WO2022226776A1

WO2022226776A1 - Intelligent driving control method and apparatus and intelligent driving control system

Info

Publication number: WO2022226776A1
Application number: PCT/CN2021/090226
Authority: WO
Inventors: 贾晓林; 项能武
Original assignee: 华为技术有限公司
Priority date: 2021-04-27
Filing date: 2021-04-27
Publication date: 2022-11-03
Also published as: CN115529830A

Abstract

An intelligent driving control method and apparatus, and an intelligent driving control system (100). The intelligent driving control method is applied to the intelligent driving control system (100), and the intelligent driving control system (100) comprises: a main controller (11), a first redundant controller (12), and a second redundant controller (13). The control method comprises: determining a failure-operable workgroup according to the states of the main controller (11), the first redundant controller (12), and the second redundant controller (13), so that when one of the main controller (11), the first redundant controller (12), and the second redundant controller (13) fails, the other two controllers constitute a failure-operable workgroup used for controlling a vehicle to perform an intelligent driving operation. The intelligent driving operation can also be implemented by a vehicle when one of the controllers fail, and a higher intelligent driving level is ensured without requiring a driver to take over the driving operation.

Description

Intelligent driving control method, device and intelligent driving control system

technical field

The present application relates to the field of intelligent driving, and in particular to an intelligent driving control method, device and intelligent driving control system.

Background technique

Intelligent driving technology is the key to realizing intelligent driving of vehicles, and it is also an inevitable trend of future vehicle development. At present, the intelligent driving level that the intelligent driving products on the market can achieve is Level L2+, at which level, the driver is still required to monitor the driving environment and be ready to take over the driving operation at any time.

Higher-level intelligent driving scenarios hardly require the driver to monitor the driving environment: such as L3 level, conditional automation, when conditions permit, the vehicle can complete all driving actions without the need for the driver to monitor the driving environment at any time; L4 level, Highly automated, no driver monitoring required.

For high-level intelligent driving scenarios, once the control system fails, it can only be downgraded, enter a safe state and wait for the driver to take over.

It can be seen that supporting high-level intelligent driving scenarios puts forward higher safety and reliability requirements for the control system.

SUMMARY OF THE INVENTION

In order to meet the safety and reliability requirements in high-level intelligent driving scenarios, the present application provides an intelligent driving control method, device, and intelligent driving control system.

A first aspect of the present application provides an intelligent driving control method, the intelligent driving control method is applied to an intelligent driving control system, and the intelligent driving control system includes: a main controller, a first redundant controller and a second redundant controller , the main controller and the first redundant controller form a failure operation (failure operation) working group for outputting vehicle control signals, and the control method includes: acquiring the main controller, the first redundant controller and the second redundant control state of the main controller and the first redundant controller; when one of the main controller and the first redundant controller is in a failed state and the second redundant controller is in a normal state, it is determined that one of the main controller and the first redundant controller is in a normal state and the second redundant controller is in a normal state. Redundant controllers form a fail-operable workgroup.

Through the above settings, when one of the controllers fails, the control system can still ensure the vehicle control through the dual controllers, and the dual controllers can effectively support L3-L4 intelligent driving without the driver taking over the driving operation, so that the Meet the safety and reliability requirements in high-level driving scenarios.

In a possible implementation manner, the method further includes: when the main controller, the first redundant controller, and the second redundant controller are all valid, making the main controller and the first redundant controller form a fail-operable working group , the second redundant controller enters the standby state.

Through the above arrangement, a higher intelligent driving level of the vehicle is achieved, and the power consumption of the second redundant controller is reduced.

In a possible implementation manner, the computing capability of the second redundant controller is lower than that of the primary controller or the first redundant controller.

Through the above arrangement, a higher intelligent driving level of the vehicle is achieved, and the cost of the control system is reduced.

In a possible implementation manner, the method further includes: causing the controller in the failed state to enter a repair mode.

Through the above settings, timely and online repair of the failed controller is realized, avoiding the situation that the vehicle cannot realize intelligent driving when two controllers fail, and can only be parked under the control of a single controller, further ensuring the vehicle intelligent driving level.

In a possible implementation manner, the main controller is connected to the first redundant controller and the second redundant controller respectively, and the first redundant controller is connected to the second redundant controller for transmitting the main controller , the status of the first redundant controller and the second redundant controller.

Through the above settings, the communication and data interaction between the controllers are realized, and then when one of the controllers fails, the other two controllers can form a failable working group in time to control the vehicle to perform intelligent driving operations to ensure the safety of the vehicle. Intelligent driving level.

In a possible implementation manner, the states of the main controller, the first redundant controller, and the second redundant controller are recorded in a controller state maintenance table, and the controller state maintenance table is stored in the main controller, the first redundant controller, and the second redundant controller respectively. in the first redundant controller and the second redundant controller.

Through the above settings, any controller can obtain the status of other controllers in time, and then when one controller fails, the other two controllers can be formed in time to form a failable working group to control the vehicle to perform intelligent driving operations to ensure that The intelligent driving level of the vehicle.

In a possible implementation, when one of the controllers cannot send the status due to failure, since the other two controllers are respectively connected to the failed controller, the other two controllers both determine the failed controller After the failure, the other two controllers update the controller state maintenance table.

In a possible implementation manner, after one of the primary controller or the first redundant controller is successfully repaired, the successfully repaired controller replaces the second redundant controller in the failed operational working group, and the second redundant controller The controller enters the standby state.

Through the above settings, the intelligent driving level of the vehicle can be further guaranteed, so that when one of the controllers fails, the control system can still ensure that the vehicle control is implemented through the dual controllers, and the dual controllers can effectively support the intelligent driving of the L3~L4 level. There is no need for the driver to take over the driving operation, which can meet the safety and reliability requirements in high-level driving scenarios.

In a possible implementation manner, when two of the main controller, the first redundant controller and the second redundant controller fail, the other controller controls the vehicle to stop.

Through the above arrangement, it is possible to avoid a traffic accident when the two controllers fail, thereby ensuring the driving safety of the vehicle.

In a possible implementation manner, the method further includes: sending the status of the failed controller to the remote maintenance system.

Through the above arrangement, the user or/and the remote maintenance system can obtain the failure information of the controller in time, so that the failed intelligent driving control can be repaired in time, and further ensure the intelligent driving level of the vehicle.

In a possible implementation manner, the method further includes: sending warning information to the user.

In a possible implementation manner, when the main controller, the first redundant controller or the second redundant controller fails, the status of the failed controller is submitted to the remote maintenance system, and the status of the failed controller is sent to the user. Warning message.

In a possible implementation manner, when two of the main controller, the first redundant controller and the second redundant controller fail, submit the status of the failed controller to the remote maintenance system, and Send alerts to users.

In a possible implementation manner, when the primary controller, the first redundant controller or the second redundant controller fails, the state of the failed controller is submitted to the remote maintenance system.

In a possible implementation manner, the driving control system further includes a first visual sensor group, a detection sensor group and a second visual sensor group, wherein the main controller is connected to the first visual sensor group, the detection sensor group and the second visual sensor group The first redundant controller is connected with the first visual camera sensor group and the detection sensor group; the second redundant controller is connected with the detection sensor group and the second visual sensor group.

Through the above arrangement, it is possible to ensure that the data obtained by the sensor is not lost when any one of the controllers fails, so that the vehicle can realize intelligent driving under the control of the two controllers and ensure a higher level of intelligent driving.

In a second aspect of the present application, an intelligent driving control device is provided, which is applied in an intelligent driving control system. The intelligent driving control system includes: a main controller, a first redundant controller, and a second redundant controller. The controller and the first redundant controller form a fail-operable working group for outputting vehicle control signals, and the control device includes: an acquisition module, which is used for acquiring the main controller, the first redundant controller and the second redundant control The state of the controller; the determining module is used for determining the main controller and the second redundant controller when one of the main controller, the first redundant controller and the second redundant controller is in a failed state and the state of the second redundant controller is normal. One of the redundant controllers in a normal state and the second redundant controller form a fail-operable working group.

In a possible implementation manner, the determining module is further configured to: when the main controller, the first redundant controller and the second redundant controller are all valid, make the composition of the main controller and the first redundant controller fail. Run the workgroup to put the second redundant controller into standby.

In a possible implementation manner, the determining module is further configured to: make the controller in the failure state enter a repair mode.

In a possible implementation manner, the states of the main controller, the first redundant controller, and the second redundant controller are recorded in a controller state maintenance table, and the controller state maintenance table is stored in the main controller respectively , the first redundant controller and the second redundant controller.

