CN115892060A - Automatic driving fault handling method and automatic driving system - Google Patents

Abstract

The invention provides an automatic driving fault processing method and an automatic driving system, wherein the method comprises the following steps: receiving a vehicle control instruction and a first running state sent by a microprocessor; obtaining a first detection result according to the vehicle control instruction and the first running state by combining a first preset fault detection mechanism; and executing a corresponding fault processing method according to the first detection result. According to the invention, the fault detection is carried out on the microprocessor by combining the received vehicle control instruction and the first running state sent by the microprocessor and the first preset fault detection mechanism, so that whether the microprocessor breaks down or not is conveniently determined according to the corresponding fault processing method to control the vehicle to safely stop, and the safety and the reliability of automatic driving are improved.

Description

Automatic driving fault handling method and automatic driving system

technical field

The invention relates to the technical field of automatic driving, in particular to an automatic driving fault processing method and an automatic driving system.

Background technique

With the development of autonomous driving technology, safety, as an issue that cannot be ignored, has received more attention. For L3 and above-level self-driving cars, the automatic driving domain controller (ADCU) which contains a microprocessor (MPU) and a microcontroller (MCU) inside and control the body, chassis steering, chassis braking, etc. The vehicle actuator controller ASC has redundancy requirements to ensure higher functional safety levels, such as the highest level of automotive hazards (ASIL D). When the ADCU is running normally, the MPU module has strong computing power and is mainly responsible for the operation of algorithm modules such as vision, positioning, planning, sensor fusion and vehicle control. The MCU has real-time and high security and is mainly responsible for ASC control and MPU. Failure planning and vehicle control.

With the introduction of the backup system, the complexity of the system increases, and it is necessary to implement the synchronization strategy of the main system and the redundant system and handle exceptions. For example, when the driver activates automatic driving, the MPU cannot output vehicle control commands or Abnormal control commands (such as excessive steering and braking commands), at this time the MCU needs to detect the fault and control the vehicle to decelerate and stop according to the detection results, and at the same time notify the driver to take over in time; for another example, when the MCU on one side fails, The redundant side needs to take over the vehicle control immediately, otherwise, when a fault occurs, the driver cannot immediately realize and take over the vehicle, which is extremely dangerous.

Contents of the invention

The present invention provides an automatic driving fault processing method and an automatic driving system, which are used to solve the defect that the driver cannot take over the vehicle in time when the internal software and hardware of the automatic driving domain controller fail in the prior art, and realize the software and hardware in the automatic driving domain controller Safe deceleration and stopping in the event of a failure.

The present invention provides a method for processing automatic driving faults, including: receiving vehicle control instructions and a first operating state sent by a microprocessor; according to the vehicle control instructions and the first operating state, combined with first preset fault detection mechanism to obtain a first detection result; and execute a corresponding fault handling method according to the first detection result.

According to the automatic driving fault handling method provided by the present invention, according to the vehicle control instruction and the first running state, combined with the first preset fault detection mechanism, the first detection result is obtained, including: controlling the vehicle Instructing to perform validity detection to obtain a first validity detection result; to perform state detection on the first operating state to obtain a first operating state detection result; based on receiving the vehicle control instruction sent by the microprocessor and the first operating state , performing communication timeout detection to obtain a first communication timeout detection result; based on the received vehicle control command and the first running state, performing an end-to-end protection detection on the microprocessor to obtain a first end-to-end protection detection result; according to The first validity detection result, the first running state detection result, the first communication timeout detection result, and the first end-to-end protection detection result obtain a first detection result.

According to an automatic driving fault processing method provided by the present invention, according to the first detection result, executing the corresponding fault processing method includes: if the first detection result is failure or fault, shielding the message sent by the microprocessor vehicle control command and the first operating state, and perform perception and positioning to generate the first vehicle control request; send the first vehicle control request to the main vehicle execution controller to perform lane deceleration and parking, and generate a driving Takeover reminder to notify the driver to take over the vehicle.

According to an automatic driving fault handling method provided by the present invention, after sending the first vehicle control request to the main vehicle execution controller, it includes: receiving a response from the main vehicle execution controller based on the first vehicle control request The second operating state of the second operating state; the state detection is carried out on the second operating state to obtain the second operating state detection result; if the second operating state detection result is an operating failure, switch to the hot backup mode and request the main The vehicle executive controller exits the working mode and switches to the hot backup mode, and sends the detection result of the second running state to the redundant microcontroller for the redundant microcontroller and the redundant microcontroller The redundant whole-vehicle executive controller communicating with the controller is switched from the hot backup mode to the working mode.

According to a method for handling automatic driving faults provided by the present invention, the second operating state is that the main vehicle execution controller performs fault detection based on the first vehicle control request and the second preset fault detection mechanism, and according to The operating status of the main vehicle executive controller returned after the fault detection result confirms that there is no fault;

The performing fault detection based on the first vehicle control request and the second preset fault detection mechanism includes: performing communication timeout detection based on receiving the first vehicle control request; performing terminal End-to-end protection detection.

According to the automatic driving failure processing method provided by the present invention, it also includes: sending a second heartbeat signal to the redundant microcontroller, or sending the second heartbeat signal to the redundant microcontroller and displaying it as failure or failure The second running state detection result, for the redundant microcontroller to determine whether to switch from the hot backup mode to the working mode according to the second heartbeat signal and the result of the fault detection by the third preset fault detection mechanism, and whether Sensing and positioning are performed to generate a second vehicle control request and send the second vehicle control request to a redundant vehicle executive controller.

