KR20230158161A - Controller Redundancy system and method of self-driving vehicles - Google Patents

Abstract

A vehicle controller redundancy system according to an embodiment includes an autonomous vehicle, an autonomous driving server that communicates with the autonomous vehicle, and a main electronic control unit (ECU) that controls the autonomous vehicle to drive in an autonomous driving mode. When a failure of the autonomous vehicle is detected, the main communication unit of the self-driving vehicle communicates with the self-driving server to receive commands for autonomous driving of the self-driving vehicle from the self-driving server. A vehicle including a control unit that controls the main communication unit. A controller redundancy system is initiated.

Description

{Controller Redundancy system and method of self-driving vehicles}

The disclosed invention relates to a system and method for duplicating the controller of an autonomous vehicle, and more specifically, to a controller duplication system for safely controlling the vehicle when a failure is detected in the autonomous vehicle.

Recently, not only existing automobile companies but also companies in various fields are pursuing the development of autonomous vehicles. However, safety issues regarding autonomous vehicles are still emerging.

Accordingly, the importance of redundancy is being highlighted as a technological supplement to the safety of autonomous vehicles.

Accordingly, when a failure occurs in a component of an autonomous vehicle, a system that can control the autonomous vehicle is required.

One aspect of the disclosed invention seeks to provide a vehicle controller redundancy system and a control method of the vehicle controller redundancy system that can safely control the vehicle through communication with an autonomous driving server when a failure occurs in a component of an autonomous vehicle.

A vehicle controller redundancy system according to one aspect of the disclosed invention includes an autonomous vehicle, an autonomous driving server that communicates with the autonomous vehicle, and a main electronic control unit (ECU) that controls the autonomous vehicle to drive in an autonomous driving mode. When a failure of the self-driving vehicle is detected, the main communication unit of the autonomous vehicle communicates with the autonomous driving server and includes a control unit that controls the main communication unit to receive commands for autonomous driving of the autonomous vehicle from the autonomous driving server. can do.

The vehicle controller redundancy system according to one aspect of the disclosed invention further includes a backup communication unit that communicates with the autonomous driving server, and when a failure of the main communication unit is detected, the control unit communicates with the autonomous driving server through the backup communication unit. The backup communication unit may be controlled to communicate and receive commands for autonomous driving of the autonomous vehicle from the autonomous driving server.

The vehicle controller redundancy system according to one aspect of the disclosed invention further includes a backup electronic control unit (ECU, Electronic Control Unit) that controls the autonomous vehicle to drive in an autonomous driving mode, wherein the control unit is configured to operate in an autonomous driving mode when the backup communication unit fails. When this is detected, control can be changed so that the autonomous vehicle is controlled by the backup electronic control unit.

The command for autonomous driving may include either moving to a destination or moving to a preset point.

The control unit may receive an input regarding either movement to a destination or a preset point from the driver through an input unit provided in the self-driving vehicle, and transmit the received input to the self-driving server. there is.

If the input received from the driver through the input unit provided in the autonomous vehicle is movement to the destination, the control unit may control the autonomous vehicle to move to the preset point after arriving at the destination.

The control unit may control the autonomous vehicle to perform an emergency stop by the backup electronic control unit.

A control method of a vehicle controller redundancy system according to an aspect of the disclosed invention detects a failure of a main electronic control unit (ECU) that controls an autonomous vehicle to drive in an autonomous driving mode, and detects a failure of the main electronic control unit (ECU). When a failure of the self-driving vehicle is detected, the main communication unit of the self-driving vehicle may communicate with the self-driving server to receive a command for autonomous driving of the self-driving vehicle from the self-driving server.

The control method of the vehicle controller redundancy system according to one aspect of the disclosed invention includes detecting a failure of the main communication unit, communicating with the autonomous driving server through a backup communication unit, and transmitting information from the autonomous driving server to the autonomous driving server for autonomous driving of the autonomous vehicle. It may further include receiving a command.

The control method of the vehicle controller redundancy system according to one aspect of the disclosed invention includes detecting a failure of the backup communication unit and changing control so that the autonomous vehicle is controlled by a backup electronic control unit (ECU). Can include more?C.

The command for autonomous driving may include either moving to a destination or moving to a preset point.

A control method of a vehicle controller redundancy system according to an aspect of the disclosed invention includes receiving an input regarding any one of movement to a destination or movement to a preset point from a driver through an input unit provided in the autonomous vehicle, It may further include transmitting the received input to the autonomous driving server.

The control method of the vehicle controller redundancy system according to one aspect of the disclosed invention is to move the autonomous vehicle to the preset point after arriving at the destination when the input received from the driver through the input unit provided in the autonomous vehicle is movement to the destination. It may further include controlling an autonomous vehicle.

