Safety system for laser radar, chip, laser radar, and terminal device

Abstract

The present disclosure provides a safety system for a laser radar, a chip, a laser radar, and a terminal device. The safety system comprises: a slave controller, configured to determine first safety information of a first functional element; and a master controller, configured to receive the first safety information provided by the slave controller, determine second safety information of a second functional element, and on the basis of the first safety information and the second safety information, determine at least one of a functional safety diagnosis result of the laser radar or a cybersecurity diagnosis result of the laser radar. The master controller is further configured to execute a safety action on the basis of the at least one of the functional safety diagnosis result or the cybersecurity diagnosis result. The safety system of the present disclosure has a simple structure and high versatility, and can ensure the safety of the laser radar during operation.

Description

Safety system, chip, lidar and terminal device for lidar

[0001] The present disclosure claims priority to the Chinese patent application entitled "Safety system, chip, lidar and terminal device for lidar", application number 202410743810.X, filed on June 07, 2024, the content of which is incorporated by reference in its entirety in the present application. TECHNICAL FIELD

[0002] The present disclosure relates to the field of lidar, and in particular to a safety system, chip, lidar and terminal device for lidar. BACKGROUND

[0003] Lidar can be used in various safety monitoring systems, such as lidar-based safe driving systems, such as autonomous vehicles, lidar-based safety area monitoring systems, etc.

[0004] Lidar can also have some safety problems, such as failure of lidar functions, data transmission safety, external malicious attacks, etc. Therefore, how to ensure the safety of lidar during operation is a technical problem to be solved. SUMMARY

[0005] The present disclosure provides a safety system capable of ensuring the safety of lidar during operation, which is simple in structure and strong in versatility.

[0006] In a first aspect, the embodiments of the present disclosure provide a safety system. The safety system is used for a lidar. The lidar includes a first functional element and a second functional element. The safety system includes: a slave controller configured to determine first safety information of the first functional element; a master controller configured to receive the first safety information provided by the slave controller, and determine second safety information of the second functional element, determine at least one of a functional safety diagnosis result or a network security diagnosis result of the lidar based on the first safety information and the second safety information; the master controller is further configured to perform a safety action according to at least one of the functional safety diagnosis result or the network security diagnosis result.

[0007] Optionally, the first safety information includes at least one of first functional safety information, first network security information or a first diagnosis result, the first diagnosis result representing a safety diagnosis result of the slave controller on the first functional element; the second safety information includes at least one of second functional safety information, second network security information or a second diagnosis result, the second diagnosis result including a safety diagnosis result of the master controller on the second functional element.

[0008] Optionally, the master controller comprises a master diagnostic manager configured to determine the functional safety diagnostic result based on at least one of the first functional safety information, the first diagnostic result or second functional safety information, and the master diagnostic manager is configured to determine the cyber security diagnostic result based on at least one of the first cyber security information, the first diagnostic result or second cyber security information.

[0009] Optionally, the master controller further comprises a master functional diagnostic configured to receive the first safety information provided by the slave controller, and determine the second functional safety information, determine a preliminary functional safety diagnostic result based on the second functional safety information, the preliminary functional safety diagnostic result being used as an input to the master diagnostic manager to determine the functional safety diagnostic result.

[0010] Optionally, the master diagnostic manager is configured to enable or disable the master functional diagnostic according to an operational state of the safety system.

[0011] Optionally, after the safety system is started, the master diagnostic manager is configured to perform at least one first safety action of: shutting down the first functional element, shutting down the second functional element, reporting the functional safety diagnostic result, or reporting the cyber security diagnostic result.

[0012] Optionally, the first functional element comprises at least one of: the slave controller, the master controller, an Ethernet chip, a laser, a detector, a motor or a window heater; and the second functional element comprises at least one of: the slave controller, the master controller, an Ethernet chip, a laser, a detector, a motor or a window heater.

[0013] Optionally, the master controller further comprises a radar intrusion detector configured to record an execution state of a cyber security function of the laser radar and the second cyber security information, and determine the cyber security diagnostic result based on the execution state of the cyber security function and the second cyber security information.

[0014] Optionally, during a start-up phase of the safety system, the radar intrusion detector is configured to perform a second safety action according to the cyber security diagnostic result, the second safety action comprising terminating the continued start-up of the safety system.

[0015] Optionally, the master controller comprises a master cyber security configured to perform the cyber security function.

[0016] Optionally, the master controller further comprises at least one of a trusted platform module or a hardware security module, and the master network security device and the at least one of the trusted platform module or the hardware security module are configured to jointly perform the network security function.

[0017] Optionally, the first function safety information comprises process data related to function safety generated by the first function element, and the first network security information comprises process data related to network security generated by the first function element; and the second function safety information comprises process data related to function safety generated by the second function element, and the second network security information comprises process data related to network security generated by the second function element.

[0018] Optionally, the slave controller comprises a slave diagnostic manager configured to record the first safety information.

[0019] Optionally, the slave diagnostic manager is configured to perform a first safety action of shutting down a laser.

[0020] Optionally, the slave controller further comprises a slave function diagnostic device configured to determine first function safety information of the first safety information, and determine a first diagnostic result based on the first function safety information.

