CN117601897A - Monitoring device and method for safety of wire control chassis function - Google Patents

Abstract

The embodiment of the specification discloses a supervision device and a supervision method for the safety of a wire control chassis function, wherein the device can comprise: the control abnormality cutting module is connected with the automatic driving controller at the first end, and connected with the chassis control controller at the second end, and the chassis control controller is used for controlling the corresponding chassis control by wire; the control abnormality cutoff module is used for interrupting a first control signal transmitted by the supervision device and issued to the drive-by-wire chassis controller by the automatic driving controller when the state of the automatic driving controller is monitored to be abnormal, and sending a refreshing signal for refreshing a bus signal of the drive-by-wire chassis controller to a communication bus of the drive-by-wire chassis controller; the refreshing signal is a preset initial state signal or a request-free signal; the supervision device further comprises a first communication interruption module and a second communication interruption module, wherein the first communication interruption module is arranged between the control abnormality interception module and the automatic driving controller.

Description

Monitoring device and method for safety of wire control chassis function

Technical Field

The application relates to the technical field of automatic driving, in particular to a supervision device and method for the functional safety of a drive-by-wire chassis.

Background

The automatic driving automobile becomes a research and development hot spot of the automobile industry at the present stage, and in the research and development testing process of the automatic driving technology, when the control of the automatic driving controller on the drive-by-wire chassis needs to be timely cut off due to different reasons, the drive-by-wire chassis controller can keep the control message of the automatic driving controller received in the last frame to continuously control the drive-by-wire chassis, so that the manual driving takeover is influenced. The reasons for this may be varied, as may be the reason for communication delays in a situation where there may be delays in communication between the autopilot controller and the drive-by-wire chassis, which may still receive control messages from the drive-by-wire chassis controller for a period of time when the autopilot controller is off, which may cause the drive-by-wire chassis to maintain abnormal signal control. In another case, there may be a problem in state management of the controller, in which, since the autopilot controller typically manages and monitors the state of the vehicle, when the controller is disconnected, if the state management of the controller is not updated in time, the drive-by-wire chassis may still consider the controller to be in a connected state, so that the control message is continuously sent, which affects manual takeover.

Therefore, there is a need to provide a method for ensuring that the effect of an autopilot on a vehicle is effectively and timely shut off when the autopilot is broken under different conditions.

Disclosure of Invention

The embodiment of the specification provides a monitoring device and a monitoring method for the function safety of a drive-by-wire chassis, which are used for solving the problem that residual control messages possibly appear when an automatic driving controller is required to timely cut off the control of the drive-by-wire chassis due to different reasons, so that the operation correctness of the drive-by-wire chassis is affected.

In order to solve the above technical problems, the embodiments of the present specification are implemented as follows:

according to a first aspect of an embodiment of the present invention, there is provided a supervision apparatus for chassis-by-wire function security, the supervision apparatus including:

the control abnormality cutting module is connected with the automatic driving controller at a first end, connected with the chassis control controller at a second end, and used for controlling the corresponding chassis by wire; the control abnormality cutoff module is used for interrupting a first control signal transmitted by the supervision device and issued to the drive-by-wire chassis controller by the automatic driving controller when the state of the automatic driving controller is monitored to be abnormal, and sending a refreshing signal for refreshing a bus signal of the drive-by-wire chassis to a communication bus of the drive-by-wire chassis controller; the refreshing signal is a preset initial state signal or a request-free signal;

the supervision device further comprises a first communication interruption module and a second communication interruption module, wherein the first communication interruption module is arranged between the control abnormality interception module and the automatic driving controller, the second communication interruption module is arranged between the control abnormality interception module and the line control chassis controller, the first communication interruption module is used for interrupting communication between the supervision device and the automatic driving controller after a corresponding first physical key is triggered, and the second communication interruption module is used for interrupting communication between the supervision device and the line control chassis controller after a corresponding second physical key is triggered.

Preferably, the supervision device further comprises a right acquiring and releasing module, wherein a first end of the right acquiring and releasing module is connected with the first communication interrupt module, and a second end of the right acquiring and releasing module is connected with the second communication interrupt module; the permission acquisition and release module is used for converting a control interface protocol of the drive-by-wire chassis and then selectively opening the control interface protocol to the automatic driving controller according to a preset rule; the control interface protocol of the drive-by-wire chassis is a communication protocol which is opened to external equipment by the drive-by-wire chassis controller and used for controlling the drive-by-wire chassis based on a first control instruction issued to the drive-by-wire chassis controller.