In a possible implementation manner, the determining module is further configured to: after one of the main controller or the first redundant controller is successfully repaired, determine that the successfully repaired controller replaces the second redundant controller in the failed operational working group controller, the second redundant controller enters the standby state.

In a possible implementation manner, the determining module is further configured to: in the case of failure of two of the main controller, the first redundant controller and the second redundant controller, make the other controller control the vehicle to stop .

In a possible implementation manner, the determining module is further configured to: submit the status of the failed controller to the remote maintenance system.

In a possible implementation manner, the driving control system further includes sensors including a first visual sensor group, a detection sensor group, and a second visual sensor group, wherein the main controller is connected to the first visual sensor group, the detection sensor group, and the second visual sensor group. The sensor group is connected; the first redundant controller is connected with the first visual sensor group and the detection sensor group; the second redundant controller is connected with the detection sensor group and the second visual sensor group.

The technical effects brought by the intelligent driving control device provided by the second aspect of the present application and any possible implementation manner thereof are the same as those brought by the intelligent driving control method provided by the first aspect of the present application and any possible implementation manner thereof. The technical effects are the same, and for the sake of brevity, details are not repeated here.

A third aspect of the present application provides an intelligent driving control system, including: a main controller, a first redundant controller, and a second redundant controller: the main controller and the first visual sensor group and the second visual sensor group connected, obtain the first visual sensor data from the first visual sensor group, and obtain the second visual sensor data from the second visual sensor group; the first redundant controller is connected with the first visual sensor group, and obtains the first visual sensor data from the first visual sensor group. a visual sensor data; the second redundant controller is connected to the second visual sensor group, and obtains the second visual sensor data from the second visual sensor group; wherein, the first visual sensor data includes forward-looking data, surround-view data and rear-view data , the second visual sensor data includes front-view data, side-view data and rear-view data; the intelligent driving control system is based on the data output control obtained by at least two controllers in the main control controller, the first controller, and the second controller. Signal.

In a possible implementation manner, the main controller, the first redundant controller, and the second redundant controller are all connected to the detection sensor group, and acquire detection sensor data from the detection sensor group.

In a possible implementation manner, the detection sensor data includes ultrasonic radar detection data and millimeter wave radar detection data.

In a possible implementation manner, when the main controller, the first redundant controller, and the second redundant controller are all valid, the main controller and the first redundant controller form a fail-operable working group, and the second redundant controller The remaining controllers are in standby mode.

In a possible implementation manner, the method further includes: the failed controller is in a repair state.

In a possible implementation manner, when one of the primary controller or the first redundant controller is successfully repaired, the successfully repaired controller replaces the second redundant controller in the failed operational working group, and the second redundant controller The controller is in standby.

In a possible implementation manner, the method further includes: when two of the main controller, the first redundant controller and the second redundant controller fail, controlling the vehicle to stop by the other controller.

In a possible implementation manner, the method further includes: submitting the status of the failed controller to the remote maintenance system.

In a possible implementation manner, alert information is sent to the user.

The technical effects brought by the intelligent driving control device provided by the third aspect of the present application and any possible implementation manner thereof are the same as those brought by the intelligent driving control method provided by the first aspect of the present application and any possible implementation manner thereof. The technical effects are the same, and for the sake of brevity, details are not repeated here.

A fourth aspect of the present application provides a vehicle, comprising: the intelligent driving control system provided by the third aspect of the present application and any possible implementation manner thereof and/or the second aspect of the present application and any possible implementation manner thereof Provided Smart Driving Controls.

A fifth aspect of the present application provides a computing device, comprising: a bus; a communication interface connected to the bus; at least one processor connected to the bus; and at least one memory connected to the bus and storing program instructions , the program instructions, when executed by at least one processor, cause at least one processor to execute the intelligent driving control method provided by the first aspect of the present application and any possible implementation manner thereof.

A sixth aspect of the present application provides a computer-readable storage medium on which program instructions are stored, and when executed by a computer, the program instructions cause the computer to execute the intelligence provided by the first aspect of the present application and any possible implementation manner thereof. driving control method.

These and other aspects of the present application will be more clearly understood in the following description of the embodiment(s).

Description of drawings

The various features of the present application and the connections between the various features are further explained below with reference to the accompanying drawings. The drawings are exemplary, some features are not shown to scale, and some of the drawings may omit features that are customary in the field to which the application relates and not essential to the application, or additionally show The non-essential features of the present application, and the combination of individual features shown in the drawings are not intended to limit the present application. In addition, the same reference numerals refer to the same contents throughout the present specification. The specific drawings are described as follows:

1A is a schematic diagram of a module of an intelligent driving control system with an intelligent driving level of L2+ and below;

1B is a schematic diagram of a module of an intelligent driving control system with an intelligent driving level ranging from level L4 to level L5;

FIG. 2A shows a schematic diagram of an intelligent driving control system provided by an embodiment of the present application;

FIG. 2B shows a schematic diagram of an intelligent driving control system provided by another embodiment of the present application;

FIG. 2C shows a schematic diagram of a module of a controller provided by an embodiment of the present application;

FIG. 3A shows a schematic diagram of signal connections between the main controller, the first redundant controller, and the second redundant controller and with other control units (systems) of the vehicle according to an embodiment of the present application;

3B shows a schematic diagram of signal connections between the main controller, the first redundant controller, and the second redundant controller and with other control units (systems) of the vehicle according to another embodiment of the present application;

4A shows a schematic structural diagram of a camera with dual POC serializer interfaces;

4B shows a schematic structural diagram of a camera head with a single POC serializer interface and a dual interface adapter box connected to the camera head with a single POC serializer interface;

5A shows a schematic diagram of a power supply structure of an intelligent driving control system provided by an embodiment of the present application;

5B shows a schematic diagram of a power supply structure of an intelligent driving control system provided by another embodiment of the present application;

FIG. 6A shows a flowchart of an intelligent driving control method provided by an embodiment of the present application;

FIG. 6B shows a flowchart of an intelligent driving control method provided by another embodiment of the present application;

FIG. 7 shows a schematic diagram of a module of an intelligent driving control device provided by an embodiment of the present application;

FIG. 8 shows a schematic diagram of a computing device provided by an embodiment of the present application.

Detailed ways

The terms first, second, third and similar terms in the description and claims are only used to distinguish similar objects, and do not represent a specific ordering of objects. It is understood that specific terms can be interchanged where permitted. A sequence or sequence such that the embodiments of the application described herein can be practiced in sequences other than those illustrated or described herein.

In the following description, the reference numerals representing steps, such as S10, S21 .

The term "comprising" used in the description and claims should not be construed as being limited to what is listed thereafter; it does not exclude other elements or steps. Accordingly, it should be interpreted as specifying the presence of said features, integers, steps or components mentioned, but not excluding the presence or addition of one or more other features, integers, steps or components and groups thereof. Therefore, the expression "apparatus comprising means A and B" should not be limited to apparatuses consisting of parts A and B only.

Reference in this specification to "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present application. Thus, the appearances of the terms "in one embodiment" or "in an embodiment" in various places in this specification are not necessarily all referring to the same embodiment, but can refer to the same embodiment. Furthermore, the particular features, structures or characteristics can be combined in any suitable manner, as would be apparent to one of ordinary skill in the art from this disclosure, in one or more embodiments.

Explanation of terms used in this application:

Lidar (Light Detection And Ranging, Lidar), its working principle is: use the light pulse emitted by the laser, and use the receiver to receive the light pulse reflected from the target, and calculate the light pulse from the laser to be reflected back to the receiver. The distance between the target and the vehicle, the orientation of the target, the height of the target, the speed of the target, the attitude of the target and the shape of the target are obtained by combining the propagation speed of the light and the parameters of the lidar.

Millimeter-wave radar (Radio Detection And Ranging, RADAR), its working principle is: use a high-frequency circuit to generate electromagnetic waves with a specific modulation frequency, and use an antenna to send electromagnetic waves and receive electromagnetic waves reflected from the target. The distance of the target from the vehicle, the speed of the target, and the orientation of the target, etc.

Ultrasonic sensor (Ultrasonic Sensor, USS), also known as ultrasonic radar, its working principle is: use an ultrasonic transmitter to transmit ultrasonic signals, and start timing at the same time as the transmission of ultrasonic waves. The ultrasonic waves propagate through the air and encounter obstacles on the way. The object will immediately reflect back, and the ultrasonic receiver stops timing when it receives the reflected ultrasonic waves. According to the propagation speed of the ultrasonic wave, the time from the transmission to the reflection of the ultrasonic wave is recorded, and then the distance between the ultrasonic wave emission point and the obstacle is obtained.