[0021] Optionally, the slave diagnostic manager is configured to receive an instruction of the master controller, and enable or disable the slave function diagnostic device in response to the instruction.

[0022] Optionally, the slave controller comprises a slave network security device configured to perform a network security function.

[0023] Optionally, the master controller further comprises a first peripheral device, and the first peripheral device and the first function element are configured to jointly provide the first safety information.

[0024] Optionally, the slave controller further comprises a second peripheral device, and the second peripheral device and the second function element are jointly configured to provide the second safety information.

[0025] In a second aspect, the disclosure also discloses a chip comprising the safety system for a lidar.

[0026] In a third aspect, the disclosure also discloses a lidar comprising the safety system for a lidar.

[0027] In a fourth aspect, the disclosure also discloses a terminal device comprising the lidar of the third aspect.

[0028] The technical solutions of the embodiments of the present disclosure have the following beneficial effects.

[0029] In the embodiments of the present disclosure, the safety system for the lidar includes a slave controller and a master controller. The slave controller is configured to determine first safety information of a first functional element; the master controller is configured to receive the first safety information provided by the slave controller, and determine second safety information of a second functional element, and determine at least one of a functional safety diagnosis result or a network security diagnosis result of the lidar based on the first safety information and the second safety information. The master controller is further configured to perform a safety action according to the at least one of the functional safety diagnosis result or the network security diagnosis result. The safety system including the master controller and the slave controller in the embodiments of the present disclosure has simple system structure, low hardware complexity, and is less limited by the type of hardware carrier and has strong versatility. Through cooperation of the master controller and the slave controller, the first safety information and the second safety information are obtained, and at least one of the functional safety diagnosis result or the network security diagnosis result of the lidar is determined, the monitoring and diagnosis of the functional safety and the network security of the functional units in the lidar are realized, and the functional safety and the network security of the lidar are ensured through the execution of the safety action, thereby improving the safety of the lidar in the working process.

[0030] Further, in the starting phase of the safety system, the radar intrusion detector performs a second safety action according to the network security diagnosis result, and the second safety action includes terminating the continuous starting of the safety system. Through the setting of the radar intrusion detector to perform the second safety action in the starting phase of the safety system, the lidar can be prevented from starting in the network unsafe state, data leakage is caused, and the safety of the lidar is further improved. BRIEF DESCRIPTION OF DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure, the following will make an exemplary introduction to the drawings used in the embodiment description. The drawings in the following description are only embodiments of the present disclosure, and those skilled in the art can also obtain other drawings according to the provided drawings without creating any creative labor. The drawings are used to provide further understanding of the present disclosure, and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the present disclosure, and do not constitute a limitation on the present disclosure.

[0032] FIG. 1 shows a structure schematic diagram of a safety system for a lidar according to some embodiments of the present disclosure;

[0033] FIG. 2 shows a structure schematic diagram of another safety system for a lidar according to some embodiments of the present disclosure;

[0034] FIG. 3 shows a structure schematic diagram of a master controller according to some embodiments of the present disclosure;

[0035] FIG. 4 shows a structural schematic diagram of a slave controller according to some embodiments of the present disclosure;

[0036] FIG. 5 shows a structural schematic diagram of another safety system for a lidar according to some embodiments of the present disclosure;

[0037] FIG. 6 shows a structural schematic diagram of a lidar according to some embodiments of the present disclosure. DETAILED DESCRIPTION

[0038] The safety system of the embodiments of the present disclosure is used for a lidar. The lidar includes a first functional element and a second functional element. The safety system includes a slave controller and a master controller. The slave controller can determine first safety information of the first functional element. The master controller can receive the first safety information provided by the slave controller and determine second safety information of the second functional element. The master controller can determine at least one of a functional safety diagnosis result and a network security diagnosis result of the lidar based on the first safety information or the second safety information. The master controller can also perform a safety action according to at least one of the functional safety diagnosis result or the network security diagnosis result.

[0039] The embodiments of the present disclosure adopt a safety system including a master controller and a slave controller, the system has simple structure, low hardware complexity, and is less limited by the type of hardware carrier and has strong versatility. Through the cooperation of the master controller and the slave controller, the first safety information and the second safety information are obtained, and at least one of the functional safety diagnosis result or the network security diagnosis result of the lidar is determined, which can realize the monitoring and diagnosis of the functional safety and the network security of the functional units in the lidar, and ensure the functional safety and the network security of the lidar by performing the safety action, thereby improving the safety of the lidar in the working process.

[0040] In order to make the above objectives, features and advantages of the present disclosure more obvious and easy to understand, specific embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0041] Please refer to FIG. 1, which shows a structural schematic diagram of a safety system for a lidar according to some embodiments of the present disclosure.

[0042] The lidar includes a first functional element 20 and a second functional element 30. The first functional element 20 and the second functional element 30 can perform functions in the lidar.

[0043] In some embodiments of the present disclosure, the first functional element 20 can include at least one of a laser, a detector, a motor, a controller, a point cloud data processor, a point cloud data transmitter, or a windshield heater, etc. The second functional element 30 can include at least one of a laser, a detector, a motor, a controller, a point cloud data processor, a point cloud data transmitter, or a windshield heater, etc. The first functional element 20 and the second functional element 30 can be different. For example, the first functional element 20 can include a processor for determining distance and reflectivity based on point cloud data and a manager for controlling the timing of laser emission and the timing of detector reception; the second functional element 30 can include a controller for controlling the timing of power-on of each functional unit when the safety system is started and a configurator for configuring each functional unit.