Changing the control may include controlling the autonomous vehicle to perform an emergency stop by the backup electronic control unit.

According to one aspect of the disclosed invention, by configuring a virtual self-driving controller through an autonomous driving server, an efficient self-driving controller redundancy system can be provided, and the accident rate can be reduced even when the self-driving vehicle breaks down. .

1 shows the configuration of a vehicle according to one embodiment.
Figure 2 shows the configuration of a driver assistance system according to one embodiment.
3 shows cameras and sensors included in a driver assistance system according to one embodiment.
FIG. 4 is a diagram illustrating an autonomous driving server of a vehicle controller redundancy system communicating with an autonomous vehicle according to an embodiment.
Figure 5 is a control block diagram of a vehicle controller redundancy system according to an embodiment.
Figure 6 is a diagram showing a failure in the main electronic control unit in a vehicle controller redundancy system according to an embodiment.
Figure 7 is a diagram showing a failure occurring in the main electronic control unit and main communication unit in the vehicle controller redundancy system according to one embodiment.
Figure 8 is a diagram showing a failure occurring in the main electronic control unit, main communication unit, and backup communication unit in the vehicle controller redundancy system according to one embodiment.
Figure 9 is a flowchart showing a control method of a vehicle controller redundancy system according to an embodiment.
Figure 10 continues to show a flowchart regarding the control method of the vehicle controller redundancy system according to one embodiment.

Like reference numerals refer to like elements throughout the specification. This specification does not describe all elements of the embodiments, and general content or overlapping content between the embodiments in the technical field to which the disclosed invention pertains is omitted. The term 'unit, module, member, block' used in the specification may be implemented as software or hardware, and depending on the embodiment, a plurality of 'unit, module, member, block' may be implemented as a single component, or It is also possible for one 'part, module, member, or block' to include multiple components.

Throughout the specification, when a part is said to be “connected” to another part, this includes not only direct connection but also indirect connection, and indirect connection includes connection through a wireless communication network. do.

Additionally, when a part "includes" a certain component, this means that it may further include other components rather than excluding other components, unless specifically stated to the contrary.

Throughout the specification, when a member is said to be located “on” another member, this includes not only cases where a member is in contact with another member, but also cases where another member exists between the two members.

Terms such as first and second are used to distinguish one component from another component, and the components are not limited by the above-mentioned terms.

Singular expressions include plural expressions unless the context clearly makes an exception.

The identification code for each step is used for convenience of explanation. The identification code does not explain the order of each step, and each step may be performed differently from the specified order unless a specific order is clearly stated in the context. there is.

Hereinafter, the operating principle and embodiments of the disclosed invention will be described with reference to the attached drawings.

1 shows the configuration of a vehicle according to one embodiment.

As shown in FIG. 1, the vehicle 1 may include an autonomous vehicle 1 and includes an engine 10, a transmission 20, a braking device 30, and a steering device 40. do. The engine 10 includes a cylinder and a piston and can generate power for the vehicle 1 to run. The transmission 20 includes a plurality of gears and can transmit power generated by the engine 10 to the wheels. The braking device 30 can slow down the vehicle 1 or stop the vehicle 1 through friction with the wheels. The steering device 40 can change the driving direction of the vehicle 1.

The vehicle 1 may include a plurality of electrical components. For example , the vehicle (1) includes an Engine Management System (EMS) (11), a Transmission Control Unit (TCU) (21), and an Electronic Brake Control Module. (31), Electronic Power Steering (EPS) (41), Body Control Module (BCM), Driver Assistance System (DAS) 100, and user interface ( 200).

The engine management system 11 may control the engine 10 in response to the driver's intention to accelerate through the accelerator pedal or a request from the driver assistance system 100. For example, engine management system 11 may control the torque of engine 10.

The engine management system 11 performs fuel injection control, fuel efficiency feedback control, lean combustion control, ignition timing control, and idle speed control. This engine management system 11 may not only be a single device, but may also be a plurality of devices connected through communication.

The transmission control unit 21 may control the transmission 20 in response to the driver's shift command through the shift lever and/or the driving speed of the vehicle 1. For example, the transmission control unit 21 can adjust the shift ratio from the engine 10 to the wheels.

The electronic brake control module 31 may control the braking device 30 in response to the driver's intention to brake through the brake pedal and/or slip of the wheels. For example, the electronic brake control module 31 may temporarily release the brakes on the wheels in response to wheel slip detected when braking the vehicle 1 (Anti-lock Braking Systems, ABS). The electronic brake control module 31 can selectively release the brakes on the wheels in response to oversteering and/or understeering detected when steering the vehicle 1 (electronic stability control, ESC). ). Additionally, the electronic braking control module 31 can temporarily brake the wheels in response to wheel slip detected when driving the vehicle 1 (Traction Control System, TCS).

