WO2022057728A1 - 一种自动驾驶方法、ads及自动驾驶车辆 - Google Patents

一种自动驾驶方法、ads及自动驾驶车辆 Download PDF

Info

Publication number
WO2022057728A1
WO2022057728A1 PCT/CN2021/117595 CN2021117595W WO2022057728A1 WO 2022057728 A1 WO2022057728 A1 WO 2022057728A1 CN 2021117595 W CN2021117595 W CN 2021117595W WO 2022057728 A1 WO2022057728 A1 WO 2022057728A1
Authority
WO
WIPO (PCT)
Prior art keywords
ads
driving
vehicle
physiological data
real
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2021/117595
Other languages
English (en)
French (fr)
Inventor
肖智涛
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to JP2023517785A priority Critical patent/JP7520220B2/ja
Priority to EP21868553.5A priority patent/EP4201780B1/en
Priority to EP25183781.1A priority patent/EP4657406A3/en
Publication of WO2022057728A1 publication Critical patent/WO2022057728A1/zh
Priority to US18/183,167 priority patent/US12409860B2/en
Anticipated expiration legal-status Critical
Priority to US19/298,090 priority patent/US20250368228A1/en
Ceased legal-status Critical Current

Links

Images

Classifications

    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W40/00—Estimation or calculation of non-directly measurable driving parameters for road vehicle drive control systems not related to the control of a particular sub unit, e.g. by using mathematical models
    • B60W40/08—Estimation or calculation of non-directly measurable driving parameters for road vehicle drive control systems not related to the control of a particular sub unit, e.g. by using mathematical models related to drivers or passengers
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W60/00—Drive control systems specially adapted for autonomous road vehicles
    • B60W60/001—Planning or execution of driving tasks
    • A—HUMAN NECESSITIES
    • A61—MEDICAL OR VETERINARY SCIENCE; HYGIENE
    • A61B—DIAGNOSIS; SURGERY; IDENTIFICATION
    • A61B5/00—Measuring for diagnostic purposes; Identification of persons
    • A61B5/68—Arrangements of detecting, measuring or recording means, e.g. sensors, in relation to patient
    • A61B5/6887—Arrangements of detecting, measuring or recording means, e.g. sensors, in relation to patient mounted on external non-worn devices, e.g. non-medical devices
    • A61B5/6893—Cars
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W30/00—Purposes of road vehicle drive control systems not related to the control of a particular sub-unit, e.g. of systems using conjoint control of vehicle sub-units
    • B60W30/18—Propelling the vehicle
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W60/00—Drive control systems specially adapted for autonomous road vehicles
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W60/00—Drive control systems specially adapted for autonomous road vehicles
    • B60W60/001—Planning or execution of driving tasks
    • B60W60/0015—Planning or execution of driving tasks specially adapted for safety
    • B60W60/0016—Planning or execution of driving tasks specially adapted for safety of the vehicle or its occupants
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W60/00—Drive control systems specially adapted for autonomous road vehicles
    • B60W60/007—Emergency override
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60Q—ARRANGEMENT OF SIGNALLING OR LIGHTING DEVICES, THE MOUNTING OR SUPPORTING THEREOF OR CIRCUITS THEREFOR, FOR VEHICLES IN GENERAL
    • B60Q1/00—Arrangement of optical signalling or lighting devices, the mounting or supporting thereof or circuits therefor
    • B60Q1/26—Arrangement of optical signalling or lighting devices, the mounting or supporting thereof or circuits therefor the devices being primarily intended to indicate the vehicle, or parts thereof, or to give signals, to other traffic
    • B60Q1/46—Arrangement of optical signalling or lighting devices, the mounting or supporting thereof or circuits therefor the devices being primarily intended to indicate the vehicle, or parts thereof, or to give signals, to other traffic for giving flashing caution signals during drive, other than signalling change of direction, e.g. flashing the headlights or hazard lights
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W40/00—Estimation or calculation of non-directly measurable driving parameters for road vehicle drive control systems not related to the control of a particular sub unit, e.g. by using mathematical models
    • B60W40/08—Estimation or calculation of non-directly measurable driving parameters for road vehicle drive control systems not related to the control of a particular sub unit, e.g. by using mathematical models related to drivers or passengers
    • B60W2040/0818—Inactivity or incapacity of driver
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W40/00—Estimation or calculation of non-directly measurable driving parameters for road vehicle drive control systems not related to the control of a particular sub unit, e.g. by using mathematical models
    • B60W40/08—Estimation or calculation of non-directly measurable driving parameters for road vehicle drive control systems not related to the control of a particular sub unit, e.g. by using mathematical models related to drivers or passengers
    • B60W2040/0872—Driver physiology
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W2540/00—Input parameters relating to occupants
    • B60W2540/215—Selection or confirmation of options
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W2540/00—Input parameters relating to occupants
    • B60W2540/22—Psychological state; Stress level or workload
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W2540/00—Input parameters relating to occupants
    • B60W2540/221—Physiology, e.g. weight, heartbeat, health or special needs
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W2556/00—Input parameters relating to data
    • B60W2556/45—External transmission of data to or from the vehicle
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W2720/00—Output or target parameters relating to overall vehicle dynamics
    • B60W2720/10—Longitudinal speed
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W2756/00—Output or target parameters relating to data
    • B60W2756/10—Involving external transmission of data to or from the vehicle
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60Y—INDEXING SCHEME RELATING TO ASPECTS CROSS-CUTTING VEHICLE TECHNOLOGY
    • B60Y2302/00—Responses or measures related to driver conditions
    • B60Y2302/05—Leading to automatic stopping of the vehicle
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C5/00—Registering or indicating the working of vehicles
    • G07C5/008—Registering or indicating the working of vehicles communicating information to a remotely located station

Definitions

  • the present application relates to the field of automatic driving, and in particular, to an automatic driving method, an ADS and an automatic driving vehicle.
