CN115390431A

CN115390431A - Controller and vehicle

Info

Publication number: CN115390431A
Application number: CN202211152534.7A
Authority: CN
Inventors: 刘玥; 潘波; 陈恺; 韩静茹
Original assignee: Shanghai Xiaoma Zhixing Intelligent Technology Development Co ltd
Current assignee: Shanghai Xiaoma Zhixing Intelligent Technology Development Co ltd
Priority date: 2022-09-21
Filing date: 2022-09-21
Publication date: 2022-11-25

Abstract

The application provides a controller and a vehicle. The controller comprises a central processing unit and a micro-processing unit, wherein the central processing unit is used for receiving a plurality of pieces of first environment information sent by a plurality of first sensors, generating a first control instruction at least according to the plurality of pieces of first environment information, and controlling a chassis actuator to execute the first control instruction; the micro-processing unit is used for receiving a plurality of second environment information sent by a plurality of second sensors and generating a second control instruction at least according to the plurality of second environment information, and under the condition that the central processing unit is in a fault, the micro-processing unit is used for controlling the chassis backup actuator to execute the first control instruction or the second control instruction, so that the safety of the vehicle is ensured to be higher, the material and development cost of the controller are ensured to be lower, and the problem that the control and the redundant backup of the automatic driving vehicle are difficult to realize in the same controller in the prior art is solved.

Description

Controller and vehicle

Technical Field

The application relates to the field of automatic driving, in particular to a controller and a vehicle.

Background

With the rapid development of automobile intellectualization and the promotion of supervision departments in various areas on the admission standard of the automatic driving vehicle, the high-level automatic driving function gradually enters the automobile front-loading market. The safety of autonomous vehicles has become an important part of the landing of products. According to the definition of the autonomous vehicle by SAEJ3016, a high-level autonomous driving system should support conditional or no driver take over after the autonomous driving master controller fails. Therefore, there is a need for a high-level autopilot system that is capable of taking over control of a vehicle after a primary controller failure by a backup controller.

However, in the prior art, when the failure controllable function of the high-level automatic driving system is realized, the failure controllable function is usually realized by combining an independent backup controller and an independent main controller, and the backup controller has an independent sensor for collecting information, such as a radar sensor, an Inertial Measurement Unit (IMU), and the like. However, the following problems still exist in that independent sensors are respectively provided for the main controller and the backup controller, and the control of the autonomous vehicle is realized through the main controller and the backup controller:

1. because the communication bandwidth and the real-time performance are limited, the main controller and the backup controller of the automatic driving vehicle can only control the automatic driving vehicle according to the information acquired by respective sensors, so that the performance of a perception algorithm is limited;

2. the output results of the main controller and the backup controller cannot be checked with each other, and only the safe running of the automatic driving vehicle can be ensured by setting a limit value at the chassis actuator. The scheme can only correct the damage caused by overlarge or undersize control output values, and can not correct failures such as trajectory tracking deviation, lane deviation and the like;

3. the primary and backup controllers use separate sensors and separate controllers, respectively, resulting in higher controller material and development costs.

Accordingly, there is a need for a controller that can simultaneously implement control and redundant backup of an autonomous vehicle.

Disclosure of Invention

The main objective of the present application is to provide a controller and a vehicle, so as to solve the problem that it is difficult to simultaneously implement control and redundant backup of an autonomous vehicle in the same controller in the prior art.

According to an aspect of an embodiment of the present invention, there is provided a controller for performing driving control of a vehicle, the controller including: the central processing unit is in communication connection with the plurality of first sensors, and is used for receiving a plurality of pieces of first environment information sent by the plurality of first sensors, generating a first control instruction according to at least the plurality of pieces of first environment information, and controlling the chassis actuator to execute the first control instruction; and the microprocessor unit is used for receiving a plurality of pieces of second environment information sent by the plurality of second sensors and generating a second control command according to at least the plurality of pieces of second environment information, and under the condition that the central processing unit is in a fault, the microprocessor unit is used for controlling the chassis backup executor to execute the first control command or the second control command, wherein the first environment information and the second environment information are both environment information of the vehicle in a preset area.

Optionally, the controller further comprises: and the exchange processing unit is in communication connection with a third sensor and is used for receiving third environmental information sent by the third sensor and respectively sending the third environmental information to the central processing unit and the micro-processing unit, wherein the third environmental information is environmental information of the vehicle in the preset area.

Optionally, the switching processing unit is further configured to: receiving a plurality of pieces of second environment information sent by the micro-processing unit, and forwarding the plurality of pieces of second environment information to the central processing unit; and receiving a plurality of pieces of first environment information sent by the central processing unit, and forwarding the plurality of pieces of first environment information to the micro-processing unit.

Optionally, the central processing unit includes a first control module, the micro processing unit includes a second control module, and the generating of the first control instruction at least according to the plurality of pieces of first environment information includes: the first control module generates the first control instruction according to the plurality of pieces of first environment information, the plurality of pieces of second environment information and the third environment information; generating a second control command according to at least a plurality of second environment information, including: and the second control module generates the second control instruction according to the plurality of second environment information and the third environment information.

