CN114872717A - Control system, method, device for autonomous vehicle, and autonomous vehicle - Google Patents

Abstract

The present disclosure provides a control system, method, device and automatic driving vehicle for an automatic driving vehicle, and relates to the technical field of artificial intelligence, in particular to the field of automatic driving and intelligent transportation. The specific implementation scheme is as follows: the control system includes an automatic driving controller, a vehicle control execution module and a safety controller, wherein the automatic driving controller is used to generate first control data based on the first sensing data sent by the first part of the sensors in the vehicle; the vehicle controls The execution module is used to control the vehicle according to the received first control data; the safety controller is used to monitor the communication state of the first communication link, and the first communication link is the communication between the automatic driving controller and the vehicle control execution module and in the case of monitoring the failure of the first communication link, generating second control data based on the second sensing data sent by the second part of the sensors in the vehicle, and sending the second control data, so that the vehicle controls the execution module Control the vehicle to perform preset safety actions.

Description

Control system, method, device for autonomous vehicle, and autonomous vehicle

technical field

The present disclosure relates to the technical field of artificial intelligence, and in particular, to the technical field of autonomous driving and intelligent transportation.

Background technique

An autonomous vehicle is a vehicle that senses its environment and drives with little or no human input. The safety issues of autonomous vehicles will seriously affect the promotion of autonomous driving technology. The current control architecture of autonomous vehicles mainly includes sensors for data collection, controllers for vehicle planning and control, and vehicle execution systems. From sensors to controllers, to vehicle power supply and execution systems, all modules are one and the same. Security issues under system failures need to be considered.

SUMMARY OF THE INVENTION

The present disclosure provides a control system, method, and device for an automatic driving vehicle and the automatic driving vehicle.

According to an aspect of the present disclosure, there is provided a control system for an autonomous vehicle, including:

an automatic driving controller, configured to generate the first control data based on the first sensing data sent by the first part of the sensors in the vehicle, and send the first control data;

a vehicle control execution module, configured to receive the first control data and control the vehicle according to the first control data;

The safety controller is used to monitor the communication state of the first communication link, where the first communication link is the communication link between the automatic driving controller and the vehicle control execution module; and when monitoring the failure of the first communication link Next, the second control data is generated based on the second sensing data sent by the second part of the sensor in the vehicle, and the second control data is sent; wherein, the second control data is used for the vehicle control execution module to control the vehicle to perform preset safety actions.

According to another aspect of the present disclosure, there is provided a control method for an automatic driving vehicle, comprising:

Monitoring the communication state of the first communication link; wherein, the first communication link is a communication link between the automatic driving controller and the vehicle control execution module, and the vehicle control execution module is used to receive the first control from the automatic driving controller data, the vehicle is controlled according to the first control data, and the first control data is generated by the automatic driving controller based on the first sensing data sent by the first part of the sensors in the vehicle;

When it is determined that the first communication link fails, the second control data is generated based on the second sensing data sent by the second part of the sensors in the vehicle; wherein the second control data is used for the vehicle control execution module to control the vehicle to execute the preset safety action.

According to another aspect of the present disclosure, there is provided a control device for an automatic driving vehicle, comprising:

A monitoring module, used for the communication state of the first communication link; wherein, the first communication link is a communication link between the automatic driving controller and the vehicle control execution module, and the vehicle control execution module is used for receiving data from the automatic driving controller to control the vehicle according to the first control data, the first control data is generated by the automatic driving controller based on the first sensing data sent by the first part of the sensors in the vehicle;

a control module, configured to generate second control data based on second sensing data sent by a second part of sensors in the vehicle when it is determined that the first communication link fails; wherein the second control data is used for the vehicle control execution module to control The vehicle performs a preset safety action.

According to another aspect of the present disclosure, there is provided an electronic device, comprising:

at least one processor; and

a memory communicatively coupled to the at least one processor; wherein,

The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor, so that the at least one processor can execute any one of the methods for controlling an autonomous driving vehicle in the embodiments of the present disclosure.

According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause a computer to execute any one of the methods for controlling an autonomous vehicle in the embodiments of the present disclosure.

According to another aspect of the present disclosure, a computer program product is provided, including a computer program, which, when executed by a processor, implements any one of the methods for controlling an automatic driving vehicle in the embodiments of the present disclosure.

According to another aspect of the present disclosure, a control system for an automatic driving vehicle is provided, including the electronic device in the embodiment of the present disclosure.

According to another aspect of the present disclosure, an automatic driving vehicle is provided, including the control system of the automatic driving vehicle in the embodiments of the present disclosure.

An embodiment in the above application has the following advantages or beneficial effects:

When the safety controller detects that the first communication link fails, that is, the communication between the vehicle control execution module and the automatic driving controller fails, causing the automatic driving function to fail, so the safety controller receives the second sensing data sent by the second part of the sensor. , and generate the second control data according to the second perception data, so that the vehicle control execution module can control the vehicle to perform preset safety actions according to the second control data. It can be seen that even when the automatic driving function of the vehicle fails, the driving safety of the vehicle can be ensured, thereby ensuring the safety of the vehicle and surrounding people in an open road environment.