Preferably, the supervision device further comprises a communication signal conversion module, wherein the communication signal conversion module is located between the first communication interruption module and the control abnormality interception module, one end of the communication signal conversion module is connected with the control abnormality interception module, the other end of the communication signal conversion module is connected with the first communication interruption module, and the first communication interruption module is connected with the automatic driving controller; the communication signal conversion module is used for converting a drive-by-wire protocol of the drive-by-wire chassis, selectively releasing the drive-by-wire protocol to the automatic driving controller according to a preset rule, judging whether a second control instruction issued by the automatic driving controller to the drive-by-wire chassis controller accords with the preset rule, and obtaining a first judgment result;

and if the first judging result shows that the second control instruction accords with the preset rule, converting the second control instruction issued by the automatic driving controller according to the preset rule into a second control signal meeting a drive-by-wire protocol of the drive-by-wire chassis, and sending the second control signal to the drive-by-wire chassis controller so that the drive-by-wire chassis controller controls the drive-by-wire chassis to execute a control action meeting the requirement of the second control signal.

Preferably, if the first judging result indicates that the second control instruction does not meet the predetermined rule, the communication signal conversion module refuses to convert the second control instruction and sends a refresh signal for refreshing the bus of the drive-by-wire chassis to the bus of the drive-by-wire chassis, wherein the refresh signal is a preset initial state signal or a no-request signal.

Preferably, the communication signal conversion module further includes a threshold value judging submodule, where the threshold value judging submodule is configured to judge whether a third control instruction issued by the automatic driving controller to the drive-by-wire chassis controller exceeds a corresponding instruction threshold value.

Preferably, the supervision device further comprises a signal monitoring module, wherein signal receiving hardware is arranged in the signal monitoring module and used for receiving control signals sent by external signal transmitting hardware and used for controlling the target automatic driving vehicle.

According to a second aspect of the embodiment of the present invention, there is provided a method for monitoring and controlling the functional safety of a chassis by wire, which is applied to a device for monitoring and controlling the functional safety of the chassis by wire, the method comprising:

receiving function self-checking result information sent by an automatic driving controller, wherein the function self-checking result information is checking result information obtained after the automatic driving controller performs function self-checking on self-equipment software;

monitoring whether the automatic driving controller issues a control enabling mark, wherein the control enabling mark is a control mark used for enabling a supervision device for ensuring the safety of the drive-by-wire chassis function to be in an activated state;

if judging whether the function self-checking result information indicates that the automatic driving controller is in an abnormal working state, the abnormal control interception module of the supervision device refuses to forward a control signal issued by the automatic driving controller to the drive-by-wire chassis controller and sends a refreshing signal for refreshing the bus of the drive-by-wire chassis to the bus of the drive-by-wire chassis, wherein the refreshing signal is a preset initial state signal or a no-request signal;

if the automatic driving controller is in a normal working state and the control enabling mark is received, receiving a control message issued by the automatic driving controller, and judging whether the control message accords with the preset rule or not to obtain a second judging result;

if the second judging result shows that the control message accords with the preset rule, converting the control message into a control signal meeting the control interface protocol of the drive-by-wire chassis, and sending the control signal to the drive-by-wire chassis controller so that the drive-by-wire chassis controller executes a first control action meeting the control message requirement, wherein the control action is used for further instructing the drive-by-wire chassis to execute a second control action meeting the control message requirement;

and if the second judging result shows that the control message does not accord with the preset rule, rejecting to forward the control message to the drive-by-wire chassis controller, and sending a refreshing signal for refreshing the bus of the drive-by-wire chassis to the bus of the drive-by-wire chassis, wherein the refreshing signal is a preset initial state signal or a no-request signal.

Preferably, if it is detected that the signal monitoring module receives a control signal sent by the external signal transmitting hardware and used for controlling the target automatic driving vehicle, a control instruction corresponding to the control signal sent by the external signal transmitting hardware is sent to the drive-by-wire chassis controller, and the control instruction corresponding to the control signal sent by the external signal transmitting hardware is used for commanding the drive-by-wire chassis to execute a corresponding control action.

One embodiment of the present disclosure can achieve at least the following advantages: compared with the prior art, from a logic perspective, the technical scheme of the control abnormal cutting module is introduced between the automatic driving controller and the wire control chassis controller, the first end of the control abnormal cutting module is connected with the automatic driving controller, the second end is connected with the wire control chassis controller, and the wire control chassis controller is used for controlling the corresponding wire control chassis; the control abnormality cutoff module is used for interrupting a first control signal transmitted by the supervision device and issued to the drive-by-wire chassis controller by the automatic driving controller when the state of the automatic driving controller is monitored to be abnormal, and sending a refreshing signal for refreshing a bus signal of the drive-by-wire chassis controller to a communication bus of the drive-by-wire chassis controller; the refresh signal is an initial state signal or a no-request signal which is preset. By adopting the scheme, when the control of the automatic driving controller on the line control chassis is required to be timely cut off due to different reasons, the influence of the residual control message in the line control chassis controller on the line control chassis can be avoided, namely, the line control chassis can be prevented from continuously executing the control instruction which is not continuously executed from the aspect of logic correctness, so that the safety of the automatic driving vehicle is ensured. Meanwhile, by introducing the first communication interrupt module and the second communication interrupt module, the command control of the supervision device on the linear control chassis can be interrupted in a mode of matching with the physical keys arranged outside.

