WO2023093536A1 - 一种自动驾驶控制***及车辆 - Google Patents

一种自动驾驶控制***及车辆 Download PDF

Info

Publication number
WO2023093536A1
WO2023093536A1 PCT/CN2022/131083 CN2022131083W WO2023093536A1 WO 2023093536 A1 WO2023093536 A1 WO 2023093536A1 CN 2022131083 W CN2022131083 W CN 2022131083W WO 2023093536 A1 WO2023093536 A1 WO 2023093536A1
Authority
WO
WIPO (PCT)
Prior art keywords
controller
automatic driving
vehicle
drive
module
Prior art date
Application number
PCT/CN2022/131083
Other languages
English (en)
French (fr)
Inventor
曹强
朱敏
陈鑫
卜玉帅
Original Assignee
宇通客车股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 宇通客车股份有限公司 filed Critical 宇通客车股份有限公司
Priority to EP22897619.7A priority Critical patent/EP4360979A1/en
Publication of WO2023093536A1 publication Critical patent/WO2023093536A1/zh

Links

Images

Classifications

    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W50/00—Details of control systems for road vehicle drive control not related to the control of a particular sub-unit, e.g. process diagnostic or vehicle driver interfaces
    • B60W50/02—Ensuring safety in case of control system failures, e.g. by diagnosing, circumventing or fixing failures
    • B60W50/023—Avoiding failures by using redundant parts
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W50/00—Details of control systems for road vehicle drive control not related to the control of a particular sub-unit, e.g. process diagnostic or vehicle driver interfaces
    • B60W50/02—Ensuring safety in case of control system failures, e.g. by diagnosing, circumventing or fixing failures
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W50/00—Details of control systems for road vehicle drive control not related to the control of a particular sub-unit, e.g. process diagnostic or vehicle driver interfaces
    • B60W50/02—Ensuring safety in case of control system failures, e.g. by diagnosing, circumventing or fixing failures
    • B60W50/0205—Diagnosing or detecting failures; Failure detection models
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W50/00—Details of control systems for road vehicle drive control not related to the control of a particular sub-unit, e.g. process diagnostic or vehicle driver interfaces
    • B60W50/02—Ensuring safety in case of control system failures, e.g. by diagnosing, circumventing or fixing failures
    • B60W50/029—Adapting to failures or work around with other constraints, e.g. circumvention by avoiding use of failed parts
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W50/00—Details of control systems for road vehicle drive control not related to the control of a particular sub-unit, e.g. process diagnostic or vehicle driver interfaces
    • B60W50/02—Ensuring safety in case of control system failures, e.g. by diagnosing, circumventing or fixing failures
    • B60W50/029—Adapting to failures or work around with other constraints, e.g. circumvention by avoiding use of failed parts
    • B60W2050/0292—Fail-safe or redundant systems, e.g. limp-home or backup systems
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02P—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS
    • Y02P90/00—Enabling technologies with a potential contribution to greenhouse gas [GHG] emissions mitigation
    • Y02P90/02—Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]