The Global Navigation Satellite System (GNSS) is a navigation and positioning system that can provide users with all-weather three-dimensional coordinate information, speed information and time information at any location on the earth's surface or near-Earth space. At present, there are four global navigation satellite systems in the world, including: China's BeiDou navigation satellite system (BDS), the United States' global positioning system (GPS), the European Union's Galileo satellite navigation system (Galileo navigation satellite system, BDS) system, Galileo) and Russia's GLONASS satellite navigation system (global orbitingnavigation satellite system, GLONASS).

Inertial measurement unit (IMU), its working principle is: use gyroscope, accelerometer and other inertial sensitive components and electronic computer to measure the acceleration of the carrier relative to the ground motion in real time to determine the position of the carrier and the earth's gravity Combination system of field parameters.

Electronic control unit (electronic control unit, ECU), also known as "trip computer", is usually composed of microprocessor, memory, input/output interface, analog-to-digital converter and integrated circuit, etc. Its working principle is: for each sensor The obtained data is calculated and processed, and a control signal is output to control the controlled object to perform the corresponding driving operation.

Advanced driver assistance systems (Advanced Driver Assistance Systems, ADAS), its working principle is: in the process of vehicle driving, the use of sensors installed on the vehicle (millimeter wave radar, lidar, mono/binocular camera and global navigation satellite system) ) to obtain the data of the target in the surrounding environment, perform operations and processing on the data, and output driving operation instructions, so as to make the driver aware of possible dangers in advance, and increase the comfort and safety of vehicle driving.

Power over Coax (POC) is a technology based on coaxial cable for signal transmission and power superposition, that is, the signal and power supply are combined together and transmitted on a coaxial cable.

Body control module (BCM), also known as "body computer", is used to control the electronic devices of the body (such as power windows, power mirrors, air conditioners, headlights, turn signals, anti-theft locking systems, central locking and defrosting device, etc.) to perform the corresponding operations. The body controller can be connected to other ECUs via the bus.

Electronic Stability Program (ESP) is a general term for a system or program that prevents runaway when the vehicle reaches the dynamic limit. Its working principle is: Acceleration sensor and steering wheel accelerator brake pedal sensor, etc.) to process and calculate the data obtained, compare the calculated result with the preset value, when the calculated result exceeds or is close to the preset value, control each execution Systems (such as electronic brake distribution system, anti-lock braking system, tracking control system and vehicle dynamic control system, etc.) maintain the dynamic balance of the vehicle.

Electric power steering system (Electric Power Steering, EPS), which can include: sensors (such as torque sensor, angle sensor and vehicle speed sensor), power steering mechanism (such as motor, clutch and reduction transmission mechanism) and ECU. Its working principle is: when the driver turns the steering wheel, the torque sensor and the angle sensor generate a corresponding voltage signal according to the input torque and steering angle, the vehicle speed sensor detects the vehicle speed signal, and the ECU generates a control command to control the motor according to the voltage signal and the vehicle speed signal. It operates to assist the driver in steering operations.

Brake-by-wire system (Ibooster, IBS), which may include: booster motor, booster transmission mechanism, push rod mechanism, stroke sensor, master cylinder and controller, etc. When the driver steps on the brake pedal, the push rod mechanism generates displacement, the stroke sensor detects the push rod displacement, and sends the push rod displacement signal to the controller. The controller calculates the torque that the motor should generate according to the displacement signal, and controls the power assist. The transmission mechanism converts the torque into the servo braking force, which works together with the push rod force generated by the input of the pedal, and realizes the braking through the hydraulic pressure in the master cylinder.

In-Vehicle Infotainment (IVI) is a system that provides infotainment functions for drivers and passengers. It can provide multimedia playback, navigation, Bluetooth/Wi-Fi The screen is directly mapped to the vehicle screen), human-vehicle interaction functions (such as touch screen function, button function, voice interaction, gesture recognition, face recognition and other functions), body information display and control functions, intelligent driving functions and social functions, etc. .

Vehicle control unit (VCU), which is used to collect motor state, battery state, accelerator pedal signal, brake pedal signal and sensor signal, analyze the driver's intention, output corresponding control commands, and control the various The controller performs the corresponding action. The vehicle control unit can be used to control the normal driving of the vehicle, braking energy feedback, energy management of the vehicle engine and battery, fault diagnosis and processing, and vehicle status monitoring, etc. Normal and stable work in reliability state.

Telematics box (T-box), which can provide remote communication interface for vehicles through 4G/5G long-distance wireless communication, global navigation satellite system, inertial measurement system and CAN communication, etc., providing driving data collection, driving trajectory Recording, vehicle fault monitoring, vehicle remote query and control (opening and locking, air conditioning control, window control, engine torque limit and engine start and stop), driving behavior analysis and 4G/5G wireless hotspot sharing and other services.

Micro Control Unit (MCU) is a chip-level computer that can integrate components such as memory, counter, interface and CPU on a single chip to perform different combined control for different applications.

Video Serial Interface (Camera Serial Interface-2, CSI-2) is an interface specification formulated by Mobile Industry Processor Interface (MIPI).

Controller Area Network (CAN) is a technology used for data transmission between various ECUs in the vehicle to realize communication between various ECUs in the vehicle. The maximum data transmission rate is 1Mbps.

Controller Area Network-Flexible Data-Rate (CAN FD) with flexible data rate, compared with controller area network, it can support higher data transmission rate, the maximum data transmission rate is 5Mbps, and it supports more transmission rate. Long byte data, the longest byte data is 64bytes.

In the field of intelligent driving, in order to indicate the ability of the vehicle to act and react, the intelligent driving level can be divided into the following categories:

Level L1: Vehicles can implement driver assistance functions that control steering wheel steering or control vehicle speed through the ADAS platform, but require the driver to monitor the driving environment and be ready to take over driving operations at any time.

Level L2: The vehicle can implement driver assistance functions that simultaneously control the steering wheel steering and control the vehicle speed through the ADAS platform, but requires the driver to monitor the driving environment and be ready to take over the driving operation at any time.

Level L2+: Level L2+ is an enhancement of the functions of Level L2. When conditions permit, the vehicle can realize all driving operations through the ADAS platform, but the driver is still required to monitor the driving environment and be ready to take over the driving operation at any time.

Level L3: The vehicle can perform all driving operations and can alert the driver. When conditions permit, there is no need for the driver to monitor the driving environment, but the driver is required to take over the driving of the vehicle in order to deal with possible situations that the artificial intelligence cannot handle.

Level L4: The vehicle can implement all driving operations, and in certain scenarios, the vehicle can be operated without a driver.

Level L5: The vehicle can perform all driving operations without a driver in the vehicle in all scenarios.

Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the technical field to which this application belongs. If there is any inconsistency, the meaning described in this specification or the meaning derived from the content described in this specification shall prevail. In addition, the terms used herein are only for the purpose of describing the embodiments of the present application, and are not intended to limit the present application.

It should be noted that, in this application, "vehicle" may include one or more different types of vehicles, and may also include one or more different types of vehicles on land (eg, roads, roads, railways, etc.), Vehicles or movable objects that operate or move on water surfaces (eg, waterways, rivers, oceans, etc.) or space. For example, vehicles may include cars, bicycles, motorcycles, trains, subways, airplanes, boats, aircraft, and/or other types of transportation or movable objects, and the like.

In the field of intelligent driving, as shown in FIG. 1A , an intelligent driving control system with an intelligent driving level of L2+ and below may include: a single controller 02 , which is connected with a sensor 010 . The sensors may include: camera 011 , millimeter wave radar 012 and ultrasonic radar 013 . In some embodiments, the sensor may also include: Lidar (014). In the embodiment shown in FIG. 1A , the sensors include: a camera 011 , a millimeter-wave radar 012 , an ultrasonic radar 013 , and a lidar 014 . However, this application does not limit this, and different types of sensors can be configured according to usage scenarios. It is used to perform perception processing, fusion processing, positioning processing, and regulation processing on the data obtained by the sensor 010, and output vehicle control instructions, thereby assisting the driver to perform a series of driving operations. When the controller 020 fails, the vehicle cannot drive by itself, and only the driver can take over the driving operation of the vehicle.