Drawings

In order to more clearly illustrate the embodiments of the present description or the technical solutions in the prior art, the drawings that are required to be used in the embodiments or the description of the prior art will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments described in the present application, and that other drawings may be obtained according to these drawings without inventive effort to a person skilled in the art.

FIG. 1 is a schematic diagram of the connection relationship between an autopilot controller, a vehicle controller and a drive-by-wire chassis in a conventional autopilot vehicle;

FIG. 2 is a schematic diagram of the connection relationship between an autopilot controller, a vehicle controller of the supervisory device and a drive-by-wire chassis after the supervisory device for the safety of the drive-by-wire chassis function provided by the invention is introduced;

fig. 3 is a schematic diagram of connection relation of a supervision device with a safe function of a drive-by-wire chassis according to an embodiment of the present invention;

fig. 4 is a schematic diagram of connection relation of a supervision device with a safe function of a drive-by-wire chassis according to an embodiment of the present invention based on fig. 3;

fig. 5 is a flow chart of a method for supervising the function safety of a drive-by-wire chassis according to an embodiment of the present invention.

Detailed Description

For the purposes of making the objects, technical solutions and advantages of one or more embodiments of the present specification more clear, the technical solutions of one or more embodiments of the present specification will be clearly and completely described below in connection with specific embodiments of the present specification and corresponding drawings. It will be apparent that the described embodiments are only some, but not all, of the embodiments of the present specification. All other embodiments, which can be made by one of ordinary skill in the art based on the embodiments herein without undue burden, are intended to be within the scope of one or more embodiments herein.

It should be understood that although the terms first, second, third, etc. may be used in this application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish one type of information from another.

When the influence of the automatic driving controller on the wire control chassis needs to be timely cut off due to various reasons in an abnormal control state of the automatic driving program (for example, the control program issued by the automatic driving controller is an abnormal program or the automatic driving controller is in an abnormal situation such as downtime), the wire control chassis controller may keep the control message of the automatic driving controller received in the last frame to continuously control the wire control chassis, so that the manual driving takeover is influenced, which may be due to the problem of communication delay or state management of the controller, and may also be the problem of design of the wire control chassis, the design of the wire control chassis may influence the interaction of the wire control chassis and the automatic driving controller, and if the wire control chassis does not correctly process the situation that the controller is disconnected, the wire control chassis may keep abnormal signal control. In response to these problems in the autopilot technology, the related art generally provides a targeted solution in terms of strengthening state management, optimizing communication protocols, adding fault detection and handling mechanisms, and the like. In the solution of strengthening the state management, the state management is strengthened in the design process of an automatic driving system and a drive-by-wire chassis, so that when the automatic driving controller is disconnected, the system can update the state in time and respond correctly. In the optimized communication protocol solution, the number of delay messages received by the drive-by-wire chassis is reduced by reducing communication delay, and in the solution of adding a fault detection and processing mechanism, particularly in the design of a module between an automatic driving system and the drive-by-wire chassis, the fault detection and processing mechanism is added, so that abnormal situations can be found and processed in time.

More specific examples, for example, chinese patent No. 202111613415.2 discloses a module and a method for taking over an automatic driving program after crash, and in this document, the basic principle of an automatic driving vehicle is briefly introduced, and the basic principle of an automatic driving vehicle is first briefly introduced in conjunction with the related content, so as to make the technical solution of the present application easy to understand based on this.

The automatic driving vehicle is provided with advanced vehicle-mounted sensors, controllers, actuators and other devices, combines modern communication and network technologies, realizes intelligent information exchange and sharing between the vehicle and X (people, vehicles, roads, cloud ends and the like), has the functions of complex environment sensing, intelligent decision, cooperative control and the like, can realize safe, efficient, comfortable and energy-saving running, and can finally realize a new-generation vehicle operated by replacing people.