Definitions

  • the invention belongs to the field of fault diagnosis and decision-making of an automatic driving system, and in particular relates to an automatic driving control system and a vehicle.
  • the existing self-driving vehicles use the automatic driving intelligent controller of the automatic driving system to realize the automatic driving of the vehicle.
  • most of the existing automatic driving vehicles lack the detection of the automatic driving intelligent controller, which makes the automatic driving intelligent controller appear Abnormalities are likely to cause safety problems.
  • a small number of self-driving vehicles have a detection module in the automatic driving intelligent controller to detect whether there is an abnormality in the automatic driving intelligent controller.
  • the built-in detection module cannot detect the automatic driving intelligent control in time.
  • the abnormal delay of the message when the device sends the message to the outside makes the automatic driving still have safety problems.
  • the existing automatic driving vehicle also lacks the abnormal detection of the detection module. Therefore, the existing automatic driving vehicle lacks the automatic The effective detection of the abnormal situation of the intelligent driving controller cannot effectively control the vehicle when the intelligent controller of the automatic driving is abnormal, which will lead to safety accidents of the vehicle.
  • the invention provides an automatic driving control system and a vehicle, which are used to solve the vehicle safety problem caused by the lack of effective detection of abnormal conditions of the automatic driving intelligent controller in the prior art.
  • the present invention provides an automatic driving control system, which includes an automatic driving intelligent controller and a vehicle controller, and the communication connection between the automatic driving intelligent controller and the vehicle controller, and the automatic driving control system also It includes a drive-by-wire controller and a safety redundant controller, the drive-by-wire controller communicates with the automatic driving intelligent controller and the vehicle controller respectively, and the safety redundant controller communicates with the drive-by-wire controller and the vehicle controller respectively.
  • the vehicle controller is connected in communication, the drive-by-wire controller is used to send a braking command to the vehicle controller when detecting an abnormality of the automatic driving intelligent controller, and the safety redundant controller is used to detect When the drive-by-wire controller is abnormal, it sends a braking command to the vehicle controller.
  • a safety redundant controller connected to the drive-by-wire controller is provided to detect whether there is an abnormality in the drive-by-wire controller. If there is an abnormality, the safety redundant controller sends a braking command to the vehicle controller in time to prevent When the drive-by-wire controller is abnormal, it will cause traffic safety problems.
  • the secondary safety control composed of the drive-by-wire controller and the safety redundant controller, it can effectively control the vehicle when the automatic driving intelligent controller is abnormal, and better Improve the reliability and driving safety of the automatic driving control system.
  • the present invention provides an automatic driving control system, which also includes the safety redundant controller is also used to control the connected braking module, and when the vehicle detects When the controller is abnormal, it sends a braking command to the braking module.
  • the present invention provides an automatic driving control system, which also includes abnormality means that the sent command timeout and the sent command CRC check At least one of the two conditions of failure.
  • the present invention provides an automatic driving control system, which also includes that the drive-by-wire controller is also used to control the connected steering module, when the automatic driving intelligent control When the controller is normal, the drive-by-wire controller is used to forward the steering command from the automatic driving intelligent controller to the steering module, and transmit the driving command or braking command from the automatic driving intelligent controller to the vehicle controller .
  • the present invention provides an automatic driving control system, which also includes abnormalities including sudden changes in steering commands or driving commands.
  • the present invention provides an automatic driving control system, which also includes the communication between the drive-by-wire controller, the intelligent automatic driving controller and the vehicle controller.
  • the communication method is CAN communication.
  • the present invention provides an automatic driving control system, which also includes communication between the safety redundant controller, the drive-by-wire controller and the vehicle controller
  • the communication method is CAN communication.
  • the present invention also provides a vehicle, including a steering module, a driving module and a braking module, the vehicle also includes the above-mentioned automatic driving control system, and the automatic driving control system is connected to the steering module, the driving module and the braking module respectively , the automatic driving control system is used to send corresponding steering instructions, driving instructions and braking instructions to the steering module, driving module and braking module, the steering module is used to realize steering after receiving the steering instruction, and the driving module is used to receive Driving is realized after a driving instruction, and the braking module is used to realize braking after receiving a braking instruction.
  • Fig. 1 is a block diagram of the automatic driving control system of the present invention
  • Fig. 2 is a control logic diagram of the wire-controlled drive controller of the present invention
  • Fig. 3 (a) is the first control logic diagram of the safety redundant controller of the present invention.
  • Fig. 3(b) is a second control logic diagram of the safety redundant controller of the present invention.
  • the basic idea of the present invention is: by setting the drive-by-wire controller connected with the intelligent controller for automatic driving, to detect whether there is any abnormality in the intelligent controller for automatic driving.
  • a safety redundant controller connected with the drive-by-wire controller to detect whether there is an abnormality in the drive-by-wire controller.
  • the two-level safety control composed of drive-by-wire drive controller and safety redundant controller can effectively control the vehicle when the automatic driving intelligent controller is abnormal, and better improve the reliability of the automatic driving control system and driving Safety.
  • Fig. 1 is a block diagram of an automatic driving control system of the present invention
  • Fig. 2 is a control logic diagram of a drive-by-wire controller of the present invention
  • Fig. 3 (a) is a first control logic diagram of a safety redundant controller of the present invention
  • Fig. 3(b) is the second control logic diagram of the safety redundant controller of the present invention.
  • the automatic driving control system of this embodiment works when the vehicle is in an unmanned driving state.
  • the automatic driving control system includes an automatic driving intelligent controller, a vehicle controller (VCU new energy controller), a drive-by-wire controller and a safety redundant controller; the drive-by-wire controller is the chassis
  • the driver by wire (DBW) is the communication module between the intelligent controller for automatic driving and the CAN bus of the vehicle; It is a control unit with functions such as optimal control of the vehicle, energy management of the vehicle, maintenance and management of the CAN network, diagnosis and treatment of faults, and vehicle status monitoring.
  • the communication connection between the automatic driving intelligent controller and the vehicle controller, the drive-by-wire controller is respectively connected with the automatic driving intelligent controller and the vehicle controller
  • the safety redundancy controller is respectively connected with the drive-by-wire controller and the vehicle controller.
  • Controller communication connection is Among them, the communication mode between the drive-by-wire controller and the automatic driving intelligent controller and the vehicle controller is CAN communication, and the communication mode between the safety redundant controller and the drive-by-wire controller and the vehicle controller is CAN communication.
  • the automatic driving intelligent controller is used to generate a CAN message to realize the automatic driving of the vehicle, and the CAN message includes a steering command, a driving command and a braking command.
  • the drive-by-wire controller is used to receive the CAN message from the automatic driving intelligent controller, and detect whether the automatic driving intelligent controller is abnormal.
  • the drive-by-wire controller sends a braking command CAN message to the vehicle controller when detecting an abnormality of the automatic driving intelligent controller.
  • the abnormality of the automatic driving intelligent controller includes three situations: the command sent by the automatic driving intelligent In at least one of the two situations, it means that the automatic driving intelligent controller is abnormal.
  • the abnormal situations of the control instructions issued by the intelligent controller of automatic driving include but are not limited to the situations shown in Table 1.
  • the abnormal state of the control command issued by the intelligent controller of the automatic driving system 1 Drive control signal overtime 100ms (or according to the calibration value) 2 Brake control signal overtime 100ms (or according to the calibration value) 3 Steering control signal timeout 100ms (or according to the calibration value) 4 Drive control signal CRC check failure 5 Brake control signal CRC check failure 6 Steering control signal CRC check failure 7 The drive control signal does not conform to the logical transition 8 Steering control signal does not conform to logic jump