  • the dynamic driving task, DDT defines the level of automatic driving (that is, there are 6 levels of automatic driving from L0 to L5), but it lacks the consideration of driving safety. Based on this, according to the current status of the discovery of autonomous driving technology, an autonomous driving strategy with driving safety as the core, especially for scenarios where the health status of drivers and passengers is uncertain, needs to be launched urgently.
  • the embodiments of the present application provide an automatic driving method, an ADS and an automatic driving vehicle, which are used to newly add a range of health and physiological data as a set of applicable scopes of the ODD within the operational design domain (ODD). If the real-time physiological data deviates from this range and lasts for a certain period of time, the automatic driving system (ADS) will determine the abnormal health of the driver and passenger, and execute the corresponding first driving strategy according to the degree of deviation and the duration, so as to achieve the correct Timely response to unexpected health accidents of drivers and passengers to reduce the incidence of traffic accidents.
  • ADS automatic driving system
  • an embodiment of the present application first provides an automatic driving method, which can be used in the field of automatic driving.
  • the method includes: first, the driver and occupant in the automatic driving vehicle deployed with ADS wear a monitoring device (eg, a smart watch). , smart bracelet, smart heart rate monitor and other wearable devices), the monitoring device can collect real-time physiological data of drivers and passengers in real time, and the collected real-time physiological data is then connected to ADS through communication protocols (such as Bluetooth, WiFi, etc.) . After ADS receives the real-time physiological data of the driver and passenger sent by the monitoring device, it will judge whether the real-time physiological data deviates from the range of healthy physiological data.
  • ADS determines that the difference between the received real-time physiological data and the range of healthy physiological data is greater than the preset value , then further determine whether the duration of the real-time physiological data deviating from the range of healthy physiological data is greater than the first preset duration, when the ADS determines that the duration of the real-time physiological data deviating from the range of healthy physiological data is greater than the first preset duration, then the ADS will automatically drive The automatic driving service being executed by the vehicle is degraded, and the first driving strategy is executed according to the specific value of the difference and the duration.
  • the scope of the health and physiological data is a set of applicable scopes added to the ODD in advance, and an additional set of applicable scopes used to represent the health indicators of drivers and passengers is added to the ODD defined in the automatic driving classification standard J3016TM, that is, the scope of health and physiological data, such as , normal heart rate range, normal blood pressure range, etc., the ODD is deployed on the ADS.
  • the ADS determines that the driver and passenger have abnormal health , and implement the corresponding first driving strategy according to the degree of deviation and duration, so as to timely respond to sudden health accidents of drivers and passengers and reduce the incidence of traffic accidents.
  • ADS will issue an authorization request to the driver and passenger, and the authorization request can be communicated to the driver and passenger by voice broadcast, or it can be displayed to the driver by means of interface display (provided that a display screen is deployed on the autonomous vehicle). It is communicated by the passengers, which is not limited here.
  • the authorization request is used to ask the driver and passenger whether the second driving strategy needs to be executed. After the driver and passenger receives the authorization request sent by the ADS, in the case that the driver and passenger accepts the authorization request, the ADS executes the second driving strategy.
  • the second driving strategy is essentially an upgrade of the original risk mitigation strategy. No matter which automatic driving level the existing risk mitigation strategy is at, when there is an ADS that cannot perform dynamic driving tasks or the driver and passenger When the dynamic driving task cannot be taken over, the ultimate focus of the risk mitigation strategy is to "stop the vehicle", that is, only consider the vehicle safety in a narrow sense.
  • the ultimate focus of the risk mitigation strategy is to "stop the vehicle", that is, only consider the vehicle safety in a narrow sense.
  • there are more efforts to be done in the vehicle including but not limited to calling for help, organizing rescue, and requesting emergency access. , booking medical resources and other measures.
  • the second driving strategy may be: pull over to a side road, call for rescue, establish a communication connection with a medical institution, plan a driving path between the autonomous vehicle and the medical institution, Any one or more of booking medical resources and requesting emergency medical access.
  • the ADS executing the first driving strategy according to the difference and the duration may specifically be: determining the health level of the driver and passenger according to the difference and the duration, and when the ADS determines the health level If it is a mild abnormality, the first driving strategy may be any one or more of ADS controlling the speed of the autonomous vehicle to drop below a preset speed (eg, below 60km/h), driving on the side road, and turning on double jump lights. item.
  • a preset speed eg, below 60km/h
  • the first driving strategy is when the automatic driving level is L4 or L5, when the health level of the driver and passenger is slightly abnormal, that is, the deviation based on real-time physiological data
  • the difference between the health and physiological data ranges and the duration of the deviation determine the health level, and different first driving strategies are adopted based on different health levels, which are more targeted.
  • the first driving strategy when the automatic driving level is L4 or L5, when the ADS determines that the health level is severely abnormal, the first driving strategy may be that the ADS controls the speed of the automatic driving vehicle to decrease slowly Go to zero, pull over to the sidewalk, turn on the double jump lights, run at idle speed, turn on the outer circulation of the vehicle, turn on the inner circulation of the vehicle, set the target temperature in the vehicle, and unlock the central door lock.
  • the first driving strategy is when the level of automatic driving is L4 or L5, when the health level of the driver and passenger is severely abnormal, that is, the deviation from health based on real-time physiological data
  • the difference in the range of physiological data and the duration of the deviation determine the health level, and different first driving strategies are adopted based on different health levels, which is more targeted.
  • the driver and occupant are the driver in the driving position of the automatic driving vehicle.
  • the difference between the real-time physiological data deviating from the healthy physiological data range is greater than the preset value, and the duration of the real-time physiological data deviating from the healthy physiological data range is greater than the first preset duration, it means that there is a high probability that the driver and passenger have a health condition, and the ADS will Locking the ADS occupies the control of the autonomous vehicle, that is, the control of the vehicle cannot be handed over to the driver and occupant.