And the intelligent driving system is a system which is composed of hardware and software and can continuously execute part or all of the dynamic driving tasks and/or execute the dynamic driving task takeover. The system CAN fuse sensor data from cameras, laser radars, ultrasonic waves, millimeter wave radars, GPS/inertial navigation (IMUs) and maps together, position vehicles, sense environment, plan paths, decide driving behaviors and send CAN signals to a drive-by-wire chassis to control the vehicles to execute corresponding driving tasks. The system consists of a hardware part (a main control board, a fusion positioning module, a router and various I/O interfaces) and a software part (an operating system, autopilot software, a configuration file and the like). The intelligent driving system core software layer can be subdivided into three layers: the lowest layer is the RTOS real-time operating system. The middle layer is Runtime Framework, provides data layer support for the modules of the upper layer, and the uppermost layer is an implementation part of each functional module of automatic driving, and comprises a map engine, positioning, sensing, planning, monitoring, control, end-to-end, human-machine interface HMI and the like, wherein the hardware part comprises a vehicle drive-by-wire chassis which mainly comprises: (1) an electric appliance driving controller MCU: the drive-by-wire driving of the vehicle is realized by controlling the power, torque and rotation speed output by the motor; (2) an electronic power steering controller EPS: the steering column is driven by a motor, and the steering wheel angle (wheel angle) of the vehicle is controlled by a wire control; (3) an electro-hydraulic brake controller EHB: the brake-by-wire (braking) is realized by controlling the motor and the pump to build pressure on the vehicle brake pipeline; (4) electronic parking controller EPB: control by wire vehicle parking brake; (5) The gear-shifting control device mainly comprises a gear-shifting lever and a sensor control unit, when a certain gear is hung in, the sensor transmits a gear request signal to a gearbox control unit TCU, meanwhile, the TCU analyzes according to other various signals (such as engine rotating speed, vehicle speed, throttle opening, safety belt, vehicle door switch signals and the like) on an automobile, and judges whether to execute a gear-shifting request according to a communication protocol.

The temporary takeover module is introduced into the takeover algorithm module after the automatic driving program is crashed, the input end of the temporary takeover module is connected with the automatic driving program module, the output end of the temporary takeover module is connected with the input end of the vehicle drive-by-wire chassis, and the output end of the vehicle drive-by-wire chassis is respectively connected with the input end of the temporary takeover program module and the input end of the automatic driving program module, so that when the automatic driving program module is crashed or wrongly reported, a flag bit for requesting takeover is output to the temporary takeover program module, and at the moment, the temporary takeover program module outputs a control instruction to the vehicle drive-by-wire chassis to control the vehicle to slow down and stop by-wire and then exit the takeover program, thereby being capable of monitoring the running state of the automatic driving program in real time, realizing safe takeover when the automatic driving program is wrong or the thread is crashed, being capable of effectively avoiding the damage caused by the vehicle runaway and reducing the risk of traffic accidents.

However, the solution adopted in the prior art in the upper section is equivalent to introducing a redundancy design scheme parallel to the autopilot program module, and the stability of the system is improved by a redundancy backup mode, and the problem that the control message of the autopilot controller received in the last frame is kept to control the drive-by-wire chassis by the control chassis controller in the process of taking over the control chassis after the problem of the autopilot program is not solved, because the error of the autopilot program or the safe take-over when the thread is crashed occurs is focused on.

In view of the technical problems in the related art mentioned above, a supervision device with a safe function of a chassis-by-wire is introduced in the technical solution of the present application, as shown in fig. 1 and fig. 2, fig. 1 is a schematic diagram of a connection relationship among an autopilot controller, a whole vehicle controller and a chassis-by-wire in an existing autopilot vehicle, and fig. 2 is a schematic diagram of a connection relationship among the autopilot controller, the whole vehicle controller and the chassis-by-wire after the supervision device with the safe function of the chassis-by-wire is introduced, which is provided by the present invention, in contrast to the prior art in fig. 1, the supervision device in the present application is logically located between the autopilot controller and the chassis-by-wire controller (the chassis-by-wire controller is used for controlling the chassis-by-wire), and the autopilot controller issues a control command to the chassis-by-wire to the chassis controller, and needs to be forwarded to the chassis-wire controller via the supervision device, so that when an abnormal state of the autopilot controller is monitored by a control abnormality module, the control signal forwarded by the autopilot controller is interrupted, and a communication bus for refreshing a bus of the chassis-by the chassis controller.

The technical scheme of the monitoring device and method for the function safety of the drive-by-wire chassis provided by the invention is further described below based on fig. 3 to 4.

