (EPB) system 341 provided on at least one of the multiple wheels, a parking lock (P-Lock) system 342 provided on the transmission of the vehicle 1, and a propulsion system 343 including a shift device configured to select a shift range.

[0021] The active safety system 35 detects obstacles (pedestrians, bicycles, parked vehicles, utility poles, etc.) in front or behind the vehicle 1 using the camera 54 and radar sensors 55, 56. The active safety system 35 determines whether there is a possibility that the vehicle 1 will collide with the obstacle based on the distance between the vehicle 1 and the obstacle and the moving direction of the vehicle 1. If the active safety system 35 determines that there is a possibility of a collision, it outputs a braking command to the brake system 32 via the integrated control manager 31 so as to increase the braking force.

[0022] The body system 36 is configured to control parts such as direction indicators (turn lamps, hazard lamps), a horn, wipers, headlamps, and brake lamps in accordance with the driving state or environment of the vehicle 1. The body system 36 controls each of the above parts in accordance with a predetermined control request output from the ADS 11 via the VCIB 40 and the integrated control manager 31.

[0023] The VCIB 40 is configured to be able to communicate with the ADS 11 via a CAN (Controller Area Network) or the like. The VCIB 40 executes a predetermined API defined for each signal to receive various control requests from the ADS 11 and output the vehicle state to the ADS 11. When the VCIB 40 receives a control request from the ADK 10, it outputs a control command corresponding to the control request to a system corresponding to the control command via the integrated control manager 31. The VCIB 40 also acquires various pieces of information about the base vehicle 30 from various systems via the integrated control manager 31, and outputs the state of the base vehicle 30 to the ADS 11 as the vehicle state.

[0024] The base vehicle 30 further includes an emergency stop switch 39. The emergency stop switch 39 is provided so as to be operable by the driver of the vehicle 1, and when operated, outputs a signal indicating that the switch has been operated to the integrated control manager 31.

[0025] Fig. 2 is a diagram showing in more detail the configurations of the ADS 11, the VCIB 40, and the VP 20. As shown in Fig. 2, the ADS 11 includes a computer 111, an HMI (Human Machine Interface) 112, a recognition sensor 113, an attitude sensor 114, and a sensor cleaner 115.

[0026] The computer 111 includes a processor such as a CPU (Central Processing Unit) and memories such as a ROM (Read Only Memory) and a RAM (Random Access Memory). During autonomous driving of the vehicle 1, the computer 111 acquires the environment of the vehicle 1, as well as the attitude, behavior, and position of the vehicle 1 using various sensors, and acquires the vehicle state from the VP 20 via the VCIB 40 to set the next operation of the vehicle 1 (acceleration, deceleration, turning, etc.). The computer 111 outputs various commands to the VCIB 40 to realize the next operation. The computer 111 includes communication modules 111A and 111B. Each of the communication modules 111A and 111B is configured to be able to communicate with the VCIB 40.

[0027] The HMI 112 presents information to the user and accepts user operations during autonomous driving, during driving that requires user operation, and during a transition between autonomous driving and driving that requires user operation.

[0028] The recognition sensor 113 is a sensor for recognizing the environment of the vehicle 1. The recognition sensor 113 includes, for example, at least one of a LIDAR (Laser Imaging Detection and Ranging), a millimeter wave radar, and a camera.

[0029] The attitude sensor 114 is a sensor for detecting the attitude, behavior, and position of the vehicle 1. The attitude sensor 114 includes, for example, an IMU (Inertial Measurement Unit) and a GPS (Global Positioning System). The sensor cleaner 115 is configured to remove dirt adhering to the above-mentioned various sensors (camera lenses, laser light irradiation parts, etc.) while the vehicle 1 is traveling, using a cleaning liquid, a wiper, etc.

[0030] The VCIB40 includes a main VCIB41 and a sub VCIB42. Each of the VCIBs 41 and 42 includes a processor such as a CPU (Central Processing Unit) and a memory such as a ROM (Read Only Memory) and a RAM (Random Access Memory). The memory stores a program executable by the processor. The VCIB41 and the communication module 111A are connected to each other so as to be able to communicate with each other. The VCIB42 and the communication module 111B are connected to each other so as to be able to communicate with each other. Furthermore, the VCIB41 and the VCIB42 are connected to each other so as to be able to communicate with each other.

[0031] Each of the VCIBs 41 and 42 relays control requests and vehicle information between the ADS11 and the VP20. More specifically, the VCIB 41 uses an API to generate a control command from a control request from the ADS11. The VCIB 41 then outputs the generated control command to a corresponding system among the multiple systems included in the VP20. The VCIB 41 also uses an API to generate information indicating a vehicle state from vehicle information from each system of the VP20. The VCIB 41 outputs the generated information indicating the vehicle state to the ADS11. The same is true for the VCIB 42.