  • the ADS further determines the health level of the driver and passenger according to the difference of the deviation and the duration of the deviation, and executes the corresponding first driving strategy according to the health level.
  • the first driving strategy may also be that the ADS controls the speed of the autonomous vehicle to drop below the preset speed (eg , below 60km/h), driving on the side road, and turning on any one or more of the double jump lights.
  • the first driving strategy can also be any one of the ADS controlling the speed of the autonomous vehicle to drop below the preset speed, driving over to the side lane, turning on the double jump lights, or Multiple items, that is, the health level is determined based on how much the real-time physiological data deviates from the range of healthy physiological data and the duration of the deviation, and different first driving strategies are adopted based on different health levels, which is more targeted.
  • the first driving strategy in the case where the automatic driving level is L3, when the ADS determines that the health level is severely abnormal, the first driving strategy will not only lock the ADS to occupy the control right of the automatic driving vehicle, but also It can be: ADS controls the speed of the self-driving vehicle to slowly drop to zero, pull over to the side road, turn on the double jump lights, run at idle speed, turn on the outer circulation of the vehicle, turn on the inner circulation of the vehicle, set the target temperature in the vehicle, and unlock the central door lock any one or more of .
  • the first driving strategy can also control the speed of the self-driving vehicle to slowly drop to zero, pull over to the sidewalk, turn on the double jump lights, run at an idle speed, turn on the outer loop of the vehicle, and turn on the vehicle.
  • any one or more of the internal circulation, setting the target temperature in the car, and unlocking the central door lock that is, based on the difference between the real-time physiological data and the range of the healthy physiological data and the duration of the deviation to determine the health level, and Different first driving strategies are adopted based on different health levels, which are more targeted. And in the above-mentioned embodiment of the present application, only when the health level of the driver and passenger is normal, the driver and passenger has the right to take over the vehicle control, otherwise the vehicle control cannot be handed over to the driver, thus avoiding the problem of the driver and passenger. Vehicle risk and personal safety due to physical inability to actually take over for a period of time.
  • the ADS can control the automatic driving vehicle to restore the degraded automatic driving business.
  • the ADS downgrades the automatic driving service to "high-speed following the car, speed 60km/h", and continuously monitor the real-time physiological data collected subsequently, if the monitored real-time physiological data returns to the range of healthy physiological data within the second preset time period (eg, 8 minutes), then the ADS will be degraded to " High-speed following the car, the speed of 60km/h" automatic driving business returns to the original "high-speed following the car, the speed of 100km/h".
  • the ADS can control the self-driving vehicle to restore the degraded self-driving service, which improves the user experience.
  • the ADS may also generate an event log based on the real-time physiological data, and the event log is used to record abnormal real-time physiological data and subsequent events during the period when the real-time physiological data deviates from the healthy physiological data range.
  • a series of operations of the ADS, and the event log is reported periodically (eg, every 5 minutes) to the cloud server corresponding to the self-driving vehicle.
  • the ADS can record all health-related data and operations during the period of abnormal real-time physiological data as an event log and periodically report it to the cloud corresponding to the autonomous vehicle for backup, thereby facilitating the definition of human and vehicle responsibilities.
  • the real-time physiological data includes at least one of the following physiological data: real-time blood pressure, real-time heart rate, real-time blood oxygen, real-time body temperature, premature heart beat, atrial fibrillation of the driver
  • Other real-time physiological data as long as it is the physiological data that can be collected by the monitoring equipment and can reflect the health status of the driver and passengers, it is not limited here.
  • a second aspect of the embodiments of the present application provides an ADS, where the ADS has the function of implementing the method of the first aspect or any possible implementation manner of the first aspect.
  • This function can be implemented by hardware or by executing corresponding software by hardware.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • a third aspect of an embodiment of the present application provides an ADS, which may include a memory, a processor, and a bus system, wherein the memory is used to store a program, and the processor is used to call the program stored in the memory to execute the first aspect of the embodiment of the present application or A method for any possible implementation of the first aspect.
  • a fourth aspect of an embodiment of the present application provides an automatic driving vehicle.
  • the automatic driving vehicle includes a processor and a memory, wherein the memory is used for storing a program, and the processor is used for calling the program stored in the memory to execute the first embodiment of the present application. Aspect or a method of any possible implementation of the first aspect.
  • a fifth aspect of the present application provides a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, when the computer-readable storage medium runs on a computer, the computer can execute the first aspect or any one of the possible implementations of the first aspect way method.
  • a sixth aspect of the embodiments of the present application provides a computer program product, which, when running on a computer, enables the computer to execute the first aspect or the method of any possible implementation manner of the first aspect.
  • a sixth aspect of an embodiment of the present application provides a chip, the chip includes at least one processor and at least one interface circuit, the interface circuit is coupled to the processor, and the at least one interface circuit is configured to perform a transceiving function and send an instruction to At least one processor, at least one processor is used to run a computer program or instruction, which has the function of implementing the method as described above in the first aspect or any possible implementation manner of the first aspect, and the function can be implemented by hardware or software.
  • the implementation can also be implemented by a combination of hardware and software, where the hardware or software includes one or more modules corresponding to the above functions.
  • the interface circuit is used to communicate with other modules outside the chip.
  • Figure 1 is a schematic diagram of the ODD defined in Figure 11 in Chapter 6 of the automatic driving classification standard J3016TM;
  • FIG. 2 is a schematic diagram of adding a set of additionally to the defined ODD in an embodiment of the present application to represent the applicable scope of the health indicators of drivers and passengers;
  • FIG. 3 is a schematic diagram of the relationship between different automatic driving levels and manual driving provided by an embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of an automatic driving vehicle provided by an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of an automatic driving method provided by an embodiment of the present application.
  • FIG. 6 is a schematic diagram of an example of an automatic driving method provided by an embodiment of the present application.