As shown in fig. 3, fig. 3 is a schematic diagram of a connection relationship of a monitoring device for controlling chassis function safety, where the monitoring device for controlling chassis function safety may include a control abnormality cutting module, where a first end of the control abnormality cutting module is connected to an automatic driving controller, and a second end of the control abnormality cutting module is connected to a chassis controller, and the chassis controller is used for controlling a corresponding chassis; the control abnormality cutoff module is used for interrupting a first control signal transmitted by the supervision device and issued to the drive-by-wire chassis controller by the automatic driving controller when the state of the automatic driving controller is monitored to be abnormal, and sending a refreshing signal for refreshing a bus signal of the drive-by-wire chassis controller to a communication bus of the drive-by-wire chassis controller; the refresh signal is an initial state signal or a no-request signal which is preset.

The supervision device may further include a first communication interruption module and a second communication interruption module, the first communication interruption module is disposed between the control abnormality interruption module and the automatic driving controller, the second communication interruption module is disposed between the control abnormality interruption module and the line control chassis controller, the first communication interruption module is used for interrupting communication between the supervision device and the automatic driving controller after the corresponding first physical key is triggered, and the second communication interruption module is used for interrupting communication between the supervision device and the line control chassis controller after the corresponding second physical key is triggered.

In the scheme, the state of the automatic driving controller can be monitored by the control abort module, the related monitoring method can be flexibly selected, and is not repeated herein, once the abnormal state of the automatic driving control is monitored, a refreshing signal for refreshing a bus signal of the wire-controlled chassis can be sent to a communication bus of the wire-controlled chassis controller, the influence of a residual control message in the wire-controlled chassis controller on the wire-controlled chassis is avoided, and the wire-controlled chassis can be prevented from continuously executing a control instruction which is not continuously executed from the aspect of logic correctness, so that the safety of the automatic driving vehicle is ensured. Meanwhile, when the control of the automatic driving controller on the line control chassis is required to be timely cut off due to different reasons, for example, the automatic driving vehicle has a scene of needing manual taking over, so that in other schemes, after the monitoring device is powered on, a scheme that the monitoring device always sends a refreshing signal (an initial state signal or a no-request signal) according to the protocol requirement of the line control chassis controller can be adopted, the refreshing signal can ensure that the line control chassis is always in a controllable state, and when the signal of the automatic driving controller is normally sent, the monitoring device can forward the control signal of the automatic driving controller.

Compared with the prior art, from a logic perspective, the technical scheme of the control abnormal cutting module is introduced between the automatic driving controller and the wire control chassis controller, the first end of the control abnormal cutting module is connected with the automatic driving controller, the second end is connected with the wire control chassis controller, and the wire control chassis controller is used for controlling the corresponding wire control chassis; the control abnormality cutoff module is used for interrupting a first control signal transmitted by the supervision device and issued to the drive-by-wire chassis controller by the automatic driving controller when the state of the automatic driving controller is monitored to be abnormal, and sending a refreshing signal for refreshing a bus signal of the drive-by-wire chassis controller to a communication bus of the drive-by-wire chassis controller; the refresh signal is an initial state signal or a no-request signal which is preset. By adopting the scheme, when the control of the automatic driving controller on the line control chassis is required to be timely cut off due to different reasons, the influence of the residual control message in the line control chassis controller on the line control chassis can be avoided, namely, the line control chassis can be prevented from continuously executing the control instruction which is not continuously executed from the aspect of logic correctness, so that the safety of the automatic driving vehicle is ensured. Meanwhile, by introducing the first communication interrupt module and the second communication interrupt module, the command control of the supervision device on the linear control chassis can be interrupted in a mode of matching with the physical keys arranged outside.

Based on the device structure of fig. 3, the examples of the present specification also provide some specific embodiments of the device, as described below.

In the automatic driving industry, a front end sensing layer of a vehicle sensing system comprising environment sensing hardware such as a laser radar, a camera, a millimeter wave radar and the like generally senses driving environment around a vehicle, a central decision layer of a decision system is used for making decisions such as path planning, driving control and the like, and a bottom execution layer of an execution system is used for performing operations such as steering by wire, power control, braking control and the like, namely, in the process of sensing, positioning, decision-execution, the vehicle needs to execute instructions given by the decision layer at the bottom of the tail end, and the vehicle can particularly be represented as a wire control on an accelerator (gear shifting), a brake, steering and a suspension. Thus, in an alternative embodiment, the supervision device may further include a rights acquisition and release module, a first end of the rights acquisition and release module may be connected to the first communication interrupt module, and a second end of the rights acquisition and release module may be connected to the second communication interrupt module. In this embodiment, the permission acquisition and release module is configured to convert a control interface protocol of the drive-by-wire chassis and selectively open the control interface protocol to the autopilot controller according to a predetermined rule; the control interface protocol of the drive-by-wire chassis is a communication protocol which is opened to external equipment by the drive-by-wire chassis controller and used for controlling the drive-by-wire chassis based on a first control instruction issued to the drive-by-wire chassis controller.

