CN116118778A

CN116118778A - Vehicle control method and device, electronic equipment and automatic driving vehicle

Info

Publication number: CN116118778A
Application number: CN202310117029.7A
Authority: CN
Inventors: 刘明
Original assignee: Beijing Baidu Netcom Science and Technology Co Ltd
Current assignee: Beijing Baidu Netcom Science and Technology Co Ltd
Priority date: 2023-01-30
Filing date: 2023-01-30
Publication date: 2023-05-16

Abstract

The disclosure provides a vehicle control method, relates to the technical field of automatic driving, and particularly relates to the technical field of intelligent transportation. The specific implementation scheme is as follows: in the running process of the vehicle, acquiring a vehicle control command and a vehicle planning path generated by a controller of the vehicle; determining a security level based on an operating parameter of the vehicle in response to detecting the controller failure; and selecting a safety strategy of a corresponding grade to control the vehicle to park according to the safety grade, wherein the safety strategy comprises a slow brake strategy based on a vehicle control command, a slow brake strategy based on a vehicle planning path and a sudden brake strategy based on the wheel orientation. The disclosure also provides a vehicle control device, an electronic apparatus, a storage medium, and an autonomous vehicle.

Description

Vehicle control method and device, electronic equipment and automatic driving vehicle

Technical Field

The disclosure relates to the technical field of automatic driving, in particular to the technical field of intelligent traffic. More specifically, the present disclosure provides a vehicle control method, apparatus, electronic device, storage medium, and autonomous vehicle.

Background

Failure of the automatic driving vehicle can cause unexpected problems such as out-of-control and the like of an automatic driving system, so that safety risks are caused, and personal and property losses are caused. Therefore, how to control the vehicle when the vehicle fails is important.

Disclosure of Invention

The present disclosure provides a vehicle control method, apparatus, device, storage medium, and autonomous vehicle.

According to a first aspect, there is provided a vehicle control method comprising: in the running process of the vehicle, acquiring a vehicle control command and a vehicle planning path generated by a controller of the vehicle; determining a security level based on an operating parameter of the vehicle in response to detecting the controller failure; and selecting a safety strategy of a corresponding grade to control the vehicle to park according to the safety grade, wherein the safety strategy comprises a slow brake strategy based on a vehicle control command, a slow brake strategy based on a vehicle planning path and a sudden brake strategy based on the wheel orientation.

According to a second aspect, there is provided a vehicle control apparatus including: the acquisition module is used for acquiring a vehicle control command and a vehicle planning path generated by a controller of the vehicle in the running process of the vehicle; a first determination module for determining a security level based on an operating parameter of the vehicle in response to detecting the controller failure; the control module is used for selecting a safety strategy of a corresponding grade to control the vehicle to park according to the safety grade, wherein the safety strategy comprises a slow brake strategy based on a vehicle control command, a slow brake strategy based on a vehicle planning path and a sudden brake strategy based on the wheel orientation.

According to a third aspect, there is provided an electronic device comprising: at least one processor; and a memory communicatively coupled to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform a method provided in accordance with the present disclosure.

According to a fourth aspect, there is provided a non-transitory computer readable storage medium storing computer instructions for causing a computer to perform a method provided according to the present disclosure.

According to a fifth aspect, there is provided a computer program product comprising a computer program stored on at least one of a readable storage medium and an electronic device, which, when executed by a processor, implements a method provided according to the present disclosure.

It should be understood that the description in this section is not intended to identify key or critical features of the embodiments of the disclosure, nor is it intended to be used to limit the scope of the disclosure. Other features of the present disclosure will become apparent from the following specification.

Drawings

The drawings are for a better understanding of the present solution and are not to be construed as limiting the present disclosure. Wherein:

FIG. 1 is a diagram of the connection of an autopilot domain controller to a chassis controller according to one embodiment of the present disclosure;

FIG. 2 is a flow chart of a vehicle control method according to one embodiment of the present disclosure;

FIG. 3 is a software architecture schematic of a security system running on a micro control unit MCU according to one embodiment of the present disclosure;

FIG. 4 is a block diagram of a vehicle control apparatus according to one embodiment of the present disclosure;

fig. 5 is a block diagram of an electronic device of a vehicle control method according to one embodiment of the present disclosure.

Detailed Description

Exemplary embodiments of the present disclosure are described below in conjunction with the accompanying drawings, which include various details of the embodiments of the present disclosure to facilitate understanding, and should be considered as merely exemplary. Accordingly, one of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the present disclosure. Also, descriptions of well-known functions and constructions are omitted in the following description for clarity and conciseness.

In the technical scheme of the disclosure, the related processes of collecting, storing, using, processing, transmitting, providing, disclosing and the like of the personal information of the user accord with the regulations of related laws and regulations, and the public order colloquial is not violated.

In the technical scheme of the disclosure, the authorization or consent of the user is obtained before the personal information of the user is obtained or acquired.