[0044] The first functional element 20 and the second functional element 30 in the laser radar can be set according to the actual application scenario, and the present disclosure does not limit this.

[0045] In some embodiments of the present disclosure, the safety system 10 can perform shutdown for at least one of the first functional element 20 or the second functional element 30. The shutdown includes at least one of shutting down power supply, shutting down a laser, shutting down a motor, or shutting down a windshield heater. For example, shutting down a laser includes shutting down the power supply voltage of the laser and shutting down the voltage controller of the laser. For example, shutting down a motor includes shutting down the power supply voltage of the motor and shutting down the voltage controller of the motor. For example, shutting down a windshield heater includes shutting down the power supply voltage of the windshield heater and shutting down the voltage controller of the windshield heater.

[0046] In some embodiments of the present disclosure, the safety system 10 for the laser radar can include a master controller 101 and a slave controller 102. The slave controller 102 is coupled to the first functional element 20 and can determine first safety information of the first functional element 20. The first safety information can be transmitted to the master controller 101 for at least one of functional safety diagnosis or network security diagnosis. In some embodiments of the present disclosure, the first safety information can include state information of the first functional element 20, such as fault information or non-fault information, etc.

[0047] In some embodiments of the present disclosure, the functional safety of the laser radar includes the safety of functions related to point cloud data. The functions related to point cloud data can include control of laser start timing, control of laser emission intensity, control of detector start timing, control of detector detection area, control of motor, processing of point cloud data, transmission of point cloud data, etc. The network security of the laser radar can include data security in the software and hardware inside the laser radar, such as security of point cloud data transmitted by the laser radar or security of confidential data stored inside the laser radar, etc.

[0048] In some embodiments of the present disclosure, the master controller 101 is coupled with the slave controller 102. The master controller 101 can receive the first safety information provided by the slave controller 102. The master controller 101 is also coupled with the second functional element 30. The master controller 101 can determine the second safety information of the second functional element 30. The second safety information can be used by the master controller 101 to perform at least one of functional safety diagnosis or network security diagnosis. In some embodiments of the present disclosure, the second safety information can include state information of the second functional element 30, such as fault information and non-fault information, etc.

[0049] In some embodiments of the present disclosure, the first safety information can include at least one of: lidar state information used to locate a lidar fault or a fault cause, or quality factor information used to guide lidar diagnosis. The second safety information can include at least one of: lidar state information used to locate a lidar fault or a fault cause, or quality factor information used to guide lidar diagnosis. For example, the quality factor information used to guide lidar diagnosis can include diagnosis threshold, diagnosis logic, diagnosis times, diagnosis state record information, etc.

[0050] In some embodiments of the present disclosure, the master controller 101 can determine at least one of a functional safety diagnosis result or a network security diagnosis result of the lidar based on the first safety information and the second safety information. The functional safety diagnosis result can include whether a function of a functional unit (such as the first functional element and the second functional element) in the lidar is abnormal. The network security diagnosis result can include whether a data transmission network of the lidar is abnormal.

[0051] In some embodiments of the present disclosure, the master controller 101 can also perform a safety action according to at least one of the functional safety diagnosis result or the network security diagnosis result. In some embodiments of the present disclosure, when at least one of the functional safety diagnosis result or the network security diagnosis result indicates an abnormality, the master controller 101 can ensure the functional safety and the network security of the lidar by performing the safety action.

[0052] In some embodiments of the present disclosure, through the cooperation of the master controller 101 and the slave controller 102, the master controller can determine at least one of a functional safety diagnosis result or a network security diagnosis result of the lidar based on the first safety information and the second safety information. In this way, the diagnosis of the functional safety and the network security in the lidar can be realized, and the functional safety and the network security of the lidar can be ensured by performing the safety action, thereby ensuring the safety of the lidar during the working process.

[0053] In some embodiments of the present disclosure, the master controller 101 can include a microcontroller unit (MCU), a field programmable gate array (FPGA), a system on chip (SoC), an application specific integrated circuit (ASIC) chip, or the like.

[0054] In some embodiments of the present disclosure, the slave controller 102 can include an MCU, an FPGA, an SoC, an ASIC, or the like.

[0055] For example, when the master controller 101 is an MCU (e.g., an MCU of the lidar) and the slave controller 102 is an FPGA (e.g., an FPGA of the lidar), the MCU can include a controller that implements functional safety and cyber security countermeasures and communication protocol stacks, and the FPGA can include a controller that implements system timing control, point cloud data processing, and motor control.

[0056] For another example, the master controller 101 and the slave controller 102 can both be disposed in an MCU (e.g., an MCU of the lidar). The master controller 101 can implement functional safety and cyber security countermeasures and communication protocol stacks. The slave controller 102 can implement system timing control, point cloud data processing, and motor control.