In the above technical solution, it is stated that under a partial scenario, a part of control authority of the drive-by-wire chassis can be released (as to which control authority can be released to the automatic driving controller and can be determined according to business negotiation) to the automatic driving controller, so that the automatic driving controller can control the drive-by-wire chassis more directly, on the basis, in an alternative embodiment, the supervision device may further include a communication signal conversion module, where the communication signal conversion module is located between the first communication interruption module and the abnormal control interruption module, one end of the communication signal conversion module is connected with the abnormal control interruption module, and the other end of the communication signal conversion module is connected with the first communication interruption module, and the first communication interruption module is connected with the automatic driving controller; the communication signal conversion module is used for converting a drive-by-wire protocol of the drive-by-wire chassis, selectively releasing the drive-by-wire protocol to the automatic driving controller according to a preset rule, judging whether a second control instruction issued by the automatic driving controller to the drive-by-wire chassis controller accords with the preset rule, and obtaining a first judgment result;

and if the first judging result shows that the second control instruction accords with the preset rule, converting the second control instruction issued by the automatic driving controller according to the preset rule into a second control signal meeting a drive-by-wire protocol of the drive-by-wire chassis, and sending the second control signal to the drive-by-wire chassis controller so that the drive-by-wire chassis controller controls the drive-by-wire chassis to execute a control action meeting the requirement of the second control signal.

In this embodiment, by introducing the communication signal conversion module, the autopilot controller can more directly control the drive-by-wire chassis according to a specified rule, that is, the autopilot controller needs to realize more direct control of the drive-by-wire chassis according to the requirement of the communication signal conversion module, and an "intermediate layer" is added between the autopilot controller and the drive-by-wire chassis controller (used for controlling the drive-by-wire chassis), thereby not only meeting the requirement that the autopilot controller needs to control the drive-by-wire chassis more directly in part of scenes, but also ensuring the safety in the control process and avoiding the safety risk possibly caused by directly opening the original control drive-by-wire protocol of the vehicle enterprise.

In an optional embodiment, if the first determination result indicates that the second control instruction does not meet the predetermined rule, the communication signal conversion module refuses to convert the second control instruction, and sends a refresh signal for refreshing the bus of the drive-by-wire chassis to the bus of the drive-by-wire chassis, where the refresh signal is a preset initial state signal or a no-request signal. In this embodiment, if the second control instruction does not meet the predetermined rule, the "middle layer" of the communication signal conversion module refuses to convert and further forward the control instruction, so as to ensure the safety of the vehicle.

In an alternative embodiment, the communication signal conversion module may further include a threshold value judging submodule, where the threshold value judging submodule is configured to judge whether a third control instruction issued by the autopilot controller to the drive-by-wire chassis controller exceeds a corresponding instruction threshold value. In this embodiment, considering that the related instruction issued by the autopilot controller to the drive-by-wire chassis controller may not be suitable in some cases, in the technical scheme of the present application, the threshold judging submodule may analyze and judge the related instruction by the threshold judging submodule after introducing the threshold judging submodule, perform threshold control and other processes on the related instruction, as described in the foregoing, in some technical schemes, part of the control authority of the drive-by-wire chassis may be released to the autopilot controller, so that the autopilot controller may control the drive-by-wire chassis, where in one case of drive-by-wire is to control steering, and the steering process involves controlling and correcting the corner, so that after introducing the threshold judging submodule, the module may analyze and judge the related instruction, perform threshold control and other processes, and further ensure the safety in the steering process.

Considering that in some situations, such as in the process of testing an automatic driving vehicle without related personnel in the vehicle, the automatic driving vehicle needs to be controlled from the outside of the vehicle, such as controlling the vehicle at a distance from the vehicle, so as to ensure the convenience and safety of testing the automatic driving vehicle, in an alternative embodiment, the supervision device may further include a signal monitoring module, where the signal monitoring module is provided with signal receiving hardware, and the signal receiving hardware is used to receive a control signal sent by the external signal transmitting hardware and used to control the target automatic driving vehicle. In this embodiment, the signal monitoring module monitors the control signal (the control signal may be a control signal such as a deceleration or a brake) transmitted by the external signal transmitting hardware outside the vehicle, and once the signal monitoring module receives the control signal transmitted by the external signal transmitting hardware, the signal monitoring module may issue a corresponding command signal to the drive-by-wire chassis controller through the communication bus, and then the drive-by-wire chassis controller controls the drive-by-wire chassis to complete a corresponding operation, in an alternative embodiment, as shown in fig. 4, the signal monitoring module may be logically located between the communication signal conversion module and the second communication interrupt module, and the external signal transmitting hardware may be in the form of a wireless remote controller or a remote monitoring platform.