It should be understood that what is described in this section is not intended to identify key or critical features of embodiments of the disclosure, nor is it intended to limit the scope of the disclosure. Other features of the present disclosure will become readily understood from the following description.

Description of drawings

The accompanying drawings are used for better understanding of the present solution, and do not constitute a limitation to the present disclosure. in:

1A is a schematic structural diagram of a control system for an autonomous driving vehicle according to an embodiment of the present disclosure;

FIG. 1B is a schematic structural diagram of a control system of an autonomous driving vehicle according to another embodiment of the present disclosure;

FIG. 2 is a schematic structural diagram of a control system for an automatic driving vehicle according to another embodiment of the present disclosure;

3 is a schematic diagram of a specific structure of a control system for an automatic driving vehicle according to another embodiment of the present disclosure;

4 is a schematic diagram of a specific structure of a vehicle control execution module according to another embodiment of the present disclosure;

FIG. 5 is a schematic flowchart of a control method for an automatic driving vehicle according to an embodiment of the present disclosure;

FIG. 6 is a block diagram of a control device of an autonomous driving vehicle according to an embodiment of the present disclosure;

FIG. 7 is a block diagram of a control device of an autonomous driving vehicle according to another embodiment of the present disclosure;

FIG. 8 is a block diagram of an electronic device used to implement the control method of an automatic driving vehicle according to an embodiment of the present disclosure.

Detailed ways

Exemplary embodiments of the present disclosure are described below with reference to the accompanying drawings, which include various details of the embodiments of the present disclosure to facilitate understanding and should be considered as exemplary only. Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the present disclosure. Also, descriptions of well-known functions and constructions are omitted from the following description for clarity and conciseness.

FIG. 1A is a schematic structural diagram of a control system of an automatic driving vehicle according to an embodiment of the present disclosure. As shown in Figure 1A, the system may include:

an automatic driving controller 110, configured to generate first control data based on the first sensing data sent by the first part of the sensor 120 in the vehicle, and send the first control data;

a vehicle control execution module 130, configured to receive the first control data, and control the vehicle according to the first control data;

The safety controller 140 is used to monitor the communication state of the first communication link, where the first communication link is the communication link between the automatic driving controller 110 and the vehicle control execution module 130; and when the first communication link is monitored In the case of failure, the second control data is generated based on the second sensing data sent by the second part of the sensor 150 in the vehicle, and the second control data is sent; wherein, the second control data is used by the vehicle control execution module 130 to control the vehicle to execute the pre-control. Set up safe actions.

Exemplarily, the vehicle may be an automatic driving vehicle, and the automatic driving controller 110 may correspondingly generate different first control data according to different first sensing data, so as to control the vehicle control execution module 130 according to the first control data to realize the automatic driving of the vehicle. driving function. Specifically, the relationship table between the first perception data and the first control data can be stored in the automatic driving controller 110 in advance, so that the automatic driving controller 110 can generate the first control data by looking up the table according to the received first perception data. It can also be that after the automatic driving controller 110 receives the first perception data, the automatic driving controller 110 calculates the first perception data, so as to generate corresponding first control data according to the calculation result.

Exemplarily, if the first communication link fails, that is, the communication between the automatic driving controller 110 and the vehicle control execution module 130 fails, then the failure of the automatic driving controller 110 itself may cause the automatic driving controller 110 and the vehicle control execution module to fail. If the communication between 130 fails, the failure of the vehicle control execution module may also cause the communication between the automatic driving controller 110 and the vehicle control execution module 130 to fail. Alternatively, the failure of the communication link between the automatic driving controller 110 and the vehicle control execution module 130 may cause the communication failure between the automatic driving controller 110 and the vehicle control execution module 130 . Therefore, the automatic driving controller 110 can send information to the safety controller 140 to determine that the communication between the automatic driving controller 110 and the vehicle control execution module 130 is invalid, and the safety controller 140 can also monitor the automatic driving controller 110 and the vehicle. The presence or absence of data transmission between the control execution modules 130 determines the communication status between the automatic driving controller 110 and the vehicle control execution module 130 . The communication state between the automatic driving controller 110 and the vehicle control execution module 130 may also be determined by combining the above two methods.

Exemplarily, the vehicle control execution module 130 may include a vehicle controller and a vehicle actuator, and the vehicle controller may include: a steering controller, a brake controller, a drive controller, a body controller, an air conditioner controller, etc.; a vehicle actuator It can include: steering actuators, brake actuators, drive actuators, air conditioner actuators, body actuators, etc., wherein the drive actuators include: drive motors, gearboxes, differentials, transmission shafts, etc., brake actuators Including: brake electro-hydraulic module, brake oil pipe, caliper, brake disc, etc. Steering actuator: power steering motor, steering gear, steering knuckle, etc. In this embodiment, after the vehicle controller receives the first control data, the vehicle controller controls the vehicle actuator according to the first control data to control the driving of the vehicle.