The electronic steering device 41 can assist the operation of the steering device 40 so that the driver can easily operate the steering wheel in response to the driver's steering intention through the steering wheel. For example, the electronic steering device 41 may assist the operation of the steering device 40 to reduce steering force when driving at low speeds or parking and increase steering force when driving at high speeds.

The body control module 51 can control the operation of electrical components that provide convenience to the driver or ensure the driver's safety. For example, the body control module 51 can control headlamps, wipers, clusters, multi-function switches, and turn signal lamps.

The driver assistance system 100 can assist the driver in operating (driving, braking, and steering) the vehicle 1, and in the case of the autonomous vehicle 1, the driver's intervention can control the vehicle 1 itself. It may be possible.

For example, the driver assistance system 100 detects the environment of the road on which the vehicle 1 is driving (e.g., other vehicles, pedestrians, cyclists, lanes, road signs, traffic lights, etc.), and detects the environment of the road on which the vehicle 1 is driving. Driving and/or braking and/or steering of the vehicle 1 may be controlled in response to the environment.

The driver assistance system 100 can provide various functions to the driver. For example, the driver assistance system 100 includes Lane Departure Warning (LDW), Lane Keeping Assist (LKA), High Beam Assist (HBA), and Automatic Emergency Braking ( It can provide Autonomous Emergency Braking (AEB), Traffic Sign Recognition (TSR), Smart Cruise Control (SCC), and Blind Spot Detection (BSD).

The driver assistance system 100 includes a camera module 101 that acquires image data around the vehicle 1 and a radar module 102 that acquires object data around the vehicle 1. The camera module 101 includes a camera 101a and a controller (Electronic Control Unit, ECU) 101b, and photographs the front of the vehicle 1 and detects other vehicles, pedestrians, cyclists, lanes, road signs, traffic lights, etc. It can be recognized. The radar module 102 includes a radar 102a and a controller 102b, and is capable of acquiring the relative position, relative speed, etc. of objects (e.g., other vehicles, pedestrians, cyclists, etc.) around the vehicle 1. there is.

That is, the driver assistance system 100 processes the image data acquired from the camera module 101 and the detection data (radar data) acquired from the radar module 102, and responds to processing the image data and radar data to It is possible to detect the environment of the road on which (1) is driving, front objects located in front of vehicle (1), and side objects located on the sides of vehicle (1).

The driver assistance system 100 is not limited to what is shown in FIG. 1 and may further include a lidar that scans the surroundings of the vehicle 1 and detects objects.

The above electronic components can communicate with each other through a vehicle communication network (NT). For example, electronic components transmit data through Ethernet, MOST (Media Oriented Systems Transport), Flexray, CAN (Controller Area Network), LIN (Local Interconnect Network), etc. You can give and receive. For example, the driver assistance system 100 provides drive control signals, braking signals, and steering signals to the engine management system 11, the electronic brake control module 31, and the electronic steering device 41, respectively, through the vehicle communication network (NT). Signals can be transmitted.

FIG. 2 shows the configuration of a driver assistance system according to an embodiment, and FIG. 3 shows a camera and radar included in the driver assistance system according to an embodiment.

As shown in FIG. 2 , vehicle 1 may include an acceleration system 12, a braking system 32, a speaker 60, a display 70, and a driver assistance system 100.

The acceleration system 12 includes the engine management system 11 (see FIG. 1) and the engine 10 (see FIG. 1) described in conjunction with FIG. 1, and the braking system 32 includes an electronic braking control module 31 (see FIG. 1). 1) and a braking device 30 (see FIG. 1). The speaker 60 and display 70 can provide notifications to the driver in the form of audio and video.

The driver assistance system 100 may include a front camera 110, a first sensor 120, and a second sensor 130.

The front camera 110 may have a field of view 110a facing the front of the vehicle 1 as shown in FIG. 3 . The front camera 110 may be installed on the front windshield of the vehicle 1, for example.

The front camera 110 can photograph the front of the vehicle 1 and acquire image data of the front of the vehicle 1.

The front camera 110 may include a plurality of lenses and an image sensor. The image sensor may include a plurality of photo diodes that convert light into an electrical signal, and the plurality of photo diodes may be arranged in a two-dimensional matrix.

The front camera 110 may be electrically connected to the control unit 140. For example, the front camera 110 is connected to the control unit 140 through a vehicle communication network (NT), connected to the control unit 140 through a hard wire, or a printed circuit board (Printed Circuit Board, It can be connected to the control unit 140 through a PCB).

Accordingly, the front camera 110 can transmit image data from the front of the vehicle 1 to the control unit 140.