According to the automatic driving failure processing method provided by the present invention, it also includes: receiving the first heartbeat signal sent by the redundant microcontroller, or receiving the first heartbeat signal sent by the redundant microcontroller and the first heartbeat signal displayed as failure or failure 3. Running state detection result, the third running state detection result is obtained by the redundant micro-controller performing state detection according to the third running state sent by the redundant vehicle executive controller; according to the first heartbeat signal, And combined with the fourth preset fault detection mechanism, a second detection result is obtained; based on the second detection result being failure or failure, it is determined that the redundant microcontroller is failure; based on the third operating state detection shown as failure or failure As a result, it is determined that the redundant vehicle executive controller fails.

The present invention also provides an automatic driving fault processing device, including: a data receiving module, receiving the vehicle control command and the first running state sent by the microprocessor; a fault detection module, according to the vehicle control command and the first running state , combined with the first preset fault detection mechanism to obtain a first detection result; the fault processing module executes a corresponding fault processing method according to the first detection result.

The present invention also provides an automatic driving system, applying the automatic driving fault processing method described above, including a microprocessor and a main microcontroller, wherein: the microprocessor sends vehicle control to the main microcontroller instruction and the first operating state; the main microcontroller obtains the first detection result according to the received vehicle control instruction and the first operating state, combined with the first preset fault detection mechanism; the main microcontroller obtains the first detection result according to the For the first detection result, execute the corresponding fault handling method.

The present invention also provides an electronic device, including a memory, a processor, and a computer program stored on the memory and operable on the processor. When the processor executes the program, the automatic driving failure described in any of the above-mentioned ones can be realized. The steps of the processing method.

The present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of any one of the automatic driving fault handling methods described above are realized.

The present invention also provides a computer program product, including a computer program. When the computer program is executed by a processor, the steps of any one of the automatic driving fault handling methods described above are realized.

The automatic driving fault processing method and the automatic driving system provided by the present invention, through receiving the vehicle control command and the first running state sent by the microprocessor, combined with the first preset fault detection mechanism, the fault detection is performed on the microprocessor, so as to facilitate According to whether the microprocessor fails, determine the corresponding fault handling method to control the safe parking of the vehicle, which improves the safety and reliability of automatic driving; in addition, combined with the first preset fault detection mechanism, the fault detection of the microprocessor can be In the event of hardware and software failure, ensure that the vehicle can safely decelerate and stop, thereby effectively ensuring driving safety.

Description of drawings

In order to more clearly illustrate the present invention or the technical solutions in the prior art, the accompanying drawings that need to be used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings in the following description are the present invention. For some embodiments of the invention, those skilled in the art can also obtain other drawings based on these drawings without creative effort.

Fig. 1 is a schematic flow chart of the automatic driving fault processing method provided by the present invention;

Fig. 2 is a structural schematic diagram of an automatic driving fault processing device provided by the present invention;

Fig. 3 is a schematic structural diagram of an automatic driving system provided by the present invention;

Fig. 4 is a schematic structural diagram of an electronic device provided by the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present invention clearer, the technical solutions in the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the present invention. Obviously, the described embodiments are part of the embodiments of the present invention , but not all examples. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

Fig. 1 shows a schematic flow chart of an automatic driving fault handling method of the present invention, the method comprising:

S11. Receive the vehicle control instruction and the first running state sent by the microprocessor.

S12. Obtain a first detection result according to the vehicle control instruction and the first running state, combined with a first preset fault detection mechanism.

S13. Execute a corresponding fault handling method according to the first detection result.

It should be noted that the S1N in this specification does not represent the order of the automatic driving fault handling methods, and the automatic driving fault handling method of the present invention will be described in detail below.

Step S11, receiving the vehicle control command and the first running state sent by the microprocessor.

It should be noted that the execution subject of this method is the main microcontroller (MCU-A), and the main microcontroller (MCU-A) receives the vehicle control instruction and the first running state sent by the microprocessor (MPU), and the first The running state is the running state of the MPU itself.

Step S12, according to the vehicle control command and the first running state, combined with the first preset fault detection mechanism, the first detection result is obtained.

In this embodiment, according to the vehicle control command and the first running state, combined with the first preset fault detection mechanism, the first detection result is obtained, including: performing a validity detection on the vehicle control command to obtain the first validity detection result ; Perform state detection on the first operating state to obtain the first operating state detection result; based on receiving the vehicle control command and the first operating state sent by the microprocessor, perform communication timeout detection to obtain the first communication timeout detection result; based on the received Carry out end-to-end protection detection on the microprocessor to obtain the first end-to-end protection detection result based on the vehicle control command and the first running state; according to the first validity detection result, the first running state detection result, and the first communication timeout detection The result and the first end-to-end protection detection result are used to obtain the first detection result. It should be noted that the MCU-A performs fault detection on the MPU to determine whether the MPU is faulty, so as to facilitate subsequent determination of a corresponding fault handling method according to the fault detection result. in particular:

The validity detection of the vehicle control command includes: checking the range according to the vehicle control command, and if the vehicle control command does not meet the preset range, it is considered invalid. For example, if the preset range is that the maximum deceleration is not greater than 4m/s ² , then the maximum deceleration requested in the vehicle control command cannot be greater than 4m/s ² , otherwise the vehicle control command is an invalid command.

The state detection of the first operating state includes: detecting whether the first operating state is normal, thereby judging whether the microprocessor is operating normally.

Based on receiving the vehicle control command and the first running state sent by the microprocessor, performing communication overtime detection, including: receiving the vehicle control command and the first running state sent by the microprocessor based on a preset communication cycle; detecting the received vehicle control command and whether the number of times of the first running state matches the number of cycles of the preset communication cycle.