  • the irrational jump of the sent steering/driving command refers to a sudden change in the sent steering command and/or driving command.
  • the normal steering command is generally in a linear relationship, that is, the corresponding steering
  • the angle changes linearly. For example, under normal circumstances, the steering angle gradually increases from 10°, 15°, and 20°. If the steering angle suddenly changes from 10° to 50° during the increase, it can be judged that the steering command has a sudden change; Commands are similar.
  • Normal driving commands are generally linear, that is, the corresponding torque also changes linearly. For example, under normal circumstances, the torque gradually increases from 20N ⁇ m, 30N ⁇ m, and 40N ⁇ m. From 20N ⁇ m to 100N ⁇ m, it can be judged that the driving command has a sudden change.
  • the drive-by-wire controller is also used to control the connected steering module.
  • the drive-by-wire controller will automatically The steering command from the driving intelligent controller is forwarded to the steering module, and the drive-by-wire drive controller forwards the driving command or braking command from the automatic driving intelligent controller to the vehicle controller.
  • the working process of the drive-by-wire controller is as follows:
  • the DBW drive-by-wire controller first determines whether the current vehicle is in the automatic driving state. When the control command issued by the controller is in a normal state, the control command will be issued normally. If it is determined that the control command issued by the automatic driving intelligent controller is in an abnormal state, the safety protection function will be triggered to intercept the abnormal automatic driving intelligent controller. control command and control the vehicle to decelerate and stop safely.
  • the safety redundant controller is used to receive the CAN message from the drive-by-wire controller and detect whether the drive-by-wire controller is abnormal.
  • the CAN message includes a steering command, a driving command and a braking command.
  • the safety redundant controller sends a CAN message including a braking command to the vehicle controller when detecting an abnormality of the drive-by-wire controller.
  • the abnormality of the drive-by-wire controller includes two situations: the command sent by the drive-by-wire controller timed out and the CRC check failure of the command sent. If at least one of the two situations occurs in the drive-by-wire controller, it means that the line The control drive controller is abnormal.
  • the safety redundant controller is also used to control the connected brake module, and the safety redundant controller also detects whether the vehicle controller is abnormal.
  • the vehicle controller When the vehicle controller is abnormal, it sends a CAN message including a braking command to the braking module.
  • the abnormality of the vehicle controller includes two situations: the instruction sent by the vehicle controller is timed out and the CRC check failure of the instruction sent by the vehicle controller. If at least one of the two situations occurs in the vehicle controller, it means that the vehicle controller Abnormal.
  • the working process of the safety redundant controller is as follows:
  • the safety redundant controller in the running state of the vehicle, the safety redundant controller first determines whether it is currently in the state of automatic driving, and when it is confirmed that it is in the state of automatic driving, it determines whether there is a control command issued by the DBW drive-by-wire controller within 150ms ;When it is determined that the DBW drive-by-wire controller normally issues control commands within 150ms and the control command verification is normal, the safety redundant controller is in the monitoring state, and continuously monitors the timeout status of the control commands of the automatic driving system; when it is determined that the DBW drive-by-wire control When the controller does not issue a control command within 150ms, the safety protection function will be triggered, and the safety redundant controller will issue a control command to control the vehicle to decelerate and stop safely.
  • the safety redundant controller when the vehicle is running, the safety redundant controller will monitor whether there is a status message sent by the VCU new energy controller within 150ms and whether the status message is verified to be normal; when it is determined that the VCU new energy control When a status message is sent within 150ms and the status message is verified to be normal, the safety redundant controller is in the monitoring state and continuously monitors the timeout status of the status message of the VCU new energy controller; when it is determined that the VCU new energy controller does not send it within 150ms When the status message is sent, the safety protection function is triggered, and the safety redundancy controller sends a control command to the braking module to control the vehicle to decelerate and stop safely.
  • the vehicle controller is used to receive the CAN message from the drive-by-wire controller or the safety redundant controller, and control the driving module or the braking module, so as to drive or brake the vehicle.
  • the working process of the automatic driving control system is as follows:
  • the DBW drive-by-wire drive controller receives the driving, braking and steering control CAN messages sent by the automatic driving intelligent controller, and sends braking commands when the driving, braking and steering control CAN messages are in abnormal states such as timeout and verification faults
  • the vehicle controller makes the automatic driving vehicle stop safely; when the driving, braking and steering control CAN messages are in a normal state, the DBW drive-by-wire drive controller normally sends the CAN message of the intelligent controller of the automatic driving system to the vehicle for execution layer (vehicle controller or steering module), so that the vehicle is in a safe automatic driving state;
  • the safety redundant controller receives the driving, braking and steering control CAN messages sent by the DBW drive-by-wire controller, and sends braking commands when the driving, braking and steering control CAN messages are in abnormal states such as timeout and verification faults Make the automatic driving vehicle stop safely for the vehicle controller; when the driving, braking and steering control CAN messages are in the normal state, the safety redundant controller is in the monitoring state and does not issue control CAN message commands;
  • the safety redundant controller also receives the status CAN message of the VCU new energy controller (that is, the vehicle controller). When the status CAN message of the VCU new energy controller is in an abnormal state of being lost, it directly sends the brake control CAN The message is sent to the brake module to make the self-driving vehicle stop safely.
  • the drive-by-wire controller connected with the intelligent controller for automatic driving, it is detected whether there is an abnormality in the intelligent controller for automatic driving.
  • the controller sends a braking command to prevent driving safety problems when the automatic driving intelligent controller is abnormal, thereby improving the reliability and driving safety of the automatic driving control system.
  • a safety redundant controller connected to the drive-by-wire controller is provided to detect whether there is an abnormality in the drive-by-wire controller. If there is an abnormality, the safety redundant controller sends a braking command to the vehicle controller in time to prevent When the drive-by-wire controller is abnormal, it will cause traffic safety problems.
  • the secondary safety control composed of the drive-by-wire controller and the safety redundant controller, it can effectively control the vehicle when the automatic driving intelligent controller is abnormal, and better Improve the reliability and driving safety of the automatic driving control system.
  • the safety redundant controller can also control the vehicle to brake and stop when the vehicle controller is abnormal.
  • the safety redundant controller monitors the CAN message of the vehicle controller status
  • the three-level safety protection decision-making system for self-driving vehicles makes the operation of the vehicle safer, and solves and eliminates the problems that endanger the safety of passengers, such as vehicle loss of control and collisions caused by the crash or poor stability of the automatic driving system during automatic driving.
  • the automatic driving control system of this embodiment includes but is not limited to running safety protection for automatic driving vehicles.
  • This embodiment provides a vehicle.
  • the vehicle in this embodiment is an automatic driving vehicle.
  • the vehicle in this embodiment includes a steering module, a driving module, a braking module and an automatic driving control system.
  • the automatic driving control system is respectively connected with the steering module, the driving module and the braking module, and the automatic driving control system is used to send corresponding steering instructions, driving instructions and braking instructions to the steering module, the driving module and the braking module. instruction.
  • the specific content of the automatic driving control system has been introduced in the embodiment of the automatic driving control system, and will not be repeated here.
  • the steering module is used to realize steering after receiving a steering command, and the steering module is, for example, a steering controller. There is at least one steering module.
  • the driving module is used to realize driving after receiving a driving instruction, and the driving module is, for example, a driving controller.
  • the braking module is used to implement braking after receiving a braking instruction, and the braking module is, for example, a braking controller. There is at least one Braking Module.