According to a second aspect of the embodiments of the present invention, there is provided a method for monitoring and controlling the functional safety of a chassis by wire, which is applied to the device for monitoring and controlling the functional safety of a chassis by wire described above, and the method may include:

step 502: and receiving function self-checking result information sent by the automatic driving controller, wherein the function self-checking result information is checking result information obtained after the automatic driving controller performs function self-checking on own equipment software.

In this embodiment, after the autonomous vehicle is powered on, the autonomous controller of the vehicle may first perform a functional self-test,

step 504: and monitoring whether the automatic driving controller issues a control enabling mark, wherein the control enabling mark is a control mark used for enabling the supervision device for ensuring the safety of the drive-by-wire chassis function to be in an activated state.

Step 506: if the function self-checking result information is judged to be whether the automatic driving controller is in an abnormal working state or not, the control abnormality cutoff module of the supervision device refuses to forward the control signal issued by the automatic driving controller to the drive-by-wire chassis controller and sends a refreshing signal for refreshing the bus of the drive-by-wire chassis to the bus of the drive-by-wire chassis, wherein the refreshing signal is a preset initial state signal or a no-request signal.

Step 508: and if the automatic driving controller is in a normal working state and the control enabling mark is received, receiving a control message issued by the automatic driving controller, and judging whether the control message accords with the preset rule or not to obtain a second judging result.

Step 510: if the second judging result shows that the control message accords with the preset rule, converting the control message into a control signal meeting the control interface protocol of the drive-by-wire chassis, and sending the control signal to the drive-by-wire chassis controller so that the drive-by-wire chassis controller executes a first control action meeting the control message requirement, wherein the control action is used for further instructing the drive-by-wire chassis to execute a second control action meeting the control message requirement.

Step 512: and if the second judging result shows that the control message does not accord with the preset rule, rejecting to forward the control message to the drive-by-wire chassis controller, and sending a refreshing signal for refreshing the bus of the drive-by-wire chassis to the bus of the drive-by-wire chassis, wherein the refreshing signal is a preset initial state signal or a no-request signal.

In an optional technical solution, if it is monitored that the signal monitoring module receives a control signal sent by the external signal transmitting hardware and used for controlling the target autopilot vehicle, a control instruction corresponding to the control signal sent by the external signal transmitting hardware is sent to the drive-by-wire chassis controller, and the control instruction corresponding to the control signal sent by the external signal transmitting hardware is used for commanding the drive-by-wire chassis to execute a corresponding control action.

Those of ordinary skill in the art will appreciate that: the drawing is a schematic diagram of one embodiment and the modules or flows in the drawing are not necessarily required to practice the invention.

Those of ordinary skill in the art will appreciate that: the modules in the apparatus of the embodiments may be distributed in the apparatus of the embodiments according to the description of the embodiments, or may be located in one or more apparatuses different from the present embodiments with corresponding changes. The modules of the above embodiments may be combined into one module, or may be further split into a plurality of sub-modules.

Finally, it should be noted that: the above embodiments are only for illustrating the technical solution of the present invention, and are not limiting; although the invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical scheme described in the foregoing embodiments can be modified or some of the technical features thereof can be replaced by equivalents; such modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (8)

1. A supervisory device for the functional safety of a drive-by-wire chassis, characterized in that the supervisory device comprises:

the control abnormality cutting module is connected with the automatic driving controller at a first end, connected with the chassis control controller at a second end, and used for controlling the corresponding chassis by wire; the control abnormality cutoff module is used for interrupting a first control signal transmitted by the supervision device and issued to the drive-by-wire chassis controller by the automatic driving controller when the state of the automatic driving controller is monitored to be abnormal, and sending a refreshing signal for refreshing a bus signal of the drive-by-wire chassis to a communication bus of the drive-by-wire chassis controller; the refreshing signal is a preset initial state signal or a request-free signal;

the supervision device further comprises a first communication interruption module and a second communication interruption module, wherein the first communication interruption module is arranged between the control abnormality interception module and the automatic driving controller, the second communication interruption module is arranged between the control abnormality interception module and the line control chassis controller, the first communication interruption module is used for interrupting communication between the supervision device and the automatic driving controller after a corresponding first physical key is triggered, and the second communication interruption module is used for interrupting communication between the supervision device and the line control chassis controller after a corresponding second physical key is triggered.