Optionally, the central processing unit further comprises: the first checking module is used for receiving the first control instruction sent by the first control module, receiving the second control instruction sent by the second control module and checking the first control instruction and the second control instruction; the first diagnosis module is used for carrying out fault detection on the central processing unit; the micro-processing unit further includes: the second checking module is configured to receive a third control instruction sent by the first control module, receive a fourth control instruction sent by the second control module, and check the third control instruction and the fourth control instruction, where the first control instruction and the third control instruction are the same control instruction, and the second control instruction and the fourth control instruction are the same control instruction; and the second diagnosis module is used for carrying out fault detection on the micro-processing unit.

Optionally, the vehicle further includes a first CAN transceiver and a second CAN transceiver, wherein the first CAN transceiver is in communication connection with the first checking module and the second diagnosing module, respectively, and the second CAN transceiver is in communication connection with the second checking module and the first diagnosing module, respectively, and after checking the first control command and the second control command and checking the third control command and the fourth control command, the controller is further configured to: under the condition that the first checking module and the second checking module both pass the checking and the first diagnosis module and the second diagnosis module both do not detect faults, the first checking module sends the first control instruction to the first CAN transceiver so that the first CAN transceiver forwards the first control instruction to the chassis executor, and the first diagnosis module sends a first closing instruction to the second CAN transceiver so that the second CAN transceiver does not work.

Optionally, after verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller is further configured to: under the conditions that the first checking module fails to check, the second checking module passes to check, the first diagnosis module detects a fault, and the second diagnosis module does not detect the fault, the second checking module sends the third control command to the second CAN transceiver so that the second CAN transceiver forwards the third control command to the chassis backup executor, and the second diagnosis module sends a second closing command to the first CAN transceiver so that the first CAN transceiver does not work; under the conditions that the first checking module fails to check, the second checking module passes the check, the first diagnosis module does not detect the fault and the second diagnosis module detects the fault, the first checking module sends the first control command to the first CAN transceiver so that the first CAN transceiver forwards the first control command to the chassis actuator, and the first diagnosis module sends the first closing command to the second CAN transceiver so that the second CAN transceiver does not work.

Optionally, after verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller is further configured to: under the condition that the first checking module and the second checking module do not check, the first diagnosis module detects a fault and the second diagnosis module does not detect the fault, the second checking module sends the fourth control instruction to the second CAN transceiver so that the second CAN transceiver sends the fourth control instruction to be forwarded to the chassis backup executor, and the second diagnosis module sends a second closing instruction to the first CAN transceiver so that the first CAN transceiver does not work; under the conditions that the first checking module and the second checking module do not check, the first diagnosis module does not detect faults and the second diagnosis module detects faults, the first checking module sends the first control command to the first CAN transceiver so that the first CAN transceiver forwards the first control command to the chassis executor, and the first diagnosis module sends the first closing command to the second CAN transceiver so that the second CAN transceiver does not work.

Optionally, after verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller is further configured to: under the conditions that the first checking module passes checking, the second checking module fails checking, the first diagnosis module detects a fault, and the second diagnosis module does not detect a fault, the second checking module sends the fourth control command to the second CAN transceiver, so that the second CAN transceiver sends the fourth control command to be forwarded to the chassis backup executor, and the second diagnosis module sends a second closing command to the first CAN transceiver, so that the first CAN transceiver does not work; under the conditions that the first checking module passes checking, the second checking module fails checking, the first diagnosis module does not detect faults and the second diagnosis module detects faults, the first checking module sends the first control command to the first CAN transceiver so that the first CAN transceiver forwards the first control command to the chassis actuator, and the first diagnosis module sends the first closing command to the second CAN transceiver so that the second CAN transceiver does not work.

Optionally, after verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller is further configured to: and under the conditions that the first checking module fails to check, the second checking module passes check, the first diagnosis module detects a fault, and the second diagnosis module detects a fault, the first CAN transceiver and the second CAN transceiver are both in a closed state, and the vehicle is in emergency stop.

Optionally, the central processing unit and the micro processing unit do not share the same power supply unit.

Optionally, the plurality of first sensors include an image acquisition device and a lidar, and the plurality of second sensors include a short-range millimeter-wave radar and a GNSS and IMU fusion location.

Optionally, the exchange processing unit is respectively in communication with the central processing unit and the micro processing unit through an RGMII communication interface, and the third sensor is a long-range millimeter wave radar.

Optionally, the first calibration module and the second diagnostic module communicate with the first CAN transceiver through a CAN line, the second calibration module and the first diagnostic module communicate with the second CAN transceiver through the CAN line, the first control module communicates with the second calibration module through an SPI communication bus, the second control module communicates with the first calibration module through the SPI communication bus, the first calibration module communicates with the first diagnostic module through the SPI communication bus, the first diagnostic module communicates with the second diagnostic module through the SPI communication bus, and the second diagnostic module communicates with the second calibration module through the SPI communication bus.

According to another aspect of the embodiment of the present invention, there is also provided a vehicle including a controller, the controller being any one of the controllers.