The autopilot domain controller is responsible for the functions of multi-sensor data fusion, positioning, path planning, decision control and the like of the autopilot vehicle. The automatic driving domain controller mainly comprises two computing units: SOC (System-on-a-Chip), MCU (Microcontroller Unit, micro control unit). The SOC generally integrates a plurality of processing units such as a central processing unit CPU, a graphics processing unit GPU, a Neural network processing unit NPU (Neural-network Processing Unit), and the like, can support multiple functions such as high-performance computation, graphics computation, artificial intelligence AI computation, audio processing, and the like, and has strong computation performance. MCU also can be called singlechip, and in the automation car field MCU is more integrated input and output device in the chip, convenient better control input and output device. SOC generally runs Linux system, mostly time-sharing operating system. The MCU runs a real-time operating system, the calculation power is lower than that of the SOC, but the stability and the safety level are high.

The autopilot controller is typically directly connected to the chassis controller of the autopilot vehicle for vehicle control purposes.

Fig. 1 is a diagram of the connection of an autopilot domain controller to a chassis controller in accordance with one embodiment of the present disclosure.

As shown in fig. 1, the autopilot controller 110 includes a system on chip SOC and a micro control unit MCU. The autopilot controller 110 is directly connected to the chassis controller 120. The system-on-chip SOC and the micro control unit MCU communicate through Ethernet (Ethernet), and the micro control unit MCU communicates with the chassis controller 120 through a CAN bus.

The communication mode of the CAN bus has strict limitation on the message sending period, and the conditions of process jamming, system faults and the like CAN occur occasionally in the SOC, and the problems CAN cause unexpected problems such as out-of-control and the like of an automatic driving system, so that safety risks are caused, and personal and property losses are caused. The MCU is provided with a safety system for recalling the problems of the automatic driving systems and taking over the vehicle when necessary to replace the SOC to control the vehicle, so that the reliability of the safety taking over is ensured.

In one example, the system on chip SOC and the micro control unit MCU may both be redundant backups, e.g., the system on chip SOC includes a main SOC and a redundant SOC, and the micro control unit MCU includes a main MCU and a redundant MCU. Since the safety of one SOC cannot be guaranteed in the event of failure of the other SOC, both the main MCU and the redundant MCU can start takeover of the vehicle in the event of failure of at least one of the main SOC and the redundant SOC. The host MCU and the redundant MCU both start the take over of the vehicle, so that the other MCU can take over smoothly under the condition that one MCU in the host MCU and the redundant MCU fails.

Fig. 2 is a flowchart of a vehicle control method according to one embodiment of the present disclosure.

The execution body of the present embodiment may be a micro control unit MCU, for example, may be at least one of a main MCU and a redundant MCU.

As shown in fig. 2, the vehicle control method 200 includes operations S210 to S230.

In operation S210, a vehicle control command and a vehicle planned path generated by a controller of a vehicle are acquired during a running of the vehicle.

For example, the controller of the vehicle may refer to a system on a chip SOC. During vehicle operation, the system-on-chip SOC may generate vehicle control commands and vehicle planning paths for controlling vehicle operation based on vehicle travel environment data collected by the multiple sensors.

The vehicle control commands include, for example, lateral control commands for controlling the steering of the vehicle, longitudinal control commands for controlling acceleration and deceleration of the vehicle, braking, and the like. The vehicle planned path is a predicted trajectory for the vehicle.

The MCU receives a vehicle control command and a vehicle planning path generated by the system-on-chip SOC in real time, and sends the vehicle control command and the vehicle planning path to the chassis controller, so that the vehicle is controlled to run based on the vehicle control command and the vehicle planning path.

In response to detecting the controller failure, a security level is determined according to the operating parameters of the vehicle in operation S220.

For example, during the operation of the vehicle, the micro control unit MCU detects the state data of the system on chip SOC in real time to determine whether the system on chip SOC is operating normally.

The state data of the system-on-chip SOC includes, for example, heartbeat data, communication data, traffic data, and the like, and in the event of abnormality of at least one of the heartbeat data, the communication data, and the traffic data, it can be determined that the system-on-chip SOC fails.

In case of failure of the system on chip SOC, the micro control unit MCU needs to take over the vehicle to control the vehicle instead of the system on chip SOC.

In one example, in the event that at least one of the main SOC and the redundant SOC fails, the main MCU and the redundant MCU may each perform operations S210 to S230 of the present embodiment to take over the vehicle.

The micro control unit MCU can determine the safety level according to the running parameters of the current vehicle. According to different security levels, corresponding security takeover strategies (hereinafter referred to as security strategies) are adopted to control the vehicle to park so as to avoid accidents of the vehicle.

The current vehicle operating parameters may include braking parameters, IMU parameters, MCU own parameters, planned path parameters, etc. The more the parameters in the normal state among the above parameters, the higher the vehicle controllability and the higher the safety, and therefore the higher the safety level. Conversely, the more of the above-described parameters are in an abnormal state, the lower the vehicle controllability and the lower the safety, and therefore the lower the safety level.

In operation S230, a security policy of a corresponding level is selected to control the vehicle to park according to the security level.

For example, according to the above-described safe operation parameters, three safe levels, that is, a first level, a second level, and a third level, respectively, may be determined, and the safety of the first level, the second level, and the third level is sequentially degraded.

Each security level may correspond to a security policy. The safety strategies may include a slow-brake strategy based on vehicle control commands, a slow-brake strategy based on vehicle planned paths, and a sudden-brake strategy based on wheel orientations. The vehicle control command-based slow braking strategy can be to carry out slow braking according to a control command sent before the SOC fails, and the vehicle planning path-based slow braking strategy can be to carry out slow braking according to a planning path sent before the SOC fails.