The first sensor 120 may have a field of sensing 120a facing the front of the vehicle 1 as shown in FIG. 3 . The first sensor 120 may be installed, for example, on the grille or bumper of the vehicle 1. The first sensor 120 may be provided in the form of a radar.

The first sensor 120 may include a transmitting antenna (or transmitting antenna array) that radiates transmitted radio waves toward the front of the vehicle 1, and a receiving antenna (or receiving antenna array) that receives reflected radio waves reflected by an object. You can. The first sensor 120 may obtain first sensor data from a transmitted radio wave transmitted by a transmitting antenna and a reflected radio wave received by a receiving antenna. The first sensor data may include distance information and speed information regarding other vehicles, pedestrians, or cyclists located in front of the vehicle 1. Speed information may include both lateral speed information and longitudinal speed information. The first sensor 120 calculates the state distance to the object based on the phase difference (or time difference) between the transmitted radio wave and the reflected radio wave, and calculates the relative speed of the object based on the frequency difference between the transmitted radio wave and the reflected radio wave. It can be calculated.

The first sensor 120 may be connected to the control unit 140 through, for example, a vehicle communication network (NT) or a hard wire or printed circuit board. Accordingly, the first sensor 120 may transmit the first sensor data to the control unit 140.

Additionally, the driver assistance system 100 may further include a second sensor 130, and the second sensor 20 may be provided in the form of a plurality of corner radars.

The second sensor 130 includes a first corner radar 131 installed on the front right side of the vehicle 1, a second corner radar 132 installed on the front left side of the vehicle 1, and It may include a third corner radar 133 installed on the rear right side and a fourth corner radar 134 installed on the rear left side of the vehicle 1.

The first corner radar 131 may have a detection field of view 131a facing the front right side of the vehicle 1 as shown in FIG. 3 . The first sensor 120 may be installed, for example, on the right side of the front bumper of the vehicle 1. The second corner radar 132 may have a detection field of view 132a facing the front left side of the vehicle 1, and may be installed, for example, on the left side of the front bumper of the vehicle 1. The third corner radar 133 may have a detection field of view 133a facing the rear right side of the vehicle 1, and may be installed, for example, on the right side of the rear bumper of the vehicle 1. The fourth corner radar 134 may have a detection field of view 134a facing toward the rear left side of the vehicle 1, and may be installed, for example, on the left side of the rear bumper of the vehicle 1.

Each of the first, second, third, and fourth corner radars 131, 132, 133, and 134 may include a transmitting antenna and a receiving antenna. The first, second, third, and fourth corner radars 131, 132, 133, and 134 acquire first corner radar data, second corner radar data, third corner radar data, and fourth corner radar data, respectively. can do. The first corner radar data may include distance information and speed information about other vehicles, pedestrians, or cyclists (hereinafter referred to as “objects”) located on the right front of the vehicle 1. The second corner radar data may include distance information and speed of an object located on the front left of the vehicle 1. The third and fourth corner radar data may include distance information and relative speed of objects located on the rear right side of the vehicle 1 and the rear left side of the vehicle 1.

Each of the first, second, third and fourth corner radars 131, 132, 133, and 134 may be connected to the control unit 140, for example, through a vehicle communication network (NT) or a hard wire or printed circuit board. there is. The first, second, third, and fourth corner radars 131, 132, 133, and 134 may transmit first, second, third, and fourth corner radar data to the control unit 140, respectively.

The navigation 165 can receive road information. For example, information regarding whether a traffic light exists in front of the vehicle 1 may be received.

The control unit 140 is a separate integrated controller (101b, see FIG. 1) of the camera module (101, see FIG. 1) and/or a controller (102b, see FIG. 1) of the radar module (102, see FIG. 1). May include a controller.

The control unit 140 may include a processor 141 and a memory 142.

The processor 141 processes the front image data of the front camera 110, the first sensor data of the first sensor 120, and the second sensor data of the second sensor 130, and the acceleration system 12 and the braking system (32), signals for controlling the speaker 60 and the display 70 can be generated.

For example, the processor 141 may be an image processor that processes front image data of the front camera 110 and/or a digital signal processor that processes radar data of the first sensor 120 and the second sensor 130, and/ Alternatively, it may include a micro control unit (MCU) that generates driving signals and braking signals.

The processor 141 may recognize objects (e.g., the front vehicle) in front of the vehicle 1 based on the front image data of the front camera 110 and the first sensor data of the first sensor 120. .

Specifically, the location (direction) and/or type information and/or lane information of objects in front of the vehicle 1 may be obtained based on the front image data of the front camera 110.

In addition, the processor 141 matches the objects detected by the front image data to the objects detected by the first sensor data, and provides type information, positions, and relative speeds of the objects in front of the vehicle 1 based on the matching results. It can be obtained.