In an embodiment of the present invention, the controller includes a central processing unit and a micro processing unit, where the central processing unit is communicatively connected to the plurality of first sensors, and is configured to receive a plurality of pieces of first environment information sent by the plurality of first sensors, generate a first control instruction according to at least the plurality of pieces of first environment information, and control the chassis actuator to execute the first control instruction; the micro-processing unit is in communication connection with the second sensors and is used for receiving the second environment information sent by the second sensors and generating a second control instruction according to the second environment information, and under the condition that the central processing unit is in a fault, the micro-processing unit is used for controlling the chassis backup actuator to execute the first control instruction or the second control instruction. In the application, a central processing unit (namely a main controller) generates a first control instruction at least according to a plurality of pieces of first environment information to realize automatic driving control of a vehicle; and under the condition that the central processing unit has a fault, the micro processing unit (namely the backup controller) generates a second control command at least according to the plurality of second environment information, and controls the chassis backup executor to execute the first control command or the second control command. That is to say, under the condition that the central processing unit breaks down, the micro-processing unit realizes the emergency take-over of the vehicle, thereby realizing the control and the redundancy backup of the vehicle in the same controller, thus ensuring the higher safety of the vehicle, ensuring the lower material and development cost of the controller, and further solving the problem that the control and the redundancy backup of the automatic driving vehicle in the same controller are difficult to realize simultaneously in the prior art.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this application, illustrate embodiments of the application and, together with the description, serve to explain the application and are not intended to limit the application. In the drawings:

FIG. 1 shows a schematic structural diagram of a controller according to an embodiment of the present application;

fig. 2 shows a schematic structural diagram of a controller according to yet another embodiment of the present application.

Wherein the figures include the following reference numerals:

100. a controller; 200. a central processing unit; 201. an image acquisition device; 202. a laser radar; 203. a first sensing module; 204. a first positioning module; 205. a prediction module; 206. a first path planning module; 207. a first control module; 208. a first checking module; 209. a first diagnostic module; 210. a first CAN transceiver; 211. a first sensor; 2011. camera information; 2021. laser radar information; 300. a switching processing unit; 301. a third sensor; 3011. long range millimeter wave radar information; 400. a micro-processing unit; 401. short-range millimeter wave radar; 402. GNSS and IMU fusion positioning; 403. a second sensing module; 404. a second positioning module; 405. a second path planning module; 406. a second control module; 407. a second diagnostic module; 408. a second check module; 409. a second CAN transceiver; 410. a second sensor; 4011. short-range millimeter wave radar information; 4021. fusing information; 500. a chassis actuator; 600. and backing up the executor by the chassis.

Detailed Description

It should be noted that the embodiments and features of the embodiments in the present application may be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings in conjunction with embodiments.

In order to make the technical solutions better understood by those skilled in the art, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only partial embodiments of the present application, but not all embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.

It should be noted that the terms "first," "second," and the like in the description and claims of this application and in the drawings described above are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It should be understood that the data so used may be interchanged under appropriate circumstances in order to facilitate the description of the embodiments of the application herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

As mentioned in the background of the invention, it is difficult to implement control and redundant backup of an autonomous vehicle in the same controller in the prior art, and to solve the above problems, in an exemplary embodiment of the present application, a controller and a vehicle are provided.

According to an embodiment of the present application, a controller is provided. As shown in fig. 1, the vehicle includes a controller 100, a chassis executor 500, and a chassis backup executor 600, the controller 100 being used for driving control of the vehicle. The controller 100 includes a central processing unit 200 and a micro processing unit 400. The central processing unit 200 is communicatively connected to the plurality of first sensors 211, and the central processing unit 200 is configured to receive a plurality of pieces of first environment information sent by the plurality of first sensors 211, generate a first control command according to at least the plurality of pieces of first environment information, and control the chassis actuator 500 to execute the first control command; the microprocessor 400 is communicatively connected to the plurality of second sensors 410, the microprocessor 400 is configured to receive a plurality of second environment information transmitted by the plurality of second sensors 410, generate a second control command according to at least the plurality of second environment information, and control the chassis backup executor 600 to execute the first control command or the second control command when the central processing unit 200 is in a failure, where the first environment information and the second environment information are environment information of the vehicle in a predetermined area.

The controller comprises a central processing unit and a micro-processing unit, wherein the central processing unit is in communication connection with the first sensors and is used for receiving the first environment information sent by the first sensors, generating a first control instruction according to the first environment information and controlling the chassis actuator to execute the first control instruction; the micro-processing unit is in communication connection with the second sensors and is used for receiving the second environment information sent by the second sensors and generating a second control instruction according to the second environment information at least, and under the condition that the central processing unit is in a fault, the micro-processing unit is used for controlling the chassis backup actuator to execute the first control instruction or the second control instruction. In the application, a central processing unit (namely a main controller) generates a first control instruction at least according to a plurality of pieces of first environment information to realize automatic driving control of a vehicle; and under the condition that the central processing unit breaks down, the micro-processing unit (namely the backup controller) generates a second control instruction at least according to a plurality of second environment information, and controls the chassis backup actuator to execute the first control instruction or the second control instruction, namely, under the condition that the central processing unit breaks down, the micro-processing unit realizes emergency take-over of the vehicle, so that the vehicle is controlled and redundant backup is realized in the same controller, the safety of the vehicle is ensured to be higher, the material and development cost of the controller are ensured to be lower, and the problem that in the prior art, the control and the redundant backup of the automatic driving vehicle are difficult to realize in the same controller at the same time is solved.

Specifically, in the above-described embodiment, the types of the plurality of first sensors and the plurality of second sensors among the plurality of first sensors and the plurality of second sensors may be completely different. Of course, there may be some similarities in the types of the plurality of first sensors and the plurality of second sensors.