The first level may correspond to a slow-brake strategy based on a vehicle planned path, the second level may correspond to a slow-brake strategy based on a vehicle control command, and the third level may correspond to a sudden-brake strategy based on wheel orientation.

Therefore, under the condition that the safety level is the first level, selecting a slow brake strategy based on a vehicle planning path to control the vehicle to park; under the condition that the safety level is the second level, selecting a slow braking strategy based on a vehicle control command to control the vehicle to stop; and when the safety level is the third level, selecting an emergency braking strategy based on the wheel orientation to control the vehicle to stop.

According to the embodiment, under the condition that the controller is detected to be invalid, the corresponding safety strategy is adopted to carry out parking control on the vehicle according to the safety level of the current vehicle, so that the fine control of the automatic driving vehicle in a fault state can be realized, and the safety of the vehicle is improved.

The execution body of the embodiment shown in fig. 2 may be a micro control unit MCU, and in particular may be a security system provided in the micro control unit MCU.

The security system provided by this embodiment is described below with reference to fig. 3.

Fig. 3 is a software architecture schematic of a security system running on a micro control unit MCU according to one embodiment of the present disclosure.

As shown in fig. 3, the software architecture of the security system includes underlying software 310 and application layer software 320. The underlying software 310 includes a diagnostic event management (Diagnostic Event Manager, DEM) module 311 and a communication module 312. The application layer software 320 includes a detection module 321, a decision module 322, and a control module 323.

The diagnostic event management module 311 is used to process and store fault data such as loss of signal detection and fault de-jittering, etc. The communication module 312 is used to provide the basic capabilities of software communications such as signal transmission and reception.

The detection module 321 is configured to detect own state data, and state data of a peripheral device such as SOC, where the state data includes fault-related data. The detection module 321 may also feed back the detected SOC fault related data to the SOC, pass the fault related data to the decision module 322, etc.

The decision module 322 is configured to make a decision on the vehicle performer and the degradation policy according to the fault data provided by the detection module 321. For example, determining the security level of the vehicle, determining whether to take over the vehicle, what security policy to take over, etc.

The control module 323 is configured to execute the security policy after receiving the decision instruction of the decision module 322.

The detection module 321 is specifically described below.

The detection module 321 may perform heartbeat detection, communication data detection, and service data detection for the external module, so as to determine status data such as a heartbeat status, a communication status, and a service status. The external module may include an SOC, an inertial control unit (Intertial Measurement Unit, IMU), and a chassis controller.

Table 1 shows the detection contents of the detection module 321 for each external module.

TABLE 1

The detection module 321 may perform detection of the contents as shown in table 1 for each external module.

The detection contents shown in table 1 include a detection type, a detection manner, and an abnormality judgment criterion.

The detection type comprises heartbeat detection, communication detection, service data abnormal state detection and service data abnormal value detection.

The detection mode of the heartbeat detection comprises the steps of detecting whether the frequency is abnormal, detecting whether the heartbeat packet is overtime and detecting whether the time stamp sequence is correct. The criterion for the frequency abnormality is to determine whether the detected frequency is less than the design frequency by a certain proportion, for example, 20HZ, and if the detected frequency is less than 10HZ or 8HZ, the heart beat abnormality can be determined. The criterion of the heartbeat packet timeout is to determine whether the heartbeat packet is not received for a certain time beyond the design period, for example, the design period is 50ms, and if the heartbeat packet is not received for more than 7 to 8 periods, the heartbeat packet timeout can be determined. The judgment criterion of the timestamp sequence abnormality is to judge whether the timestamp of the current frame is smaller than the timestamp of the previous frame, and if so, the timestamp abnormality can be determined.

Communication detection is mainly directed to detection of control commands. The detection mode comprises detecting whether a control command signal is overtime, and judging whether the control command is received for a certain time beyond a design period or not by judging the standard. For example, the design period is 10ms, and if no control command is received for more than 5 to 10 periods, it may be determined that the control command signal is timed out.

The abnormal state detection of the service data mainly aims at detecting the state value of the service data. The detection mode includes detecting whether the state value is abnormal, and the judging standard is judged according to the service design value, for example, the speed signal comprises a speed value and a credibility state value, and if the credibility state value in a plurality of (for example, 5) continuous speed signals indicates that the speed value is not credible, the state value is abnormal.

The abnormal value detection of the service data mainly aims at detecting the signal value of the service data. The detection mode comprises the step of detecting whether the signal value is abnormal or not, wherein the judgment standard is judged according to the service design value, for example, the speed value is higher than 200KM/h, and the signal value can be determined to be abnormal.

The detection module 321 may also detect the state of the MCU itself. For example, the voltage current value is obtained through the underlying interface during a duty cycle. For example, the MCU may be multi-core (e.g., 6-core) operation, and the operation states of the cores may be detected. For example, it may also be detected whether the application layer is operating properly, whether the underlying software communication layer is operating properly, and whether the driver layer is operating properly.

Detecting whether the application layer is operating normally includes detecting whether the decision module 322 and the control module 323 are operating normally. Detecting whether the underlying software communication layer is operating properly includes detecting whether diagnostic event management module 311 is operating properly. Detecting whether the driving layer is normal includes detecting whether the CAN bus and the ethernet are normal.