What needs to be added is that the preset communication cycle can be set according to actual communication requirements, and is not further limited here. For example, 10 milliseconds is used as a cycle, and the MPU sends a vehicle control command and the first running state to the MCU-A once; in addition, the preset The threshold can be set according to the actual detection requirements. For example, if the preset threshold is 5, then correspondingly every 5 cycles, it is detected whether the number of receiving corresponding data is 5 times.

In addition, based on the received vehicle control command and the first running state, performing end-to-end (End-to-End, E2E) protection detection on the microprocessor, including: based on the received vehicle control command and the first running state, using E2E algorithm for E2E protection detection. It should be noted that the E2E algorithm can be an existing algorithm, such as the CRC16 algorithm to ensure data consistency, the Rolling counter algorithm to ensure real-time data, etc., or an algorithm designed for E2E protection detection based on specific requirements.

For example, when the CRC16 algorithm is used, based on the received vehicle control command and the first running state, the E2E algorithm is used to perform E2E protection detection, including: receiving the vehicle control command and the first running state, wherein the vehicle control command and the first running state A CRC control field is pre-added in the first running state; evaluating the vehicle control instruction and the CRC control field in the first running state, and calculating the CRC control field; judging whether the calculation result conforms to the preset receiving content.

When the Rolling counter algorithm is used, based on the received vehicle control command and the first running state, the E2E algorithm is used to perform E2E protection detection, including: receiving the vehicle control command and the first running state, wherein the vehicle control command and the first running state The Rolling counter field is added in advance; diagnose based on the increase in the Rolling counter field. It should be noted that before receiving the vehicle control command and the first running state sent by the microprocessor, the microprocessor adds a Rolling counter field to the vehicle control command and the first running state to be sent, and counts according to the preset counting rule ; In addition, the default counting rule is that the counter increases by the preset value every time it is executed, and is cleared to zero after reaching the preset maximum value. The preset setting can be set according to the actual setting requirements. For example, when it is 1, the corresponding counter corresponds to each count value according to 0->1->2->3->...->14->15->0- >1->... and so on.

Obtaining the first detection result includes: based on at least one of the first validity detection result, the first running state detection result, the first communication timeout detection result and the first end-to-end protection detection result being failure or failure, then the first detection The result is failure or failure; based on the first validity detection result, the first running state detection result, the first communication timeout detection result and the first end-to-end protection detection result are all valid or normal, then the first detection result is valid or normal.

In an optional embodiment, when the MPU sends the vehicle control instruction and the first operating state to the MCU-A, it also includes: sending the vehicle control instruction and the first operating state to the redundant microcontroller (MCU-B) , to use the MCU-B to detect the fault of the MPU according to the received vehicle control command and the first running state. The specific way to detect the fault of the MPU can refer to the main micro-controller according to the vehicle control command and the first running state, combined with The first default fault detection mechanism and the manner of obtaining the first detection result are not further limited here.

Step S13, according to the first detection result, execute a corresponding fault handling method.

In this embodiment, according to the first detection result, the corresponding fault processing method is executed, including: if the first detection result is a failure or fault, shielding the vehicle control command and the first operating state sent by the microprocessor, and performing perception and Position to generate the first vehicle control request; send the first vehicle control request to the main vehicle executive controller (ASC-A) for in-lane deceleration and parking, and generate a driver takeover reminder to notify the driver to proceed with the vehicle take over. It should be noted that at this time, MCU-A and ASC-A are in the working mode, and the hot backup mode is the backup mode when the system is in normal operation. In addition, perception and positioning can be realized by activating its internal perception module and positioning module.

In an optional embodiment, according to the first detection result, executing the corresponding fault handling method also includes: if the first detection result is valid or normal, it indicates that the MPU is running normally without failure, and then the MCU-A, ASC -A, ASC-B and redundant vehicle executive controller (ASC-B) perform fault detection, so as to determine the corresponding fault handling method.

Specifically, using the main micro-controller to detect the failure of the main vehicle executive controller, that is, after sending the first vehicle control request to the main vehicle executive controller, including: receiving the main vehicle executive controller based on the first vehicle The second operating state returned by the control request; the operating state is detected based on the second operating state, and combined with the second preset fault detection mechanism, the second detection result is obtained; if the second detection result is abnormal operation or failure, switch to hot Backup mode, and request the main vehicle executive controller to exit the working mode and switch to the hot backup mode, and send the second running state detection result to the redundant microcontroller, so that the redundant microcontroller and the redundant microcontroller The redundant vehicle execution controller of the controller communication is switched from the hot backup mode to the working mode, thereby decelerating the vehicle, and generating a driver takeover reminder to notify the driver to take over the vehicle.

What needs to be added is that if the detection result of the second operating state is normal operation, the microprocessor, the main microcontroller and the main trailer executive controller all maintain the same working mode, and the redundant microcontroller and the redundant vehicle executive control All devices remain in hot backup mode.

In addition, in the second operating state, the main vehicle execution controller performs fault detection based on the first vehicle control request and the second preset fault detection mechanism, and returns to the operation of the main vehicle execution controller after determining that there is no fault according to the fault detection result state. In other words, after the main vehicle execution controller receives the first vehicle control request, based on the second preset fault detection mechanism, it detects the fault of the main micro-controller, and based on the result of the fault detection that there is no fault, it changes its own running state ( That is, the second operating state) is sent to the main microcontroller.