Landscapes

  • Engineering & Computer Science (AREA)
  • Automation & Control Theory (AREA)
  • Human Computer Interaction (AREA)
  • Transportation (AREA)
  • Mechanical Engineering (AREA)
  • Regulating Braking Force (AREA)
  • Safety Devices In Control Systems (AREA)
  • Control Of Driving Devices And Active Controlling Of Vehicle (AREA)

Abstract

本发明涉及一种自动驾驶控制***及车辆，该自动驾驶控制***包括自动驾驶智能控制器和整车控制器，自动驾驶智能控制器和整车控制器之间通信连接，自动驾驶控制***还包括线控驱动控制器和安全冗余控制器，线控驱动控制器分别与自动驾驶智能控制器和整车控制器通信连接，安全冗余控制器分别与线控驱动控制器和整车控制器通信连接，线控驱动控制器用于在检测到自动驾驶智能控制器异常时向整车控制器发送制动指令，安全冗余控制器用于在检测到线控驱动控制器异常时向整车控制器发送制动指令。基于本发明的自动驾驶控制***，能够解决现有技术中自动驾驶车辆缺少对自动驾驶智能控制器异常情况的有效检测导致的车辆安全问题。

Description

一种自动驾驶控制***及车辆 技术领域
本发明属于自动驾驶***故障诊断和决策领域，具体涉及一种自动驾驶控制***及车辆。
背景技术
近年来，自动驾驶***的开发受到了越来越多的科研机构、高校和汽车企业的重视，搭载自动驾驶***的车辆也逐渐地出现在了大街小巷。随着自动驾驶车辆的普及应用，自动驾驶车辆出现的安全事故也受到了社会的普遍关注。因此，如何确保自动驾驶车辆的行驶安全以提高乘客的乘坐安全感和满意度，成为此类车辆开发过程中必须攻克的难题。
现有的自动驾驶车辆多通过自动驾驶***的自动驾驶智能控制器实现车辆的自动驾驶，然而，现有的自动驾驶车辆大都缺少对自动驾驶智能控制器的检测，这样使得自动驾驶智能控制器出现异常时容易造成安全问题，少量自动驾驶车辆在自动驾驶智能控制器中内设有一个检测模块，用于检测自动驾驶智能控制器是否出现异常，然而内设的检测模块不能及时检测自动驾驶智能控制器向外发送报文时的报文延时异常情况，使得自动驾驶依然存在安全问题，另外现有的自动驾驶车辆也缺少对检测模块的异常检测，因此，现有的自动驾驶车辆缺少对自动驾驶智能控制器异常情况的有效检测，无法在自动驾驶智能控制器异常时对车辆进行有效控制，进而导致车辆出现安全事故。
发明内容
本发明提供了一种自动驾驶控制***及车辆，用以解决现有技术中自动驾驶车辆缺少对自动驾驶智能控制器异常情况的有效检测导致的车辆安全问题。
为解决上述技术问题，本发明提供一种自动驾驶控制***，包括自动驾驶智能控制器和整车控制器，自动驾驶智能控制器和整车控制器之间通信连接，所述自动驾驶控制***还包括线控驱动控制器和安全冗余控制器，所述线控驱动控制器分别与自动驾驶智能控制器和整车控制器通信连接，所述安全冗余控制器分别与线控驱动控制器和整车控制器通信连接，所述线控驱动控制器用于在检测到所述自动驾驶智能控制器异常时向所述整车控制器发送制动指令，所述安全冗余控制器用于在检测到所述线控驱动控制器异常时向所述整车控制器发送制动指令。
上述技术方案的有益效果为：通过设置与自动驾驶智能控制器连接的线控驱动控制器，以检测自动驾驶智能控制器是否出现异常，若出现异常，线控驱动控制器及时向整车控制器 发送制动指令，防止在自动驾驶智能控制器出现异常时造成行车安全问题，进而提高自动驾驶控制***的可靠性和行车安全。另外还设置有与线控驱动控制器连接的安全冗余控制器，以检测线控驱动控制器是否出现异常，若出现异常，安全冗余控制器及时向整车控制器发送制动指令，防止线控驱动控制器出现异常时造成行车安全问题，通过线控驱动控制器和安全冗余控制器构成的二级安全控制，能够在自动驾驶智能控制器异常时对车辆进行有效控制，更好地提高自动驾驶控制***的可靠性和行车安全。
进一步地，为了更好地提高自动驾驶控制***的可靠性，本发明提供了一种自动驾驶控制***，还包括所述安全冗余控制器还用于控制连接制动模块，在检测到整车控制器异常时向制动模块发送制动指令。
进一步地，为了准确、全面检测自动驾驶智能控制器或者线控驱动控制器是否异常，本发明提供了一种自动驾驶控制***，还包括异常是指出现发送的指令超时和发送的指令CRC校验故障两种情况中的至少一种情况。
进一步地，为了保证自动驾驶智能控制器正常时车辆能够正常行驶，本发明提供了一种自动驾驶控制***，还包括所述线控驱动控制器还用于控制连接转向模块，当自动驾驶智能控制器正常时，所述线控驱动控制器用于向转向模块转发来自所述自动驾驶智能控制器的转向指令，以及向整车控制器转发来自所述自动驾驶智能控制器的驱动指令或制动指令。
进一步地，为了更加准确、全面检测自动驾驶智能控制器或者线控驱动控制器是否异常，本发明提供了一种自动驾驶控制***，还包括异常还包括转向指令或驱动指令突变的情况。