  • FIG. 7 is a schematic diagram of another example of an automatic driving method provided by an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of an ADS provided in an embodiment of the present application.
  • FIG. 9 is another schematic structural diagram of an ADS provided by an embodiment of the present application.
  • the embodiments of the present application provide an automatic driving method, an ADS, and an automatic driving vehicle, which are used to newly add a range of healthy physiological data in the ODD as a set of applicable ranges of the ODD.
  • the ADS will determine that the driver and passenger have abnormal health, and implement the corresponding first driving strategy according to the degree of deviation and duration, so as to timely respond to the sudden health accident of the driver and passenger and reduce the incidence of traffic accidents. .
  • ADS Automatic driving system
  • ADS is a system composed of hardware and software that realizes driving automation. It can also be called a control system.
  • a vehicle deployed with ADS is called an autonomous vehicle, and can also be called an unmanned vehicle, a computer-driven vehicle, or a wheeled vehicle. mobile robots, etc.
  • autonomous vehicles Under the control of ADS, autonomous vehicles are equipped with advanced on-board sensors, controllers, data processors, actuators and other devices, and use modern mobile communication and network technologies such as the Internet of Vehicles, 5G and V2X to realize the communication between traffic participants and each other. Exchange and share, so as to have the functions of sensing perception, decision planning, control execution and other functions in complex environments.
  • the entire workflow of an autonomous vehicle is as follows: first, the external environment is perceived and identified through radar, lidar, camera, and in-vehicle networking system, etc., to obtain the perception information of the external environment; then, in the fusion of multiple On the basis of the perception information, the intelligent algorithm is used to learn the external scene information, predict the trajectory of the traffic participants in the scene, and plan the running trajectory of the self-vehicle; finally, track the trajectory target of the decision-making plan, and control the driving actions such as the accelerator, brake and steering of the vehicle. , adjust the state of vehicle speed, position and direction to ensure the safety, maneuverability and stability of the vehicle.
  • ODD can also be called design operation domain, design application domain, design driving area, etc., which refers to the environment in which autonomous driving vehicles work safely. (that is, the scope of application of autonomous driving).
  • the weather environment, road conditions (eg, straight road, radius of curve, etc.), vehicle speed, traffic flow and other information are measured to ensure that the system's capabilities are within a safe environment.
  • a safe working environment for autonomous vehicles including speed (high speed, low speed, etc.), terrain (plain, mountainous, etc.), road conditions (straight roads, detours, etc.), environment (weather, climate, infrastructure, etc.), traffic conditions (Simple, complex, illegal behavior, fixed route, etc.), time period (day, night), ..., because of high-speed or low-speed, plain or mountainous, straight or detour, weather conditions, infrastructure, simple or complex traffic conditions, A series of conditions such as day or night will have a decisive effect on the performance of autonomous driving.
  • Figure 1 is the ODD defined in Figure 11 in Chapter 6 of the automatic driving classification standard J3016TM.
  • the factors considered include vehicle speed, terrain, road type, weather environment, traffic state, time, etc.
  • the operating conditions that the ODD corresponding to different automatic driving levels needs to meet can be different.
  • the operating conditions for Level 2 (ie L2 level) corresponding to the ODD operating conditions are: daytime, highway, and vehicle speed less than or equal to 35 miles. Hourly (unit: mph); while Level 4 (ie L4) corresponds to the operating conditions of ODD, and the elements that need to be met are: daytime, campus roads, and vehicle speed less than or equal to 25mph.
  • ODD Whether ODD is comprehensive and meticulous can reflect to a certain extent whether the autonomous driving solution is mature; and whether the conditions set by ODD are loose or not can also reflect the level of solutions at the same level to a certain extent. If it can only be used within a strictly limited range, the "intelligence" of the vehicle may be relatively low, and the actual use of the scene is relatively small and the experience is slightly poor.
  • an additional set of ODDs are added to the ODD defined in the automatic driving classification standard J3016TM to indicate the applicable range of the health indicators of drivers and passengers, that is, the range of health and physiological data. , for example, the normal heart rate range, the normal blood pressure range, etc., so as to avoid the vehicle risk caused by the fact that the vehicle takeover person does not have the ability to take over the vehicle during a certain period of time due to physical health problems.
  • the newly added range of health and physiological data can be added to the ODD under each automatic driving level, especially the ODD under the L3 to L5 level.
  • the ODD integrates the health indicators of the driver and occupant (the driver and passenger of the L3 level are the driver), that is, the driver's ability to take over is considered; in the automatic driving level L4 and L5
  • the drivers and passengers have no obligation and way to take over, and the corresponding ODD also needs to integrate the health indicators of the drivers and passengers to guide the ADS to implement subsequent risk mitigation strategies.
  • the conditions under which the driving automation function can work properly as determined during the design run including the ODD, driver status, and other necessary conditions.
  • Dynamic driving tasks refer to all real-time operational and tactical functions (decision-like behaviors) required for vehicles to drive on the road, excluding strategic functions such as itinerary, destination and route selection. Specifically, it refers to the operations and decisions that need to be made to drive a vehicle on the road, including operations on the lateral and longitudinal directions of the vehicle, monitoring the surrounding environment of the vehicle and performing corresponding operations, etc.
  • dynamic driving tasks can be understood as several specific functions implemented by automatic driving solutions. In today's mass-produced assisted driving and autonomous driving models, the more common car-following, adaptive cruise, emergency braking, as well as the paddle changing lanes and active overtaking equipped with very few models are typical dynamic driving. Task.
  • graded early warning is a relatively common dynamic driving task support operation.
  • deceleration and parking are relatively common and common designs.
  • Risk reduction measures taken by the ADS such as in-lane parking, when the ADS cannot perform the dynamic driving task, or when the driver and occupant cannot take over the dynamic driving task.
  • the automatic driving classification standard J3016TM sets the automatic driving technology into six levels, namely Level0, Level1, Level2, Level3, Level4, Level5, also referred to as L0, L1 , L2, L3, L4, L5.