Specifically, performing fault detection based on the first vehicle control request in combination with a second preset fault detection mechanism includes: performing communication timeout detection based on receiving the first vehicle control request to obtain a second communication timeout detection result; according to the first vehicle Control the request, perform end-to-end protection detection, and obtain a second end-to-end protection detection result. It should be noted that the process of obtaining the second communication timeout detection result and obtaining the second end-to-end protection detection result can refer to the above, obtain the first communication timeout detection result and obtain the first end-to-end protection detection result, which will not be repeated here elaborate.

In an optional embodiment, using the main microcontroller to detect the fault of the redundant microcontroller includes: receiving the first heartbeat signal sent by the redundant microcontroller, or receiving the first heartbeat signal sent by the redundant microcontroller The signal and the third operating state detection result displayed as failure or failure, the third operating state detection result is obtained by the redundant microcontroller according to the third operating state sent by the redundant vehicle execution controller; according to the first The heartbeat signal, combined with the fourth preset failure detection mechanism, obtains a second detection result; based on the second detection result being failure or failure, it is determined that the redundant microcontroller fails; based on the third operating state detection result displayed as failure or failure , it is determined that the redundant vehicle executive controller fails.

It should be noted that since the redundant microcontroller is in the hot backup mode, not in the working mode, and there is no urgent safety risk, the corresponding main microcontroller and the main vehicle executive controller can be maintained normally according to the fault handling process. In the working mode, the redundant microcontroller maintains the hot backup mode. When the main microcontroller receives the first heartbeat signal sent by the redundant microcontroller, the redundant vehicle execution controller is also in the hot backup mode; when the main microcontroller receives the redundant microcontroller When the first heartbeat signal sent by the microcontroller and the detection result of the third running state indicated failure or failure, the corresponding redundant vehicle executive controller fails.

In this embodiment, according to the first heartbeat signal, combined with the fourth preset fault detection mechanism, the second detection result is obtained, including: performing heartbeat signal detection on the first heartbeat signal to determine whether the heartbeat signal is lost within the target time period ; Perform communication timeout detection based on receiving the first heartbeat signal. It should be noted that the detection of the first heartbeat signal includes: receiving the first heartbeat signal sent by the redundant microcontroller based on the preset cycle; Whether the heartbeat signal is lost within the target time period.

It should be noted that the communication timeout detection based on receiving the first heartbeat signal can refer to the communication timeout detection based on receiving the vehicle control command and the first running state sent by the microprocessor above, which will not be repeated here. In addition, the third operating state is the own operating state returned by the redundant vehicle execution controller according to the second vehicle control request sent by the redundant microcontroller. For details, please refer to the following, which will not be repeated here.

In an optional embodiment, using the redundant microcontroller to detect the failure of the main microcontroller includes: sending a second heartbeat signal to the redundant microcontroller, or sending a second heartbeat signal and A second operating state detection result displayed as a failure or fault, for the redundant microcontroller to determine whether to switch from the hot backup mode to the working mode according to the second heartbeat signal and the result of the fault detection by the third preset fault detection mechanism, and Whether to perform sensing and positioning to generate a second vehicle control request and send the second vehicle control request to the redundant vehicle execution controller.

Specifically, the main microcontroller sends a second heartbeat signal to the redundant microcontroller, or sends a second heartbeat signal and a second operating status detection result indicating failure or failure to the redundant microcontroller; the redundant microcontroller The device receives a second heartbeat signal, or receives a second heartbeat signal and a second operating state detection result indicating failure or failure.

In a possible implementation, the redundant microcontroller receives the second heartbeat signal. At this time, the main vehicle executive controller is in a fault-free state, then according to the second heartbeat signal and combined with the third preset fault detection mechanism, The third detection result is obtained; based on the third detection result being failure or failure, it is determined that the main microcontroller is invalid, and the failure of the main microcontroller also means that the main microcontroller cannot operate normally and outputs the controller to execute the control of the main vehicle. Therefore It is necessary to adjust the main vehicle executive controller from working mode to hot backup mode.

In addition, the redundant microcontroller switches from the hot backup mode to the working mode, senses and locates to generate a second vehicle control request and sends the second vehicle control request to the redundant vehicle executive controller, so as to utilize the redundant microcontroller The controller detects the failure of the redundant vehicle executive controller; the main microcontroller controls the power supply to the microprocessor through a hard-wired connection. If the main microcontroller fails, it is a common cause failure, that is, the main microcontroller Failure of the controller causes the microprocessor to fail at the same time. It should be noted that the fault detection of the redundant vehicle executive controller by using the redundant microcontroller can refer to the fault detection of the ASC-A by the MCU-A described above, and no further description is given here.

In another possible implementation manner, the redundant microcontroller receives the second heartbeat signal and the second operating state detection result displayed as failure or failure. At this time, because the second operating state detection result indicates failure or failure, If the corresponding main vehicle executive controller fails, the third detection result is obtained according to the second heartbeat signal combined with the third preset fault detection mechanism; When the failure or failure of the third detection result mentioned above can be referred to, the fault handling method when the main micro-controller fails is determined, which will not be repeated here; if the third detection result is normal, the above-mentioned Use MCU-A to perform fault detection on ASC-A and the corresponding fault handling methods, which will not be described here.

To sum up, the embodiment of the present invention detects the fault of the microprocessor by receiving the vehicle control instruction and the first running state sent by the microprocessor, in combination with the first preset fault detection mechanism, so as to detect the fault according to whether the microprocessor When a fault occurs, determine the corresponding fault handling method to control the safe parking of the vehicle, which improves the safety and reliability of automatic driving; in addition, combined with the first preset fault detection mechanism, the fault detection of the microprocessor can prevent the failure of the software and hardware. Under certain circumstances, ensure that the vehicle can safely decelerate and stop, so as to effectively ensure driving safety.