As shown in FIG. 1B , it is an example of an intelligent driving control system with an intelligent driving level ranging from level L4 to level L5, including: a main controller 021 and a redundant controller 022 . The main controller 021 and the redundant controller 022 are connected to the sensor 010, respectively. The sensors may include: camera 011 , millimeter wave radar 012 and ultrasonic radar 013 . In some embodiments, the sensor may also include: Lidar 014 . In the embodiment shown in FIG. 1B , the sensors include: a camera 011 , a millimeter-wave radar 012 , an ultrasonic radar 013 , and a lidar 014 . However, this application does not limit this, and different types of sensors can be configured according to usage scenarios. When neither the main controller 021 nor the redundant controller 022 fails, the main controller 021 controls the vehicle to perform the intelligent driving operation, and the redundant controller 022 is in a standby state. The main controller 021 performs perception processing, fusion processing, positioning processing, and regulation processing on the data obtained by the sensors, and outputs vehicle control instructions, thereby controlling the vehicle to perform intelligent driving operations. After the main controller 021 fails, the redundant controller 022 switches from the standby state to the running state, and controls the vehicle to stop at an appropriate position. When the main controller 021 fails, the vehicle is downgraded to L2+, one possibility is that the vehicle is parked under the control of the redundant controller 022, and the intelligent driving operation at the L4-L5 level cannot be continued.

In order to enable the vehicle to realize intelligent driving even when any controller fails, and to ensure the intelligent driving level of the vehicle from level L4 to level L5, the embodiments of the present application provide an intelligent driving control method, an intelligent driving control device, and an intelligent driving control method. Intelligent driving control system.

Example 1: Intelligent Driving Control System

FIG. 2A shows an intelligent driving control system 100 provided by an embodiment of the present application. As shown in FIG. 2A , the intelligent driving control system 100 includes: a main controller 11 , a first redundant controller 12 and a second redundant control device 13.

In some embodiments, the intelligent driving control system 100 may further include a plurality of sensors connected with the main controller 11 , the first redundant controller 12 and the second redundant controller 13 . For example, visual sensors and detection sensors, as shown in FIG. 2B, the visual sensor may include one or more cameras 22, the detection sensor may include one or more millimeter-wave radars 21, one or more ultrasonic radars 24, and optionally One or more lidars 23 are included. In a possible implementation, the multiple visual sensors can be divided into two visual sensor groups, wherein the first visual sensor group includes one or more front-view cameras, one or more surround-view cameras, and one or more rear-view cameras. Cameras; the second visual sensor group includes one or more front-view cameras, one or more side-view cameras, and one or more rear-view cameras. The front-view cameras in the first visual sensor group and the second visual sensor group may be the same or different. For example, the front-view camera may include long-range, medium-range and short-range cameras. In a possible implementation, the front-view camera in the first visual sensor group may include long-range and short-range cameras, and the second visual sensor group may include long-range and short-range cameras. The front-view camera may include a mid-range camera; in another possible implementation manner, the front-view camera in the first visual sensor group and the front-view camera in the second visual sensor group are the same, including long-range, medium-range and short-range from the camera. Similarly, the rear view cameras in the first visual sensor group and the second visual sensor group may be the same or different. The main controller is connected with the first visual sensor group and the second visual sensor group, acquires the first visual sensor data from the first visual sensor group, and acquires the second visual sensor data from the second visual sensor group; the first redundant controller is connected to The first visual sensor group is connected, and the first visual sensor data is obtained from the first visual sensor group; the second redundant controller is connected with the second visual sensor group, and the second visual sensor data is obtained from the second visual sensor group; wherein , the first visual sensor data includes forward-looking data, surround-view data and rear-view data, and the second visual sensor data includes forward-looking data, side-view data and rear-view data; the intelligent driving control system is based on the main A control controller, at least two of the first controller and the second controller obtain data to output a control signal. In this way, although the visual data obtained by the first redundant controller and the second redundant controller is less than that of the main controller, the visual data obtained by any two controllers forming a working group includes the forward-looking data. , side view data, surround view data, and rear view data. It can be understood that, if the forward-looking camera in the first visual sensor group and the forward-looking camera in the second visual sensor group are the same, the forward-looking data in the first visual sensor data and the forward-looking camera in the second visual sensor data are the same. The data are the same, otherwise, the forward-looking data in the first vision sensor data and the forward-looking data in the second vision sensor data are different. If the rear-view camera in the first visual sensor group and the rear-view camera in the second visual sensor group are the same, the rear-view data in the first visual sensor data and the rear-view data in the second visual sensor data are the same, otherwise, The backsight data in the first vision sensor data and the backsight data in the second vision sensor data are different.

In some embodiments, the sensor may further include: a detection sensor. The detection sensor may be connected to the main controller, the first redundant controller and the second redundant controller respectively, and the main controller, the first redundant controller and the second redundant controller obtain the detection sensor from the detection sensor group data. In some embodiments, the detection sensor data includes ultrasonic radar detection data and millimeter wave radar detection data. Optionally, lidar detection data may also be included. In the example shown in FIG. 2B , the detection sensors may include: a millimeter wave radar 21 , a camera 22 , a laser radar 23 and an ultrasonic radar 24 . This application does not limit this, and different types of sensors can be configured according to usage scenarios.

In some embodiments, as shown in FIG. 2B , the intelligent driving control system may further include: the ECU 32 of the vehicle chassis, the positioning and inertial measurement unit 25 , and other ECUs 31 and T-box 41 of the vehicle connected to the controller through the central gateway 50 . The positioning and inertial measurement unit 25 may include: a global navigation satellite positioning device and an inertial measurement device. The positioning and inertial measurement unit 25 can be connected to the satellite positioning system (BDS, GPS, GNS or GLONASS) 71 through the antenna 61 according to the type of the global navigation satellite positioning device it is equipped with and interact with the controller for time synchronization signals to carry out The local time service of the vehicle and the calculation of the vehicle positioning, etc.

The main controller 11, the first redundant controller 12 and the second redundant controller can control the sensors (millimeter wave radar 21, camera 22, lidar 23 and ultrasonic radar 24), positioning and inertial measurement unit 25, central gateway The obtained data is processed and calculated, and combined with the status of the chassis ECU 32 and other ECUs, a control command of the vehicle is generated, thereby controlling the vehicle to perform corresponding intelligent driving operations.

In some embodiments, the main controller 11 , the first redundant controller 12 and the second redundant controller 13 are all controllers with strong computing capabilities; or the main controller is a controller with strong computing capabilities, the first A redundant controller is a controller with medium or strong computing power, and the second redundant controller can be a controller with medium or weak computing power. As in the foregoing implementation manner, the visual data processed by the first redundant controller and the second redundant controller is less than that of the main controller, and accordingly, the computing power may be lower than that of the main controller, thereby reducing the cost of the intelligent control system.

FIG. 2C shows a schematic block diagram of a controller provided by an embodiment of the present application. As shown in FIG. 2C , each of the main controller 11 , the first redundant controller 12 and the second redundant controller 13 shown in FIGS. 2A and 2B may include: a computing unit 101 , an MCU 102 and an interface module 103 .

The computing unit 101 can process and calculate data obtained by sensors, etc., and generate control instructions according to the user's driving needs. The computing unit 101 may include: a system-on-chip SOC (System on Chip, SOC) 1011 and a memory 1012 . SOC1011 may include multiple functional modules, for example: image processing modules for image processing, such as GPU (graphics processing unit, graphics processing unit), general computing modules for general computing, such as CPU, artificial intelligence Computing AI computing modules, such as NPU (neural-network process units, neural network units), interface modules for connecting with other devices (for example: MCU102), and internal memory. The memory 1012 may store application software (eg, perception application software, fusion application software, positioning application software, and control application software, etc.) and other data for performing intelligent driving operations. When the computing unit 101 is running, the SOC 1101 can execute the computer execution instructions in the memory 1012 to perform perception processing, fusion processing, positioning processing and planning processing on the data obtained by sensors such as cameras, lidars, and millimeter-wave radars, and output corresponding control instructions, and then control the vehicle to perform intelligent driving operations.

The MCU 102 can be used to monitor the state of the controller, for example: monitor the voltage, temperature of the controller, and whether it fails or fails; it can also be used to power on and off the controller and reset the controller; and is used to communicate with the ECU of the vehicle chassis and the vehicle The other control units are connected to make the corresponding ECU perform various operations. The MCU 102 may include: a processor, a memory, a communication interface, and the like. The communication interface can be connected with the SOC of the current controller, the MCU of other controllers, and the vehicle chassis ECU, etc., for data exchange with the SOC of the controller, the MCU of other controllers, and the vehicle chassis ECU, for example, to obtain the current controller. The state data of the SOC, the state data of the MCU and/or SOC of other controllers, and the state data of the vehicle chassis ECU. The processor can process and calculate the status data obtained through the communication interface, and generate corresponding control instructions. In some embodiments, the processor may establish a controller status table based on the acquired status data. As shown in Table 1, the status table recorded for each controller is used to record the main controller and the first redundant controller. and the status of the second redundant controller. For example, after the system is started, each controller is normal, and the status records are shown in Table 1. The processor determines a failure operational working group according to the state table of the controller. In the example shown in Table 1, the main controller and the first redundant controller form a failure operational working group, and the second redundant control is in standby. It should be noted that this is only an example, not a limitation. In some embodiments, the controller state table is stored in memory. The memory, which may include read-only memory and random access memory, provides instructions and data to the processor. A portion of the processor may also include non-volatile random access memory. For example, the processor may also store device type information.