[0057] In some embodiments of the present disclosure, the safety system including the master controller 101 and the slave controller 102 has a simple structure and low hardware complexity. The safety system of the present disclosure can be implemented using various types of hardware carriers, and has strong versatility.

[0058] In some embodiments of the present disclosure, the first safety information includes at least one of first functional safety information, first cyber security information, or a first diagnosis result. The first diagnosis result includes a functional safety diagnosis result of the first functional element 20 by the slave controller 102. The slave controller 102 can be coupled to the first functional element 20, and determine the first functional safety information and the first cyber security information. The slave controller 102 can send the first functional safety information and the first cyber security information to the master controller 101.

[0059] In some embodiments of the present disclosure, the slave controller 102 can also determine the first diagnosis result of the first functional element 20 based on the first functional safety information, and send the first diagnosis result to the master controller 101.

[0060] In some embodiments of the present disclosure, the slave controller 102 can further send the first functional safety information, the first network security information, and the first diagnosis result to the master controller 101.

[0061] In some embodiments of the present disclosure, the second safety information includes at least one of second functional safety information, second network security information, or a second diagnosis result. The second diagnosis result includes a safety diagnosis result of the master controller 101 on the second functional element 30.

[0062] In some embodiments of the present disclosure, the first functional safety information includes functional safety related process data determined based on the first functional element 20. The first network security information includes network security related process data determined based on the first functional element 20. The second functional safety information includes functional safety related process data determined based on the second functional element 30. The second network security information includes network security related process data determined based on the second functional element 30.

[0063] The safety system 10 is described below in combination with the structure of the master controller 101 and the slave controller 102.

[0064] In some embodiments of the present disclosure, the master controller 101 includes a master diagnosis manager and a master functional diagnosis device, and the slave controller 102 includes a slave diagnosis manager and a slave functional diagnosis device.

[0065] Referring to FIG. 2, FIG. 2 shows a structural schematic diagram of another safety system for lidar provided by embodiments of the present disclosure. The master controller 101 includes a master diagnosis manager 1011. In some embodiments, the master diagnosis manager 1011 can be a circuit on a circuit board or a chip. For example, the master controller 101 can be an MCU. The master diagnosis manager 1011 can be a part of the circuit on the MCU. The master diagnosis manager 1011 can determine at least one of a functional safety diagnosis result or a network security diagnosis result based on input information. The input information of the master diagnosis manager 1011 can include at least one of first safety information of the first functional element or second safety information of the second functional element. In some embodiments, the master diagnosis manager 1011 is a safety management center. By coordinating and managing functional safety diagnosis and network security diagnosis through the master diagnosis manager 1011, global safety management of the lidar can be achieved.

[0066] In some embodiments of the present disclosure, the master diagnosis manager 1011 can determine the functional safety diagnosis result based on at least one of the first functional safety information, the first diagnosis result, the second functional safety information, or the second diagnosis result. The master diagnosis manager 1011 can determine the network security diagnosis result based on at least one of the first network security information, the first diagnosis result, the second network security information, or the second diagnosis result.

[0067] In some embodiments of the present disclosure, the main controller 101 further comprises a main function diagnostic 1012. In some embodiments, the main function diagnostic 1012 can be a circuit on a circuit board or a chip. For example, the main controller 101 can be an MCU. The main function diagnostic 1012 can be a part of the circuit on the MCU. The main function diagnostic 1012 is coupled to the slave controller 102. In some embodiments of the present disclosure, the main function diagnostic 1012 can be coupled to the slave controller 102, and the main function diagnostic 1012 can communicate with the slave controller 102 to receive the first safety information. The main function diagnostic 1012 is further coupled to the main diagnostic manager 1011 to provide a preliminary functional safety diagnostic result for the main diagnostic manager 1011 to make a decision. The preliminary functional safety diagnostic result can include a part of the functional safety diagnostic in the first diagnostic result and the second diagnostic result.

[0068] In some embodiments of the present disclosure, the main function diagnostic 1012 can receive the first safety information provided by the slave controller 102 and determine the second functional safety information. The main function diagnostic 1012 can determine the preliminary functional safety diagnostic result based on the first safety information and the second functional safety information. The preliminary functional safety diagnostic result is input to the main diagnostic manager 1011. The main diagnostic manager 1011 can determine the functional safety diagnostic result according to the preliminary functional safety diagnostic result.

[0069] In some other embodiments of the present disclosure, the second safety information, the first functional safety information, and the first network safety information can also be input to the main diagnostic manager 1011. The main diagnostic manager 1011 can determine the functional safety diagnostic result according to the preliminary functional safety diagnostic result, the second safety information, and the first functional safety information.

[0070] In some embodiments of the present disclosure, the main function diagnostic 1012 can receive the first diagnostic result provided by the slave controller 102 and input the first diagnostic result to the main diagnostic manager 1011. The main function diagnostic 1012 can also generate a part of the functional safety diagnostic in the second diagnostic result according to the second functional safety information in the second safety information and input the second diagnostic result to the main diagnostic manager 1011.

[0071] In some embodiments of the present disclosure, the main function diagnostic 1012 can receive the first functional safety information provided by the slave controller 102 and generate the first diagnostic result. The main function diagnostic 1012 can also generate a part of the functional safety diagnostic in the second diagnostic result according to the second functional safety information in the second safety information and input the first diagnostic result and the second diagnostic result to the main diagnostic manager 1011.