Illustratively, the first portion of the sensor 120 and the second portion of the sensor 150 may comprise identical, partly identical, or entirely different sensors. As shown in FIG. 1A , the first partial sensor 120 may include the second partial sensor 150 . Alternatively, as shown in FIG. 1B , the first partial sensor 120 and the second partial sensor 150 may be independent of each other. It can be understood that the first part of the sensor 120 and the second part of the sensor 150 may also include some of the same sensors. For example, the first part of the sensor 120 and the second part of the sensor 150 both include the sensor A, and the first part of the sensor 120 includes the sensor B, and the second part of the sensor 150 does not include the sensor B; for another example, both the first part of the sensor 120 and the second part of the sensor 150 The sensor A is included, the first part of the sensor 120 also includes the sensor B, and the second part of the sensor 150 also includes the sensor C. In this embodiment, the second sensor is a sensor necessary for a safety action, that is, the least sensor required for a safety action, and the second part of the sensors 150 may include a camera, an automotive radar, and the like.

Exemplarily, the safety controller 140 may generate different second control data correspondingly according to different second sensing data, and specifically, the safety controller 140 may store a relationship table between the second sensing data and the second control data in advance. ; It may also be that after the automatic driving controller 110 receives the second perception data, the safety controller 140 calculates the second perception data, so as to generate corresponding second control data according to the calculation result.

Exemplarily, the preset safety actions performed based on the second control data may include braking actions, obstacle avoidance actions, deceleration actions, etc. Further, when the second control data is received, only one safety action may be performed, and further It can be to perform multiple security actions. For example, the braking action is directly executed to realize an emergency stop on the current road section; for another example, the deceleration action is executed first, then the obstacle avoidance action is executed to change the lane, and the braking action is executed finally to realize the pullover.

In the technical solution of the present disclosure, when the safety controller 140 detects that the first communication link fails, that is, the communication between the vehicle control execution module 130 and the automatic driving controller 110 fails, thereby causing the automatic driving function to fail, so the safety controller 140 receives the second sensing data sent by the second part of the sensor 150, and generates second control data according to the second sensing data, so that the vehicle control execution module 130 can control the vehicle to perform preset safety actions according to the second control data. It can be seen that even when the automatic driving function of the vehicle fails, the driving safety of the vehicle can be ensured, thereby ensuring the safety of the vehicle and surrounding people in an open road environment.

In one embodiment, as shown in Figure 2, the system further includes:

The safety power supply module 210 is used to supply power to the safety controller 140, the second part of the sensors 150 and at least part of the driving controllers in the vehicle control execution module 130; wherein, at least part of the driving controllers are driving controllers that receive and store at least part of the data device.

Exemplarily, when the failure of the first communication link is detected, it means that the communication between the vehicle control execution module 130 and the automatic driving controller 110 fails, thereby causing the failure of the automatic driving function. Therefore, the safety power supply module 210 is used for the safety controller 140, the first The two-part sensor 150 and at least part of the driving controller in the control execution module are powered to ensure that each module can work normally, thereby ensuring that the vehicle can perform safe actions. In this embodiment, if the communication between the vehicle control execution module 130 and the automatic driving controller 110 fails, at least part of the driving controllers in the control execution module may include: a steering controller, a braking controller, a driving controller, a body control actuators, steering actuators, brake actuators, drive actuators and body actuators, etc.

In one embodiment, the vehicle control execution module 130 is further configured to store at least part of the first control data;

The security controller 140 monitors the communication status of the first communication link by monitoring the update status of the data stored in the vehicle control execution module 130 . That is to say, the safety controller 140 is further configured to monitor the update status of the data stored by the vehicle control execution module 130 . Exemplarily, in the case of an abnormal update status, it is indicated that the above-mentioned communication link is interrupted, so as to determine the automatic driving controller 110 The communication with the vehicle control execution module 130 fails; on the contrary, it is determined that the communication between the automatic driving controller 110 and the vehicle control execution module 130 is normal when the update state is normal.

The vehicle control execution module 130 may store the first control data updated in real time, or may only store the latest first control data, which is not limited herein. That is, the safety controller 140 can monitor the communication status between the automatic driving controller 110 and the vehicle control execution module 130 by monitoring whether the data stored in the vehicle control execution module 130 is updated in time.

Exemplarily, if the automatic driving controller 110 processes the received first sensing data in real time, and generates the first control data according to the first sensing data, the vehicle control execution module 130 may receive the latest first control data in real time, then the vehicle The first control data stored in the control execution module 130 is also updated in real time. If the safety controller 140 detects that the update status of the data stored in the vehicle control execution module 130 is an unupdated status (ie, an abnormal status), it means that there is a communication interruption on the link where the automatic driving controller 110 is located, that is, the automatic driving control The communication between the controller 110 and the vehicle control execution module 130 fails, thereby causing the automatic driving function to fail. It can be seen that the safety controller 140 can accurately determine whether the communication status between the automatic driving controller 110 and the vehicle control execution module 130 is a failure status by monitoring the update status of the data stored in the first control data, thereby determining the automatic driving function is invalid.

In one embodiment, the safety controller 140 is further configured to monitor the communication status of the second communication link, which is the communication link between the safety controller 140 and the automatic driving controller 110; The communication status of the first communication link is monitored until the second communication link fails.

Specifically, the safety controller 140 may monitor the update status of the data stored in the vehicle control execution module 130 in the event that the communication failure between the safety controller 140 and the automatic driving controller 110 is detected.