The detection module 321 collates the detected abnormal data (fault data) and its own status data and sends the collated data to the decision module 322.

Decision block 322 is described in detail below.

The decision module 322 determines whether the MCU takes over the vehicle according to the fault data sent from the detection module 321.

The condition that the MCU takes over the vehicle comprises SOC failure, namely, under the condition that the SOC fails, the MCU is determined to take over the vehicle. For example, after any one of the above-described determination criteria in table 1 determines abnormality, it may be determined that the SOC is invalid.

It should be noted that, after determining that the MCU takes over the vehicle, even if the SOC is recovered from the fault, the SOC is recovered to be normal, and in order to ensure the safety of the vehicle, the MCU should continue to complete the whole take-over process, but the SOC should not continue to control the vehicle. In addition, under the condition that a safety person exists on the vehicle, the MCU is allowed to take over manually and quit the automatic driving mode manually, and the MCU does not take over any more.

The SOC continuously outputs the control command and the planned route to the MCU for a period of time (e.g., ten seconds) during normal operation, so that in the case of determining that the SOC fails, the MCU obtains the control command and the planned route sent before the SOC fails, and can be used as a legend of the SOC.

After determining that the SOC has failed, a security level of the current vehicle may be determined based on the operating parameters of the current vehicle to determine with what security policy to take over.

According to an embodiment of the present disclosure, the operating parameters include: braking parameters, inertial Measurement Unit (IMU) parameters and vehicle planning path parameters; determining the security level based on the operating parameters of the vehicle includes: determining the safety level as a first level in response to the operation parameter conforming to a first condition, wherein the first condition is that the brake parameter, the inertial measurement unit IMU parameter and the vehicle planning path parameter are all in a normal state; determining the safety level as a second level in response to the operation parameter conforming to a second condition, wherein the second condition is that both the braking parameter and the vehicle planning path parameter are in a normal state; and determining the safety level to be a third level in response to the operating parameter meeting a third condition, wherein the third condition is other than the first condition and the second condition.

It should be noted that the operation parameters further include parameters of the MCU, and the MCU can take over the vehicle under the condition that the parameters of the MCU are normal. Therefore, the first condition, the second condition and the third condition all comprise that the parameters of the MCU are in a normal state.

Table 2 shows the conditions that each security level (or security policy) needs to meet.

TABLE 2

As shown in table 2, in the case that the current vehicle meets the first condition, the security level is determined as the first level, and the security policy is determined as the slow brake policy based on the planned path of the vehicle. And under the condition that the current vehicle meets the second condition, determining the safety level as the second level, and determining the safety strategy as the slow brake strategy of the vehicle control command. And under the condition that the current vehicle meets the third condition, determining the safety level as a third level, and determining the safety strategy as an emergency braking strategy based on the wheel orientation.

The second condition may allow the inertial measurement unit IMU to be abnormal in state compared to the first condition. The vehicle controllability is higher in the first condition than in the second condition. The vehicle is controlled by the inertial measurement unit IMU while the vehicle is braked along the planned path according to the slow braking strategy based on the vehicle planned path corresponding to the first condition, so that the slow braking strategy of the vehicle planned path is most aggressive. The slow brake strategy based on the vehicle control command only needs to send the control command to the chassis controller regularly, does not participate in the vehicle control, and is therefore relatively conservative. The sudden braking strategy based on wheel orientation is the most conservative direct braking approach.

According to an embodiment of the present disclosure, the vehicle control method further includes determining, in response to a change in an operating parameter of the vehicle, a security level degradation according to a condition that the changed operating parameter meets. In response to the security level degradation, a security policy degradation is determined.

In response to a change in an operating parameter of the vehicle, determining a security level degradation based on a condition met by the changed operating parameter includes: determining that the security level is downgraded from the first level to the second level in response to the condition met by the operating parameter of the vehicle being downgraded from the first condition to the second condition; determining that the security level is downgraded from the first level to a third level in response to the condition met by the operating parameter of the vehicle being downgraded from the first condition to the third condition; in response to the condition met by the operating parameter of the vehicle degrading from the second condition to a third condition, determining that the security level is degrading from the second level to the third level.

In response to the security level degradation, determining the security policy degradation includes: in response to the degradation of the security level from the first level to the second level, degrading a slow-to-brake strategy based on the vehicle planned path to a slow-to-brake strategy based on the vehicle control command; in response to the degradation of the safety level from the first level to a third level, degrading a slow brake strategy based on the planned path of the vehicle to a sudden brake strategy based on the wheel orientation; in response to the degradation of the safety level from the second level to the third level, the slow brake strategy based on the vehicle control command is degraded to a sudden brake strategy based on the wheel orientation.

For example, the running condition of the vehicle changes, the condition of the running parameter is changed, the safety level is changed, and the safety strategy is correspondingly changed. That is, the security policy may be broken, e.g., in the event of a security level degradation, the security policy may be degraded to a more conservative policy.

The security level may be downgraded to a more conservative policy and should not be downgraded to a more aggressive policy. For example, i.e. in case of recovering from a fault, the security level is upgraded, the security policy may remain current and should not be upgraded.

After the MCU controls the vehicle to stop, namely, after the safety strategy is executed, the fault can be continuously detected, and after all the faults are recovered to be normal, the MCU can wait for manual confirmation to recover to automatic driving.