The automatic driving fault processing device provided by the present invention is described below, and the automatic driving fault processing device described below and the automatic driving fault processing method described above can be referred to in correspondence.

Fig. 2 shows a schematic structural diagram of an automatic driving fault processing device of the present invention, which device includes:

The data receiving module 21 receives the vehicle control instruction and the first running state sent by the microprocessor;

The fault detection module 22 obtains a first detection result according to the vehicle control instruction and the first running state, combined with the first preset fault detection mechanism;

The fault processing module 23 executes a corresponding fault processing method according to the first detection result.

In this embodiment, the fault detection module 22 includes: a command detection unit, which detects the validity of the vehicle control command, and obtains the first validity detection result; a state detection unit, which detects the state of the first operating state, and obtains the first Running state detection results; the first communication timeout detection unit, based on receiving the vehicle control command and the first running state sent by the microprocessor, performs communication timeout detection, and obtains the first communication timeout detection result; the end-to-end protection detection unit, based on receiving Carry out end-to-end protection detection on the microprocessor to obtain the first end-to-end protection detection result; the result acquisition unit, according to the first validity detection result, the first operation state detection result, The first communication timeout detection result and the first end-to-end protection detection result are used to obtain the first detection result. It should be noted that the MCU-A performs fault detection on the MPU to determine whether the MPU is faulty, so as to facilitate subsequent determination of a corresponding fault handling method according to the fault detection result.

Furthermore, the command detection unit includes: a range checking subunit, which performs a range check according to the vehicle control command, and considers it invalid if the vehicle control command does not meet the preset range. For example, if the preset range is that the maximum deceleration is not greater than 4m/s ² , then the maximum deceleration requested in the vehicle control command cannot be greater than 4m/s ² , otherwise the vehicle control command is an invalid command. .

The state detection unit includes: a state detection subunit, which detects whether the first operating state is normal, thereby judging whether the microprocessor operates normally.

The first communication overtime detection unit includes: a data receiving subunit, based on a preset communication cycle, receiving the vehicle control instruction and the first operating state sent by the microprocessor; detecting whether the received vehicle control instruction and the number of times of the first operating state conform to The number of cycles of the preset communication cycle.

The end-to-end protection detection unit uses the E2E algorithm to perform E2E protection detection based on the received vehicle control command and the first running state. It should be noted that the E2E algorithm can be an existing algorithm, such as the CRC16 algorithm to ensure data consistency, the Rolling counter algorithm to ensure real-time data, etc., or an algorithm designed for E2E protection detection based on specific requirements.

For example, when the CRC16 algorithm is used, the instruction detection unit includes: a data receiving subunit, which receives the vehicle control instruction and the first operating state, wherein the CRC control field is pre-added in the vehicle control instruction and the first operating state; The calculation subunit evaluates the vehicle control instruction and the CRC control field in the first running state, and calculates the CRC control field; the judgment subunit judges whether the calculation result conforms to the preset received content.

When the Rolling counter algorithm is adopted, the command detection unit includes: a data receiving subunit, which receives the vehicle control command and the first running state, wherein the Rollingcounter field is pre-added in the vehicle control command and the first running state; the diagnosis subunit, based on The increase in the Rolling counter field is used for diagnosis.

The result acquisition unit, including: a first result acquisition subunit, based on at least one of the first validity detection result, the first running state detection result, the first communication timeout detection result and the first end-to-end protection detection result being a failure or failure , then the first detection result is failure or failure; the second result acquisition subunit is based on the first validity detection result, the first running state detection result, the first communication timeout detection result and the first end-to-end protection detection result being valid or normal, the first detection result is valid or normal.

Correspondingly, the failure processing module 23 includes: a shielding unit, if the first detection result is a failure or failure, then shielding the vehicle control command and the first running state sent by the microprocessor; the first request generating unit for sensing and positioning to Generate the first vehicle control request; the first request sending unit sends the first vehicle control request to the main vehicle executive controller (ASC-A) for deceleration and parking in the lane, and generates a driver takeover reminder to notify The driver takes over the vehicle.

In an optional embodiment, after the first request sending unit sends the first vehicle control request to the main vehicle execution controller, the main microcontroller is used to perform fault detection on the main vehicle execution controller, that is, the fault detection module , further comprising: a second state receiving unit, which receives the second running state returned by the main vehicle executive controller based on the first vehicle control request; a first detection unit, which detects the running state based on the second running state, and combines the second predetermined A fault detection mechanism is set up to obtain a second detection result.

Correspondingly, the failure processing module 23 includes: a mode switching unit, which switches to the hot backup mode based on the second detection result of abnormal operation or failure, and requests the main vehicle executive controller to exit the working mode and switch to the hot backup mode; The state sending unit sends the second operating state detection result to the redundant microcontroller, so that the redundant microcontroller and the redundant vehicle execution controller communicating with the redundant microcontroller can switch from the hot backup mode to the working mode , so as to decelerate the vehicle and generate a driver takeover reminder to notify the driver to take over the vehicle.

The first detection unit includes: a communication timeout detection subunit, which performs communication timeout detection based on receiving the first vehicle control request, and obtains a second communication timeout detection result; an end-to-end protection detection subunit, according to the first vehicle control request, performs The end-to-end protection detection is performed to obtain a second end-to-end protection detection result.