进一步地，为了更好地提高控制器间通信的可靠性，本发明提供了一种自动驾驶控制***，还包括所述线控驱动控制器与自动驾驶智能控制器和整车控制器之间的通信方式为CAN通信。
进一步地，为了更好地提高控制器间通信的可靠性，本发明提供了一种自动驾驶控制***，还包括所述安全冗余控制器与线控驱动控制器和整车控制器之间的通信方式为CAN通信。
本发明还提供了一种车辆，包括转向模块、驱动模块和制动模块，所述车辆还包括上述的自动驾驶控制***，所述自动驾驶控制***分别与转向模块、驱动模块和制动模块连接，自动驾驶控制***用于向转向模块、驱动模块和制动模块发送对应的转向指令、驱动指令和制动指令，所述转向模块用于接收转向指令后实现转向，所述驱动模块用于接收驱动指令后实现驱动，所述制动模块用于接收制动指令后实现制动。
附图说明
图1是本发明的自动驾驶控制***框图；
图2是本发明的线控驱动控制器的控制逻辑图；
图3(a)是本发明的安全冗余控制器的第一控制逻辑图；
图3(b)是本发明的安全冗余控制器的第二控制逻辑图。
具体实施方式
本发明的基本构思为：通过设置与自动驾驶智能控制器连接的线控驱动控制器，以检测自动驾驶智能控制器是否出现异常，若出现异常，线控驱动控制器及时向整车控制器发送制动指令，另外还设置有与线控驱动控制器连接的安全冗余控制器，以检测线控驱动控制器是否出现异常，若出现异常，安全冗余控制器及时向整车控制器发送制动指令，通过线控驱动控制器和安全冗余控制器构成的二级安全控制，能够在自动驾驶智能控制器异常时对车辆进行有效控制，更好地提高自动驾驶控制***的可靠性和行车安全。
为了使本发明的目的、技术方案及技术效果更加清楚明了，以下结合附图及具体实施例对本发明进行进一步详细说明。
自动驾驶控制***实施例:
图1是本发明的自动驾驶控制***框图；图2是本发明的线控驱动控制器的控制逻辑图；图3(a)是本发明的安全冗余控制器的第一控制逻辑图；图3(b)是本发明的安全冗余控制器的第二控制逻辑图。
本实施例提供一种自动驾驶控制***。本实施例的自动驾驶控制***在车辆处于无人驾驶状态时工作。如图1所示，自动驾驶控制***包括自动驾驶智能控制器、整车控制器(即VCU新能源控制器)、线控驱动控制器和安全冗余控制器；其中线控驱动控制器为底盘线控单元(Driver By Wire，DBW)，是自动驾驶智能控制器和车辆CAN总线的通信模块；整车控制器(Vehicle Control Unit，VCU)是纯电动汽车用于实现驱动力矩控制、制动能量的优化控制、整车的能量管理、CAN网络的维护和管理、故障的诊断和处理、车辆状态监视等功能的控制单元。自动驾驶智能控制器和整车控制器之间通信连接，线控驱动控制器分别与自动驾驶智能控制器和整车控制器通信连接，安全冗余控制器分别与线控驱动控制器和整车控制器通信连接。其中，线控驱动控制器与自动驾驶智能控制器和整车控制器之间的通信方式为CAN通信，安全冗余控制器与线控驱动控制器和整车控制器之间的通信方式为CAN通信。
在本实施例中，自动驾驶智能控制器用于生成CAN报文，以便实现车辆的自动驾驶，CAN报文包括转向指令、驱动指令和制动指令。
在本实施例中，线控驱动控制器用于接收来自自动驾驶智能控制器的CAN报文，并检测自动驾驶智能控制器是否异常。
在本实施例中，线控驱动控制器在检测到自动驾驶智能控制器异常时向整车控制器发送制动指令CAN报文。其中，自动驾驶智能控制器异常包括自动驾驶智能控制器发送的指令超时、发送的转向/驱动指令不符合逻辑性跳变和发送的指令CRC校验故障三种情况，若自动驾驶智能控制器出现两种情况中的至少一种情况，则说明自动驾驶智能控制器出现异常。自动驾驶智能控制器下发的控制指令异常情况包括但不限于表1所示的情况。
表1控制指令异常状态定义表
序号 自动驾驶***智能控制器下发的控制指令异常状态
1 驱动控制信号超时100ms(或依据标定值)
2 制动控制信号超时100ms(或依据标定值)
3 转向控制信号超时100ms(或依据标定值)
4 驱动控制信号CRC校验故障
5 制动控制信号CRC校验故障
6 转向控制信号CRC校验故障
7 驱动控制信号不符合逻辑性跳变
8 转向控制信号不符合逻辑性跳变
其中，发送的转向/驱动指令不符合逻辑性跳变是指发送的转向指令和/或驱动指令出现突变，具体地，在行车过程中，正常的转向指令一般是呈线性关系，即对应的转向角呈线性变化，例如正常情况下转向角从10°、15°、20°逐渐增加，若在增加过程中转向角突然从10°变为50°，即可以判定为转向指令发生突变；与转向指令类似，正常的驱动指令一般也是呈线性关系，即其对应的扭矩也呈线性变化，例如正常情况下扭矩从20N·m、30N·m、40N·m逐渐增加，若在增加过程中扭矩突然从20N·m变为100N·m，即可以判定为驱动指令发生突变。
在本实施例中，为了保证自动驾驶智能控制器正常时车辆能够正常行驶，线控驱动控制器还用于控制连接转向模块，当自动驾驶智能控制器正常时，线控驱动控制器将来自自动驾驶智能控制器的转向指令转发至转向模块，线控驱动控制器将来自自动驾驶智能控制器的驱动指令或制动指令转发至整车控制器。
在本实施例中，线控驱动控制器的工作过程如下：
如图2所示，在车辆运行状态下，DBW线控驱动控制器首先判定目前车辆是否处于自动驾驶状态，当确认处于自动驾驶状态时判定自动驾驶智能控制器有无异常；若判定自动驾驶智能控制器下发的控制指令处于正常状态时将控制指令正常下发，若判定自动驾驶智能控制器下发的控制指令处于异常状态时，触发安全保护功能，拦截异常的自动驾驶智能控制器下发的控制指令并控制车辆安全减速停车。