Exemplarily, the safety controller 140 communicates with the autopilot controller 110 in real time. For example, the safety controller 140 may receive information from the autopilot controller 110 in real time. When the safety controller 140 cannot receive the information from the autopilot controller 110 (ie, the second communication link fails), it means that the autopilot controller 110 may be faulty, that is, the autopilot function may fail. In this way, it is necessary to monitor the update status of the data stored in the vehicle control execution module 130, and further determine whether the automatic driving controller 110 and the vehicle control execution module 130 communicate normally through the update status of the data stored in the vehicle control execution module 130, so that the update status can be updated. It is accurately determined whether the automatic driving controller 110 fails, so that the vehicle can be controlled more accurately.

Specifically, if the update status of the vehicle control execution module 130 is abnormal, it means that the communication between the automatic driving controller 110 and the vehicle control execution module 130 fails, then the automatic driving controller 110 is indeed faulty and the automatic driving function fails, and the safety controller 140 is required. On the contrary, if the update state of the vehicle control execution module 130 is normal, it means that the automatic driving controller 110 and the vehicle control execution module 130 can communicate normally, but the automatic driving controller 110 cannot communicate with the safety controller 140, then the automatic driving control If the controller 110 is not faulty, the safety controller 140 is not required to control the vehicle.

In one embodiment, the safety controller 140 is also used to:

The monitoring vehicle control execution module 130 controls the actions performed by the vehicle according to the first control data, and when it is determined that the action has a collision risk, generates second control data based on the second sensing data, and sends the second control data.

In this embodiment, the safety controller 140 will monitor the vehicle control execution module 130 in real time, and if it is detected that the action performed by the vehicle has a collision risk, such as insufficient steering angle during steering, insufficient braking distance during braking, etc. Then, the safety controller 140 needs to actively intervene, generate second control data based on the second sensing data, and control the vehicle control execution module 130 to perform safety actions according to the second control data, thereby ensuring the safety of the vehicle.

In order to understand the features and technical contents of the embodiments of the present disclosure in more detail, a specific application example is provided below for description. It can be understood that the following application examples are only for reference and do not limit the specific implementation process.

In an application example, as shown in FIG. 3 , the control system of an autonomous driving vehicle may include: an autonomous driving controller 310 , a vehicle controller 320 , a vehicle actuator 330 , a safety controller 340 , a safety power supply module 350 , and a first part of sensors 360 and the second part sensor 370. The first part of the vehicle controller 321 in the vehicle controller 320 is connected with the automatic driving controller 310 and the safety controller 340 ; the second part of the vehicle controller 322 in the vehicle controller 320 is connected with the safety controller 340 .

In this example, the first part of the vehicle controller 321 includes the second part of the vehicle controller 322, it is understood that in other examples, the first part of the vehicle controller 321 and the second part of the vehicle controller 322 may be independent of each other.

The first part of the vehicle controller 321 is connected to the first part of the vehicle actuators 331 of the vehicle actuators 330 , and the second part of the vehicle controller 322 is connected to the second part of the vehicle actuators 332 of the vehicle actuators 330 . In this example, the first part of the vehicle actuator 331 includes the second part of the vehicle actuator 332 , that is, the automatic driving controller 310 and the safety controller 340 are connected to the second part of the vehicle actuator 332 at the same time. It can be understood that, in other examples, the first part of the vehicle actuator 331 and the second part of the vehicle actuator 332 may also be independent of each other.

The first part of sensors 360 may include temperature sensors, gas concentration sensors, pressure sensors, rotation angle sensors, cameras, automotive radars, etc., and the second part of sensors 370 include cameras and automotive radars. As shown in FIG. 3 , the first part of the sensors 360 includes the second part of the sensors 370 , that is, the automatic driving controller 310 and the safety controller 340 are connected to the second part of the sensors 370 at the same time.

In the case that the safety controller 340 cannot communicate with the automatic driving controller 310, the safety controller 340, the second part of the sensor 370, the second part of the vehicle controller 322 and the second part of the actuator 332 are powered by the safety power supply module 350, So as to ensure the normal operation of each module. The safety controller 340 monitors the update status of the second part of the vehicle controller 322. If the update status is abnormal, it means that the automatic driving controller 310 cannot communicate with the second part of the vehicle controller 322, so the automatic driving controller 310 is faulty, that is, the vehicle's Autopilot function fails. On the contrary, if the update status is normal, it means that the automatic driving controller 310 communicates with the second part of the vehicle controller 322 normally, so the automatic driving controller 310 does not malfunction.

Under the condition that the safety controller 340 communicates with the automatic driving controller 310 normally, when the safety controller 340 receives the first part of the sensors 360 , the first part of the vehicle controller 321 , the first part of the vehicle actuator 331 and the above sent by the automatic driving controller 310 When the fault information of any module is displayed, it means that the automatic driving function of the vehicle is invalid.

After determining that the automatic driving function of the vehicle is invalid, the safety controller 340 may select to receive the second sensing data of the second part of the sensor 370 according to the current scene where the automatic driving vehicle is located, so as to sense the front and rear and lateral obstacles, according to the second sensing data The data calculates the target trajectory and the braking safety distance, thereby generating corresponding control commands to the second-part vehicle controller 322, so that the second-part vehicle controller 322 instructs the second-part actuator 332 to perform the braking action and the braking action according to the control commands. / or lane change obstacle avoidance action. Therefore, after the automatic driving function fails, the automatic driving vehicle can also realize the function of pulling over and parking by braking deceleration and changing lanes to avoid obstacles safely.