[0072] In some embodiments of the present disclosure, the main diagnostic manager 1011 can enable or disable the main functional diagnostic 1012 based on the running state of the safety system. For example, the main diagnostic manager 1011 can enable or disable the function of the main functional diagnostic 1012.

[0073] In some embodiments of the present disclosure, the slave controller 102 includes a slave diagnostic manager 1021 and a slave functional diagnostic 1022. In some embodiments, the slave diagnostic manager 1021 can be a circuit on a circuit board or a chip. For example, the slave controller 102 can be an FPGA. The slave diagnostic manager 1021 can be a part of the circuit on the FPGA. In some embodiments, the slave functional diagnostic 1022 can be a circuit on a circuit board or a chip. For example, the slave controller 102 can be an FPGA. The slave functional diagnostic 1022 can be a part of the circuit on the FPGA. The slave diagnostic manager 1021 can perform the following first safety action: turning off the laser. Turning off the laser can make the laser stop emitting light. The slave diagnostic manager 1021 turns off the laser, for example, turns off the trigger drive of the laser, so that the laser radar enters a safe state.

[0074] By setting the slave diagnostic manager 1021 to perform the first safety action, the embodiments of the present disclosure can achieve safety control of the related function in the first functional element 20, and ensure the safety of the laser radar.

[0075] In some embodiments of the present disclosure, the slave functional diagnostic 1022 can determine the first functional safety information, and determine the first diagnostic result based on the first functional safety information. The slave functional diagnostic 1022 is also coupled to the slave diagnostic manager 1021, and can send the first diagnostic result to the slave diagnostic manager 1021. The slave diagnostic manager 1021 can record the first diagnostic result.

[0076] In some embodiments of the present disclosure, the slave functional diagnostic 1022 can determine the first functional safety information, and determine the first diagnostic result based on the first functional safety information. The slave functional diagnostic 1022 can send the first diagnostic result and the first functional safety information to the slave diagnostic manager 1021 together. The slave diagnostic manager 1021 can record the first diagnostic result and the first functional safety information.

[0077] In some embodiments of the present disclosure, the slave functional diagnostic 1022 can determine the first functional safety information and the first network safety information, and determine the first diagnostic result based on the first functional safety information. The slave functional diagnostic 1022 can send the first diagnostic result, the first functional safety information and the first network safety information to the slave diagnostic manager 1021 together. The slave diagnostic manager 1021 can record the first diagnostic result, the first functional safety information and the first network safety information.

[0078] In some embodiments of the present disclosure, the first safety information includes at least one of the first functional safety information, the first network safety information, or the first diagnosis result.

[0079] In some embodiments of the present disclosure, the slave diagnosis manager 1021 can receive an instruction from the master controller 101 and enable or disable the slave functional diagnosis 1022 in response to the instruction. In some embodiments, the slave diagnosis manager 1021 can enable or disable the slave functional diagnosis 1022 under the control of the master controller 101.

[0080] In some embodiments of the present disclosure, after the safety system 10 is started, the master diagnosis manager 1011 can perform one or more first safety actions, such as shutting down at least one of the first functional element or the second functional element, reporting the functional safety diagnosis result, and reporting the network safety diagnosis result.

[0081] In some embodiments, the safety system 10 can report at least one of the functional safety diagnosis result or the network safety diagnosis result to a terminal device in which the lidar is located. The terminal device can control the lidar to switch between a running state and a fault state according to the reported information.

[0082] In some embodiments of the present disclosure, the lidar can be installed on a terminal device in an application. The lidar sends the detected perception data to the terminal device. The terminal device can implement one or more functions such as analysis, decision-making, or control using the perception data. The terminal device can include a vehicle, a ship, an aircraft (such as a flying vehicle or a drone), a robot (such as an industrial robot or a household robot), and the like, without limitation.

[0083] By performing the first safety action by the master diagnosis manager 1011, the embodiments of the present disclosure can achieve safety control of the related functions in the second functional element 30, and ensure the safety of the lidar.

[0084] In some embodiments of the present disclosure, the master controller 101 includes a master diagnosis manager, a master functional diagnosis, a radar intrusion detector, a master network safety device, a trusted platform module, or a hardware safety module. In some embodiments, the master network safety device can be a circuit or a hardware device on a circuit board or a chip. The trusted platform module can be a circuit or a hardware device on a circuit board or a chip. The hardware safety module can be a circuit or a hardware device on a circuit board or a chip. In some embodiments of the present disclosure, the slave controller 102 includes a slave diagnosis manager, a slave functional diagnosis, and a slave network safety device. In some embodiments, the slave network safety device can be a circuit or a hardware device on a circuit board or a chip.

[0085] Referring to FIG. 3, FIG. 3 shows a structural schematic diagram of a main controller according to some embodiments of the present disclosure. The radar intrusion detector 1013 can record the execution state of the network security function in the lidar and the second network security information. In some embodiments of the present disclosure, the radar intrusion detector 1013 is coupled to the main network security device 1014. The radar intrusion detector 1013 can receive the execution state of the network security function and the second network security information from the main network security device 1014.