When the front vehicle is recognized in the front image data and/or the first sensor data, the processor 141 may select the recognized front vehicle as the target vehicle.

At this time, the processor 141 may select the front vehicle as the target vehicle when the front vehicle recognized in the front image data matches the front vehicle recognized in the first sensor data.

Thereafter, the processor 141 may control the acceleration system 12, the braking system 32, and the steering system 42 to maintain the distance between the vehicle 1 and the target vehicle.

For example, the processor 141 may operate the acceleration system 12 to accelerate the vehicle 1 when the distance between the vehicle 1 and the target vehicle is greater than a preset distance in order to maintain the distance between the vehicle 1 and the target vehicle. ) can be controlled.

That is, the processor 141 may control the speed of the vehicle 1 to follow the target vehicle, and at this time, determine the required acceleration to follow the target vehicle and use the acceleration system 12 and/or the braking system 32 ) can be controlled to accelerate the acceleration of the vehicle 1 to the required acceleration.

Additionally, the processor 141 may obtain information about objects on both sides of the vehicle 1 based on the second sensor data of the second sensor 130. For example, based on the second sensor data, it can be determined whether a vehicle is present or stopped on both sides of the vehicle 1.

The memory 142 generates a program and/or data for the processor 141 to process image data, a program and/or data for processing radar data, and a driving signal and/or a braking signal. You can store programs and/or data to do this.

The memory 142 temporarily stores image data received from the front camera 110 and/or radar data received from the first sensor 120 and the second sensor 130, and the image data and /Or the processing results of radar data can be temporarily stored.

The memory 142 includes not only volatile memories such as S-RAM and D-RAM, but also flash memory, Read Only Memory (ROM), Erasable Programmable Read Only Memory (EPROM), etc. It may include non-volatile memory.

The driver assistance system 100 is not limited to what is shown in FIG. 2 and may further include a lidar that scans the surroundings of the vehicle 1 and detects objects.

Hereinafter, the operation of the control unit 140 for controlling the above-described components and the configuration for duplicating the controller will be described in detail.

Figure 4 is a control block diagram of a vehicle controller redundancy system according to an embodiment.

Referring to Figure 4, the vehicle controller redundancy system according to one embodiment includes a main communication unit 150, a backup communication unit 160, a main electronic control unit (Main ECU) 170, and a backup electronic control unit (Redundancy ECU) 180. ), a chassis domain controller (CCU) 171, a control unit 140 that controls the above-described components, and an autonomous driving server.

The main communication unit 150 may include wireless communication units 151 and 161 and wired communication units 152 and 162, and the backup communication unit 160 may also include wireless communication units 151 and 161 and wired communication units 152 and 162. can do.

The communication unit can communicate with the autonomous vehicle through a wireless communication base station, and various communication methods can be applied.

For example, the communication department uses second generation (2G) communication methods such as Time Division Multiple Access (TDMA) and Code Division Multiple Access (CDMA), and broadband code division multiple access. 3rd generation (3G) communication methods such as (Wide Code Division Multiple Access: WCDMA), CDMA2000 (Code Division Multiple Access 2000), Wibro (Wireless Broadband: Wibro), and WiMAX (World Interoperability for Microwave Access: WiMAX), LTE ( 4th generation (4G) communication methods such as Long Term Evolution (LTE) and WiBro Evolution (Wireless Broadband Evolution) can be adopted. The Ministry of Communications may adopt the 5th generation (5G) communication method.

The communication unit may include one or more components that enable communication with an external device, and may include, for example, at least one of a short-range communication module, a wired communication unit 152 and 162, and a wireless communication unit 151 and 161. .

The short-range communication module transmits signals using a wireless communication network at a short distance, such as a Bluetooth module, infrared communication module, RFID (Radio Frequency Identification) communication module, WLAN (Wireless Local Access Network) communication module, NFC communication module, and Zigbee communication module. It may include various short-range communication modules that transmit and receive.

The wired communication units 152 and 162 are a Controller Area Network (CAN) communication module, a Local Area Network (LAN) module, a Wide Area Network (WAN) module, or a Value Added Network (VAN). In addition to various wired communication units 152 and 162 such as modules, USB (Universal Serial Bus), HDMI (High Definition Multimedia Interface), DVI (Digital Visual Interface), RS-232 (recommended standard 232), power line communication, or POTS (plain) It may include various cable communication modules such as old telephone service).

The wireless communication units 151 and 161 include Radio Data System-Traffic Message Channel (RDS-TMC), Digital Multimedia Broadcasting (DMB), Wi-Fi module, and Wi-Bro (Wireless broadband) module, as well as GSM (global System for Mobile Communication), CDMA (Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access), UMTS (universal mobile telecommunications system), TDMA (Time Division Multiple Access), LTE (Long Term Evolution), etc. It may include wireless communication units 151 and 161 that support communication methods.