In an optional embodiment, the fault detection module 22 is also used for fault detection of the redundant microcontroller, specifically including: a data receiving unit, receiving the first heartbeat signal sent by the redundant microcontroller, or receiving the redundant microcontroller The first heartbeat signal sent by the microcontroller and the detection result of the third operating state indicated as failure or failure, the third operating state detection result is the redundant microcontroller according to the third operating state sent by the redundant vehicle executive controller Obtained by state detection; the second detection unit, according to the first heartbeat signal, combined with the fourth preset fault detection mechanism, obtains the second detection result; the fault determination unit determines that the redundant micro The controller is invalid; based on the detection result of the third operating state indicated as failure or failure, it is determined that the redundant vehicle executive controller is invalid.

Further, the second detection unit includes: a signal detection subunit, which performs heartbeat signal detection on the first heartbeat signal to determine whether the heartbeat signal is lost in the target time period; the second communication timeout detection unit, based on receiving the first heartbeat signal, Perform communication timeout detection. It should be noted that the signal detection subunit includes: the signal receiving grandson unit, based on the preset cycle, receiving the first heartbeat signal sent by the redundant microcontroller; the judging grandchildren unit, judging whether the number of received heartbeat signals conforms to the preset cycle Quantity, so as to determine whether the heartbeat signal is lost within the target time period.

In an optional embodiment, in order to facilitate the fault detection of the main microcontroller by the redundant microcontroller, the device further includes: a data sending device, which sends a second heartbeat signal to the redundant microcontroller, or sends a second heartbeat signal to the redundant microcontroller. The controller sends the second heartbeat signal and the second operating state detection result displayed as failure or failure, so that the redundant microcontroller can determine whether the thermal The backup mode is switched to the working mode, and whether sensing and positioning are performed to generate a second vehicle control request and send the second vehicle control request to the redundant vehicle execution controller.

In a possible implementation, the redundant microcontroller receives the second heartbeat signal. At this time, the main vehicle executive controller is in a fault-free state, then according to the second heartbeat signal and combined with the third preset fault detection mechanism, The third detection result is obtained; based on the third detection result being failure or failure, it is determined that the main microcontroller is invalid, and the failure of the main microcontroller also means that the main microcontroller cannot operate normally and outputs the controller to execute the control of the main vehicle. Therefore It is necessary to adjust the main vehicle executive controller from working mode to hot backup mode.

In addition, the redundant microcontroller switches from the hot backup mode to the working mode, senses and locates to generate a second vehicle control request and sends the second vehicle control request to the redundant vehicle executive controller, so as to utilize the redundant microcontroller The controller detects the failure of the redundant vehicle executive controller; the main microcontroller controls the power supply to the microprocessor through a hard-wired connection. If the main microcontroller fails, it is a common cause failure, that is, the main microcontroller Failure of the controller causes the microprocessor to fail at the same time. It should be noted that the fault detection of the redundant vehicle executive controller by using the redundant microcontroller can refer to the fault detection of the ASC-A by the MCU-A described above, and no further description is given here.

In another possible implementation manner, the redundant microcontroller receives the second heartbeat signal and the second operating state detection result displayed as failure or failure. At this time, because the second operating state detection result indicates failure or failure, If the corresponding main vehicle executive controller fails, the third detection result is obtained according to the second heartbeat signal combined with the third preset fault detection mechanism; When the failure or failure of the third detection result mentioned above can be referred to, the fault handling method when the main micro-controller fails is determined, which will not be repeated here; if the third detection result is normal, the above-mentioned Use MCU-A to perform fault detection on ASC-A and the corresponding fault handling methods, which will not be described here.

To sum up, the embodiment of the present invention uses the fault detection module to detect the fault of the microprocessor according to the vehicle control instruction and the first running state received by the microprocessor received by the data receiving module, combined with the first preset fault detection mechanism, In order to facilitate the fault processing module to determine the corresponding fault processing method to control the safe parking of the vehicle according to whether the microprocessor is faulty or not, the safety and reliability of automatic driving are improved; in addition, combined with the first preset fault detection mechanism, the micro The processor performs fault detection, which can ensure that the vehicle can safely decelerate and stop in the event of hardware and software failure, thereby effectively ensuring driving safety.

The present invention also provides an automatic driving system, which uses the automatic driving fault processing method as described above, including a microprocessor and a main microcontroller, wherein: the microprocessor (MPU) sends a message to the main microcontroller (MCU-A) ) sends the vehicle control command and the first running state; the main microcontroller (MCU-A) obtains the first detection result according to the received vehicle control command and the first running state, combined with the first preset fault detection mechanism; the main microcontroller The controller (MCU-A) executes a corresponding fault handling method according to the first detection result.

Referring to Fig. 3, in an optional embodiment, the automatic driving system also includes a redundant microcontroller (MCU-B), and when the MPU sends the vehicle control command and the first operating state to the MCU-A, it also includes : The MPU sends the vehicle control command and the first running state to the MCU-B, so as to use the MCU-B to detect the fault of the MPU according to the received vehicle control command and the first running state. For the specific fault detection method of the MPU, please refer to The manner in which the main microcontroller obtains the first detection result according to the vehicle control instruction and the first operating state in combination with the first preset fault detection mechanism will not be further limited here.

In a possible implementation, the automatic driving system also includes: the main vehicle executive controller (ASC-A), if the first detection result is a failure or fault, the MCU-A shields the vehicle control system sent by the microprocessor command and the first operating state, and perform perception and positioning to generate the first vehicle control request; MCU-A sends the first vehicle control request to ASC-A for deceleration and parking in the lane, and generates a driver takeover reminder, To notify the driver to take over the vehicle.