The control module 323 is described in detail below.

The control module 323 is configured to perform corresponding operations on the decision command sent by the decision module 322, so as to complete safe execution of the vehicle degradation policy. The decision command sent by the decision module 322 includes the security policy decided by the decision module 322.

The execution of the security policy may include completing the modification of the data sent by the CAN bus through the data transceiver interface provided by the underlying software, for example, in response to receiving the security policy transmitted by the decision module 322, modifying the transmitted control command from the SOC according to the policy, for example, modifying the acceleration command to the deceleration command, so as to achieve the purpose of controlling the vehicle.

The three security policies are described separately below.

Based on a slow brake strategy of a vehicle planning path, the vehicle is mainly controlled to carry out slow brake along the planning path (namely, the speaking of the SOC) generated before the SOC fails. The MCU may control logic based on the trace lines, IMU data, and real-time data fed back by the chassis.

According to an embodiment of the present disclosure, selecting a slow brake strategy based on a planned path of a vehicle to stop the vehicle in a case where a safety level is a first level includes: generating a correction instruction for correcting the planned path according to the actual running environment of the vehicle; determining a correction path according to the correction instruction; and controlling the vehicle to stop according to the corrected path.

Based on the slow braking strategy of the vehicle planning path, the vehicle can be controlled based on the inertial measurement unit IMU while the vehicle is controlled to brake along the planning path. For example, the actual steering angle of the steering wheel of the vehicle is difficult to reach and run along the planned path, the acceleration and the angular velocity of the current vehicle can be determined based on the IMU, and a control command can be regenerated based on the acceleration and the angular velocity, and the control command can correct the planned path sent before the SOC fails, generate a corrected path, and enable the vehicle to brake along the corrected path until the vehicle is stopped.

The slow braking strategy based on the vehicle planning path has the advantages of small transmission data quantity, capability of repairing the vehicle after the deviation occurs to a certain extent, for example, the trajectory line can be corrected, and high controllability of the strategy. However, this strategy relies on the IMU and cannot be used in case of failure of the IMU.

Based on the slow-braking strategy of the vehicle control command, a series of control commands, called a control command sequence, are planned in real time by the SOC, and the control command sequence is used for indicating the vehicle to perform slow braking until stopping. The control command sequence may include predicted steering commands and braking control commands required from slow to stop over a future period of time (e.g., 10 s).

When the MCU triggers a slow brake strategy based on a vehicle planning path, a control command sequence sent before the SOC is not invalid is selected to control parking. The control command sequence includes a lateral control command (e.g., steering) and a longitudinal control command (e.g., braking), the commands in the control command sequence being executed in command order.

According to an embodiment of the present disclosure, selecting a slow brake strategy based on a vehicle control command to control a vehicle to park in the event that the security level is the second level includes: determining a control command at a designated time point from the control command sequence as a start command according to the time point when the controller fails; a slow brake strategy based on vehicle control commands is executed starting from a start command in a control command sequence.

The initial control command in the control command sequence needs to be adjusted accordingly in consideration of the time of fault detection. For example, a control instruction after a specified time point, which may be determined according to the time when the MCU detects a failed SOC heartbeat abnormality, is determined from the control instruction sequence as a start command from which execution starts.

The slow brake strategy based on the vehicle control command has simple logic, and the MCU only needs to issue the control command regularly, and has no dependence on other sensors. However, the strategy has large transmission data quantity, and the braking track is not controllable.

The sudden braking strategy based on wheel orientation may be at a constant deceleration (e.g. -4m/s ² ) And stopping suddenly until the vehicle stops.

Under any strategy, the double flashing lamps are turned on at the same time of braking, when the feedback vehicle speed of the chassis is 0m/s for a period of time, parking is requested to pull up the hand brake, and after the chassis is ensured to have fed back the hand brake to be in a pulled state, the automatic driving mode is exited.

The embodiment provides three safety strategies for taking over the vehicle, and corresponding safety strategies are selected under different safety levels, so that the fine control of the automatic driving vehicle under the fault condition can be realized.

Fig. 4 is a block diagram of a vehicle control apparatus according to one embodiment of the present disclosure.

As shown in fig. 4, the vehicle control apparatus 400 includes an acquisition module 401, a first determination module 402, and a control module 403.

The acquiring module 401 is configured to acquire a vehicle control command and a vehicle planned path generated by a controller of a vehicle during a running process of the vehicle.

The first determination module 402 is operable to determine a security level based on an operating parameter of the vehicle in response to detecting the controller failure.

The control module 403 is configured to select a corresponding level of security policy to control the vehicle to stop according to the security level, where the security policy includes a slow brake policy based on a vehicle control command, a slow brake policy based on a planned path of the vehicle, and a sudden brake policy based on a wheel orientation.

According to an embodiment of the present disclosure, the security levels include a first level, a second level, and a third level, and the security of the first level, the second level, and the third level are sequentially degraded. The control module 403 includes a first control unit, a second control unit, and a third control unit.

The first control unit is used for selecting a slow braking strategy based on a vehicle planning path to control the vehicle to stop under the condition that the safety level is a first level.

The second control unit is used for selecting a slow braking strategy based on the vehicle control command to control the vehicle to stop under the condition that the safety level is the second level.

And the third control unit is used for selecting an emergency braking strategy based on the wheel orientation to control the vehicle to stop under the condition that the safety level is a third level.