When the MCU is running, the processor can execute the computer-executed instructions in the memory. For example, when the main controller fails, the MCU of the main controller can trigger the repair mode to perform operations such as power-on, reset or repair; the first redundancy The MCUs of the controller and the second redundant controller can update their own controller state table according to the obtained state of the main controller, and make the first redundant controller and the second redundant controller form a working group that can be run in failure , optionally, the MCU of the first redundant controller may send warning information to the user through the IVI. When both the main controller and the first redundant controller fail, the MCUs of the main controller and the first redundant controller can trigger the repair mode to perform operations such as power-on, reset or repair; The MCU can update its own controller state table according to the obtained state of the main controller, send warning information to the user through the IVI, and make the second redundant controller enter a safe state, so that the second redundant controller controls the vehicle to stop.

Table 1

The interface module 103 can provide an in-vehicle Ethernet interface, a video serial-parallel transceiver interface, a CAN interface and/or a CAN FD interface, etc. for connection with the sensor interface, the vehicle chassis controller interface and the gateway interface, etc., so as to realize the connection between the controller and the vehicle. data interaction with other control units or modules.

FIG. 3A shows a schematic diagram of connections between the main controller 11 , the first redundant controller 12 and the second redundant controller 13 and with other control units (systems) of the vehicle. As shown in FIG. 3A , the main controller 11 can be respectively connected with the first redundant controller 12 and the second redundant controller 13 through the vehicle Ethernet signal, and the first redundant controller 12 and the second redundant controller 13 It can be connected via in-vehicle Ethernet signal. The main controller 11 , the first redundant controller 12 and the second redundant controller 13 can be signal-connected with other modules in the vehicle, such as VCU, BCM, IVI, and/or T-box, through the in-vehicle gateway. The first redundant controller 12 and the second redundant controller 13 are connected with the vehicle gateway through CAN or CAN FD signal, and the vehicle gateway and other modules in the vehicle, such as VCU, BCM, IVI and/or T-box, etc. In-vehicle Ethernet signal connection, VCU can be connected with ESP, EPS and/or IBS through in-vehicle Ethernet signal.

The sensors may include: detection sensors and vision sensors. For example, the sensors may include one or more of millimeter wave radar 21 , camera 22 , lidar 23 , and ultrasonic radar 24 . In the example shown in FIGS. 3A and 3B , the sensors include: millimeter-wave radar 21 , camera 22 , lidar 23 and ultrasonic radar 24 , but this application is not limited, and the sensor may also include: millimeter-wave radar 21 , camera 22, and ultrasonic radar 24. In the example shown in FIGS. 3A and 3B , the sensors can be divided into sensors in the area A, sensors in the area B, sensors in the area C, and sensors in the area D according to the types of the sensors. The sensor in the area A can be the camera 22, including: a front-view camera 221, a surround-view camera 222 and a rear-view camera 223, that is, the first visual sensor group; the sensor in the area B can be an ultrasonic radar 24 and a millimeter-wave radar 21, including: front Ultrasonic radar 241 and front millimeter-wave radar 211, four-corner ultrasonic radar 242 and four-corner millimeter-wave radar 212 and rear ultrasonic radar 243 and rear millimeter-wave radar 213, namely ultrasonic radar and millimeter-wave radar sensor group; the sensor in area C can be lidar 23, including: front lidar 231, side lidar 232 and rear lidar 233, namely lidar sensor group; the sensor in area D can be a camera, including: front view camera 224, side view camera 225 and rear view camera 226, That is, the second visual sensor group. It should be noted that the lidar in area C may not be deployed, and accordingly the second sensor gateway may not be deployed. It is explained here that a certain area here includes sub-areas of different positions on the vehicle, and the area here is mainly divided by the type of the deployed sensors or the combination of the coverage positions.

The main controller 11 can be respectively connected with the camera 22 in the area A, the ultrasonic radar 24 and the millimeter wave radar 21 in the area B, the laser radar 23 in the area C and the camera 22 in the area D; the first redundant controller 12 can be respectively connected with the signal. The camera 22 in area A, the ultrasonic radar 24 and millimeter-wave radar 21 in area B, and the lidar 23 in area C are signally connected; the second redundant controller 13 can be respectively connected with the ultrasonic radar 24 and millimeter-wave radar 21 in area B and the area. The laser radar 23 of C and the camera 22 of area D are connected by signal.

In some embodiments, the ultrasonic radar 24 and the millimeter-wave radar 21 located in the area B may transmit signals with the main controller 11 , the first redundant controller 12 and the second redundant controller 13 through the first sensor gateway 2401 , respectively. . The ultrasonic radar 24 and the millimeter-wave radar 21 can be signally connected to the first sensor gateway 2401 through CAN, CAN FD and/or vehicle Ethernet. The main controller 11 , the first redundant controller 12 and the second redundant controller 13 can be signally connected to the first sensor gateway 2401 through the in-vehicle Ethernet. The lidar 23 in the area C can transmit signals with the main controller 11 , the first redundant controller 12 and the second redundant controller 13 respectively through the second sensor gateway 2301 . The lidar 23 can be signal-connected to the second sensor gateway 2301 via CAN, CAN FD and/or in-vehicle Ethernet. The main controller 11 , the first redundant controller 12 and the second redundant controller 13 can be signally connected to the second sensor gateway 2301 through the in-vehicle Ethernet. The camera 22 in the area A can be connected to the main controller 11 and the first redundant controller 12 respectively through the POC serializer interface; the camera 22 in the area D can be respectively connected with the main controller 11 and the second redundant controller 12 through the POC serializer interface. The remaining controller 13 is connected.

3B shows a schematic diagram of signal connections between the main controller 11 , the first redundant controller 12 , and the second redundant controller 13 and with other control units (systems) of the vehicle according to another embodiment of the present application. Different from FIG. 3A , the sensors in area D may include: a front-view camera 224 and a side-front-view camera 227 , that is, a second visual sensor group; the computing power of the main controller 11 is greater than or equal to the first redundant controller 12 larger than the second redundant controller 13 . When both the main controller 11 and the first redundant controller 12 fail, the second redundant controller 13 and the sensors in the area B, the area C, and the area D (the front-view camera 224 and the side front-view camera 227 ) Connect to control vehicle parking. It is explained here that a certain area here includes sub-areas at different positions on the vehicle, and the area here is mainly divided by the type of the deployed sensors.

In some possible implementations, the sensors included in the second visual sensor group can be further reduced, and correspondingly reduced sensors are included in the first vision sensor group. Taking the example shown in FIG. 3B , the side front-view camera 227 in the area D can be placed in the area A, and the area D only includes the front-view camera. Accordingly, the first redundant controller 12 and the main controller 11 are both A first visual sensor group, such as the sensor connections in area A, the first visual sensor group includes a front-view camera 221, a surround-view camera 222, a rear-view camera 223, a side-view camera 225, and a side-view camera 227, while the second redundant Both the controller 13 and the main controller 11 are connected to a second visual sensor group, such as a sensor in the area D, and the second visual sensor group includes a front-view camera. The connection method of the detection sensor group is the same as that of Fig. 3A or 3B. In this implementation, if the main controller 11 and the first redundant controller 12 fail, the second redundant controller 13 can receive the forward-looking data even though it acquires less sensor data, which can still satisfy the current control requirements. Lane parking requirements.

It should be noted that the above are only examples, and are not intended to be limiting.

As shown in FIG. 3A and FIG. 3B, since the cameras 22 in the area A and the area D need to be connected to two controllers respectively, the cameras need to have dual POC serializer interfaces, or the cameras with a single POC serializer interface can be. The two controllers are respectively connected through the dual interface switch box 26 .

FIG. 4A shows a schematic structural diagram of the camera 22 with dual POC serializer interfaces 2208 . As shown in FIG. 4A , the camera 22 with dual POC serializer interfaces may include: a camera internal power supply module 2201 , a combined power supply module 2202 , a camera sensor 2203 and a dual interface serializer 2204 . One end of the camera sensor 2203 can be connected to one end of the dual-interface serializer 2204 through the CSI-2 interface 2210 . One end of the camera internal power supply module 2201 can be connected to one end of the combined power supply module 2202 . The other end of the dual interface serializer 2204 and the other end of the combined power supply module 2202 can be connected to the controller through the dual POC serializer interface 2208, thereby realizing signal transmission and power connection with the controller.