  • the automatic driving classification standard J3016TM points out that ODD is a sufficient condition to meet different automatic driving levels.
  • ADS can realize automatic driving corresponding to the automatic driving level.
  • ODD is not satisfied Under the corresponding design operating conditions, it can only be driven manually by the driver.
  • each automatic driving level is shown in Table 1, where the system in Table 1 is ADS.
  • ADS the system in Table 1 is ADS.
  • each level of autonomous driving is shown in Table 1, where the system in Table 1 is ADS.
  • Level L0 Also known as emergency assistance, the driver fully controls the vehicle without any active safety configuration. At present, vehicles with this level of autonomous driving have almost disappeared on the market.
  • Level 1 Also known as partial driver assistance, ADS can assist the driver in certain driving tasks in some situations.
  • L2 level Also known as combined driving assistance, ADS can complete certain driving tasks, but the driver needs to monitor the driving environment and ensure that the vehicle can be taken over at any time if there is a problem. At this level of automatic driving, ADS's wrong perception and judgment At present, most car companies can provide L2-level ADS, which can divide traffic scenarios into different usage scenarios based on speed and environment, such as low-speed traffic jams on loops, fast driving on expressways, drivers in the car automatic parking, etc.
  • Level 3 Also known as conditional autonomous driving, ADS can not only complete certain driving tasks, but also monitor the driving environment in certain situations, that is, ADS is required to control the vehicle to complete all dynamic driving tasks within the limited ODD. But the driver must be prepared to regain control of the vehicle. Specifically, the ADS will send a control transfer request when it fails or exceeds the ODD range corresponding to the automatic driving level.
  • the automatic driving classification standard J3016TM also defines that the ADS can continue to control the vehicle for a few seconds after the control transfer request is issued. A period of time is used for the driver to prepare for taking over the control of the vehicle, for example, the driver's hands are on the steering wheel, the driver's eyes are facing the front of the vehicle, etc.
  • ADS can detect whether the driver's hands are on the steering wheel through the capacitive steering wheel ⁇ Use the monitoring camera in the driving seat to detect whether the driver's eyes are looking at the road, etc. to determine whether the driver is ready to take over the vehicle. If ADS determines that the driver is ready to take over the vehicle, the ADS will transfer the control of the vehicle to the driver. member. Therefore, at this level of autonomous driving, the driver is still unable to sleep or take a deep rest.
  • Level 4 Also known as highly automated driving, ADS can complete driving tasks and monitor the driving environment in certain environments and specific conditions, that is, ADS is required to not only complete dynamic driving tasks in ODD, but also be able to deal with system failures without needing The driver and occupant (since the L4 level vehicle does not need a driver, there is no driver under this automatic driving level, only the driver and occupant) to intervene.
  • L4 autonomous driving is mostly based on urban use, which can be fully automatic valet parking or directly combined with taxi services.
  • all tasks related to driving have nothing to do with the driver and passengers, and the ADS is responsible for sensing the outside world.
  • Level L5 Also known as fully autonomous driving, ADS can complete all driving tasks under all conditions, that is, full-condition unmanned driving, without defining ODD, and can complete all dynamic driving tasks and handle all dynamic driving tasks support.
  • Table 1 Relationship between automatic driving level and corresponding division elements
  • the driver and passenger essentially refers to the person located in the driving position of the automatic driving vehicle.
  • the automatic driving level is L3 or lower, the driver and passenger may also be called the driver at this time.
  • the driver and passenger In some driving tasks, there is vehicle control right to control the self-driving vehicle; but at the L4 or L5 level of automatic driving, the person in the driving position of the self-driving vehicle does not have the vehicle control right to control the self-driving vehicle. In this case, they cannot be called the driver, but are generally called the driver and passenger. Therefore, in the embodiments of the present application, the drivers and passengers are drivers at levels L3 and below, and are drivers and passengers at levels L4 and L5, which are collectively referred to as drivers and passengers in the embodiments of the present application.
  • the embodiment of the present application first introduces the specific functions of each structure inside the autonomous driving vehicle.
  • FIG. 4 is a schematic structural diagram of the autonomous driving vehicle provided by the embodiment of the present application.
  • the self-driving vehicle 100 is configured in a fully or partially self-driving mode, for example, the self-driving vehicle 100 can control itself while in the self-driving mode, and can determine the current state of the vehicle and its surrounding environment through human operation, determine A possible behavior of at least one other vehicle in the surrounding environment, and a confidence level corresponding to the possibility that the other vehicle performs the possible behavior is determined, and the autonomous driving vehicle 100 is controlled based on the determined information.
  • the autonomous vehicle 100 may also be placed to operate without human interaction when the autonomous vehicle 100 is in the autonomous driving mode.
  • the autonomous vehicle 100 may include various subsystems, such as a travel system 102, a sensor system 104 (eg, cameras, SICK, IBEO, LIDAR, etc. in FIG. 3 are all modules in the sensor system 104), an autonomous driving system 106, One or more peripherals 108 as well as power supply 110 , computer system 112 and user interface 116 .
  • the autonomous vehicle 100 may include more or fewer subsystems, and each subsystem may include multiple components. Additionally, each of the subsystems and components of the autonomous vehicle 100 may be wired or wirelessly interconnected.
  • the travel system 102 may include components that provide powered motion for the autonomous vehicle 100 .
  • travel system 102 may include engine 118 , energy source 119 , transmission 120 , and wheels/tires 121 .
  • the engine 118 may be an internal combustion engine, an electric motor, an air compression engine, or other types of engine combinations, such as a hybrid engine composed of a gasoline engine and an electric motor, and a hybrid engine composed of an internal combustion engine and an air compression engine.
  • Engine 118 converts energy source 119 into mechanical energy. Examples of energy sources 119 include gasoline, diesel, other petroleum-based fuels, propane, other compressed gas-based fuels, ethanol, solar panels, batteries, and other sources of electricity.