In an embodiment of the present invention, as shown in fig. 1, the controller 100 further includes an exchange processing unit 300, the exchange processing unit 300 is communicatively connected to a third sensor 301, and the exchange processing unit 300 is configured to receive third environment information sent by the third sensor 301 and send the third environment information to the central processing unit 200 and the micro processing unit 400, respectively, where the third environment information is environment information of the vehicle in the predetermined area. In this embodiment, the exchange processing unit is in communication connection with the third sensor, so that the exchange processing unit can acquire the third environmental information acquired by the third sensor and respectively send the third environmental information to the central processing unit and the micro processing unit, thereby further ensuring that the first control instruction generated by the central processing unit and the second control instruction generated by the micro processing unit are relatively accurate.

In another embodiment of the present application, as shown in fig. 1, the exchange processing unit 300 is further configured to: receiving a plurality of pieces of the second environment information transmitted by the microprocessor unit 400, and forwarding the plurality of pieces of the second environment information to the central processing unit 200; the first environment information transmitted from the cpu 200 is received and forwarded to the mcu 400. That is to say, the exchange processing unit realizes mutual transmission of sensor data (i.e. a plurality of first environment information and a plurality of second environment information) of the central processing unit and the micro processing unit, thereby solving the problem that the main controller (i.e. the central processing unit) and the backup controller (i.e. the micro processing unit) can only collect the sensor data of each communication due to the limitation of communication bandwidth and real-time performance between PCBs.

In another embodiment of the present application, as shown in fig. 2, the central processing unit 200 includes a first control module 207, and the micro processing unit 400 includes a second control module 406, which generates a first control command according to at least a plurality of the first environment information, including: the first control module 207 generating the first control command based on the plurality of pieces of first environment information, the plurality of pieces of second environment information, and the third environment information; generating a second control command based on at least a plurality of said second environment information, comprising: the second control module 406 generates the second control command according to a plurality of pieces of the second environment information and the third environment information. In this embodiment, the first control module generates the first control instruction according to the plurality of pieces of first environmental information, the plurality of pieces of second environmental information, and the third environmental information, so that the obtained first control instruction is relatively accurate, the subsequent central processing unit can relatively accurately control the automatically-driven vehicle according to the first control instruction, and the second control module generates the second control instruction according to the plurality of pieces of second environmental information and the third environmental information, so that the micro-processing unit can also control the vehicle to make an emergency stop according to the second control instruction under the condition that the central processing unit is in a fault, thereby realizing emergency take-over of the vehicle and ensuring higher safety of the vehicle.

In an actual application process, the second control module may also generate a second control command according to the plurality of first environment information, the plurality of second environment information, and the third environment information.

In order to avoid the damage of the vehicle caused by unexpected control or failure of control function, in another embodiment of the present application, as shown in fig. 2, the central processing unit 200 further includes a first checking module 208 and a first diagnosing module 209, wherein the first checking module 208 is configured to receive the first control command sent by the first control module 207 and receive the second control command sent by the second control module 406, and check the first control command and the second control command; the first diagnostic module 209 is used for detecting faults of the central processing unit 200; the micro-processing unit 400 further includes a second checking module 408 and a second diagnosing module 407, where the second checking module 408 is configured to receive a third control command sent by the first control module 207, receive a fourth control command sent by the second control module 406, and check the third control command and the fourth control command, where the first control command and the third control command are the same control command, and the second control command and the fourth control command are the same control command; the second diagnostic module 407 is used to perform fault detection on the micro-processing unit 400.

Specifically, the first diagnostic module may further perform fault detection on the micro processing unit, and the second diagnostic module may further perform fault detection on the central processing unit.

Specifically, as shown in fig. 2, the central processing unit 200 further includes a first sensing module 203, a first positioning module 204, a prediction module 205, and a first path planning module 206, and the central processing unit 200 is a core implementation unit for implementing automatic driving functions such as city cruise and highway cruise. The first sensing module 203 and the first positioning module may obtain sensing information and position the vehicle according to the camera information 2011, the laser radar information 2021, the long-range millimeter wave radar information 3011, the short-range millimeter wave radar information 4011, and the fusion information 4021, the prediction module 205 may predict other objects in a predetermined area where the vehicle is located, and the first path planning module 206 may plan a path where the vehicle travels. The microprocessor unit 400 further includes a second sensing module 403, a second positioning module 404, and a second path planning module 405, and the microprocessor unit implements control and take-over of the vehicle after the central processing unit fails. The second sensing module 403 and the second positioning module 404 may obtain sensing information and position the vehicle according to the long-range millimeter wave radar information 3011, the short-range millimeter wave radar information 4011, and the fusion information 4021, and the second path planning module 405 may also plan a path along which the vehicle travels.