According to an embodiment of the present disclosure, the vehicle control apparatus 400 further includes a second determination module and a third determination module.

The second determining module is used for responding to the change of the operation parameters of the vehicle and determining the security level degradation according to the condition met by the changed operation parameters.

The third determination module is to determine a security policy degradation in response to the security level degradation.

The third determination module includes a first determination unit, a second determination unit, and a third determination unit.

The first determination unit is used for degrading the slow brake strategy based on the vehicle planning path to the slow brake strategy based on the vehicle control command in response to the degradation of the safety level from the first level to the second level.

The second determination unit is used for degrading the slow brake strategy based on the vehicle planning path to the sudden brake strategy based on the wheel orientation in response to the degradation of the safety grade from the first grade to the third grade.

The third determination unit is used for degrading the slow brake strategy based on the vehicle control command to the sudden brake strategy based on the wheel orientation in response to the degradation of the safety grade from the second grade to the third grade.

According to an embodiment of the present disclosure, the operating parameters include a braking parameter, an inertial measurement unit IMU parameter, and a vehicle planned path parameter. The first determination module includes a fourth determination unit, a fifth determination unit, and a sixth determination unit.

The fourth determining unit is used for determining the safety level to be a first level in response to the operation parameter meeting a first condition, wherein the first condition is that the braking parameter, the inertial measurement unit IMU parameter and the vehicle planning path parameter are all in a normal state.

And the fifth determining unit is used for determining the safety level to be a second level in response to the operation parameter meeting a second condition, wherein the second condition is that the braking parameter and the vehicle planning path parameter are both in a normal state.

The sixth determining unit is configured to determine, in response to the operation parameter meeting a third condition, that the security level is a third level, wherein the third condition is a case other than the first condition and the second condition.

The second determination module includes a seventh determination unit, an eighth determination unit, and a ninth determination unit.

The seventh determining unit is configured to determine that the security level is degraded from the first level to the second level in response to degradation of the condition, which the operation parameter of the vehicle meets, from the first condition to the second condition.

The eighth determination unit is configured to determine that the security level is downgraded from the first level to the third level in response to the condition that the operation parameter of the vehicle meets being downgraded from the first condition to the third condition.

The ninth determination unit is configured to determine that the security level is degraded from the second level to the third level in response to degradation of the condition, which the operation parameter of the vehicle meets, from the second condition to the third condition.

The first control unit includes a generation subunit, a correction subunit, and a control subunit.

The generation subunit is used for generating a correction instruction for correcting the planned path according to the actual running environment of the vehicle.

The correction subunit is used for determining a correction path according to the correction instruction.

The control subunit is used for controlling the vehicle to stop according to the corrected path.

According to an embodiment of the present disclosure, the vehicle control command includes a control command sequence. The second control unit includes a determination subunit and an execution subunit.

The determining subunit is used for determining a control command at a specified time point from the control command sequence as a start command according to the time point when the controller fails.

The execution subunit is used for executing a slow brake strategy based on the vehicle control command from a start command in the control command sequence.

The vehicle control apparatus 400 further includes a detection module and a fourth determination module.

The detection module is used for detecting state data of the controller, wherein the state data comprises heartbeat data, communication data and service data.

The fourth determining module is used for determining that the controller fails in response to the occurrence of an abnormality in at least one of the heartbeat data, the communication data and the service data.

According to embodiments of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

Fig. 5 illustrates a schematic block diagram of an example electronic device 500 that may be used to implement embodiments of the present disclosure. Electronic devices are intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular telephones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the disclosure described and/or claimed herein.

As shown in fig. 5, the apparatus 500 includes a computing unit 501 that can perform various suitable actions and processes according to a computer program stored in a Read Only Memory (ROM) 502 or a computer program loaded from a storage unit 508 into a Random Access Memory (RAM) 503. In the RAM503, various programs and data required for the operation of the device 500 can also be stored. The computing unit 501, ROM502, and RAM503 are connected to each other by a bus 504. An input/output (I/O) interface 505 is also connected to bus 504.

Various components in the device 500 are connected to the I/O interface 505, including: an input unit 506 such as a keyboard, a mouse, etc.; an output unit 507 such as various types of displays, speakers, and the like; a storage unit 508 such as a magnetic disk, an optical disk, or the like; and a communication unit 509 such as a network card, modem, wireless communication transceiver, etc. The communication unit 509 allows the device 500 to exchange information/data with other devices via a computer network such as the internet and/or various telecommunication networks.

The computing unit 501 may be a variety of general and/or special purpose processing components having processing and computing capabilities. Some examples of computing unit 501 include, but are not limited to, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), various specialized Artificial Intelligence (AI) computing chips, various computing units running machine learning model algorithms, a Digital Signal Processor (DSP), and any suitable processor, controller, microcontroller, etc. The calculation unit 501 performs the respective methods and processes described above, such as a vehicle control method. For example, in some embodiments, the vehicle control method may be implemented as a computer software program tangibly embodied on a machine-readable medium, such as storage unit 508. In some embodiments, part or all of the computer program may be loaded and/or installed onto the device 500 via the ROM502 and/or the communication unit 509. When the computer program is loaded into the RAM503 and executed by the computing unit 501, one or more steps of the vehicle control method described above may be performed. Alternatively, in other embodiments, the computing unit 501 may be configured to perform the vehicle control method by any other suitable means (e.g. by means of firmware).