The wireless communication units 151 and 161 may include a wireless communication interface including an antenna and a receiver that receives a user's input from the vehicle. Additionally, the wireless communication units 151 and 161 may further include a signal conversion module for demodulating an analog wireless signal received through a wireless communication interface into a digital control signal.

The communication unit may communicate with the autonomous driving server to receive commands related to autonomous driving when the main electronic control unit 170 fails.

The communication unit is divided into a main communication unit 150 and a backup communication unit 160, and as described later, can communicate with the autonomous driving server through the backup communication unit 160 even if the main communication unit 150 fails.

FIG. 5 is a diagram illustrating an autonomous driving server of a vehicle controller redundancy system communicating with an autonomous vehicle according to an embodiment.

Referring to Figure 5, the autonomous driving server according to one embodiment can communicate with a plurality of vehicles (1-1, 1-2,..., 1-n). At this time, the plurality of vehicles may include autonomous vehicles of level 4 or higher.

The autonomous driving server can identify the malfunctioning vehicle among the plurality of vehicles (1-1, 1-2,..., 1-n) based on the vehicle's malfunction signal and obtain control of the malfunctioning vehicle.

To this end, the autonomous driving server can perform wireless communication with a plurality of vehicles (1-1, 1-2,..., 1-n) through a network. At this time, known communication techniques may be used for wireless communication.

Vehicles according to one embodiment may include vehicles using internal combustion engines, vehicles powered by electricity, and ultra-small electric vehicles. The type of vehicle is not limited to the above examples, and includes without limitation any vehicle that can communicate with an autonomous driving server and drive autonomously.

The autonomous driving server can perform wireless communication with multiple vehicles (1-1,1-2,…,1-n) through the network, and multiple vehicles (1-1,1-2,…,1- n) A vehicle with a major breakdown can transmit a failure signal to the autonomous driving server and receive commands regarding autonomous driving.

FIG. 6 is a diagram illustrating a failure in the main electronic control unit 170 in a vehicle controller redundancy system according to an embodiment.

Referring to FIG. 6, a failure may occur in the main electronic control unit (ECU) 170 of the autonomous vehicle, making it impossible to control the chassis domain controller (CCU) 171.

At this time, the electronic control units 170 and 180 of the vehicle may refer to devices that generally control the functions of the vehicle, such as engine control, transmission, posture control, airbag control, and tire pressure management.

Therefore, if a failure occurs in the main electronic control unit 170 in an autonomous vehicle, it may affect the overall autonomous driving, and since autonomous driving does not involve a driver, it may lead to a serious accident.

Accordingly, the control unit 140 of the vehicle controller redundancy system according to one embodiment allows the main communication unit 150 of the autonomous vehicle to communicate with the autonomous driving server even if a failure occurs in the main electronic control unit 170. The vehicle can be controlled by receiving commands for autonomous driving of the autonomous vehicle from the autonomous driving server.

Specifically, the autonomous driving server can generate and transmit commands necessary for autonomous driving of the vehicle, and can maintain information about the vehicle and overall road conditions in memory.

When the autonomous driving server receives a failure signal of the main electronic control unit 170 from the autonomous vehicle, it can directly control the chassis domain controller 171 by communicating with the main communication unit 150.

Ultimately, if communication between the self-driving vehicle and the self-driving server is maintained, the main communication unit 150 can take over the role of the main electronic control unit 170 of the self-driving vehicle and control the autonomous driving of the vehicle.

At this time, the autonomous driving server can control the chassis domain controller 171, and the chassis domain controller 171 can control the electronic power steering (EPS) (172) and the vehicle body stability control (Electronic Stability Control) (173). ), the vehicle's lamp (LAMP) 174, etc. can be controlled, and other parts related to the vehicle's autonomous driving can also be controlled.

Accordingly, even if a malfunction occurs in the main electronic control unit 170 of the autonomous vehicle and there is no driver intervention, the autonomous vehicle receives commands related to autonomous driving from the autonomous driving server and drives to the destination or to a preset point, a repair shop. can do.

According to the vehicle controller redundancy system according to one embodiment, even if a vehicle malfunction occurs, the autonomous driving server can drive to a destination or a preset point, a repair shop, which has the effect of improving the safety of the vehicle and driver.

FIG. 7 is a diagram illustrating a failure occurring in the main electronic control unit 170 and the main communication unit 150 in a vehicle controller redundancy system according to an embodiment.

Referring to FIG. 7, in addition to the failure of the main electronic control unit 170 in FIG. 6, a failure may occur in the main communication unit 150.