[0086] For example, the radar intrusion detector 1013 can determine the network security diagnosis result based on the execution state of the network security function and the second network security information. The radar intrusion detector 1013 can also transmit the second network security information to the terminal device where the lidar is located through periodic triggering or event triggering. The second network security information includes network security related state information.

[0087] In some embodiments of the present disclosure, in the startup phase of the security system 10, the radar intrusion detector 1013 can perform a second security action according to the network security diagnosis result. The second security action includes terminating the continued startup of the security system 10. For example, in the startup phase of the security system 10, when a network security related event occurs in the lidar, such as data transmission security, external malicious attack, etc., the radar intrusion detector 1013 can perform a second security action to make the lidar enter a network security state (rescue mode).

[0088] The embodiments of the present disclosure can avoid the startup of the lidar in an unsafe network state, which may cause data leakage, and further ensure the safety of the lidar by performing a second security action in the startup phase of the security system through the radar intrusion detector.

[0089] In some embodiments of the present disclosure, the main network security device 1014 can perform a network security function. In some embodiments, the main network security device 1014 can be coupled to a trusted platform module (TPM) or a hardware security module (HSM) 1015. The main network security device 1014 and the trusted platform module or the hardware security module 1015 can jointly perform a network security function. For example, the network security function includes signing or verifying (secure boot), secure storage (secure memory), secure access (secure access), and secure communication (security communication). When the main network security device 1014 performs the network security function, it can output the execution state of the network security function and the second network security information to the radar intrusion detector 1013.

[0090] In some embodiments of the present disclosure, the trusted platform module or hardware security module 1015 can perform hardware encryption and decryption, signing and verification of network security related data with confidentiality or integrity, and can support multiple encryption algorithms. The trusted platform module or hardware security module 1015 can ensure the security of data transmission and ensure the network security of the lidar.

[0091] Referring to FIG. 4, FIG. 4 shows a structural schematic diagram of a slave controller according to some embodiments of the present disclosure. The slave controller 102 can further include a slave network security device 1023. The slave network security device 1023 can perform network security functions. In some embodiments, the slave network security device 1023 can perform network security functions together with the trusted platform module or hardware security module 1015. When the slave network security device 1023 performs network security functions, it can form an execution state of the network security functions and first network security information.

[0092] The slave network security device 1023 is coupled to the slave function diagnostic device 1022, and the slave network security device 1023 sends the first network security information to the slave function diagnostic device 1022. In some embodiments of the present disclosure, the master controller 101 includes a master diagnostic manager, a master function diagnostic device, a radar intrusion detection device, a master network security device, a trusted platform module or hardware security module, and a first peripheral. The slave controller 102 includes a slave diagnostic manager, a slave function diagnostic device, a slave network security device, and a second peripheral.

[0093] Referring to FIG. 5, FIG. 5 shows a structural schematic diagram of another security system for a lidar according to some embodiments of the present disclosure. In some embodiments of the present disclosure, the master controller 101 further includes a first peripheral 1016. The slave controller 102 further includes a second peripheral 1024. The master controller 101 and the slave controller 102 can manage the peripherals.

[0094] In some embodiments of the present disclosure, the first peripheral 1016 and the second peripheral 1024 can include at least one of a power management IC (PMIC), a watchdog, a flash memory, a double data rate (RAM), a trusted platform module, a hardware security module, or an Ethernet chip.

[0095] For example, the power management IC can monitor the supply voltage of the master controller 101 and the slave controller 102, and independently supply power to the master controller 101, the watchdog, and other modules. The watchdog can monitor the clock and program flow of the safety-related functional units in the master controller 101 and the slave controller 102.

[0096] The trusted platform module and the hardware security module can be arranged in the main controller 101, or can be arranged as peripherals of the main controller 101 and the slave controller 102, and the present disclosure does not limit this.

[0097] In some embodiments of the present disclosure, the first peripheral 1016 is coupled to the main diagnostic manager 1011. The first peripheral 1016 can interact with the main diagnostic manager 1011 in data. The second peripheral 1024 is coupled to the slave diagnostic manager 1021. The second peripheral 1024 can interact with the slave diagnostic manager 1021 in data.

[0098] In some embodiments of the present disclosure, the first peripheral 1016 is arranged outside the main controller 101. In the case that the second peripheral 1024 is arranged outside the slave controller 102, when the main controller 101 communicates with the first peripheral 1016 and the slave controller 102 communicates with the second peripheral 1024, if the data exchanged is security-related data, data integrity check needs to be performed on the data, for example, checksum or readback; the communication protocol supports end-to-end (E2E) protection and data signature.

[0099] In some embodiments of the present disclosure, when the main diagnostic manager 1011 performs shutdown on at least one of the first functional element or the second functional element in the lidar, the main diagnostic manager 1011 can jointly perform shutdown on at least one of the first functional element or the second functional element in the lidar with the peripheral PMIC and the monitoring chip, so that the lidar system enters a safe state through the shutdown.

[0100] In embodiments of the present disclosure, by arranging the peripheral in the safety system, the peripheral can monitor the state of the safety system and other functional devices in the lidar and the data exchanged, further ensuring the safety of the lidar during operation.