Further, as shown in FIG. 4 , the first part of the vehicle controller controlled by the automatic driving controller may include: a brake controller 411 , a steering controller 412 , a drive controller 413 , a body controller 414 , an air conditioner controller 415 , etc. The second part of the vehicle controller controlled by the safety controller includes: a brake controller 411 , a steering controller 412 , a drive controller 413 , and a body controller 414 .

As shown in Figure 4, the first part of the vehicle actuators controlled by the automatic driving controller includes: brake actuator 421, steering actuator 422, drive actuator 423, body actuator 424, air conditioner actuator 425, etc.; the safety controller controls The second part of the vehicle actuators includes: brake actuators 421 , steering actuators 422 , drive actuators 423 , and body actuators 424 . The part of the body actuator 424 controlled by the safety controller may be a turn signal and the like.

FIG. 5 is a schematic flowchart of a control method for an automatic driving vehicle according to an embodiment of the present disclosure. As shown in Figure 5, the method may include:

S501. Monitor the communication state from the first communication link; wherein, the first communication link is the communication link between the automatic driving controller and the vehicle control execution module, and the vehicle control execution module is used to receive the information from the automatic driving controller. first control data to control the vehicle according to the first control data, the first control data being generated by the automatic driving controller based on the first sensing data sent by the first part of the sensors in the vehicle;

S502. In the case where it is determined that the first communication link fails, generate second control data based on the second sensing data sent by the second part of the sensors in the vehicle; wherein the second control data is used by the vehicle control execution module to control the vehicle to execute the pre-control Set up safe actions.

Exemplarily, the above method is executed by a safety controller, such as the safety controller in the control system of the automatic driving vehicle provided in the foregoing embodiments. The safety controller will real-time the communication status of the first communication link (that is, between the automatic driving controller and the vehicle control execution module), then, in the case of failure of the first communication link, it indicates that the automatic driving controller is faulty or the vehicle control The execution module is faulty, and any of the above faults will cause the failure of the automatic driving function. At this time, the safety controller generates the second control data based on the second sensing data sent by the second part of the sensor, so as to control the vehicle according to the second control data. The execution module is controlled to cause the vehicle to perform predetermined safety actions.

In the technical solution of the present disclosure, when the first communication link fails, the automatic driving function of the vehicle fails. Therefore, the second control data is generated based on the second sensing data sent by the second part of the sensor, and then the second control data is generated according to the second sensor. The control data controls the vehicle control execution module to cause the vehicle to perform predetermined safety actions. It can be seen that even when the automatic driving function of the vehicle fails, the driving safety of the vehicle can be ensured, thereby ensuring the safety of the vehicle and surrounding people in an open road environment.

In one embodiment, the method further includes:

monitoring the communication state of the second communication link, which is the communication link between the safety controller and the automatic driving controller; and monitoring the first communication link when the failure of the second communication link is detected communication status of the road.

Exemplarily, the safety controller may communicate with the automatic driving controller by receiving the status information of the automatic driving controller in real time (ie, the second communication link), when the safety controller cannot receive the status information of the automatic driving controller. When updating the situation, it means that there may be a fault between the automatic driving controllers. In this way, it is necessary to monitor the update status of the data stored in the vehicle control execution module, and determine the relationship between the automatic driving controller and the vehicle through the update status of the data stored in the vehicle control execution module. Control whether the communication of the execution module is interrupted (ie, the first communication link), so as to accurately determine whether the automatic driving controller is faulty, so that the vehicle can be controlled more accurately.

In one embodiment, wherein monitoring the communication status of the first communication link includes:

Monitoring the communication status of the first communication link is achieved by monitoring the update status of the data stored by the vehicle control execution module; wherein the data stored by the vehicle control execution module includes at least part of the first control data.

Exemplarily, the vehicle control execution module may update the stored first control data in real time to ensure that the stored first control data is the latest data. In this way, it can be determined that the first communication link is interrupted, that is, the communication between the automatic driving controller and the vehicle control execution module fails, when the update state of the data stored in the vehicle control execution module is detected to be abnormal. Autopilot function fails. Conversely, when it is monitored that the update state of the data stored in the vehicle control execution module is normal, it can be determined that the first communication link is not interrupted, that is, the communication between the automatic driving controller and the vehicle control execution module is normal, and it is determined that the automatic The driving function is valid. It can be seen that the effectiveness of the automatic driving function can be accurately determined by the above method.

In one embodiment, the method further includes:

In the case that the failure of the second communication link is detected and the first communication link is normal, the first alarm information is sent.

Exemplarily, if the safety controller cannot receive the information of the automatic driving controller, it means that the automatic driving controller may be faulty, so the update status of the data stored in the vehicle control execution module is monitored. If the update status is normal, the autopilot controller is not faulty, but the communication link (ie, the second communication link) between the safety controller and the autopilot controller is faulty, so the first alarm information needs to be sent to the staff , to prompt the staff that the second communication link is faulty, so that the second communication link can be repaired in time, thereby ensuring the safety of vehicle driving.