  • the energy source 119 may also provide energy to other systems of the autonomous vehicle 100 .
  • Transmission 120 may transmit mechanical power from engine 118 to wheels 121 .
  • Transmission 120 may include a gearbox, a differential, and a driveshaft. In one embodiment, transmission 120 may also include other devices, such as clutches.
  • the drive shaft may include one or more axles that may be coupled to one or more wheels 121 .
  • the sensor system 104 may include several sensors that sense information about the environment surrounding the autonomous vehicle 100 .
  • the sensor system 104 may include a positioning system 122 (the positioning system may be a global positioning GPS system, a Beidou system or other positioning systems), an inertial measurement unit (IMU) 124, a radar 126, a laser rangefinder 128 and camera 130.
  • the sensor system 104 may also include sensors that monitor the internal systems of the autonomous vehicle 100 (eg, an in-vehicle air quality monitor, a fuel gauge, an oil temperature gauge, etc.). Sensing data from one or more of these sensors can be used to detect objects and their corresponding properties (position, shape, orientation, velocity, etc.). This detection and identification is a critical function for the safe operation of the autonomous autonomous vehicle 100 .
  • the laser sensor is a very important sensing module in the sensor system 104 .
  • the positioning system 122 may be used to estimate the geographic location of the autonomous vehicle 100.
  • a laser sensor may be used as one of the positioning systems 122 to achieve precise positioning of the autonomous vehicle 100.
  • the IMU 124 is used for Position and orientation changes of the autonomous vehicle 100 are sensed based on inertial acceleration.
  • IMU 124 may be a combination of an accelerometer and a gyroscope.
  • the radar 126 can use radio signals to perceive objects in the surrounding environment of the autonomous vehicle 100 , and can be embodied as a millimeter-wave radar or a lidar. In some embodiments, in addition to sensing objects, radar 126 may be used to sense the speed and/or heading of objects.
  • the laser rangefinder 128 may utilize the laser light to sense objects in the environment in which the autonomous vehicle 100 is located.
  • the laser rangefinder 128 may include one or more laser sources, laser scanners, and one or more detectors, among other system components.
  • Camera 130 may be used to capture multiple images of the surrounding environment of autonomous vehicle 100 .
  • Camera 130 may be a still camera or a video camera.
  • the automatic driving system 106 controls the operation of the automatic driving vehicle 100 and its components. Therefore, in this embodiment of the present application, the automatic driving system 106 may also be referred to as a control system.
  • the automated driving system 106 may include various components, including a steering system 132 , a throttle 134 , a braking unit 136 , a computer vision system 140 , a line control system 142 , and an obstacle avoidance system 144 .
  • the steering system 132 is operable to adjust the heading of the autonomous vehicle 100 .
  • it may be a steering wheel system.
  • the throttle 134 is used to control the operating speed of the engine 118 and thus the speed of the autonomous vehicle 100 .
  • the braking unit 136 is used to control the deceleration of the autonomous vehicle 100 .
  • the braking unit 136 may use friction to slow the wheels 121 .
  • the braking unit 136 may convert the kinetic energy of the wheels 121 into electrical current.
  • the braking unit 136 may also take other forms to slow the wheels 121 to control the speed of the autonomous vehicle 100 .
  • Computer vision system 140 may be operable to process and analyze images captured by camera 130 in order to identify objects and/or features in the environment surrounding autonomous vehicle 100 .
  • the objects and/or features may include traffic signals, road boundaries and obstacles.
  • Computer vision system 140 may use object recognition algorithms, structure from motion (SFM) algorithms, video tracking, and other computer vision techniques.
  • SFM structure from motion
  • the computer vision system 140 may be used to map the environment, track objects, estimate the speed of objects, and the like.
  • the route control system 142 is used to determine the travel route and travel speed of the autonomous vehicle 100 .
  • the route control system 142 may include a lateral planning module 1421 and a longitudinal planning module 1422, respectively, for combining information from the obstacle avoidance system 144, the GPS 122, and one or more predetermined maps
  • the data for the autonomous vehicle 100 determines the driving route and driving speed.
  • Obstacle avoidance system 144 is used to identify, evaluate and avoid or otherwise traverse obstacles in the environment of autonomous vehicle 100 , which may be embodied as actual obstacles and virtual moving objects that may collide with autonomous vehicle 100 .
  • the autonomous driving system 106 may additionally or alternatively include components in addition to those shown and described. Alternatively, some of the components shown above may be reduced.
  • Peripherals 108 may include a wireless communication system 146 , an onboard computer 148 , a microphone 150 and/or a speaker 152 .
  • peripherals 108 provide a means for a user of autonomous vehicle 100 to interact with user interface 116 .
  • the onboard computer 148 may provide information to a user of the autonomous vehicle 100 .
  • User interface 116 may also operate on-board computer 148 to receive user input.
  • the onboard computer 148 can be operated via a touch screen.
  • peripherals 108 may provide a means for autonomous vehicle 100 to communicate with other devices located within the vehicle.
  • Wireless communication system 146 may wirelessly communicate with one or more devices, either directly or via a communication network.
  • wireless communication system 146 may use 3G cellular communications, such as CDMA, EVDO, GSM/GPRS, or 4G cellular communications, such as LTE. Or 5G cellular communications.
  • the wireless communication system 146 may communicate using a wireless local area network (WLAN).
  • WLAN wireless local area network
  • the wireless communication system 146 may communicate directly with the device using an infrared link, Bluetooth, or ZigBee.
  • Other wireless protocols, such as various vehicle communication systems, for example, wireless communication system 146 may include one or more dedicated short range communications (DSRC) devices, which may include communication between vehicles and/or roadside stations public and/or private data communications.
  • DSRC dedicated short range communications
  • the power source 110 may provide power to various components of the autonomous vehicle 100 .