在本实施例中，安全冗余控制器用于接收来自线控驱动控制器的CAN报文，并检测线控驱动控制器是否异常，CAN报文包括转向指令、驱动指令和制动指令。
在本实施例中，安全冗余控制器在检测到线控驱动控制器异常时向整车控制器发送包括制动指令CAN报文。其中，线控驱动控制器异常包括线控驱动控制器发送的指令超时和发送的指令CRC校验故障两种情况，若线控驱动控制器出现两种情况中的至少一种情况，则说明线控驱动控制器出现异常。
在本实施例中，为了更好地提高自动驾驶控制***的可靠性，安全冗余控制器还用于控制连接制动模块，安全冗余控制器还检测整车控制器是否异常，在检测到整车控制器异常时向制动模块发送包括制动指令的CAN报文。其中，整车控制器异常包括整车控制器发送的指令超时和发送的指令CRC校验故障两种情况，若整车控制器出现两种情况中的至少一种情况，则说明整车控制器出现异常。
在本实施例中，安全冗余控制器的工作过程如下：
如图3(a)所示，在车辆运行状态下，安全冗余控制器首先判定目前是否处于自动驾驶状态，当确认处于自动驾驶状态时判定DBW线控驱动控制器150ms内是否有控制指令发出；当判定DBW线控驱动控制器150ms内正常下发控制指令且控制指令校验正常时安全冗余控制器处于监测状态，持续监测自动驾驶***控制指令的超时状态；当判定DBW线控驱动控制器150ms内没有下发控制指令时，触发安全保护功能，由安全冗余控制器下发控制指令，控制车辆安全减速停车。
如图3(b)所示，在车辆运行状态下，安全冗余控制器会监测VCU新能源控制器150ms内是否有状态报文发出以及状态报文是否校验正常；当判定VCU新能源控制器150ms内有状态报文发出时且状态报文校验正常安全冗余控制器处于监测状态，持续监测VCU新能源控制器状态报文的超时状态；当判定VCU新能源控制器150ms内没有发出状态报文时，触发安全保护功能，由安全冗余控制器下发控制指令给制动模块，控制车辆安全减速停车。
在本实施例中，整车控制器用于接收来自线控驱动控制器或安全冗余控制器的CAN报文，并对驱动模块或制动模块进行控制，以实现车辆的驱动或制动。
在本实施例中，自动驾驶控制***的工作过程如下：
DBW线控驱动控制器接收自动驾驶智能控制器发出的驱动、制动和转向控制CAN报文，当驱动、制动和转向控制CAN报文处于超时、校验故障等异常状态时下发制动指令给整车控制器使自动驾驶车辆安全停车；当驱动、制动和转向控制CAN报文处于正常状态时，DBW线控驱动控制器正常下发自动驾驶***智能控制器的CAN报文到车辆执行层(整车控制器或转向模块)，使车辆处于安全的自动驾驶运行状态；
安全冗余控制器接收DBW线控驱动控制器发出的驱动、制动和转向控制CAN报文，当驱动、制动和转向控制CAN报文处于超时、校验故障等异常状态时下发制动指令给整车控制器使自动驾驶车辆安全停车；当驱动、制动和转向控制CAN报文处于正常状态时，安全冗余控制器处于监测状态，不发出控制CAN报文指令；
安全冗余控制器还接收VCU新能源控制器(即整车控制器)的状态CAN报文，当VCU新能源控制器的状态CAN报文处于丢失的异常状态时，直接下发制动控制CAN报文给制动模块，使自动驾驶车辆安全停车。
基于本实施例的自动驾驶控制***，通过设置与自动驾驶智能控制器连接的线控驱动控制器，以检测自动驾驶智能控制器是否出现异常，若出现异常，线控驱动控制器及时向整车控制器发送制动指令，防止在自动驾驶智能控制器出现异常时造成行车安全问题，进而提高自动驾驶控制***的可靠性和行车安全。另外还设置有与线控驱动控制器连接的安全冗余控制器，以检测线控驱动控制器是否出现异常，若出现异常，安全冗余控制器及时向整车控制器发送制动指令，防止线控驱动控制器出现异常时造成行车安全问题，通过线控驱动控制器和安全冗余控制器构成的二级安全控制，能够在自动驾驶智能控制器异常时对车辆进行有效控制，更好地提高自动驾驶控制***的可靠性和行车安全，另外，安全冗余控制器还可以在整车控制器异常时控制车辆制动停车，安全冗余控制器对整车控制器状态CAN报文的监测构成自动驾驶车辆的三级安全保护决策***，使车辆的运行更加安全，解决和消除了车辆在自动驾驶时由于自动驾驶***崩溃或稳定性差导致的车辆失控、碰撞等危及乘客安全的问题。本实施例的自动驾驶控制***包含但不限于用于自动驾驶车辆的运行安全防护。
车辆实施例：
本实施例提供一种车辆。本实施例的车辆为自动驾驶车辆。本实施例的车辆包括转向模块、驱动模块、制动模块和自动驾驶控制***。
在本实施例中，自动驾驶控制***分别与转向模块、驱动模块和制动模块连接，自动驾驶控制***用于向转向模块、驱动模块和制动模块发送对应的转向指令、驱动指令和制动 指令。自动驾驶控制***的具体内容已经在自动驾驶控制***实施例中进行介绍，此处不再赘述。
转向模块用于接收转向指令后实现转向，转向模块例如为转向控制器。转向模块至少有一个。
驱动模块用于接收驱动指令后实现驱动，驱动模块例如为驱动控制器。
制动模块用于接收制动指令后实现制动，制动模块例如为制动控制器。制动模块至少有一个。
基于本实施例的车辆，能够解决现有技术中自动驾驶车辆缺少对自动驾驶智能控制器异常情况的有效检测导致的车辆安全问题。