If a failure occurs in the main communication unit 150, the autonomous driving server cannot replace the control function of the main electronic control unit 170 through the main communication unit 150.

Accordingly, the vehicle controller redundancy system according to one embodiment may further include a backup communication unit 160.

When a failure of the main communication unit 150 is detected, the control unit 140 communicates with the autonomous driving server through the backup communication unit 160 and operates the backup communication unit 160 to receive commands for autonomous driving of the autonomous vehicle from the autonomous driving server. You can control it.

That is, when a failure occurs in the main electronic control unit 170 in the vehicle controller redundancy system according to one embodiment, the autonomous driving server takes over the function of the main electronic control unit 170 through the main communication unit 150. If the communication unit 150 also fails, the self-driving server has no way to control the self-driving vehicle, which may lead to a serious accident.

Even if a failure occurs in the main electronic control unit 170 and the main communication unit 150, the control unit 140 allows the backup communication unit 160 of the self-driving vehicle to communicate with the self-driving server to The vehicle can be controlled by receiving commands for autonomous driving.

Accordingly, even in a situation where a failure occurs in the main electronic control unit 170 and the main communication unit 150 at the same time, control of the vehicle is not lost, thereby protecting the driver and vehicle more effectively.

FIG. 8 is a diagram showing a failure occurring in the main electronic control unit 170, main communication unit 150, and backup communication unit 160 in the vehicle controller redundancy system according to one embodiment.

Referring to FIG. 8, a failure may occur in the backup communication unit 160 in addition to the main electronic control unit 170 and the main communication unit 150 in FIG. 7.

In other words, a failure may occur in the main electronic control unit 170 and the communication network itself, making communication with the autonomous driving server impossible.

In this way, if a failure occurs in the main electronic control unit 170 and the entire communication network, the autonomous driving server cannot replace the control function of the main electronic control unit 170 through the main communication unit 150 or backup communication unit 160. do.

Accordingly, the vehicle controller redundancy system according to one embodiment may further include a backup electronic control unit 180.

The backup electronic control unit 180 herein may refer to a device that generally controls the functions of the autonomous vehicle in the same way as the main electronic control unit 170, but may be used to control the autonomous vehicle considering cost effectiveness. May include minimal cognitive, judgment, and control functions for

For example, the backup electronic control unit 180 may only include functions for recognizing other vehicles on the road, recognizing lanes, slowing down the autonomous vehicle, and stopping the autonomous vehicle at the outermost part of the lane. there is.

When a failure of the main communication unit 150 and the backup communication unit 160 is detected, the control unit 140 can control the backup electronic control unit 180 to directly control chassis parts of the autonomous vehicle.

That is, in the vehicle controller redundancy system according to one embodiment, if a failure occurs in all of the main electronic control unit 170, the main communication unit 150, and the backup communication unit 160, a fatal defect exists in the vehicle, and the control unit 140 ) can predict the failure of the chassis domain controller 171 and allow the backup electronic control unit 180 to directly control chassis parts of the autonomous vehicle.

Accordingly, the control unit 140 allows the vehicle to be controlled by the backup electronic control unit 180 of the autonomous vehicle even if a failure occurs in the main electronic control unit 170, main communication unit 150, and backup communication unit 160. Accidents can be prevented.

At this time, the backup electronic control unit 180 may control the vehicle to cause the autonomous vehicle to perform an emergency stop.

In other words, if a failure occurs in the main electronic control unit 170, main communication unit 150, and backup communication unit 160 as above, it may be difficult to drive the vehicle, so the control unit 140 is operated on the shoulder or outside the road after the emergency lights are turned on. The backup electronic control unit 180 can be controlled to perform an emergency stop.

Accordingly, the vehicle can be safely stopped even in a situation where a failure occurs in the main electronic control unit 170, the main communication unit 150, and the backup communication unit 160.

FIG. 9 is a flowchart showing a control method of a vehicle controller redundancy system according to an embodiment, and FIG. 10 is a diagram showing a continued flowchart of a control method of a vehicle controller redundancy system according to an embodiment.

Referring to Figure 9, a vehicle according to one embodiment may start autonomous driving (900). Here, autonomous driving can mean autonomous driving without driver intervention.

The control unit 140 may detect a failure of the main electronic control unit 170 (910). When the control unit 140 detects a failure of the main electronic control unit 170 (Yes at 910), a command regarding autonomous driving can be received from the server through the main communication unit 150 (920).

At this time, the autonomous driving server can control the chassis domain controller 171 through the main communication unit 150, and the command received from the autonomous driving server may include either movement to the destination or movement to a preset point. You can.

The control unit 140 may receive an input regarding either movement to a destination or a preset point from the driver through an input unit provided in the autonomous vehicle, and may transmit the received input to the self-driving server. You can.