  • the power source 110 may be a rechargeable lithium ion or lead acid battery.
  • One or more battery packs of such batteries may be configured as a power source to provide power to various components of the autonomous vehicle 100 .
  • power source 110 and energy source 119 may be implemented together, such as in some all-electric vehicles.
  • Computer system 112 may include at least one processor 113 that executes instructions 115 stored in a non-transitory computer-readable medium such as memory 114 .
  • Computer system 112 may also be a plurality of computing devices that control individual components or subsystems of autonomous vehicle 100 in a distributed fashion.
  • the processor 113 may be any conventional processor, such as a commercially available central processing unit (CPU).
  • the processor 113 may be a dedicated device such as an application specific integrated circuit (ASIC) or other hardware-based processor.
  • processors, memory, and other components of the computer system 112 may actually include not stored in the same Multiple processors, or memories, within a physical enclosure.
  • memory 114 may be a hard drive or other storage medium located within a different enclosure than computer system 112 .
  • references to processor 113 or memory 114 will be understood to include references to sets of processors or memories that may or may not operate in parallel.
  • some components such as the steering and deceleration components may each have their own processor that only performs computations related to component-specific functions .
  • the processor 113 may be located remotely from the autonomous vehicle 100 and in wireless communication with the autonomous vehicle 100 . In other aspects, some of the processes described herein are performed on the processor 113 disposed within the autonomous vehicle 100 while others are performed by the remote processor 113, including taking the necessary steps to perform a single maneuver.
  • memory 114 may include instructions 115 (eg, program logic) executable by processor 113 to perform various functions of autonomous vehicle 100 , including those described above. Memory 114 may also contain additional instructions, including sending data to, receiving data from, interacting with, and/or controlling one or more of travel system 102 , sensor system 104 , autonomous driving system 106 , and peripherals 108 instruction. In addition to instructions 115, memory 114 may store data such as road maps, route information, vehicle location, direction, speed, and other such vehicle data, among other information. Such information may be used by the autonomous vehicle 100 and the computer system 112 during operation of the autonomous vehicle 100 in autonomous, semi-autonomous, and/or manual modes.
  • instructions 115 eg, program logic
  • a user interface 116 for providing information to or receiving information from a user of the autonomous vehicle 100 .
  • user interface 116 may include one or more input/output devices within the set of peripheral devices 108 , such as wireless communication system 146 , onboard computer 148 , microphone 150 and speaker 152 .
  • Computer system 112 may control functions of autonomous vehicle 100 based on input received from various subsystems (eg, travel system 102 , sensor system 104 , and autonomous driving system 106 ) and from user interface 116 .
  • computer system 112 may utilize input from autopilot system 106 in order to control steering system 132 to avoid obstacles detected by sensor system 104 and obstacle avoidance system 144 .
  • computer system 112 is operable to provide control over many aspects of autonomous vehicle 100 and its subsystems.
  • one or more of these components described above may be installed or associated with the autonomous vehicle 100 separately.
  • memory 114 may exist partially or completely separate from autonomous vehicle 100 .
  • the above-described components may be communicatively coupled together in wired and/or wireless fashion.
  • An autonomous vehicle traveling on a road can identify objects within its surroundings to determine adjustments to current speed.
  • the objects may be other vehicles, traffic control equipment, or other types of objects.
  • each identified object may be considered independently, and based on the object's respective characteristics, such as its current speed, acceleration, distance from the vehicle, etc., may be used to determine the speed at which the autonomous vehicle is to adjust.
  • autonomous vehicle 100 or a computing device associated with autonomous vehicle 100 such as computer system 112, computer vision system 140, memory 114 of FIG. traffic, rain, ice on the road, etc.
  • each identified object is dependent on the behavior of the other, so it is also possible to predict the behavior of a single identified object by considering all identified objects together.
  • the autonomous vehicle 100 can adjust its speed based on the predicted behavior of the identified object. In other words, the autonomous vehicle 100 can determine what steady state the vehicle will need to adjust to (eg, accelerate, decelerate, or stop) based on the predicted behavior of the object.
  • the computing device may also provide instructions to modify the steering angle of the autonomous vehicle 100 so that the autonomous vehicle 100 follows a given trajectory and/or maintains a close proximity to the autonomous vehicle 100 safe lateral and longitudinal distances for objects that are not in use (for example, cars in adjacent lanes on the road).
  • the self-driving vehicle 100 can be a car, a truck, a motorcycle, a bus, a boat, an airplane, a helicopter, a lawn mower, a recreational vehicle, a playground vehicle, construction equipment, a tram, a golf cart, a train, a cart, etc. , the embodiments of the present application are not particularly limited.
  • FIG. 5 is a schematic flowchart of the automatic driving method provided by the embodiment of the present application. It includes the following steps:
  • the automatic driving system ADS receives the real-time physiological data of the driver and passenger collected by the monitoring device.
  • the drivers and passengers in the self-driving vehicle with ADS are equipped with monitoring equipment (such as smart watches, smart bracelets, smart heart rate monitors and other wearable devices), which can collect real-time physiological data of the drivers and passengers in real time.
  • monitoring equipment such as smart watches, smart bracelets, smart heart rate monitors and other wearable devices
  • real-time physiological data such as heart rate, blood pressure, blood oxygen, body temperature, premature heart beat, atrial fibrillation, etc. of drivers and passengers can be collected, and the collected real-time physiological data can then be connected to ADS through communication protocols (such as Bluetooth, WiFi, etc.) .
  • the driver and passenger essentially refers to the person located in the driving seat of the autonomous vehicle.
  • the driver and passenger can also Known as the driver, in some driving tasks, has the vehicle control right to control the autonomous vehicle; but at the level of autopilot L4 or L5, the person in the driving position of the autonomous vehicle does not have the vehicle control to control the autonomous vehicle In this case, they cannot be called the driver, but are generally called the driver and passenger. Therefore, in the embodiments of the present application, the drivers and passengers are drivers at levels L3 and below, and are drivers and passengers at levels L4 and L5, which are collectively referred to as drivers and passengers in the embodiments of the present application.