In one embodiment, the method further includes:

monitoring the communication status of the third communication link, the third communication link including the communication link between the safety controller and the second part of the sensor and/or the communication link between the safety controller and the vehicle control execution module;

In the case that the failure of the third communication link is detected, the second alarm information is sent.

Exemplarily, since the safety controller communicates with the second part of the sensor and/or the vehicle control execution module in real time, if the information from the second part of the sensor and/or the vehicle control execution module cannot be received, it means that the safety controller communicates with the second part of the sensor and/or the vehicle control execution module. The communication between some sensors and/or the vehicle control execution module fails (that is, the third communication link fails), then, when the automatic driving function fails, the safety controller cannot control it in time. Therefore, it is necessary to send the first The second alarm information is used to remind the staff that the communication between the second part of the safety controller and/or the vehicle control execution module is invalid, so that maintenance can be carried out in time, thereby ensuring the safety of vehicle driving.

In one embodiment, the method further includes:

The monitoring vehicle control execution module controls the actions performed by the vehicle according to the first control data, and when it is determined that the action has a risk of collision, generates second control data based on the second perception data, and sends the second control data.

Exemplarily, the safety controller will monitor the vehicle control execution module in real time, and if it is detected that the action performed by the vehicle has a collision risk, such as insufficient steering angle during steering, insufficient braking distance during braking, etc. Then, the safety controller needs to actively intervene, generate second control data based on the second perception data, and control the vehicle control execution module to perform safety actions according to the second control data, thereby ensuring the safety of the vehicle.

FIG. 6 is a block diagram of a control apparatus of an autonomous driving vehicle according to an embodiment of the present disclosure. As shown in Figure 6, the apparatus may include:

The monitoring module 601 is used to monitor the communication state of the first communication link; wherein, the first communication link is the communication link between the automatic driving controller and the vehicle control execution module, and the vehicle control execution module is used for receiving data from the automatic driving the first control data of the controller to control the vehicle according to the first control data, the first control data being generated by the automatic driving controller based on the first sensing data sent by the first part of the sensors in the vehicle;

The control module 602 is configured to generate second control data based on the second sensing data sent by the second part of the sensors in the vehicle when it is determined that the first communication link fails; wherein the second control data is used for the vehicle control execution module Control the vehicle to perform preset safety actions.

In an embodiment, as shown in FIG. 6 , the monitoring module 601 is further configured to monitor the communication state of the second communication link, where the second communication link is the communication link with the automatic driving controller; In the case of monitoring that the second communication link fails, the communication state of the first communication link is monitored.

In one embodiment, as shown in FIG. 6 , the monitoring module 601 monitors the communication status of the first communication link by monitoring the update status of the data stored by the vehicle control execution module; wherein, the data stored by the vehicle control execution module At least part of the first control data is included.

FIG. 7 is a block diagram of a control apparatus of an autonomous driving vehicle according to an embodiment of the present disclosure. As shown in Figure 7, the apparatus may include:

The monitoring module 701 is used to monitor the communication state of the first communication link; wherein, the first communication link is the communication link between the automatic driving controller and the vehicle control execution module, and the data stored by the vehicle control execution module includes the first communication link. at least part of the control data, the first control data is generated by the automatic driving controller based on the first sensing data sent by the first part of the sensors in the vehicle;

A control module 702, configured to generate second control data based on the second sensing data sent by the second part of the sensors in the vehicle when it is determined that the first communication link fails; wherein the second control data is used for the vehicle control execution module Control the vehicle to perform preset safety actions.

The first alarm module 703 is configured to send the first alarm information when the failure of the second communication link is detected and the first communication link is normal.

In one embodiment, as shown in Figure 7, the device further includes:

The second alarm module 704 is used to monitor a third communication link, the third communication link includes the communication link between the safety controller and the second part of the sensor and/or the communication between the safety controller and the vehicle control execution module link; in the case of monitoring the failure of the third communication link, send the second alarm information.

In one embodiment, as shown in Figure 7, the device further includes:

The processing module 705 is used to monitor the actions performed by the vehicle control execution module to control the vehicle according to the first control data, and when it is determined that the action has a collision risk, generate second control data based on the second perception data, and send the second control data.

In this way, in the device according to the embodiment of the present disclosure, when the first communication link fails, the automatic driving function of the vehicle fails, so the second control data is generated based on the second sensing data sent by the second part of the sensor, and then the second control data is generated according to the first communication link. The second control data controls the vehicle control execution module, so that the vehicle executes the preset safety action. It can be seen that even when the automatic driving function of the vehicle fails, the driving safety of the vehicle can be ensured, thereby ensuring the safety of the vehicle and surrounding people in an open road environment.

In the technical solution of the present disclosure, the acquisition, storage and application of the user's personal information involved are all in compliance with the provisions of relevant laws and regulations, and do not violate public order and good customs.

According to embodiments of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium, and a computer program product. Optionally, the electronic device can be applied to a control system of an autonomous vehicle. That is, the present disclosure also provides a control system for an automatic driving vehicle, including the electronic device. The control system of the self-driving vehicle can also ensure the safety of the self-driving vehicle when the automatic driving function fails.