[0032] The EPB system 341 controls the EPB in accordance with a control request output from the ADS 11 via the VCIB 41. The EPB is provided separately from a braking device (such as a disc brake system), and fixes the wheels by the operation of an actuator.

[0033] The P-Lock system 342 controls the P-Lock device in accordance with a control request output from the ADS 11 via the VCIB 41. For example, the P-Lock system 342 activates the P-Lock device when the control request includes a control request to set the shift range to a parking range (P range), and releases the operation of the P-Lock device when the control request includes a control request to set the shift range to a range other than the P range. The P-Lock device fixes the rotation of the output shaft of the transmission and locks the wheels.

[0034] The propulsion system 343 switches the shift range of the shift device and controls the driving force from the driving source (motor generator, engine, etc.) in accordance with a control request output from the ADS 11 via the VCIB 41.

[0035] In the vehicle 1, for example, when an autonomous driving mode described later is selected by a request from the ADK 10, the vehicle 1 performs autonomous driving. As described above, the ADS 11 first creates a driving plan during autonomous driving. Examples of the driving plan include a plan to continue driving straight, a plan to turn left / right at a predetermined intersection on a predetermined driving route, and a plan to change the driving lane. The ADS 11 calculates control physical quantities (acceleration, deceleration, tire turning angle, etc.) required for the vehicle 1 to operate according to the created driving plan. The ADS 11 divides the physical quantities for each execution cycle of the API. The ADS 11 outputs a control request representing the divided physical quantities to the VCIB 40 using the API. Furthermore, the ADS 11 acquires the vehicle state (the actual moving direction of the vehicle 1, the state of immobilization of the vehicle, etc.) from the VP 20, and recreates a driving plan that reflects the acquired vehicle state. In this way, the ADS 11 enables the vehicle 1 to be driven autonomously.

[0036] In the above-mentioned configuration, the communication between the VP 20 and the ADK 10 is made redundant by a dual system for controlling the running, steering, and braking of the vehicle 1. In such a configuration, it is considered that the body control such as the control of the headlamps and hazard lights of the body system 36 is not made redundant but is made non-redundant in order to reduce the communication burden. In such a case, if an abnormality occurs in the communication of the body control from the ADK 10 to the VP 20, the control command from the ADK 10 cannot be transmitted to the VP 20.

[0037] Therefore, the VP20 includes a first bus 411 connecting the communication module 111A of the ADK10 to the main VCIB41, a second bus 412 connecting the communication module 111B of the ADK10 to the sub VCIB42, and a third bus 401 connecting the VCIB41 and VCIB42. When communication via the first bus 411 is abnormal, the computer 111 of the ADK10 controls the communication module 111B to transmit a non-redundant control command to the VCIB41 via the second bus 412 and the third bus 401.

[0038] As a result, if there is an abnormality in communication via the first bus 411 that is normally used to transmit a non-redundant control command from the computer 111 of the ADK 10 to the VCIB 41, the non-redundant control command is transmitted from the computer 111 to the VCIB 41 via the second bus 412, the VCIB 42, and the third bus 401. As a result, in a configuration where redundant control is possible, it is possible to execute non-redundant control when there is an abnormality in communication for non-redundant control.

[0039] Fig. 3 is a diagram for explaining communication in body control. Referring to Fig. 3, the first bus 411 communicably connects the communication module 111A of the ADK 10 and the main VCIB 41. The second bus 412 communicably connects the communication module 111B of the ADK 10 and the sub VCIB 42. The third bus 401 communicably connects the main VCIB 41 and the sub VCIB 42.

[0040] The B-bus 371 communicably connects the main VCIB 41, the body ECU (Electronic Control Unit) 361, and the central gateway (hereinafter referred to as "CGW") 37. The I-bus 372 communicably connects the main VCIB 41, the meter ECU 362, and the CGW 37. The C1-bus 373 communicably connects the main VCIB 41, the brake ECU 363, and the CGW 37.

[0041] The VP 20 includes other communication buses (for example, a CL-bus 374, a PL-bus 375, and a SBWL-bus 376 connected to a sub VCIB 42) in addition to the B-bus 371, the I-bus 372, and the C1-bus 373. These other communication buses are not connected to the body ECU 361, the meter ECU 362, and the brake ECU 363.

[0042] The body ECU 361 receives control commands for, for example, the horn, wipers, and headlamps of the body system 36 from the ADK 10 via the communication module 111A, the first bus 411, the main VCIB 41, and the B-bus 371, and controls these devices according to the control commands. For example, the body ECU 361 turns the headlamps on in high beam, low beam, or off.