2. The supervisory device for the safety of the functions of the chassis by wire according to claim 1, wherein the supervisory device further comprises a right acquiring and releasing module, a first end of the right acquiring and releasing module is connected with the first communication interrupt module, and a second end of the right acquiring and releasing module is connected with the second communication interrupt module; the permission acquisition and release module is used for converting a control interface protocol of the drive-by-wire chassis and then selectively opening the control interface protocol to the automatic driving controller according to a preset rule; the control interface protocol of the drive-by-wire chassis is a communication protocol which is opened to external equipment by the drive-by-wire chassis controller and used for controlling the drive-by-wire chassis based on a first control instruction issued to the drive-by-wire chassis controller.

3. The supervisory device for the safety of the drive-by-wire chassis function according to claim 1, further comprising a communication signal conversion module, wherein the communication signal conversion module is located between the first communication interruption module and the control abnormality interception module, one end of the communication signal conversion module is connected with the control abnormality interception module, the other end of the communication signal conversion module is connected with the first communication interruption module, and the first communication interruption module is connected with the automatic driving controller; the communication signal conversion module is used for converting a drive-by-wire protocol of the drive-by-wire chassis, selectively releasing the drive-by-wire protocol to the automatic driving controller according to a preset rule, judging whether a second control instruction issued by the automatic driving controller to the drive-by-wire chassis controller accords with the preset rule, and obtaining a first judgment result;

and if the first judging result shows that the second control instruction accords with the preset rule, converting the second control instruction issued by the automatic driving controller according to the preset rule into a second control signal meeting a drive-by-wire protocol of the drive-by-wire chassis, and sending the second control signal to the drive-by-wire chassis controller so that the drive-by-wire chassis controller controls the drive-by-wire chassis to execute a control action meeting the requirement of the second control signal.

4. The supervisory device for the function safety of a drive-by-wire chassis according to claim 3, wherein if the first determination result indicates that the second control command does not meet the predetermined rule, the communication signal conversion module refuses to convert the second control command and sends a refresh signal for refreshing the bus of the drive-by-wire chassis to the bus of the drive-by-wire chassis, wherein the refresh signal is a preset initial state signal or a no-request signal.

5. A chassis-by-wire functional safety supervision apparatus according to claim 3, wherein the communication signal conversion module further comprises a threshold determination submodule, and the threshold determination submodule is configured to determine whether a third control instruction issued by the autopilot controller to the chassis-by-wire controller exceeds a corresponding instruction threshold.

6. The supervisory device for the safety of the drive-by-wire chassis function according to claim 1, further comprising a signal monitoring module, wherein a signal receiving hardware is arranged in the signal monitoring module, and the signal receiving hardware is used for receiving a control signal sent by an external signal transmitting hardware and used for controlling the target automatic driving vehicle.

7. A method for supervising the safety of a chassis by wire function, which is applied to the device for supervising the safety of the chassis by wire function according to claim 1, and is characterized in that the method comprises the following steps:

receiving function self-checking result information sent by an automatic driving controller, wherein the function self-checking result information is checking result information obtained after the automatic driving controller performs function self-checking on self-equipment software and self-connected sensor states;

monitoring whether the automatic driving controller issues a control enabling mark, wherein the control enabling mark is a control mark used for enabling a supervision device of the drive-by-wire chassis to be in an activated state;

if the function self-checking result information is judged to be indicative that the automatic driving controller is in an abnormal working state, the control abnormality cutoff module of the supervision device refuses to forward a control signal issued by the automatic driving controller to the drive-by-wire chassis controller and sends a refreshing signal for refreshing the bus of the drive-by-wire chassis to the bus of the drive-by-wire chassis, wherein the refreshing signal is a preset initial state signal or a no-request signal;

if the automatic driving controller is in a normal working state and the control enabling mark is received, receiving a control message issued by the automatic driving controller, and judging whether the control message accords with the preset rule or not to obtain a first judging result;

if the first judging result shows that the control message accords with the preset rule, converting the control message into a control signal meeting the control interface protocol of the drive-by-wire chassis, and sending the control signal to the drive-by-wire chassis controller so that the drive-by-wire chassis controller executes a first control action meeting the control message requirement, wherein the control action is used for further instructing the drive-by-wire chassis to execute a second control action meeting the control message requirement;

and if the first judging result shows that the control message does not accord with the preset rule, rejecting to forward the control message to the drive-by-wire chassis controller, and sending a refreshing signal for refreshing the bus of the drive-by-wire chassis to the bus of the drive-by-wire chassis, wherein the refreshing signal is a preset initial state signal or a no-request signal.

8. The method according to claim 7, wherein if the signal monitoring module receives a control signal for controlling a target autonomous vehicle, the control signal is sent to the chassis-by-wire controller, and the control instruction corresponding to the control signal sent by the external signal sending hardware is used for commanding the chassis-by-wire to perform a corresponding control action.