In an embodiment of the present application, as shown in fig. 2, the vehicle further includes a first CAN transceiver 210 and a second CAN transceiver 409, wherein the first CAN transceiver 210 is respectively connected to the first checking module 208 and the second diagnosing module 407 in a communication manner, the second CAN transceiver 409 is respectively connected to the second checking module 408 and the first diagnosing module 209 in a communication manner, and after the first control command and the second control command are checked and the third control command and the fourth control command are checked, the controller 100 is further configured to: when the first checking module 208 and the second checking module 408 both check and pass and the first diagnostic module 209 and the second diagnostic module 407 do not detect a fault, the first checking module 208 sends the first control command to the first CAN transceiver 210, so that the first CAN transceiver 210 forwards the first control command to the chassis actuator 500, and the first diagnostic module 209 sends a first closing command to the second CAN transceiver 409, so that the second CAN transceiver 409 does not work. In this embodiment, the first check module of the central processing unit and the second check module of the micro processing unit both perform mutual check, so as to solve the problem that in the prior art, the output processing results of the main controller (i.e. the central processing unit of the present application) and the backup controller (i.e. the micro processing unit of the present application) cannot perform mutual check, and only the safety of the vehicle can be ensured by setting a limit value at the chassis actuator.

Specifically, the first check module may check that the first control instruction and the second control instruction are the same instruction; the second check module may be configured to set the third control instruction and the fourth control instruction as the same instruction. For example, the first control command is a left turn of the vehicle, and the second control command is also a left turn of the vehicle.

Specifically, the first control module generates a first control instruction according to the plurality of first environment information, the plurality of second environment information, and the third environment information, and the first control module sends the first control instruction to the first check module and also sends the first control instruction (i.e., the third control instruction) to the second check module. The second control module generates a second control instruction according to the plurality of second environment information and the third environment information, sends the second control instruction to the first check module, and sends the second control instruction (i.e., a fourth control instruction) to the second check module. Thus, the first check module can perform mutual check on the first control instruction and the second control instruction, and the second check module can perform mutual check on the third control instruction and the fourth control instruction (i.e., the fourth control instruction).

In order to avoid a single point failure of a single controller (i.e., a central processing unit and a micro processing unit), which may result in that the vehicle cannot be automatically driven and the safety of the vehicle needs to be ensured by setting a limit value at a chassis actuator in the prior art, in another embodiment of the present application, as shown in fig. 2, after the first control command and the second control command are verified and the third control command and the fourth control command are verified, the controller 100 is further configured to: when the first checking module 208 fails to check, the second checking module 408 passes, the first diagnosing module 209 detects a fault, and the second diagnosing module 407 does not detect a fault, the second checking module 408 sends the third control command to the second CAN transceiver 409, so that the second CAN transceiver 409 forwards the third control command to the chassis backup executor 600, and the second diagnosing module 407 sends a second closing command to the first CAN transceiver 210, so that the first CAN transceiver 210 does not operate; when the first checking module 208 fails to check, the second checking module 408 passes, the first diagnosing module 209 does not detect a fault, and the second diagnosing module 407 detects a fault, the first checking module 208 sends the first control command to the first CAN transceiver 210, so that the first CAN transceiver 210 forwards the first control command to the chassis actuator 500, and the first diagnosing module 209 sends the first closing command to the second CAN transceiver 409, so that the second CAN transceiver 409 does not operate.

In another embodiment of the present application, as shown in fig. 2, after the first control command and the second control command are verified, and the third control command and the fourth control command are verified, the controller 100 is further configured to: when the first checking module 208 and the second checking module 408 do not check, the first diagnosing module 209 detects a fault, and the second diagnosing module 407 does not detect a fault, the second checking module 408 sends the fourth control command to the second CAN transceiver 409, so that the second CAN transceiver 409 sends the fourth control command to the chassis backup executor 600, and the second diagnosing module 407 sends a second closing command to the first CAN transceiver 210, so that the first CAN transceiver 210 does not work; in the case that the first verification module 208 and the second verification module 408 do not verify, the first diagnosis module 209 does not detect a fault, and the second diagnosis module 407 detects a fault, the first verification module 208 sends the first control command to the first CAN transceiver 210, so that the first CAN transceiver 210 forwards the first control command to the chassis actuator 500, and the first diagnosis module 209 sends the first close command to the second CAN transceiver 409, so that the second CAN transceiver 409 does not work. In this embodiment, carry out dual check through first check module and second check module to the first control command and the second control command of vehicle, can avoid single controller to lead to being difficult to carry out the problem of automatic driving control to the vehicle like this, also need not to avoid simultaneously through setting up the harm that the control command's of vehicle anomaly caused the vehicle at the chassis executor, thereby can enrich the operating means of vehicle, guaranteed that user's use experience is better.

In order to further ensure that the vehicle can be controlled more safely and avoid the difficulty in performing automatic driving control on the vehicle due to failure of a single controller, in another embodiment of the present application, as shown in fig. 2, after the first control command and the second control command are verified and the third control command and the fourth control command are verified, the controller 100 is further configured to: when the first checking module 208 checks pass, the second checking module 408 checks fail, the first diagnosing module 209 detects a fault, and the second diagnosing module 407 does not detect a fault, the second checking module 408 sends the fourth control command to the second CAN transceiver 409, so that the second CAN transceiver 409 sends the fourth control command to the chassis backup executor 600, and the second diagnosing module 407 sends a second closing command to the first CAN transceiver 210, so that the first CAN transceiver 210 does not work; when the first checking module 208 checks that the second checking module 408 checks that the first checking module 209 does not detect a fault, and the second diagnosing module 407 detects a fault, the first checking module 208 sends the first control command to the first CAN transceiver 210, so that the first CAN transceiver 210 forwards the first control command to the chassis actuator 500, and the first diagnosing module 209 sends the first closing command to the second CAN transceiver 409, so that the second CAN transceiver 409 does not work.