[0101] In embodiments of the present disclosure, the safety system 10 for the lidar described above can be arranged inside the lidar. For example, the safety system 10 can be arranged in a chip (such as a SOC, a baseband chip, etc.) of the lidar. For example, the safety system 10 can be arranged in a chip module in the lidar. For example, the safety system 10 can be arranged on a circuit board in the lidar.

[0102] In embodiments of the present disclosure, the safety system 10 can also be arranged outside the lidar. For example, the safety system 10 can be arranged in a server, a computer terminal, a vehicle controller, etc. The safety system 10 is coupled to the first functional element and the second functional element of the lidar.

[0103] Please refer to FIG. 6, which shows a structural schematic diagram of a laser radar according to some embodiments of the present disclosure. Some embodiments of the present disclosure also disclose a laser radar, which can include a safety system 10 for the laser radar, a first functional element 20, and a second functional element 30.

[0104] In some embodiments of the present disclosure, the first functional element 20 is coupled to the slave controller 102 in the safety system 10, and the second functional element 30 is coupled to the master controller 101 in the safety system 10.

[0105] In some embodiments of the present disclosure, the first functional element 20 and the second functional element 30 are functional units in the laser radar 100, and the first functional element 20 is different from the second functional element 30.

[0106] In some embodiments of the present disclosure, a terminal device is also disclosed, and the laser radar described above can be installed on the terminal device. The laser radar sends the detected perception data to the terminal device, and the terminal device uses the perception data to realize one or more functions such as analysis, decision-making, or control. The terminal device can include a vehicle, a ship, an aircraft (such as a flying vehicle or a drone), a robot (such as an industrial robot or a household robot), etc., and the present disclosure does not limit the terminal device.

[0107] For more details about the working principle and working mode of the laser radar 100, please refer to the related descriptions in FIG. 1 to FIG. 5 and the corresponding embodiments, which will not be repeated here.

[0108] Regarding the modules / units included in the various devices and products described in the above embodiments, they can be software modules / units, hardware modules / units, or a combination of both. For example, for various devices and products applied to or integrated into a chip, all of their modules / units can be implemented using hardware methods such as circuits, or at least some modules / units can be implemented using software programs that run on a processor integrated within the chip, while the remaining (if any) modules / units can be implemented using hardware methods such as circuits; for various devices and products applied to or integrated into a chip module, all of their modules / units can be implemented using hardware methods such as circuits, and different modules / units can be located in the same component (e.g., chip, circuit module, etc.) or different components of the chip module, or at least some modules / units can be implemented using hardware methods such as circuits. The components can be implemented using software programs that run on the processor integrated within the chip module. The remaining (if any) modules / units can be implemented using hardware methods such as circuits. For various devices and products applied to or integrated into the terminal, each of its components / units can be implemented using hardware methods such as circuits. Different modules / units can be located in the same component (e.g., chip, circuit module, etc.) or in different components within the terminal. Alternatively, at least some modules / units can be implemented using software programs that run on the processor integrated within the terminal, while the remaining (if any) modules / units can be implemented using hardware methods such as circuits.

[0109] This disclosure also discloses a storage medium, which is a computer-readable storage medium storing a computer program thereon. When the computer program is executed, it can perform the steps of the aforementioned method. The storage medium may include ROM, RAM, a magnetic disk, or an optical disk, etc. The storage medium may also include non-volatile memory or non-transitory memory, etc.

[0110] It should be understood that the term "connection" in the embodiments of this disclosure refers to various connection methods, such as direct connection or indirect connection, to achieve communication between devices, and the embodiments of this disclosure do not limit this in any way.

[0111] In this disclosure, unless otherwise expressly specified and limited, ordinal numbers, such as "first," "second," etc., are used only to distinguish and describe related objects, and should not be construed as indicating or implying the relative importance or order between related objects. Furthermore, ordinal numbers do not represent the quantity of related objects. For example, "first lidar" may include one lidar or multiple lidars.

[0112] "Multiple" includes two or more, and other classifiers are similar.

[0113] The terms "or," "and / or," used in the disclosure are used to describe relationships between associated objects in a manner that is non-exclusive. For example, "A and / or B" and "A or B" each can include "A alone," "B alone," or "A and B," where "A" and "B" can include a single object or multiple objects. For another example, "A, B, and / or C," "A, B, or C," and "A, B, and C" each can include "A alone," "B alone," "C alone," "A and B," "A and C," "B and C," or "A, B, and C," where "A," "B," and "C" can include a single object or multiple objects. In addition, " / " in the disclosure is used to represent the relationship between the associated objects "or." The meanings of "at least one of A or B" and "one or more of A and B" in the disclosure are the same as the meaning of "A or B" above, and the meanings of "one or more of A, B, and C" and "at least one of A, B, or C" are the same as the meaning of "A, B, or C" above. The meaning of "one or more of A, B, and C" is the same as the meaning of "A, B, or C" above.

[0114] It should be understood that, in the embodiments of the disclosure, the processor can be a central processing unit (CPU), and the processor can also be other general-purpose processors, digital signal processors (DSPs), ASICs, FPGAs, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0115] It should also be understood that the memory in the embodiments of the present disclosure can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically EPROM (EEPROM) or a flash memory. The volatile memory can be a random access memory (RAM) used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DRAM) (DRAM).