[0043] The meter ECU 362 receives control commands for the turn indicators of the body system 36 from the ADK10 via the communication module 111A, the first bus 411, the main VCIB 41 and the I-bus 372, and controls the turn indicators to function as turn lamps (only one of the left and right turn indicators flashes) or hazard lamps (both the left and right turn indicators flash at the same time) in accordance with the control commands.

[0044] The brake ECU 363 receives control commands for the brake lights of the body system 36 from the ADK10 via the communication module 111A, the first bus 411, the main VCIB 41 and the C1-bus 373, and turns the brake lights on and off in accordance with the control commands sent from the ADK10 in conjunction with the braking control.

[0045] In addition, control commands for redundant control regarding driving, steering, and braking are transmitted from ADK10 via communication module 111A and first bus 411 to the main VCIB 41, and via communication module 111B and second bus 412 to the sub VCIB 42.

[0046] Fig. 4 is a flowchart showing the flow of lamp command transmission processing executed in this embodiment by the ADK 10. Referring to Fig. 4, this lamp command transmission processing is called from a higher-level process at predetermined intervals and executed by the computer 111 of the ADK 10.

[0047] The computer 111 of the ADK10 determines whether or not an instruction to transmit a headlamp command has been issued in another process being executed by the computer 111 (step S111). If it is determined that an instruction to transmit a headlamp command has not been issued (NO in step S111), the computer 111 determines whether or not an instruction to transmit a hazard lamp command has been issued in another process being executed by the computer 111 (step S112). If it is determined that an instruction to transmit a hazard lamp command has not been issued (NO in step S112), the computer 111 returns the process to be executed to the upper process that called this process.

[0048] When it is determined that an instruction to transmit a headlamp command has been issued (YES in step S111), and when it is determined that an instruction to transmit a hazard lamp command has been issued (YES in step S112), the computer 111 determines whether or not there is an abnormality in the communication on the main side (communication between the communication module 111A and the main VCIB 41) (step S113). When there is an abnormality in the communication module 111A, an abnormality in the first bus 411, or an abnormality in the communication between the main VCIB 41 and the ADK 10, it is determined that there is an abnormality in the communication on the main side.

[0049] If it is determined that there is no abnormality in the communication on the main side (NO in step S113), the computer 111 controls the communication module 111A to send a command to the main VCIB41 via the first bus 411 (step S114), and then returns the process to be executed to the higher-level process that called this process.

[0050] If it is determined that there is an abnormality in the communication on the main side (YES in step S113), the computer 111 controls the communication module 111B to send a command to the main VCIB 41 via the second bus 412, the sub VCIB 42, and the third bus 401 (step S115), and then returns the process to be executed to the higher-level process that called this process.

[0051] In addition, the braking command for the braking control is transmitted in a dual system because it is a redundant control. Therefore, even if the brake lamp control command of the body system 36 cannot be transmitted by the main communication from the ADK 10, the brake lamp can be controlled in response to the braking control based on the braking command.

[0052] [Variations] (1) In the above-described embodiment, the above disclosure is applied to the headlamp function and the hazard lamp function as shown in Figures 3 and 4. However, this is not limited thereto, and the above disclosure can be applied to any function that is a non-redundant control function that uses one of the dual systems, as opposed to a redundant control function that is controlled using a dual system.

[0053] (2) In the embodiment described above, as shown in FIG. 3, a control command for non-redundant control in which communication is not a dual system, such as control of headlamps and hazard lamps, is transmitted on the main side via the first bus 411. However, this is not limited thereto, and a control command for non-redundant control may be transmitted on the sub side via the second bus 412 instead of the first bus 411. In other words, non-redundant control may be executed using communication on the sub side. In this case, the body ECU 361 and the meter ECU 362 are connected to the communication bus on the side of the sub VCIB 42.

[0054] [summary] (1) As shown in Fig. 1, the ADK 10 is detachable from the VP 20 configured to enable autonomous driving, and issues instructions for autonomous driving. As shown in Fig. 2, the ADK 10 includes a computer 111, a first communication module 111A, and a second communication module 111B. As shown in Figures 1 to 3, VP20 includes a non-redundant control system (e.g., body system 36, body ECU 361, meter ECU 362) that executes a non-redundant control function of VP20 (e.g., a headlamp function, a hazard lamp function), a first bus 411, a second bus 412, a first VCIB41 configured to be able to communicate with the first communication module 111A via the first bus 411 and that issues control instructions to the non-redundant control system in accordance with a non-redundant control command for controlling the non-redundant control system from the ADK10, a second VCIB42 configured to be able to communicate with the second communication module 111B via the second bus 412, and a third bus 401 that connects the first VCIB41 and the second VCIB42. As shown in FIG. 4, when communication via the first bus 411 is abnormal, the computer 111 controls the second communication module 111B to send a non-redundant control command to the first VCIB 41 via the second bus 412 and the third bus 401 (e.g., step S115).