In an embodiment of the application, as shown in fig. 2, after the first control instruction and the second control instruction are verified, and the third control instruction and the fourth control instruction are verified, the controller 100 is further configured to: when the first verification module 208 fails to verify, the second verification module 408 passes, the first diagnosis module 209 detects a failure, and the second diagnosis module 407 detects a failure, both the first CAN transceiver 210 and the second CAN transceiver 409 are turned off, and the vehicle is stopped urgently. In this embodiment, under the condition that the first diagnostic module and the second diagnostic module both detect a fault, the first CAN transceiver and the second CAN transceiver are controlled to be both in a closed state, so that the vehicle is controlled to be in emergency stop, thereby further ensuring that the vehicle is safer and further avoiding damage to the vehicle.

In a specific embodiment of the present application, when the first diagnostic module detects a fault and the second diagnostic module detects a fault, both the first CAN transceiver and the second CAN transceiver are in an off state, and the vehicle is stopped emergently.

In order to ensure the functional independence of the cpu and avoid the power supply problem causing the cpu and the mcu to fail at the same time, in an embodiment of the present application, the cpu and the mcu do not share the same power supply unit.

In yet another embodiment of the present application, as shown in fig. 1, the plurality of first sensors 211 includes an image capturing device 201 and a lidar 202, and the plurality of second sensors 410 includes a short-range millimeter wave radar 401 and a GNSS and IMU fusion positioning 402.

Specifically, the image capturing device may be a camera. Of course, the image capturing device may also be a camera, and the image capturing device is not limited in this application.

Specifically, the GNSS and IMU fusion positioning is specifically a sensor fusion combining a Global Navigation Satellite System (GNSS) and an Inertial Measurement Unit (IMU).

In practical applications, as shown in fig. 1, the image capturing device 201 is communicatively connected to the central processing unit 200 via an LVDS transmission bus, and the lidar 202 is communicatively connected to the central processing unit 200 via an Ethernet bus. For the central processing unit 200, it may directly acquire a plurality of pieces of first environment information of the vehicle in a predetermined area, which is acquired by the image acquisition apparatus 201 and the laser radar 202.

Specifically, as shown in fig. 1, the short-range millimeter wave radar 401 is communicatively connected to the microprocessor unit 400 through a CAN bus, and the GNSS and IMU fusion locator 402 is communicatively connected to the microprocessor unit 400 through the CAN bus. For the micro processing unit, after receiving the plurality of second environment information collected by the MCU receiving the short-range millimeter wave radar 401 and the GNSS and IMU fusion positioning 402, the micro processing unit 400 may forward the plurality of second environment information to the exchange processing unit 300, so that the exchange processing unit 300 forwards the plurality of second environment information to the central processing unit 200, so that the central processing unit may perform information fusion according to the plurality of first environment information, the plurality of second environment information, and the third environment information, and generate a more accurate first control instruction.

In order to enable the switching processing unit to transmit data to the central processing unit and the micro processing unit more efficiently, in another embodiment of the present application, as shown in fig. 1, the switching processing unit 300 communicates with the central processing unit 200 and the micro processing unit 400 through an RGMII (Reduced Gigabit Media independent Interface, RGMII for short) communication Interface, respectively, and the third sensor 301 is a long-range millimeter wave radar.

Specifically, as shown in fig. 1, the long-range millimeter wave radar is communicatively connected to the exchange processing unit 300 via an Ethernet bus. For the exchange processing unit 300, it may transmit the third environment information of the vehicle in the predetermined area, which is collected by the long-range millimeter wave radar, to the central processing unit 200 and the micro processing unit 400. For the micro processing unit 400, after receiving the third environmental information, a second control instruction may be generated according to the plurality of second environmental information and the third environmental information, so that when the central processing unit 200 is in a failure state, the micro processing unit may implement degradation control on the vehicle, implement emergency stop on the vehicle, and further ensure driving safety of the vehicle.

In an embodiment of the present application, the first calibration module and the second diagnostic module communicate with the first CAN transceiver through a CAN line, the second calibration module and the first diagnostic module communicate with the second CAN transceiver through the CAN line, the first control module communicates with the second calibration module through an SPI (Serial Peripheral Interface, SPI for short) communication bus, the second control module communicates with the first calibration module through the SPI communication bus, the first calibration module communicates with the first diagnostic module through the SPI communication bus, the first diagnostic module communicates with the second diagnostic module through the SPI communication bus, the second diagnostic module communicates with the second calibration module through the SPI communication bus, and thus, the communication is more efficient.

In an exemplary embodiment of the present application, there is also provided a vehicle including a controller, the controller being any one of the controllers described above.

The vehicle comprises any one of the controllers, and the controller comprises a central processing unit and a micro-processing unit, wherein the central processing unit is in communication connection with the first sensors, and is used for receiving the first environmental information sent by the first sensors, generating a first control command according to the first environmental information, and controlling a chassis actuator to execute the first control command; the micro-processing unit is in communication connection with the second sensors and is used for receiving the second environment information sent by the second sensors and generating a second control instruction according to the second environment information, and under the condition that the central processing unit is in a fault, the micro-processing unit is used for controlling the chassis backup actuator to execute the first control instruction or the second control instruction. In the application, a central processing unit (namely a main controller) generates a first control instruction at least according to a plurality of pieces of first environment information to realize automatic driving control of a vehicle; and under the condition that the central processing unit has a fault, the micro processing unit (namely the backup controller) generates a second control command at least according to the plurality of second environment information, and controls the chassis backup executor to execute the first control command or the second control command. That is to say, under the condition that the central processing unit breaks down, the micro-processing unit realizes the emergency take-over of the vehicle, thereby realizing the control and the redundancy backup of the vehicle in the same controller, thus ensuring the higher safety of the vehicle, ensuring the lower material and development cost of the controller, and further solving the problem that the control and the redundancy backup of the automatic driving vehicle in the same controller are difficult to realize simultaneously in the prior art.