If the first detection result is valid or normal, it indicates that the MPU is operating normally without failure, and the automatic driving system also needs to execute the controller for MCU-A, ASC-A, ASC-B and redundant vehicle (ASC-B) Carry out fault detection in order to determine the corresponding fault handling method.

Specifically, using MCU-A to perform fault detection on ASC-A, that is, after MCU-A sends the first vehicle control request to ASC-A, includes: MCU-A receiving the information returned by ASC-A based on the first vehicle control request The second operating state: MCU-A performs operating state detection based on the second operating state, and combines the second preset fault detection mechanism to obtain the second detection result; if the second detection result is abnormal operation or failure, MCU-A switches It is a hot backup mode, and requests ASC-A to exit the working mode and switch to a hot backup mode, and send the second running state detection result to MCU-B, so that MCU-B and ASC-B communicating with MCU-B are controlled by The hot backup mode is switched to the working mode, thereby decelerating the vehicle, and generating a driver takeover reminder to notify the driver to take over the vehicle.

In addition, after receiving the first vehicle control request, ASC-A performs fault detection on the main microcontroller MCU-A based on the second preset fault detection mechanism, and based on the fault detection result being no fault, changes its own operating state ( That is, the second running state) is sent to MCU-A.

In an optional embodiment, using MCU-A to perform fault detection on MCU-B includes: MCU-A receiving the first heartbeat signal sent by MCU-B, or MCU-A receiving the first heartbeat signal sent by MCU-B and the third operating state detection result displayed as failure or failure, the third operating state detection result is obtained by MCU-B according to the third operating state sent by ASC-B; MCU-A according to the first heartbeat signal, and Combined with the fourth preset fault detection mechanism, the second detection result is obtained; MCU-A determines that MCU-B is invalid based on the second detection result as failure or failure; MCU-A is based on the third operating state detection result shown as failure or failure , to determine that ASC-B is invalid.

It should be noted that since MCU-B is in the hot backup mode, not in the working mode, and there is no urgent safety risk, the corresponding MCU-A and ASC-A can remain in the working mode according to the normal fault handling process, and MCU-B Maintain hot backup mode, when MCU-A receives the first heartbeat signal sent by MCU-B, ASC-B is also in hot backup mode; when MCU-A receives the first heartbeat signal sent by MCU-B and displays as failure or failure When the detection result of the third operating state of the corresponding ASC-B fails.

In an optional embodiment, using MCU-B to perform fault detection on MCU-A includes: MCU-A sends a second heartbeat signal to MCU-B, or MCU-A sends a second heartbeat signal to MCU-B and displays It is the second operating state detection result of failure or fault, for MCU-B to determine whether to switch from hot backup mode to working mode according to the result of fault detection by the second heartbeat signal and the third preset fault detection mechanism, and whether to sense and positioned to generate a second vehicle control request and send the second vehicle control request to the ASC-B.

In a possible implementation, MCU-B receives the second heartbeat signal, and at this time, ASC-A is in a fault-free state, then MCU-B obtains the second heartbeat signal in combination with the third preset fault detection mechanism. Three detection results; MCU-B determines that MCU-A is invalid based on the third detection result. The failure of MCU-A also means that MCU-A cannot operate normally and outputs control to ASC-A, so ASC-A needs to be Adjust from working mode to hot backup mode.

In addition, MCU-B switches from hot backup mode to working mode, and senses and locates to generate a second vehicle control request and sends the second vehicle control request to ASC-A to troubleshoot ASC-B with MCU-B Detection; MCU-A controls the power supply to the MPU through a hard-wired connection, and in the case of MCU-A failure, it is a common cause failure at this time, that is, the MCU-A failure causes the MPU to also fail at the same time. It should be noted that the fault detection of ASC-B by using MCU-A may refer to the fault detection of ASC-A by using MCU-A described above, and no further description will be made here.

In another possible implementation, the MCU-B receives the second heartbeat signal and the second operating state detection result indicated as failure or failure. At this time, since the second operating state detection result indicates failure or failure, the corresponding If ASC-A fails, the third detection result is obtained according to the second heartbeat signal combined with the third preset fault detection mechanism; if the third detection result is failure or failure, it is determined that MCU-A is invalid. At this time, refer to the above Described the 3rd detection result is invalidation or fault, and the fault handling mode when determining MCU-A failure, does not go into details here; If the 3rd detection result is normal, then can utilize MCU-A to ASC- A performs fault detection and corresponding fault handling methods, which will not be described here.

Fig. 4 illustrates the schematic diagram of the entity structure of a kind of electronic equipment, as shown in Fig. 4, this electronic equipment can comprise: processor (processor) 41, communication interface (Communications Interface) 42, memory (memory) 43 and communication bus 44, Wherein, the processor 41 , the communication interface 42 , and the memory 43 communicate with each other through the communication bus 44 . The processor 41 can call the logic instruction in the memory 43 to execute the automatic driving fault processing method, the method includes: receiving the vehicle control instruction and the first operating state sent by the microprocessor; according to the vehicle control instruction and the first operating state, and Combined with the first preset fault detection mechanism, a first detection result is obtained; according to the first detection result, a corresponding fault handling method is executed.

In addition, the logic instructions in the above-mentioned memory 43 may be implemented in the form of software function units and when sold or used as an independent product, they may be stored in a computer-readable storage medium. Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disc, etc., which can store program codes. .