[0116] The above-described embodiments can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented by software, the above-described embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the processes or functions described in the embodiments of the present disclosure are wholly or partially generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transferred from one website, computer, server, or data center to another website, computer, server, or data center through a wired or wireless manner. The computer-readable storage medium can be any available medium accessible by a computer or a data storage device such as a server, data center, or the like containing one or more available medium collections. It should be understood that in various embodiments of the present disclosure, the size of the serial number of the above processes does not mean the execution order, and the execution order of the processes should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present disclosure.

[0117] In several embodiments provided by the present disclosure, it should be understood that the disclosed methods, devices and systems can be implemented in other ways. For example, the above-described device embodiments are only illustrative; for example, the division of the units is only a logical function division, and actual implementation can have another division manner; for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed units can be indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0118] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or they can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of some embodiments of the present disclosure.

[0119] In addition, the functional units in each embodiment of the present disclosure can be integrated in one processing unit, or each individual physical unit, or two or more units integrated in one unit. The above integrated unit can be realized in the form of hardware or hardware and software functional units.

[0120] The integrated units in the form of hardware mentioned above can be implemented in the form of hardware circuit, and the functions of part or all of the modules can be implemented by the design of the hardware circuit, which can be understood as one or more processors. For example, in one implementation, the hardware circuit is an ASIC, and the functions of part or all of the modules are implemented by the design of the logical relationship of the elements in the circuit. For another example, in another implementation, the hardware circuit is a programmable logic device (PLD), which can include a large number of logic gate circuits, and the logical relationship between the logic gate circuits is configured by a configuration file, so as to implement the functions of part or all of the modules.

[0121] The integrated units in the form of hardware and software function units can be implemented in the form of processor calling software. For example, the system includes a processor, the processor is connected with a memory, the memory stores instructions, and the processor calls the instructions stored in the memory to implement any one of the above methods or the functions of the modules of the system. The processor is, for example, a general processor such as a CPU or a microprocessor, and the memory is a memory in the system or a memory outside the system. The software mentioned above can be stored in a computer readable storage medium.

[0122] Although the present disclosure discloses the above, the present disclosure is not limited thereto. Any person skilled in the art can make various modifications and changes without departing from the spirit and scope of the present disclosure, and therefore the protection scope of the present disclosure should be subject to the scope defined by the claims.

Claims

1. A safety system for a lidar, the lidar comprising a first functional element and a second functional element, characterized in that, The safety system comprises: a slave controller configured to determine first safety information of the first functional element; a master controller configured to receive the first safety information provided by the slave controller, and determine second safety information of the second functional element, determine at least one of a functional safety diagnosis result or a network security diagnosis result of the lidar based on the first safety information and the second safety information; the master controller is further configured to perform a safety action according to at least one of the functional safety diagnosis result or the network security diagnosis result.

2. The safety system of claim 1, wherein, The first safety information comprises at least one of first functional safety information, first network security information, or a first diagnosis result, the first diagnosis result comprising a safety diagnosis result of the slave controller on the first functional element; The second safety information comprises at least one of second functional safety information, second network security information, or a second diagnosis result, the second diagnosis result comprising a safety diagnosis result of the master controller on the second functional element.

3. The safety system of claim 2, wherein, The master controller comprises a master diagnosis manager configured to receive the first safety information provided by the slave controller, and determine the second functional safety information, determine a preliminary functional safety diagnosis result based on the second functional safety information, the preliminary functional safety diagnosis result being used as an input to the master diagnosis manager to determine the functional safety diagnosis result; and the master diagnosis manager is configured to determine the network security diagnosis result based on at least one of the first network security information, the first diagnosis result, or second network security information.

4. A safety system according to claim 3, characterised in that, After the safety system is started, the master diagnosis manager is configured to perform at least one of the following first safety actions: shutting down the first functional element, shutting down the second functional element, reporting the functional safety diagnosis result, or reporting the network security diagnosis result.

5. The safety system of claim 1, wherein, The first functional element comprises at least one of the slave controller, the master controller, a point cloud data processor, a point cloud data transmitter, a laser, a detector, a motor, or a windshield heater; and the second functional element comprises at least one of the slave controller, the master controller, a point cloud data processor, a point cloud data transmitter, a laser, a detector, a motor, or a windshield heater.

6. The safety system of claim 1, wherein, The slave controller comprises a slave diagnosis manager configured to record the first safety information.

7. The safety system of claim 6, wherein, The slave diagnosis manager is configured to perform the following first safety action: shutting down a laser.

8. The safety system of claim 6, wherein, The slave controller further comprises a slave functional diagnosis device configured to determine first functional safety information in the first safety information, and determine a first diagnosis result based on the first functional safety information.

9. The safety system of claim 8, wherein, The slave diagnosis manager is configured to receive an instruction of the master controller, and enable or disable the slave functional diagnosis device in response to the instruction.

10. A chip, characterized by The chip comprises the safety system of any one of claims 1 to 9.

11. A lidar, comprising: The lidar comprises the safety system of any one of claims 1 to 9.

12. A terminal device, comprising: The terminal device comprises the lidar of claim 11.

Images