Accordingly, the autonomous driving server can control the chassis domain controller 171 by generating a command corresponding to either movement to the destination or movement to a preset point.

Thereafter, the control unit 140 may detect a failure of the main communication unit 150 (930).

When a failure of the main communication unit 150 is detected (example in 930), the control unit 140 may receive a command related to autonomous driving from the server through the backup communication unit 160, referring to FIG. 10 (940).

Accordingly, even if a malfunction occurs in the main communication unit 150, communication with the autonomous driving server can be performed through the backup communication unit 160, so redundancy of the controller may be possible.

The control unit 140 may detect a failure of the backup communication unit 160 (950). When the control unit 140 detects a failure of the backup communication unit 160 (example 950), it is determined that there is a serious defect in the vehicle, and the backup electronic control unit 180 communicates directly with the chassis parts of the autonomous vehicle to maintain the vehicle. Can be safely controlled (960).

As described above, the disclosed embodiments have been described with reference to the attached drawings. A person skilled in the art to which the present invention pertains will understand that the present invention can be practiced in forms different from the disclosed embodiments without changing the technical idea or essential features of the present invention. The disclosed embodiments are illustrative and should not be construed as limiting.

1: vehicle
100: Driver assistance system
140: control unit
141: processor
142: memory
150: Main communication department
160: Backup communication department
170: main electronic control unit
171: Chassis domain controller
180: Backup electronic control unit
200: Self-driving server

Claims (14)

autonomous vehicles;
an autonomous driving server that communicates with the autonomous vehicle;
When a failure of the main electronic control unit (ECU) that controls the autonomous vehicle to drive in autonomous driving mode is detected, the main communication unit of the autonomous vehicle communicates with the autonomous driving server to receive information from the autonomous driving server. A control unit that controls the main communication unit to receive commands for autonomous driving of the self-driving vehicle. According to paragraph 1,
It further includes a backup communication unit that communicates with the autonomous driving server,
The control unit,
When a failure of the main communication unit is detected, a vehicle controller redundancy system that controls the backup communication unit to communicate with the autonomous driving server through the backup communication unit and receive commands for autonomous driving of the autonomous vehicle from the autonomous driving server. According to paragraph 2,
It further includes a backup electronic control unit (ECU, Electronic Control Unit) that controls the autonomous vehicle to drive in autonomous driving mode,
The control unit,
A vehicle controller redundancy system that changes control so that the autonomous vehicle is controlled by the backup electronic control unit when a failure of the backup communication unit is detected. According to paragraph 2,
The command for autonomous driving is,
A vehicle controller redundancy system that includes either movement to a destination or movement to a preset point. According to paragraph 4,
The control unit,
A vehicle controller redundancy system that receives an input regarding either movement to a destination or a preset point from the driver through an input unit provided in the autonomous vehicle, and transmits the received input to the autonomous driving server. According to clause 5,
The control unit,
A vehicle controller redundancy system that controls the autonomous vehicle to move to the preset point after arriving at the destination when the input received from the driver through the input unit provided in the autonomous vehicle is movement to the destination. According to paragraph 3,
The control unit,
A vehicle controller redundancy system that controls the autonomous vehicle to perform an emergency stop by the backup electronic control unit. Detecting a failure in the main electronic control unit (ECU) that controls the autonomous vehicle to drive in autonomous driving mode;
When a failure of the main electronic control unit is detected, the main communication unit of the autonomous vehicle communicates with an autonomous driving server to receive commands for autonomous driving of the autonomous vehicle from the autonomous driving server. control method. According to clause 8,
detecting a failure of the main communication unit;
The control method of the vehicle controller dual system further comprising: communicating with the autonomous driving server through a backup communication unit and receiving commands for autonomous driving of the autonomous vehicle from the autonomous driving server. According to clause 9,
detecting a failure of the backup communication unit;
A control method for a vehicle controller redundancy system further comprising changing control so that the autonomous vehicle is controlled by a backup electronic control unit (ECU). According to clause 9,
The command for autonomous driving is,
A control method of a vehicle controller redundancy system including either movement to a destination or movement to a preset point. According to clause 11,
Receiving an input regarding either movement to a destination or movement to a preset point from the driver through an input unit provided in the autonomous vehicle;
A control method for a vehicle controller redundancy system further comprising transmitting the received input to the autonomous driving server. According to clause 12,
If the input received from the driver through the input unit provided in the autonomous vehicle is movement to the destination, controlling the autonomous vehicle to move to the preset point after arriving at the destination; Dual vehicle controller system further comprising: control method. According to clause 10,
Changing the control is
A control method of a vehicle controller redundancy system comprising controlling the autonomous vehicle to perform an emergency stop by the backup electronic control unit.

Images