Various implementations of the systems and techniques described here above may be implemented in digital electronic circuitry, integrated circuit systems, field Programmable Gate Arrays (FPGAs), application Specific Integrated Circuits (ASICs), application Specific Standard Products (ASSPs), systems On Chip (SOCs), complex Programmable Logic Devices (CPLDs), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include: implemented in one or more computer programs, the one or more computer programs may be executed and/or interpreted on a programmable system including at least one programmable processor, which may be a special purpose or general-purpose programmable processor, that may receive data and instructions from, and transmit data and instructions to, a storage system, at least one input device, and at least one output device.

Program code for carrying out methods of the present disclosure may be written in any combination of one or more programming languages. These program code may be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus such that the program code, when executed by the processor or controller, causes the functions/operations specified in the flowchart and/or block diagram to be implemented. The program code may execute entirely on the machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.

In the context of this disclosure, a machine-readable medium may be a tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. The machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and pointing device (e.g., a mouse or trackball) by which a user can provide input to the computer. Other kinds of devices may also be used to provide for interaction with a user; for example, feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form, including acoustic input, speech input, or tactile input.

The systems and techniques described here can be implemented in a computing system that includes a background component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such background, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local Area Networks (LANs), wide Area Networks (WANs), and the internet.

The computer system may include a client and a server. The client and server are typically remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other.

It should be appreciated that various forms of the flows shown above may be used to reorder, add, or delete steps. For example, the steps recited in the present disclosure may be performed in parallel, sequentially, or in a different order, provided that the desired results of the disclosed aspects are achieved, and are not limited herein.

The above detailed description should not be taken as limiting the scope of the present disclosure. It will be apparent to those skilled in the art that various modifications, combinations, sub-combinations and alternatives are possible, depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present disclosure are intended to be included within the scope of the present disclosure.

Claims

1. A vehicle control method comprising:

in the running process of the vehicle, acquiring a vehicle control command and a vehicle planning path generated by a controller of the vehicle;

determining a security level from an operating parameter of the vehicle in response to detecting the controller failure;

and selecting a safety strategy of a corresponding grade according to the safety grade to control the vehicle to park, wherein the safety strategy comprises a slow brake strategy based on the vehicle control command, a slow brake strategy based on the vehicle planning path and a sudden brake strategy based on the wheel orientation.

2. The method of claim 1, wherein the security levels comprise a first level, a second level, and a third level, the security of the first level, the second level, and the third level being sequentially downgraded; the selecting the security policy of the corresponding level to control the vehicle to park according to the security level comprises:

Under the condition that the safety level is the first level, selecting a slow braking strategy based on the vehicle planning path to control the vehicle to stop;

selecting a slow braking strategy based on the vehicle control command to control the vehicle to stop under the condition that the safety level is the second level;

and if the safety level is the third level, selecting an abrupt brake strategy based on the wheel orientation to control the vehicle to stop.

3. The method of claim 2, further comprising:

responding to the change of the operation parameters of the vehicle, and determining the security level degradation according to the condition which is met by the changed operation parameters;

in response to the security level degradation, the security policy degradation is determined.

4. The method of claim 3, wherein the determining the security policy degradation in response to the security level degradation comprises:

in response to the security level being downgraded from a first level to a second level, downgrading the vehicle planned path-based slow-brake strategy to the vehicle control command-based slow-brake strategy;

in response to the degradation of the safety level from a first level to a third level, degrading the slow-brake strategy based on the vehicle planned path to the sudden-brake strategy based on wheel orientation;

In response to the degradation of the safety level from the second level to a third level, the slow brake strategy based on the vehicle control command is degraded to the sudden brake strategy based on the wheel orientation.

5. A method according to claim 3, wherein the operating parameters include: braking parameters, inertial Measurement Unit (IMU) parameters and vehicle planning path parameters; the determining the security level according to the operating parameters of the vehicle comprises:

determining the safety level to be a first level in response to the operation parameter meeting a first condition, wherein the first condition is that the brake parameter, the Inertial Measurement Unit (IMU) parameter and the vehicle planning path parameter are all in a normal state;

determining the safety level to be a second level in response to the operation parameter meeting a second condition, wherein the second condition is that the brake parameter and the vehicle planning path parameter are both in a normal state;

and determining that the safety level is a third level in response to the operating parameter meeting a third condition, wherein the third condition is other than the first condition and the second condition.

6. The method of claim 5, wherein the determining the security level degradation based on the changed operating parameter compliance condition in response to the change in the operating parameter of the vehicle comprises:

Determining that the security level is downgraded from a first level to a second level in response to the condition met by the operating parameter of the vehicle being downgraded from a first condition to a second condition;

determining that the security level is downgraded from a first level to a third level in response to the condition met by the operating parameter of the vehicle being downgraded from the first condition to the third condition;

and determining that the security level is downgraded from the second level to a third level in response to the condition met by the operating parameter of the vehicle being downgraded from the second condition to the third condition.

7. The method of claim 2, wherein the selecting a slow-braking strategy based on the vehicle planned path to park if the safety level is a first level comprises:

generating a correction instruction for correcting the planned path according to the actual running environment of the vehicle;

determining a correction path according to the correction instruction;

and controlling the vehicle to stop according to the corrected path.