Claims (8)

  1. 一种自动驾驶控制***，包括自动驾驶智能控制器和整车控制器，自动驾驶智能控制器和整车控制器之间通信连接，其特征在于，所述自动驾驶控制***还包括线控驱动控制器和安全冗余控制器，所述线控驱动控制器分别与自动驾驶智能控制器和整车控制器通信连接，所述安全冗余控制器分别与线控驱动控制器和整车控制器通信连接，所述线控驱动控制器用于在检测到所述自动驾驶智能控制器异常时向所述整车控制器发送制动指令，所述安全冗余控制器用于在检测到所述线控驱动控制器异常时向所述整车控制器发送制动指令。
  2. 根据权利要求1所述的自动驾驶控制***，其特征在于，所述安全冗余控制器还用于控制连接制动模块，在检测到整车控制器异常时向制动模块发送制动指令。
  3. 根据权利要求1或2所述的自动驾驶控制***，其特征在于，异常是指出现发送的指令超时和发送的指令CRC校验故障两种情况中的至少一种情况。
  4. 根据权利要求3所述的自动驾驶控制***，其特征在于，所述线控驱动控制器还用于控制连接转向模块，当自动驾驶智能控制器正常时，所述线控驱动控制器用于向转向模块转发来自所述自动驾驶智能控制器的转向指令，以及向整车控制器转发来自所述自动驾驶智能控制器的驱动指令或制动指令。
  5. 根据权利要求4所述的自动驾驶控制***，其特征在于，异常还包括转向指令或驱动指令突变的情况。
  6. 根据权利要求1所述的自动驾驶控制***，其特征在于，所述线控驱动控制器与自动驾驶智能控制器和整车控制器之间的通信方式为CAN通信。
  7. 根据权利要求1所述的自动驾驶控制***，其特征在于，所述安全冗余控制器与线控驱动控制器和整车控制器之间的通信方式为CAN通信。
  8. 一种车辆，包括转向模块、驱动模块和制动模块，其特征在于，所述车辆还包括权利要求1-7任一项所述的自动驾驶控制***，所述自动驾驶控制***分别与转向模块、驱动模块和制动模块连接，自动驾驶控制***用于向转向模块、驱动模块和制动模块发送对应的转向指令、驱动指令和制动指令，所述转向模块用于接收转向指令后实现转向，所述驱动模块用于接收驱动指令后实现驱动，所述制动模块用于接收制动指令后实现制动。
PCT/CN2022/131083 2021-11-26 2022-11-10 一种自动驾驶控制***及车辆 WO2023093536A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP22897619.7A EP4360979A1 (en) 2021-11-26 2022-11-10 Autonomous driving control system and vehicle