From the above description, it can be seen that the above-described embodiments of the present application achieve the following technical effects:

1) The controller comprises a central processing unit and a micro-processing unit, wherein the central processing unit is in communication connection with the first sensors and is used for receiving the first environmental information sent by the first sensors, generating a first control instruction according to the first environmental information and controlling the chassis actuator to execute the first control instruction; the micro-processing unit is in communication connection with the second sensors and is used for receiving the second environment information sent by the second sensors and generating a second control instruction according to the second environment information, and under the condition that the central processing unit is in a fault, the micro-processing unit is used for controlling the chassis backup actuator to execute the first control instruction or the second control instruction. In the application, a central processing unit (namely a main controller) generates a first control instruction at least according to a plurality of pieces of first environment information to realize automatic driving control of a vehicle; and under the condition that the central processing unit fails, the micro-processing unit (namely the backup controller) generates a second control command according to at least a plurality of second environment information, and controls the chassis backup executor to execute the first control command or the second control command. That is to say, under the condition that the central processing unit breaks down, the micro-processing unit realizes the emergency take-over of the vehicle, thereby realizing the control and the redundancy backup of the vehicle in the same controller, thus ensuring the higher safety of the vehicle, ensuring the lower material and development cost of the controller, and further solving the problem that the control and the redundancy backup of the automatic driving vehicle in the same controller are difficult to realize simultaneously in the prior art.

2) The vehicle comprises any one of the controllers, wherein the controller comprises a central processing unit and a micro-processing unit, wherein the central processing unit is in communication connection with the first sensors and is used for receiving the first environment information sent by the first sensors, generating a first control command according to the first environment information and controlling a chassis actuator to execute the first control command; the micro-processing unit is in communication connection with the second sensors, and is configured to receive the second environment information sent by the second sensors, generate a second control instruction according to at least the second environment information, and control the chassis backup executor to execute the second control instruction, and under a condition that the central processing unit is in a fault, the micro-processing unit is configured to control the chassis backup executor to execute the first control instruction or the second control instruction. In the application, a central processing unit (namely a main controller) generates a first control instruction at least according to a plurality of pieces of first environment information to realize automatic driving control of a vehicle; and under the condition that the central processing unit has a fault, the micro processing unit (namely the backup controller) generates a second control command at least according to the plurality of second environment information, and controls the chassis backup executor to execute the first control command or the second control command. That is to say, under the condition that the central processing unit breaks down, the micro-processing unit realizes the emergency take-over of the vehicle, thereby realizing the control and the redundancy backup of the vehicle in the same controller, thus ensuring the higher safety of the vehicle and the lower material and development cost of the controller, and further solving the problem that the control and the redundancy backup of the automatic driving vehicle in the same controller are difficult to realize in the prior art.

The above description is only a preferred embodiment of the present application and is not intended to limit the present application, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A controller for controlling the driving of a vehicle, the controller comprising:

the central processing unit is in communication connection with the plurality of first sensors and is used for receiving a plurality of pieces of first environment information sent by the plurality of first sensors, generating a first control command according to at least the plurality of pieces of first environment information and controlling the chassis actuator to execute the first control command;

a microprocessor unit, communicatively connected to the plurality of second sensors, the microprocessor unit being configured to receive a plurality of second environment information sent by the plurality of second sensors, and generate a second control instruction according to at least the plurality of second environment information, and under a condition that the central processing unit is in a fault, the microprocessor unit being configured to control the chassis backup executor to execute the first control instruction or the second control instruction,

wherein the first environmental information and the second environmental information are both environmental information of the vehicle in a predetermined area.

2. The controller of claim 1, further comprising:

and the exchange processing unit is in communication connection with a third sensor and is used for receiving third environmental information sent by the third sensor and respectively sending the third environmental information to the central processing unit and the micro-processing unit, wherein the third environmental information is the environmental information of the vehicle in the preset area.

3. The controller of claim 2, wherein the switch processing unit is further configured to:

receiving a plurality of pieces of second environment information sent by the micro-processing unit, and forwarding the plurality of pieces of second environment information to the central processing unit;

and receiving a plurality of pieces of first environment information sent by the central processing unit, and forwarding the plurality of pieces of first environment information to the micro-processing unit.

4. The controller of claim 3, wherein the central processing unit comprises a first control module, the micro-processing unit comprises a second control module,

generating a first control instruction according to at least a plurality of pieces of the first environment information, wherein the first control instruction comprises:

the first control module generates the first control instruction according to the plurality of pieces of first environment information, the plurality of pieces of second environment information and the third environment information;

generating a second control command according to at least a plurality of second environment information, including:

and the second control module generates the second control instruction according to the plurality of second environment information and the third environment information.