FIG. 4B shows a schematic structural diagram of the camera head 22 with the single POC serializer interface 2209 and the dual interface adapter box 26 connected to the camera head 22 with the single POC serializer interface 2209 . As shown in FIG. 4B , the camera 22 with a single POC serializer interface 2209 may include: a camera internal power module 2205, a single interface serializer 2206, and a camera sensor 2207. The camera sensor 2207 can be connected to the single interface serializer 2206 through the CSI-2 interface 2210. The single interface serializer 2206 and the camera internal power module 2205 can be connected to the dual interface adapter box 26 through the single POC serializer interface. The dual interface switch box 26 may include a first serializer 261 , a second serializer 262 , a deserializer 263 and a combined power supply module 264 . One ends of the first serializer 261 and the second serializer 262 are respectively connected to the controller through the dual POC serializer interface 2208, and the other ends of the first serializer 261 and the second serializer 262 are connected to the deserializer 263 One end of the combined power supply module 264 is respectively connected with the dual POC serializer interface 2208, and the other end of the combined power supply module 264 is used to connect with the single POC serializer interface 2209, thereby realizing the single POC serializer interface 2209 The camera 22 is connected with the controller for signal transmission and power supply.

Depending on the type of sensor, its power supply method is also different. In some embodiments, the camera does not have a power supply voltage stabilization module, which requires the on-board power supply to be powered by the power supply voltage stabilization module of the controller; ultrasonic radar, millimeter-wave radar and lidar have a power supply voltage stabilization module, which can be supplied by the vehicle power supply. powered by. In some embodiments, ultrasonic radar, millimeter-wave radar, and lidar can also be powered by an on-board power supply via a power regulator module. In order to not affect the power supply to any sensor when any controller fails, an embodiment of the present application provides a method for supplying power to an intelligent driving control system, as shown in FIG. 5A and FIG. 5B .

FIG. 5A shows a schematic diagram of the power supply structure of the intelligent driving control system provided by the embodiment of the present application, and the first redundant controller 12 and the main controller 11 can be the first redundant controller 12 and the main controller 11 through the on-board power bus A, the on-board power bus B and the on-board power bus C, respectively. And the second redundant controller 13 supplies power. The ultrasonic radar 24 and the millimeter-wave radar 21 in the area B and the lidar 23 in the area C are powered through the vehicle power bus A and the vehicle power bus B respectively.

The camera 22 in the area A may be powered by the main controller power supply voltage stabilization module 11A of the main controller 11 and the first redundant controller power supply voltage stabilization module 12A of the first redundant controller 12 . The camera 22 in the area D may be powered by the main controller power supply voltage stabilization module 11A of the main controller 11 and the second redundant controller power supply voltage stabilization module 13A of the second redundant controller 13 . The regulated power supply module is a power supply device for providing stable alternating current or direct current to the load equipment. In some embodiments, the regulated power supply module may be integrated in the controller. For the sake of clarity, FIG. 5A only shows the first redundant controller power supply voltage stabilization module 12A and the main controller power voltage stabilization module 11A of the first redundant controller 12 , the main controller 11 and the second redundant controller 13 and the second redundant controller power supply voltage regulator module 13A.

FIG. 5B shows a schematic diagram of a power supply structure of an intelligent driving control system provided by another embodiment of the present application. Different from FIG. 5A , the sensors in the area D may include: a front-view camera 224 and a side front-view camera 227 , that is, a second camera sensor group. The rest of the power supply modes are the same as the power supply structure of the intelligent driving control system shown in FIG. 5A .

Embodiment 2. Intelligent driving control method

FIG. 6A shows a flowchart of an intelligent driving control method provided by an embodiment of the present application. In some embodiments, the intelligent driving control method provided by the embodiments of the present application may be implemented by the processor of the MCU executing the computer-executed instructions in the memory. As shown in FIG. 6A , a control method for an intelligent driving control system provided by an embodiment of the present application may include the following steps:

Step S1: Acquire the states of the main controller, the first redundant controller and the second redundant controller.

Wherein, the intelligent driving control system may include: a main controller, a first redundant controller and a second redundant controller, and each controller is connected in pairs for acquiring the status of other controllers. After the intelligent driving control system is powered on and initialized, the MCU can determine that the main controller and the first redundant controller form a fail-operable working group for outputting vehicle control signals and determining that the second redundant controller enters a standby state.

In some embodiments, the driving control system further includes a first visual sensor group, a detection sensor group and a second visual sensor group, wherein the main controller is connected to the first visual sensor group and the detection sensor group connected with the second visual sensor group; the first redundant controller is connected with the first visual sensor group and the detection sensor group; the second redundant controller is connected with the detection sensor group and the detection sensor group The second visual sensor group is connected.

In some embodiments, the computing power of the primary controller may be higher than that of the first redundant controller and the second redundant controller.

Step S2: when one of the main controller and the first redundant controller is in a failed state and the second redundant controller is in a normal state, the main controller and the first redundant controller in a normal state are in a normal state with the second redundant controller. Controllers form fail-running workgroups.

In some embodiments, each controller can obtain the status of other controllers through a heartbeat mechanism. The MCU of each controller can send its own status information to other controllers every preset time, and each controller updates its own controller status table according to the status information provided by other controllers. When the status information of the controller or the status information of the failure of other controllers is obtained, the MCU determines that the controller fails and updates the status table of the controller; or, the MCU of each controller can detect other controllers every preset time. When the state of a certain controller is not detected or the failure of a certain controller is detected, the MCU determines that the controller fails, and updates the state table of the controller.

In some embodiments, each controller can also obtain the status of other controllers by means of an alarm light. In some failure cases, the controller can determine the failed controller by sending alarm information to other controllers, and update The state table of the controller. In the case that the alarm information cannot be sent due to the failure of the controller, the MCU can obtain the status of other controllers through the combination of the heartbeat mechanism and the alarm light, and then update the controller status table and determine the failure and runnable work group.

In some embodiments, when one of the main controller, the first redundant controller and the second redundant controller fails but the failure is detected by other valid controllers and the self-healing succeeds, step S2 may not be performed, The fail-operable working group composed of the main controller and the first redundant controller continues to perform intelligent driving control and outputs vehicle control signals, while the second redundant controller is still in a standby state. In some embodiments, when one of the main controller and the first redundant controller is in a failed state and the second redundant controller is in a normal state, the other one of the main controller and the first redundant controller is upgraded to a new one on this basis, when one of the new primary controller and the second redundant controller fails, the only valid controller becomes the new The main controller controls the vehicle to stop.

In some embodiments, when one of the primary controller and the first redundant controller is in a failed state and the second redundant controller fails, the only valid controller acts as the new primary controller to control vehicle parking.

In some embodiments, the intelligent driving control method further includes: when the main controller, the first redundant controller and the second redundant controller are all valid, enabling the main controller and the second redundant controller The first redundant controller forms a fail-operable working group, so that the second redundant controller enters a standby state.

In some embodiments, the intelligent driving control method further comprises: in the case of failure of two of the main controller, the first redundant controller and the second redundant controller, by another A controller controls vehicle parking.

In some embodiments, when one controller fails and repair fails, and one of the two controllers that make up the failed runnable workgroup also fails but self-healing is successful without being detected by the other controllers, the process may continue. Perform non-degraded smart driving maneuvers and do not control vehicle parking.

In some embodiments, the intelligent driving control method may further include: causing the controller in the failed state to enter a repair mode.

In some embodiments, the intelligent driving control method may further include: when one of the main controller or the first redundant controller is successfully repaired, the successfully repaired controller replaces the failed operable work The second redundant controller in the group, the second redundant controller enters a standby state.

In some embodiments, the intelligent driving control method further comprises: submitting the status of the failed controller to a remote maintenance system.

In some embodiments, the intelligent driving control method may further include: sending warning information to the user. For example, when one of the primary controller, the first redundant controller, and the second redundant controller fails, the status of the failed controller is submitted to the remote maintenance system, and an alert message may optionally be sent to the user. When two of the main controller, the first redundant controller and the second redundant controller fail, submit the status of the failed controller to the remote maintenance system and send warning information to the user.

FIG. 6B shows a flowchart of an intelligent driving control method provided by another embodiment of the present application. A control method for an intelligent driving control system provided by another embodiment of the present application may include the following steps:

After the intelligent driving control system is powered on and initialized, step S10 is performed: the main controller and the first redundant controller form a fail-operable working group, and the second redundant controller is in a standby state.

The fail operational working group is used to control the vehicle to perform the driving operation, and can not affect the vehicle to perform the intelligent driving operation if any one of the main controller and the first redundant controller fails, Guaranteed intelligent driving level.