8. The method of claim 2, wherein the vehicle control command comprises a control command sequence; the selecting a slow brake strategy based on the vehicle control command to control the vehicle to park if the safety level is a second level comprises:

Determining a control command at a specified time point from the control command sequence as a start command according to the time point when the controller fails;

and executing the slow brake strategy based on the vehicle control command from a start command in the control command sequence.

9. The method of claim 1, further comprising:

detecting state data of the controller, wherein the state data comprises heartbeat data, communication data and service data;

and determining that the controller fails in response to an occurrence of an anomaly in at least one of the heartbeat data, communication data, and traffic data.

10. A vehicle control apparatus comprising:

the acquisition module is used for acquiring a vehicle control command and a vehicle planning path generated by a controller of the vehicle in the running process of the vehicle;

a first determination module for determining a security level from an operating parameter of the vehicle in response to detecting the controller failure;

and the control module is used for selecting a safety strategy of a corresponding grade to control the vehicle to park according to the safety grade, wherein the safety strategy comprises a slow brake strategy based on the vehicle control command, a slow brake strategy based on the vehicle planning path and a sudden brake strategy based on the wheel orientation.

11. The apparatus of claim 10, wherein the security levels comprise a first level, a second level, and a third level, the security of the first level, the second level, and the third level being sequentially downgraded; the control module includes:

the first control unit is used for selecting a slow brake strategy based on the vehicle planning path to control the vehicle to park under the condition that the safety level is a first level;

the second control unit is used for selecting a slow brake strategy based on the vehicle control command to control the vehicle to park under the condition that the safety level is a second level;

12. The apparatus of claim 11, further comprising:

the second determining module is used for responding to the change of the operation parameters of the vehicle and determining the safety grade degradation according to the condition which is met by the changed operation parameters;

and a third determining module, configured to determine the security policy degradation in response to the security level degradation.

13. The apparatus of claim 12, wherein the third determination module comprises:

A first determining unit, configured to, in response to the degradation of the safety level from a first level to a second level, degrade the slow-release strategy based on the vehicle planned path to the slow-release strategy based on the vehicle control command;

a second determining unit, configured to, in response to the degradation of the safety level from the first level to a third level, degrade the slow brake strategy based on the vehicle planned path to the sudden brake strategy based on the wheel orientation;

and the third determining unit is used for degrading the slow braking strategy based on the vehicle control command to the sudden braking strategy based on the wheel orientation in response to the degradation of the safety grade from the second grade to the third grade.

14. The apparatus of claim 12, wherein the operating parameters comprise: braking parameters, inertial Measurement Unit (IMU) parameters and vehicle planning path parameters; the first determining module includes:

a fourth determining unit, configured to determine, in response to the operation parameter meeting a first condition, that the safety level is a first level, where the first condition is that the braking parameter, the inertial measurement unit IMU parameter, and the vehicle planned path parameter are all in a normal state;

A fifth determining unit, configured to determine, in response to the operation parameter meeting a second condition, that the safety level is a second level, where the second condition is that both the braking parameter and the vehicle planned path parameter are in a normal state;

a sixth determining unit configured to determine that the security level is a third level in response to the operation parameter conforming to a third condition, wherein the third condition is a case other than the first condition and the second condition.

15. The apparatus of claim 14, wherein the second determination module comprises:

a seventh determining unit configured to determine that the security level is degraded from a first level to a second level in response to degradation of a condition, which the operation parameter of the vehicle meets, from the first condition to the second condition;

an eighth determination unit configured to determine that the security level is degraded from the first level to a third level in response to degradation from the first condition to the third condition of the condition to which the operation parameter of the vehicle conforms;

and a ninth determining unit configured to determine that the security level is degraded from the second level to the third level in response to degradation of the condition, which the operation parameter of the vehicle meets, from the second condition to the third condition.

16. The apparatus of claim 11, wherein the first control unit comprises:

a generation subunit, configured to generate a correction instruction for correcting the planned path according to an actual running environment of the vehicle;

the correction subunit is used for determining a correction path according to the correction instruction;

and the control subunit is used for controlling the vehicle to stop according to the corrected path.

17. The apparatus of claim 11, wherein the vehicle control command comprises a control command sequence; the second control unit includes:

a determining subunit, configured to determine, from the control command sequence, a control command at a specified time point as a start command according to a time point when the controller fails;

and the execution subunit is used for executing the slow brake strategy based on the vehicle control command from the starting command in the control command sequence.

18. The apparatus of claim 10, further comprising:

the detection module is used for detecting state data of the controller, wherein the state data comprises heartbeat data, communication data and service data;

and a fourth determining module, configured to determine that the controller fails in response to an occurrence of an abnormality in at least one of the heartbeat data, the communication data, and the traffic data.

19. An electronic device, comprising:

at least one processor; and

a memory communicatively coupled to the at least one processor; wherein,,

the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 9.

20. An autonomous vehicle comprising the electronic device of claim 19.

21. A non-transitory computer readable storage medium storing computer instructions for causing the computer to perform the method of any one of claims 1 to 9.

22. A computer program product comprising a computer program stored on at least one of a readable storage medium and an electronic device, which, when executed by a processor, implements the method according to any one of claims 1 to 9.