5. The controller according to claim 4,

the central processing unit further comprises:

the first checking module is used for receiving the first control instruction sent by the first control module, receiving the second control instruction sent by the second control module, and checking the first control instruction and the second control instruction;

the first diagnosis module is used for carrying out fault detection on the central processing unit;

the micro-processing unit further includes:

the second checking module is configured to receive a third control instruction sent by the first control module, receive a fourth control instruction sent by the second control module, and check the third control instruction and the fourth control instruction, where the first control instruction and the third control instruction are the same control instruction, and the second control instruction and the fourth control instruction are the same control instruction;

and the second diagnosis module is used for carrying out fault detection on the micro-processing unit.

6. The controller of claim 5, wherein the vehicle further comprises a first CAN transceiver communicatively coupled to the first calibration module and the second diagnostic module, respectively, and a second CAN transceiver communicatively coupled to the second calibration module and the first diagnostic module, respectively,

after verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller is further configured to:

under the condition that the first checking module and the second checking module both pass the checking and the first diagnosis module and the second diagnosis module both do not detect faults, the first checking module sends the first control instruction to the first CAN transceiver so that the first CAN transceiver forwards the first control instruction to the chassis executor, and the first diagnosis module sends a first closing instruction to the second CAN transceiver so that the second CAN transceiver does not work.

7. The controller of claim 6, wherein after verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller is further configured to:

under the conditions that the first checking module fails to check, the second checking module passes to check, the first diagnosis module detects a fault, and the second diagnosis module does not detect the fault, the second checking module sends the third control command to the second CAN transceiver so that the second CAN transceiver forwards the third control command to the chassis backup executor, and the second diagnosis module sends a second closing command to the first CAN transceiver so that the first CAN transceiver does not work;

under the conditions that the first checking module fails to check, the second checking module passes the check, the first diagnosis module does not detect the fault and the second diagnosis module detects the fault, the first checking module sends the first control command to the first CAN transceiver so that the first CAN transceiver forwards the first control command to the chassis actuator, and the first diagnosis module sends the first closing command to the second CAN transceiver so that the second CAN transceiver does not work.

8. The controller of claim 6, wherein after verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller is further configured to:

under the condition that the first checking module and the second checking module do not check, the first diagnosis module detects a fault and the second diagnosis module does not detect the fault, the second checking module sends the fourth control instruction to the second CAN transceiver so that the second CAN transceiver sends the fourth control instruction to be forwarded to the chassis backup executor, and the second diagnosis module sends a second closing instruction to the first CAN transceiver so that the first CAN transceiver does not work;

under the condition that the first checking module and the second checking module do not check, the first diagnosis module does not detect faults and the second diagnosis module detects faults, the first checking module sends the first control command to the first CAN transceiver so that the first CAN transceiver forwards the first control command to the chassis actuator, and the first diagnosis module sends the first closing command to the second CAN transceiver so that the second CAN transceiver does not work.

9. The controller of claim 6, wherein after verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller is further configured to:

under the conditions that the first checking module passes checking, the second checking module fails checking, the first diagnosis module detects a fault, and the second diagnosis module does not detect a fault, the second checking module sends the fourth control command to the second CAN transceiver, so that the second CAN transceiver sends the fourth control command to be forwarded to the chassis backup executor, and the second diagnosis module sends a second closing command to the first CAN transceiver, so that the first CAN transceiver does not work;

under the conditions that the first checking module passes checking, the second checking module fails checking, the first diagnosis module does not detect faults and the second diagnosis module detects faults, the first checking module sends the first control command to the first CAN transceiver so that the first CAN transceiver forwards the first control command to the chassis executor, and the first diagnosis module sends the first closing command to the second CAN transceiver so that the second CAN transceiver does not work.

10. The controller of claim 6, wherein after verifying the first control instruction and the second control instruction, and verifying the third control instruction and the fourth control instruction, the controller is further configured to:

and under the conditions that the first checking module fails to check, the second checking module passes check, the first diagnosis module detects a fault, and the second diagnosis module detects a fault, the first CAN transceiver and the second CAN transceiver are both in a closed state, and the vehicle is in emergency stop.

11. The controller according to any one of claims 1 to 10, wherein the central processing unit and the micro processing unit do not share a same power supply unit.

12. The controller according to any one of claims 1 to 10, wherein the plurality of first sensors comprises an image capture device and a lidar, and the plurality of second sensors comprises a short-range millimeter wave radar and a GNSS and IMU fusion location.

13. The controller according to any one of claims 2 to 10, wherein the switching processing unit communicates with the central processing unit and the micro processing unit via an RGMII communication interface, respectively, and the third sensor is a long-range millimeter wave radar.

14. The controller of any one of claims 6 to 10, wherein the first and second calibration modules communicate with the first CAN transceiver over a CAN line, the second and first calibration modules communicate with the second CAN transceiver over the CAN line, the first control module communicates with the second calibration module over an SPI communication bus, the second control module communicates with the first calibration module over the SPI communication bus, the first calibration module communicates with the first diagnostic module over the SPI communication bus, the first diagnostic module communicates with the second diagnostic module over the SPI communication bus, and the second diagnostic module communicates with the second calibration module over the SPI communication bus.

15. A vehicle characterized in that it comprises a controller according to any one of claims 1 to 14.