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111423748.9 2021-11-26
CN202111423748.9A CN116176609A (zh) 2021-11-26 2021-11-26 一种自动驾驶控制***及车辆

Publications (1)

Publication Number Publication Date
WO2023093536A1 true WO2023093536A1 (zh) 2023-06-01

Family

ID=86435030

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/131083 WO2023093536A1 (zh) 2021-11-26 2022-11-10 一种自动驾驶控制***及车辆

Country Status (3)

Country Link
EP (1) EP4360979A1 (zh)
CN (1) CN116176609A (zh)
WO (1) WO2023093536A1 (zh)

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3498561A1 (en) * 2016-08-10 2019-06-19 Hitachi Automotive Systems, Ltd. Vehicle control device
CN109917779A (zh) * 2019-03-26 2019-06-21 中国第一汽车股份有限公司 面向l3自动驾驶的冗余控制***
US20190193746A1 (en) * 2017-12-27 2019-06-27 Micron Technology, Inc. Determination of Reliability of Vehicle Control Commands via Redundancy
CN111752269A (zh) * 2020-06-30 2020-10-09 东风商用车有限公司 自动驾驶控制器和整车控制器的交互***及方法
CN111942349A (zh) * 2020-07-03 2020-11-17 东风汽车集团有限公司 适用于自动驾驶的制动冗余备份***及制动方法
CN112849055A (zh) * 2021-02-24 2021-05-28 清华大学 基于底盘域控制器的智能汽车信息流冗余安全控制***
CN113050605A (zh) * 2021-03-29 2021-06-29 紫清智行科技(北京)有限公司 一种用于自动驾驶测试平台的安全控制冗余***及方法
CN113183978A (zh) * 2021-06-01 2021-07-30 西安主函数智能科技有限公司 自动驾驶工程车线控***故障诊断方法和安全保护方法

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3498561A1 (en) * 2016-08-10 2019-06-19 Hitachi Automotive Systems, Ltd. Vehicle control device
US20190193746A1 (en) * 2017-12-27 2019-06-27 Micron Technology, Inc. Determination of Reliability of Vehicle Control Commands via Redundancy
CN109917779A (zh) * 2019-03-26 2019-06-21 中国第一汽车股份有限公司 面向l3自动驾驶的冗余控制***
CN111752269A (zh) * 2020-06-30 2020-10-09 东风商用车有限公司 自动驾驶控制器和整车控制器的交互***及方法
CN111942349A (zh) * 2020-07-03 2020-11-17 东风汽车集团有限公司 适用于自动驾驶的制动冗余备份***及制动方法
CN112849055A (zh) * 2021-02-24 2021-05-28 清华大学 基于底盘域控制器的智能汽车信息流冗余安全控制***
CN113050605A (zh) * 2021-03-29 2021-06-29 紫清智行科技(北京)有限公司 一种用于自动驾驶测试平台的安全控制冗余***及方法
CN113183978A (zh) * 2021-06-01 2021-07-30 西安主函数智能科技有限公司 自动驾驶工程车线控***故障诊断方法和安全保护方法

Also Published As

Publication number Publication date
EP4360979A1 (en) 2024-05-01
CN116176609A (zh) 2023-05-30

Similar Documents

Publication Publication Date Title
CN112141106B (zh) 用于控制自主车辆制动的设备
US8548708B2 (en) Brake system for a vehicle and method for operating a brake system for a vehicle
CN207931706U (zh) 一种车辆冗余制动***
CN109249873A (zh) 一种无人驾驶车辆底盘***与备份控制方法
KR20210105329A (ko) 듀얼의 독립된 제어 기능을 구비하는 제동 시스템 및 제어 방법
CN215244703U (zh) 具备多重安全冗余机制的自动驾驶车辆及自动驾驶***
WO2022022254A1 (zh) 制动冗余控制方法、***和自动驾驶车辆
CN100592997C (zh) 用于轨道车辆的制动装置
CN114735073B (zh) 一种避免自动驾驶车辆转向***故障的装置及其控制方法
AU2021269281B2 (en) Rail vehicle brake system and monitoring method for rail vehicle brake system
CN209191847U (zh) 一种无人驾驶车辆底盘***
CN114940183B (zh) 一种满足自动驾驶分布式动力备份控制***及车辆
WO2023093536A1 (zh) 一种自动驾驶控制***及车辆
CN113771870A (zh) 一种用于自动驾驶车辆的故障检测方法和***
WO2021248824A1 (zh) 应用于无人驾驶车辆的制动***
CN207937819U (zh) 一种车辆双人机交互***
CN109435875A (zh) 一种无人驾驶汽车底盘供电***备份方法
CN207931708U (zh) 车辆冗余制动***
KR20220085880A (ko) 무인저속자율주행차량의 제동 안전시스템
CN112158188A (zh) 一种智能驾驶车辆行车制动***、方法及汽车
CN109910613B (zh) 扭矩关断方法、扭矩关断***和车辆
CN109760518B (zh) 车辆、车辆紧急制动控制***及方法和车辆紧急制动装置
CN221366587U (zh) 一种线控底盘的冗余制动***及车辆
CN109308067A (zh) 一种无人驾驶汽车底盘驱动***备份方法
WO2023005015A1 (zh) 一种轨道车辆制动***和轨道车辆制动***的监控方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22897619

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2022897619

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2022897619

Country of ref document: EP

Effective date: 20240123