Optionally, either the control system of the autonomous vehicle or the control system of the autonomous vehicle can be applied to the autonomous vehicle. That is, the present disclosure also provides an autonomous driving vehicle. The self-driving vehicle can also ensure the safety of the self-driving vehicle even when the self-driving function fails.

FIG. 8 shows a schematic block diagram of an example electronic device 800 that may be used to implement embodiments of the present disclosure. Electronic devices are intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are by way of example only, and are not intended to limit implementations of the disclosure described and/or claimed herein.

As shown in FIG. 8 , the device 800 includes a computing unit 801 that can be executed according to a computer program stored in a read only memory (ROM) 802 or a computer program loaded from a storage unit 808 into a random access memory (RAM) 803 Various appropriate actions and handling. In the RAM 803, various programs and data necessary for the operation of the device 800 can also be stored. The computing unit 801 , the ROM 802 , and the RAM 803 are connected to each other through a bus 804 . An input/output (I/O) interface 805 is also connected to bus 804 .

Various components in the device 800 are connected to the I/O interface 805, including: an input unit 806, such as a keyboard, mouse, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a magnetic disk, an optical disk, etc. ; and a communication unit 809, such as a network card, a modem, a wireless communication transceiver, and the like. The communication unit 809 allows the device 800 to exchange information/data with other devices through a computer network such as the Internet and/or various telecommunication networks.

Computing unit 801 may be various general-purpose and/or special-purpose processing components with processing and computing capabilities. Some examples of computing units 801 include, but are not limited to, central processing units (CPUs), graphics processing units (GPUs), various specialized artificial intelligence (AI) computing chips, various computing units that run machine learning model algorithms, digital signal processing processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 801 executes the various methods and processes described above, such as a control method of an autonomous vehicle. For example, in some embodiments, a control method for an autonomous vehicle may be implemented as a computer software program tangibly embodied on a machine-readable medium, such as storage unit 808 . In some embodiments, part or all of the computer program may be loaded and/or installed on device 800 via ROM 802 and/or communication unit 809 . When the computer program is loaded into the RAM 803 and executed by the computing unit 801, one or more steps of the above-described control method for an autonomous vehicle may be performed. Alternatively, in other embodiments, the computing unit 801 may be configured to perform the control method of the autonomous vehicle by any other suitable means (eg, by means of firmware).

Various implementations of the systems and techniques described herein may be implemented in digital electronic circuitry, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chips System (SOC), Complex Programmable Logic Device (CPLD), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include being implemented in one or more computer programs executable and/or interpretable on a programmable system including at least one programmable processor that A processor, which may be a special-purpose or general-purpose programmable processor, may receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

Program code for implementing the methods of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general purpose computer, special purpose computer or other programmable data processing apparatus, such that the program code, when executed by the processor or controller, performs the functions/functions specified in the flowcharts and/or block diagrams. Action is implemented. The program code may execute entirely on the machine, partly on the machine, partly on the machine and partly on a remote machine as a stand-alone software package or entirely on the remote machine or server.

In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in connection with the instruction execution system, apparatus or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media may include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media would include one or more wire-based electrical connections, portable computer disks, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), fiber optics, compact disk read only memory (CD-ROM), optical storage, magnetic storage, or any suitable combination of the foregoing.

To provide interaction with a user, the systems and techniques described herein may be implemented on a computer having a display device (eg, a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user ); and a keyboard and pointing device (eg, a mouse or trackball) through which a user can provide input to the computer. Other kinds of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (eg, visual feedback, auditory feedback, or tactile feedback); and can be in any form (including acoustic input, voice input, or tactile input) to receive input from the user.

The systems and techniques described herein may be implemented on a computing system that includes back-end components (eg, as a data server), or a computing system that includes middleware components (eg, an application server), or a computing system that includes front-end components (eg, a user's computer having a graphical user interface or web browser through which a user may interact with implementations of the systems and techniques described herein), or including such backend components, middleware components, Or any combination of front-end components in a computing system. The components of the system may be interconnected by any form or medium of digital data communication (eg, a communication network). Examples of communication networks include: Local Area Networks (LANs), Wide Area Networks (WANs), and the Internet.

A computer system can include clients and servers. Clients and servers are generally remote from each other and usually interact through a communication network. The relationship of client and server arises by computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, a distributed system server, or a server combined with blockchain.

It should be understood that steps may be reordered, added or deleted using the various forms of flow shown above. For example, the steps described in the present disclosure can be executed in parallel, sequentially, or in different orders. As long as the desired results of the technical solutions disclosed in the present disclosure can be achieved, there is no limitation herein.

The above-mentioned specific embodiments do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modifications, equivalent replacements, and improvements made within the spirit and principles of the present disclosure should be included within the protection scope of the present disclosure.