[0055] As a result, if there is an abnormality in communication via the first bus 411 that is normally used to transmit a non-redundant control command from the computer 111 of the ADK 10 to the first VCIB 41, the non-redundant control command is transmitted from the computer 111 to the first VCIB 41 via the second bus 412, the second VCIB 42, and the third bus 401. As a result, in a configuration capable of redundant control, non-redundant control can be executed when there is an abnormality in communication for non-redundant control.

[0056] 4, when there is no abnormality in the communication via the first bus 411, the computer 111 may control the first communication module 111A to transmit a non-redundant control command to the first VCIB 41 via the first bus 411 (for example, step S114). This allows the non-redundant control command to be transmitted efficiently over a short route when there is no abnormality.

[0057] 3, the VP20 may further include a redundant control system (e.g., a brake system 32, a steering system 33, a power train system 34) that executes a redundant control function (e.g., a braking function, a steering function, a driving function) different from the non-redundant control function of the VP20, and the computer 111 may control the first communication module 111A to transmit a redundant control command (e.g., a braking command, a steering command, a driving command) for controlling the redundant control function to the first VCIB41 via the first bus 411, and may control the second communication module 111B to transmit the redundant control command to the second VCIB42 via the second bus 412. This allows the redundant control command to be transmitted from the ADK10 to the VP20 in a dual system.

[0058] (4) As shown in Figures 3 and 4, the non-redundant control function may be a headlamp function or a hazard lamp function. In this way, in a configuration capable of redundant control, control of the headlamp function or the hazard lamp function can be executed when communication for controlling the headlamp function or the hazard lamp function is abnormal.

[0059] The embodiments disclosed herein should be considered to be illustrative and not restrictive in all respects. The scope of the disclosure is defined by the claims, not by the description of the embodiments described above, and is intended to include all modifications within the meaning and scope of the claims. [Explanation of symbols]

[0060] 1 Vehicle, 10 ADK, 11 ADS, 20 VP, 30 Base vehicle, 31 Integrated control manager, 32 Brake system, 33 Steering system, 34 Power train system, 35 Active safety system, 36 Body system, 37 CGW, 39 Emergency stop switch, 40, 41, 42 VCIB, 51, 52 Wheel speed sensor, 53 Pinion angle sensor, 54 Camera, 55, 56 Radar sensor, 111 Computer, 111A, 111B Communication module, 112 HMI, 113 Recognition sensor, 114 Attitude sensor, 115 Sensor cleaner, 341 EPB system, 342 P-Lock system, 343 Propulsion system, 361 Body ECU, 362 Meter ECU, 363 Brake ECU, 401 3rd bus, 411 1st bus, 412 2nd bus.

Claims

1. An autonomous driving kit that can be attached to and detached from a vehicle platform configured to enable autonomous driving and issues instructions for autonomous driving, The autonomous driving kit includes: A processor; A first communication module; a second communication module; The vehicle platform includes: a non-redundant control system for performing non-redundant control functions for the vehicle platform; The first bus, The second bus, A first vehicle control interface box configured to be able to communicate with the first communication module via the first bus and to issue a control instruction to the non-redundant control system according to a non-redundant control command for controlling the non-redundant control system from the autonomous driving kit; A second vehicle control interface box configured to be able to communicate with the second communication module via the second bus; a third bus connecting the first vehicle control interface box and the second vehicle control interface box; The processor, An autonomous driving kit that controls the second communication module to transmit the non-redundant control command to the first vehicle control interface box via the second bus and the third bus when communication via the first bus is abnormal.

2. The processor, The autonomous driving kit of claim 1, further comprising: a control module configured to control the first communication module to transmit the non-redundant control command to the first vehicle control interface box via the first bus when communication via the first bus is not abnormal.

3. The vehicle platform includes: a redundant control system for performing redundant control functions distinct from the non-redundant control functions of the vehicle platform; The processor, 2. The autonomous driving kit of claim 1, further comprising: a control module configured to control a redundant control function for controlling the redundant control function, the control module configured to control the first communication module to transmit a redundant control command for controlling the redundant control function to the first vehicle control interface box via the first bus; and a control module configured to control the second communication module to transmit the redundant control command to the second vehicle control interface box via the second bus.

4. The autonomous driving kit of claim 1 , wherein the non-redundant control function is a headlamp function or a hazard lamp function.

Images