A controller in a standby state is in a low power consumption mode, its microcontroller MCU can monitor the state of the controller, and its computing unit 101 (see FIG. 2C ) is in a sleep state and does not work. In the standby state, the microcontroller MCU monitors the operating states of its own controller and other controllers (such as monitoring the operating states of the main controller, the first redundant controller and the second redundant controller), the voltage and the voltage of its own controller. The temperature of its own controller, etc. When the microcontroller unit MCU detects the failure of other controllers, the MCU controls the computing unit (see Figure 2C) to switch from the sleep state to the working state, and forms a fail-operable working group with the non-failed controllers to control the vehicle to perform intelligent driving operations .

In some embodiments, any two of the main controller, the first redundant controller, and the second redundant controller may form a fail-operable working group, for example, the main controller and the second redundant controller form A working group can be run if it fails, and the remaining one is in a standby state, which is not limited in this application.

In some embodiments, the primary controller, the first redundant controller, and the second redundant controller may be the same controller or different controllers. That is, the main controller, the first redundant controller and the second redundant controller are all controllers with strong computing capabilities; or the main controller is a controller with strong computing capabilities, and the first redundant controller is a controller with strong computing capabilities. A controller with medium or high computing power, the second redundant controller may have a controller with medium or low computing power.

In the case that the primary controller fails, step S21 is executed: the first redundant controller and the second redundant controller form a fail-operable working group.

The main controller, the first redundant controller, and the second redundant controller can be connected to each other, respectively, for sending or acquiring the status and data of other controllers. When the primary controller fails, it can send a signal to other controllers, and the first redundant controller and the second redundant controller form a fail-operable working group according to the signal. When the main controller cannot send a signal to other controllers due to failure, other controllers can obtain the status of the main controller through the MCU of the main controller, and then adjust the types of controllers that can be operated in failure.

Step S31: The main controller enters an online self-repair mode.

In some embodiments, a signal of the failure of the main controller can also be sent to the user, for example, the user is notified of the failure of the controller through IVI, or/and the status of the failed controller is submitted to the remote maintenance system. When the main controller fails to repair itself online, the main controller can be repaired manually through the remote maintenance system or offline.

Step S41: Determine whether the self-repair of the main controller is successful. When the main controller is successful in self-repair, step S10 is performed; when the main controller fails in self-repair, step S21 is performed.

In the case that the first redundant controller fails, step S22 is executed: the main controller and the second redundant controller form a fail-operable working group.

Step S32: The first redundant controller enters an online self-healing mode.

In some embodiments, a signal of the failure of the first redundant controller can also be sent to the user, for example, the user is notified of the failure of the controller through IVI, or/and the status of the failed controller is submitted to the remote maintenance system. In the case that the online self-repair of the first redundant controller fails, the first redundant controller can be repaired manually through a remote maintenance system or offline. Step S42: Determine whether the self-healing of the first redundant controller is successful. When the self-repairing of the first redundant controller succeeds, step S10 is performed; when the self-repairing of the first redundant controller fails, step S22 is performed.

In the case that the second redundant controller fails, step S23 is executed: the main controller and the first redundant controller form a fail-operable working group.

Step S33: the second redundant controller enters an online self-healing mode.

In some embodiments, a signal of the failure of the second redundant controller can also be sent to the user, for example, the user is notified of the failure of the controller through IVI, or/and the status of the failed controller is submitted to the remote maintenance system. In the case that the online self-healing of the second redundant controller fails, the second redundant controller can be repaired manually through a remote maintenance system or offline.

Step S41: Determine whether the self-healing of the second redundant controller is successful, and when the second redundant controller succeeds in self-repairing, perform step S10; when the first redundant controller fails, perform step S23.

In some embodiments, when the primary controller, the first redundant controller or the second redundant controller fails, the failed controller is put into a self-healing mode, and the status of the failed controller is submitted to the remote Maintain the system and send alerts to users.

In a possible implementation manner, when the primary controller, the first redundant controller or the second redundant controller fails, the failed controller is put into a self-healing mode, and the state of the failed controller is submitted to the remote maintenance system.

In the event that any two of the main controller, the first redundant controller and the second redundant controller fail, step S50 is executed: the only normal controller enters a safe mode and controls the vehicle to park in a proper position.

In some embodiments, alarm information may also be sent to the user when any two of the primary controller, the first redundant controller, and the second redundant controller fail.

Embodiment 3. Intelligent driving control device

FIG. 7 shows a schematic block diagram of an intelligent driving control device provided by an embodiment of the present application. As shown in FIG. 7 , the intelligent driving control device provided in the embodiment of the present application is applied to an intelligent driving control system. The intelligent driving control system includes: a main controller, a first redundant controller, and a second redundant controller. The main control The controller and the first redundant controller form a working group for outputting vehicle control signals, and the control device includes: an acquisition module 1000, which is used for acquiring the states of the main controller, the first redundant controller and the second redundant controller; A determination module 2000, which is used for determining the main controller and the first redundant controller when one of the main controller, the first redundant controller and the second redundant controller is in a failed state and the state of the second redundant controller is normal One of the controllers in a normal state and the second redundant controller form a fail-operable working group.

In some embodiments, the determining module is further configured to: when the main controller, the first redundant controller and the second redundant controller are all valid, make the main controller and the first redundant controller form a failable work group , the second redundant controller enters the standby state.

In some embodiments, the computing power of the second redundant controller is lower than the computing power of the primary controller or the first redundant controller.

In some embodiments, the determining module is further configured to: put the controller in the failed state into a repair mode.

In some embodiments, the main controller is connected to the first redundant controller and the second redundant controller respectively, and the first redundant controller is connected to the second redundant controller for transmitting the main controller, the first redundant controller and the second redundant controller. Status of the redundant controller and the second redundant controller.

In some embodiments, the states of the main controller, the first redundant controller, and the second redundant controller are recorded in a controller state maintenance table, and the controller state maintenance table is stored in the main controller, the first redundant controller, and the first redundant controller, respectively. in the redundant controller and the second redundant controller.

In some embodiments, when one of the controllers cannot send the status due to failure, since the other two controllers are respectively connected to the failed controller, after the other two controllers both determine that the failed controller fails, The other two controllers update the controller state maintenance table.

In some embodiments, the determining module is further configured to: after one of the primary controller or the first redundant controller is successfully repaired, determine that the successfully repaired controller replaces the second redundant controller in the failed operational working group, The second redundant controller enters a standby state.

In some embodiments, the determining module is further configured to cause the other controller to control the vehicle to stop when two of the primary controller, the first redundant controller and the second redundant controller fail.

In some embodiments, the determining module is further configured to: submit the status of the failed controller to the remote maintenance system.

In some embodiments, the method further includes: sending alert information to the user.

In some embodiments, when the primary controller, the first redundant controller or the second redundant controller fails, the status of the failed controller is submitted to the remote maintenance system, and warning information is sent to the user.

In some embodiments, in the event of failure of two of the primary controller, the first redundant controller, and the second redundant controller, the status of the failed controller is submitted to the remote maintenance system and sent to the user Warning message.

In some embodiments, in the event of failure of the primary controller, the first redundant controller, or the second redundant controller, the status of the failed controller is submitted to the remote maintenance system.

In some embodiments, the driving control system further includes sensors including a first visual sensor group, a detection sensor group and a second visual sensor group, wherein the main controller is connected to the first visual sensor group, the detection sensor group and the second visual sensor group the first redundant controller is connected with the first visual sensor group and the detection sensor group; the second redundant controller is connected with the detection sensor group and the second visual sensor group.

Embodiment 4. Vehicle

The fourth embodiment of the present application provides a vehicle, including: the intelligent driving control system provided by the first embodiment of the present application and/or the intelligent driving control device provided by the third embodiment of the present application.

Embodiment 5. Computing equipment

FIG. 8 is a schematic structural diagram of a computing device 1500 provided by an embodiment of the present application. The computing device 1500 includes a processor 1510 , a memory 1520 , a communication interface 1530 and a bus 1540 .

It should be understood that the communication interface 1530 in the computing device 1500 shown in FIG. 8 may be used to communicate with other devices.

Wherein, the processor 1510 can be connected with the memory 1520 . The memory 1520 may be used to store the program codes and data. Therefore, the memory 1520 may be a storage unit inside the processor 1510 , or an external storage unit independent from the processor 1510 , or may include a storage unit inside the processor 1510 and an external storage unit independent from the processor 1510 . part.