Claims (22)

1. A control system for an autonomous vehicle, comprising: an automatic driving controller, configured to generate first control data based on first sensing data sent by a first part of sensors in the vehicle, and send the first control data; a vehicle control execution module, configured to receive the first control data, and control the vehicle according to the first control data; a safety controller for monitoring a communication state of a first communication link, where the first communication link is a communication link between the automatic driving controller and the vehicle control execution module; and after monitoring the When the first communication link fails, the second control data is generated based on the second sensing data sent by the second part of the sensors in the vehicle, and the second control data is sent; The vehicle control execution module controls the vehicle to execute preset safety actions. 2. The system of claim 1, further comprising: a safety power supply module for supplying power to the safety controller, the second part of the sensors and at least part of the travel controller in the vehicle control execution module; wherein the at least part of the travel controller is used to receive and store the At least part of the data for the ride controller. 3. The system of claim 1, wherein the vehicle control execution module is further configured to store at least part of the first control data; The safety controller monitors the communication state of the first communication link by monitoring the update state of the data stored in the vehicle control execution module. 4. The system according to any one of claims 1-3, wherein the safety controller is further configured to monitor the communication status of a second communication link, the second communication link being the safety controller a communication link with the autopilot controller; and monitoring the communication state of the first communication link in the event that the failure of the second communication link is detected. 5. The system of any of claims 1-4, wherein the safety controller is further configured to: Monitoring the action performed by the vehicle control execution module to control the vehicle according to the first control data, and in the case of determining that the action has a risk of collision, generate the second control data based on the second perception data, and send the result. the second control data. 6. A control method for an autonomous vehicle, comprising: Monitoring the communication state of the first communication link; wherein, the first communication link is a communication link between an automatic driving controller and a vehicle control execution module, and the vehicle control execution module is configured to receive data from the automatic driving first control data of the controller to control the vehicle according to the first control data, the first control data being generated by the automatic driving controller based on the first sensing data sent by the first part of the sensors in the vehicle; In the event that the first communication link is determined to fail, second control data is generated based on second sensing data sent by a second portion of sensors in the vehicle; wherein the second control data is used to control the vehicle The execution module controls the vehicle to execute preset safety actions. 7. The method of claim 6, the monitoring of the communication status of the first communication link, comprising: monitoring the communication status of a second communication link, the second communication link being the communication link between the safety controller and the automatic driving controller; and in the case of monitoring the failure of the second communication link , and monitor the communication status of the first communication link. 8. The method according to claim 6 or 7, wherein the monitoring of the communication state of the first communication link comprises: Monitoring the communication state of the first communication link is achieved by monitoring the update state of the data stored by the vehicle control execution module; wherein the data stored by the vehicle control execution module includes at least part of the first control data data. 9. The method of any one of claims 7-8, further comprising: In the case that the failure of the second communication link is detected and the first communication link is normal, first alarm information is sent. 10. The method of any one of claims 6-9, further comprising: Monitoring the communication status of a third communication link including the communication link between the safety controller and the second part of the sensor and/or the communication link between the safety controller and the vehicle control execution module communication link between In the case that the failure of the third communication link is detected, second alarm information is sent. 11. The method of any one of claims 6-10, further comprising: Monitoring the action performed by the vehicle control execution module to control the vehicle according to the first control data, and in the case of determining that the action has a risk of collision, generate the second control data based on the second perception data, and send the result. the second control data. 12. A control device for an autonomous vehicle, comprising: a monitoring module for monitoring the communication state of a first communication link; wherein, the first communication link is a communication link between an automatic driving controller and a vehicle control execution module, and the vehicle control execution module is used for receiving first control data from the autopilot controller to control the vehicle according to the first control data, the first control data being generated by the autopilot controller based on first perception data sent by a first portion of sensors in the vehicle ; a control module, configured to generate second control data based on second sensing data sent by a second part of sensors in the vehicle when it is determined that the first communication link fails; wherein the second control data is used The vehicle control execution module controls the vehicle to execute preset safety actions. 13. The device according to claim 12, wherein the monitoring module is further configured to monitor the communication state of a second communication link, wherein the second communication link is communication with the automatic driving controller and monitoring the communication state of the first communication link when the failure of the second communication link is detected. 14. The apparatus according to claim 12 or 13, wherein the monitoring module monitors the communication status of the first communication link by monitoring the update status of the data stored in the vehicle control execution module; wherein, the The data stored by the vehicle control execution module includes at least part of the first control data. 15. The apparatus of any of claims 12-14, further comprising: A first alarm module, configured to send first alarm information when it is detected that the second communication link fails and the first communication link is normal. 16. The apparatus of any of claims 12-15, further comprising: The second alarm module is used to monitor the communication status of the third communication link, the third communication link includes the communication link between the safety controller and the second part of the sensor and/or the safety controller and the The vehicle controls the communication link between the execution modules; and in the case of monitoring the failure of the third communication link, sending second alarm information. 17. The apparatus of any of claims 12-16, further comprising: a processing module, configured to monitor the actions performed by the vehicle control execution module to control the vehicle according to the first control data, and generate the second control based on the second perception data when it is determined that the action has a risk of collision data, and send the second control data. 18. An electronic device comprising: at least one processor; and a memory communicatively coupled to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the execution of any of claims 6-11 Methods. 19. A non-transitory computer readable storage medium storing computer instructions for causing the computer to perform the method of any of claims 6-11. 20. A computer program product comprising a computer program which, when executed by a processor, implements the method of any of claims 6-11. 21. A control system for an autonomous vehicle, comprising: the electronic device of claim 18. 22. An autonomous vehicle comprising: the system of any of claims 1-5 and 21.

Images