On the other hand, the present invention also provides a computer program product. The computer program product includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can Executing the automatic driving fault handling method provided by the above methods, the method includes: receiving the vehicle control command and the first running state sent by the microprocessor; according to the vehicle control command and the first running state, combined with the first preset fault detection mechanism to obtain a first detection result; and execute a corresponding fault handling method according to the first detection result.

In another aspect, the present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it is implemented to execute the automatic driving fault handling method provided by the above-mentioned methods, the method Including: receiving the vehicle control command and the first running state sent by the microprocessor; according to the vehicle control command and the first running state, combined with the first preset fault detection mechanism, obtaining the first detection result; according to the first detection result, executing Corresponding troubleshooting method.

The device embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed to multiple network elements. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. It can be understood and implemented by those skilled in the art without any creative effort.

Through the above description of the implementations, those skilled in the art can clearly understand that each implementation can be implemented by means of software plus a necessary general hardware platform, and of course also by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the prior art can be embodied in the form of software products, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic discs, optical discs, etc., including several instructions to make a computer device (which may be a personal computer, server, or network device, etc.) execute the methods described in various embodiments or some parts of the embodiments.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims (10)

1. An automatic driving fault handling method, characterized by comprising:

receiving a vehicle control instruction and a first running state sent by a microprocessor;

obtaining a first detection result according to the vehicle control instruction and the first running state and by combining a first preset fault detection mechanism;

and executing a corresponding fault processing method according to the first detection result.

2. The automatic driving fault handling method according to claim 1, wherein obtaining a first detection result according to the vehicle control command and the first operating state in combination with a first preset fault detection mechanism comprises:

carrying out validity detection on the vehicle control instruction to obtain a first validity detection result;

carrying out state detection on the first running state to obtain a first running state detection result;

based on the received vehicle control instruction and the first running state sent by the microprocessor, carrying out communication timeout detection to obtain a first communication timeout detection result;

performing end-to-end protection detection on the microprocessor based on the received vehicle control instruction and the first running state to obtain a first end-to-end protection detection result;

and obtaining a first detection result according to the first validity detection result, the first running state detection result, the first communication overtime detection result and the first end-to-end protection detection result.

3. The automatic driving fault handling method according to claim 1, wherein executing a corresponding fault handling method according to the first detection result includes:

if the first detection result is failure or fault, shielding a vehicle control instruction and a first running state sent by the microprocessor, and sensing and positioning to generate a first vehicle control request;

and sending the first vehicle control request to a main vehicle execution controller to decelerate and stop in a lane, and generating a driver takeover prompt to inform the driver of taking over the vehicle.

4. The automatic driving fault handling method according to claim 3, wherein after sending the first vehicle control request to a main vehicle execution controller, comprising:

receiving a second running state returned by the main vehicle execution controller based on the first vehicle control request;

performing state detection on the second running state to obtain a second running state detection result;

and if the second running state detection result is a running fault, switching to a hot backup mode, requesting the main whole vehicle execution controller to exit the working mode and switch to the hot backup mode, and sending the second running state detection result to a redundant microcontroller so that the redundant microcontroller and the redundant whole vehicle execution controller communicated with the redundant microcontroller are switched to the working mode from the hot backup mode.

5. The automatic driving fault handling method according to claim 4, wherein the second operating state is an operating state of the main vehicle execution controller that the main vehicle execution controller performs fault detection based on the first vehicle control request and a second preset fault detection mechanism, and returns after determining that there is no fault according to a fault detection result;

the fault detection based on the first vehicle control request and a second preset fault detection mechanism comprises:

performing communication timeout detection based on receiving the first vehicle control request;

and performing end-to-end protection detection according to the first vehicle control request.

6. The automatic driving failure processing method according to claim 4, characterized by further comprising:

and sending a second heartbeat signal to a redundant microcontroller, or sending the second heartbeat signal and a second running state detection result which shows that the second running state detection result is invalid or failed to the redundant microcontroller, so that the redundant microcontroller determines whether to switch from a hot backup mode to a working mode according to the second heartbeat signal and a result of fault detection performed by a third preset fault detection mechanism, and whether to sense and position to generate a second vehicle control request and send the second vehicle control request to a redundant whole vehicle execution controller.

7. The automatic driving failure processing method according to claim 1, characterized by further comprising:

receiving a first heartbeat signal sent by a redundant microcontroller, or receiving the first heartbeat signal sent by the redundant microcontroller and a third running state detection result which is displayed as failure or fault, wherein the third running state detection result is obtained by the redundant microcontroller through state detection according to a third running state sent by a redundant whole vehicle execution controller;

obtaining a second detection result according to the first heartbeat signal and by combining a fourth preset fault detection mechanism;

determining that the redundant microcontroller is failed based on the second detection result being failure or fault;

and determining that the redundant vehicle execution controller fails based on the third operation state detection result which is displayed as failure or fault.

8. An automatic driving system, characterized in that the automatic driving fault handling method according to any one of claims 1 to 7 is applied, comprising a microprocessor and a main microcontroller, wherein:

the microprocessor sends a vehicle control instruction and a first running state to the main microcontroller;

the main microcontroller obtains a first detection result according to the received vehicle control instruction and the first running state and in combination with a first preset fault detection mechanism;

and the main microcontroller executes a corresponding fault processing method according to the first detection result.

9. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the steps of the method of automatic driving fault handling according to any of claims 1 to 7 are implemented when the processor executes the program.

10. A non-transitory computer readable storage medium having stored thereon a computer program, wherein the computer program, when executed by a processor, implements the steps of the automated driving fault handling method according to any one of claims 1 to 7.

Images