Optionally, computing device 1500 may also include bus 1540 . The memory 1520 and the communication interface 1530 can be connected to the processor 1510 through the bus 1540. The bus 1540 may be a peripheral component interconnect standard (Peripheral Component Interconnect, PCI) bus or an Extended Industry Standard Architecture (Extended Industry Standard Architecture, EISA) bus or the like. The bus 1540 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one line is shown in FIG. 8, but it does not mean that there is only one bus or one type of bus.

It should be understood that, in this embodiment of the present application, the processor 1510 may adopt a central processing unit (central processing unit, CPU). The processor may also be other general-purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), off-the-shelf programmable gate arrays (FPGAs) or other Programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like. Alternatively, the processor 1510 uses one or more integrated circuits to execute related programs to implement the technical solutions provided by the embodiments of the present application.

The memory 1520 may include read only memory and random access memory and provides instructions and data to the processor 1510 . A portion of the processor 1510 may also include non-volatile random access memory. For example, the processor 1510 may also store device type information.

When the computing device 1500 is running, the processor 1510 executes the computer-executed instructions in the memory 1520 to execute the operation steps of the intelligent driving control method provided by the embodiments of the present application.

It should be understood that the computing device 1500 according to the embodiments of the present application may correspond to corresponding subjects in executing the methods according to the various embodiments of the present application, and the above-mentioned and other operations and/or functions of the modules in the computing device 1500 are respectively for the purpose of realizing the present application. For the sake of brevity, the corresponding processes of each method in the embodiment will not be repeated here.

Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described systems, devices and units may refer to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.

The functions, if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program codes .

Embodiment 6. Computer-readable storage medium

Embodiments of the present application further provide a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, is used to execute a method for generating diverse problems, and the method includes the methods described in the foregoing embodiments. at least one of the options.

The computer storage medium of the embodiments of the present application may adopt any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any combination of the above. More specific examples (a non-exhaustive list) of computer readable storage media include: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read only memory (ROM), Erasable programmable read only memory (EPROM or flash memory), optical fiber, portable compact disk read only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

A computer-readable signal medium may include a propagated data signal in baseband or as part of a carrier wave, with computer-readable program code embodied thereon. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device .

Program code embodied on a computer readable medium may be transmitted using any suitable medium including, but not limited to, wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

Computer program code for performing the operations of the present application may be written in one or more programming languages, including object-oriented programming languages—such as Java, Smalltalk, C++, but also conventional Procedural programming language - such as the "C" language or similar programming language. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any kind of network, including a local area network (LAN) or wide area network (WAN), or may be connected to an external computer (eg, through the Internet using an Internet service provider) connect).

Note that the above are only the preferred embodiments of the present application and the applied technical principles. Those skilled in the art will understand that the present application is not limited to the specific embodiments described herein, and various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the protection scope of the present application. Therefore, although the present application has been described in detail through the above embodiments, the present application is not limited to the above embodiments, and can also include more other equivalent embodiments without departing from the concept of the present application, all of which belong to The scope of protection of this application.

Claims

An intelligent driving control method, characterized in that the intelligent driving control method is applied in an intelligent driving control system, and the intelligent driving control system comprises: a main controller, a first redundant controller and a second redundant controller , the main controller and the first redundant controller form a failure operation (failure operation) working group for outputting vehicle control signals, and the control method includes:

obtaining the status of the primary controller, the first redundant controller and the second redundant controller;

When one of the main controller and the first redundant controller is in a failed state and the second redundant controller is in a normal state, it is determined that the main controller and the first redundant controller are in a normal state One of the fail-operational working groups is formed with the second redundant controller.
The control method according to claim 1, further comprising: when the main controller, the first redundant controller and the second redundant controller are all valid, enabling the main control The second redundant controller and the first redundant controller form a fail-operable working group, so that the second redundant controller enters a standby state.
The control method according to claim 1 or 2, further comprising: making the controller in the failed state enter a repair mode.
The control method according to any one of claims 1-3, wherein when one of the main controller or the first redundant controller is successfully repaired, the successfully repaired controller replaces the Failing to operate the second redundant controller in the workgroup, the second redundant controller enters a standby state.
The control method according to any one of claims 1-4, further comprising: two of the main controller, the first redundant controller and the second redundant controller In the event of a failure, make another controller control the vehicle to stop.
The control method according to any one of claims 1-5, further comprising: submitting the status of the failed controller to a remote maintenance system.
The control method according to claim 5 or 6, further comprising: sending warning information to the user.
The control method according to any one of claims 1-7, wherein the driving control system further comprises a first visual sensor group, a detection sensor group and a second visual sensor group, wherein,

the main controller is connected with the first visual sensor group, the detection sensor group and the second visual sensor group;

the first redundant controller is connected to the first visual sensor group and the detection sensor group;

The second redundant controller is connected to the detection sensor group and the second vision sensor group.
The control method according to any one of claims 1-8, characterized in that, the computing capability of the main controller is higher than that of the first redundant controller and the second redundant controller.
An intelligent driving control device, characterized in that the intelligent driving control device is applied in an intelligent driving control system, and the intelligent driving control system comprises: a main controller, a first redundant controller and a second redundant controller , the main controller and the first redundant controller form a failure operation work group for outputting vehicle control signals, and the control device includes:

an acquisition module, configured to acquire the states of the primary controller, the first redundant controller and the second redundant controller;

a determining module, configured to determine the One of the primary controller and the first redundant controller in a normal state and the second redundant controller form a fail-operable working group.
The control device according to claim 10, wherein the determining module is further configured to: when the main controller, the first redundant controller and the second redundant controller are all valid, The primary controller and the first redundant controller are made to form a fail-operable working group, and the second redundant controller is brought into a standby state.
The control device according to claim 10 or 11, wherein the determining module is further configured to: make the controller in the failure state enter a repair mode.
The control device according to any one of claims 10-12, wherein the determining module is further configured to: after one of the main controller or the first redundant controller is successfully repaired, It is determined that the successfully repaired controller replaces the second redundant controller in the failed operational working group, and the second redundant controller enters a standby state.
The control device according to any one of claims 10-13, characterized in that, the determining module is further configured to: in the main controller, the first redundant controller and the second redundant controller In the event of failure of two of the controllers, the other controller is made to control the vehicle to stop.
The control device according to any one of claims 10-14, wherein the determining module is further configured to: submit the status of the failed controller to a remote maintenance system.
The control device according to claim 14 or 15, further comprising: sending warning information to the user.
The control device according to any one of claims 10-16, wherein the driving control system further includes sensors including a first visual sensor group, a detection sensor group and a second visual sensor group, wherein the main control a device is connected to the first visual sensor group, the detection sensor group and the second visual sensor group;

the first redundant controller is connected to the first visual sensor group and the detection sensor group;

The second redundant controller is connected to the detection sensor group and the second vision sensor group.
The control device according to any one of claims 10-17, wherein the computing power of the main controller is higher than that of the first redundant controller and the second redundant controller.
An intelligent driving control system, comprising: a main controller, a first redundant controller and a second redundant controller:

the main controller is connected to the first visual sensor group and the second visual sensor group, acquires first visual sensor data from the first visual sensor group, and acquires second visual sensor data from the second visual sensor group;

the first redundant controller is connected to the first visual sensor group, and obtains the first visual sensor data from the first visual sensor group;

the second redundant controller is connected to the second visual sensor group, and obtains the second visual sensor data from the second visual sensor group;

Wherein, the first visual sensor data includes forward view data, surround view data and rear view data, and the second visual sensor data includes forward view data, side view data and rear view data;

The intelligent driving control system outputs control signals based on data obtained by at least two of the main control controller, the first controller, and the second controller.
The control system according to claim 19, wherein the main controller, the first redundant controller and the second redundant controller are all connected to a detection sensor group, and the detection sensor group is connected from the detection sensor group. Acquire probe sensor data.
The control system according to claim 20, wherein the detection sensor data includes ultrasonic radar detection data and millimeter wave radar detection data.
The control system according to any one of claims 19-21, wherein when the main controller, the first redundant controller and the second redundant controller are all valid, the The primary controller and the first redundant controller form a failure operation work group, and the second redundant controller is in a standby state.
The control system according to any one of claims 19-22, further comprising: the failed controller is in a repair state.
The control system according to any one of claims 19-23, wherein when one of the main controller or the first redundant controller is successfully repaired, the successfully repaired controller replaces the Failed to operate the second redundant controller in the workgroup, the second redundant controller was in a standby state.
The control system according to any one of claims 19-24, further comprising: two of the main controller, the first redundant controller and the second redundant controller In the event of a failure, another controller controls the vehicle to stop.
The control system according to any one of claims 19-25, further comprising: submitting the status of the failed controller to a remote maintenance system.
The control system according to claim 25 or 26, further comprising: sending warning information to the user.