  • the ADS performs an automatic driving operation on the automatic driving service being performed by the automatic driving vehicle. de-escalate, and execute the first driving strategy according to the difference and the duration, and the range of health and physiological data is a set of applicable ranges added in advance to the design operating range ODD.
  • ADS After ADS receives the real-time physiological data of the driver and passenger sent by the monitoring device, it will judge whether the real-time physiological data deviates from the range of healthy physiological data. When ADS determines that the difference between the received real-time physiological data and the range of healthy physiological data is greater than the preset value , then further determine whether the duration of the real-time physiological data deviating from the range of healthy physiological data is greater than the first preset duration, when the ADS determines that the duration of the real-time physiological data deviating from the range of healthy physiological data is greater than the first preset duration, then the ADS will automatically drive The automatic driving service being executed by the vehicle is degraded, and the first driving strategy is executed according to the specific value of the difference and the duration.
  • the scope of the health and physiological data is a set of applicable scopes added to the ODD in advance.
  • an additional set of ODDs has been added to the ODD defined by the automatic driving classification standard J3016TM to indicate the health of the driver and passengers.
  • the applicable range of the indicator that is, the range of healthy physiological data, for example, the normal heart rate range, the normal blood pressure range, etc., the ODD is deployed on the ADS. Therefore, the vehicle risk caused by the fact that the vehicle takeover personnel cannot actually take over the vehicle within a certain period of time due to physical health problems can be avoided.
  • the newly added range of health and physiological data can be added to the ODD under each automatic driving level, especially the ODD under the L3 to L5 level.
  • the ODD integrates the health indicators of the driver and occupant (the driver and passenger of the L3 level are the driver), that is, the driver's ability to take over is considered; in the automatic driving level L4 and L5
  • the drivers and passengers have no obligation and way to take over, and the corresponding ODD also needs to integrate the health indicators of the drivers and passengers to guide the ADS to implement subsequent risk mitigation strategies.
  • the above step 502 is described below by taking the real-time physiological data collected by the monitoring device as the real-time heart rate and the healthy physiological data range as the healthy heart rate range. If the real-time heart rate of the driver and passenger collected by the monitoring equipment at a certain moment is 120 beats/min to 160 beats/min, which exceeds the healthy heart rate range, then the ADS will be triggered to start timing, assuming that the first preset duration set in advance is 3 After reaching 3 minutes, the real-time heart rate collected by the monitoring device within these 3 minutes is still 120 beats/min to 160 beats/min, that is, the duration of the abnormal real-time heart rate reaches 3 minutes, and the real-time heart rate and health The difference between the heart rate range is 20 beats/min to 60 beats/min, which is greater than the preset value (assuming the preset value is 20 beats/min), then there is a high probability that the driver and passenger have a sudden health condition.
  • the ADS The "high-speed following" business being performed by the autonomous vehicle (assuming that the self-driving business being performed is the “high-speed following” business) will be downgraded, for example, the original speed will be changed from 100 km/h (unit: km/h) Slowly reduce the speed to 70km/h, and implement the first driving strategy according to the difference and the duration.
  • the first driving strategy may be to drive on the side road and turn on the double jump lights to warn.
  • the driver and passenger are the driver in the driving seat of the automatic driving vehicle.
  • the difference between the real-time physiological data deviating from the healthy physiological data range is greater than the preset value, and the duration of the real-time physiological data deviating from the healthy physiological data range is greater than the first preset duration, it means that there is a high probability that the driver and passenger have a health condition.
  • the ADS will lock the ADS to occupy the control of the autonomous vehicle, that is, the control of the vehicle cannot be handed over to the driver. After that, the ADS further determines the health level of the driver and passenger according to the difference of the deviation and the duration of the deviation, and executes the corresponding first driving strategy according to the health level.
  • the first driving In addition to locking the ADS to take control of the autonomous vehicle, the strategy can also be: the ADS controls the speed of the autonomous vehicle to drop below the preset speed (eg, below 60km/h), pull over to the side lane, and turn on the double jump lights.
  • the first driving strategy can also be: the ADS controls the speed of the autonomous vehicle to slowly decrease to zero, Pull over to the sidewalk, turn on the double jump lights, idle running, turn on the outer circulation of the vehicle, turn on the inner circulation of the vehicle, set the target temperature in the vehicle, and unlock the central door lock.
  • the health level when the driver and passenger have a health condition, the health level is divided into mild abnormality and severe abnormality (if the real-time physiological data is within the range of healthy physiological data, the health level is normal), for ease of understanding, the following takes real-time physiological data as real-time heart rate as an example to illustrate one of the ways of dividing the health level of drivers and passengers.
  • the healthy heart rate range is 60 beats/min to 100 beats per minute. /minute.
  • the health level is normal: the real-time heart rate of the driver and passenger is between 60 beats/minute and 100 beats/minute. At this time, the health level of the driver and passenger is normal, which can also be called the first level, indicating the health status of the driver and passenger. good.
  • the health level is mildly abnormal: the real-time heart rate of the driver and occupant is 40 beats/min to 60 beats/min for 3 minutes, or the real-time heart rate of the driver and occupant is 100 beats/min to 160 beats/min for 3 minutes. 3 minutes, at this time, the health level of the driver and passenger is mildly abnormal, which can also be called as the second-level health level, indicating that the driver and passenger have mild health problems and the driver and passenger are mildly unwell.
  • the health level is severely abnormal: the real-time heart rate of the driver and passenger is less than 40 beats/min and lasts for 5 minutes, or, the real-time heart rate of the driver and passenger is greater than 160 beats/min and lasts for 5 minutes. At this time, the health level of the driver and passenger is It is a severe abnormality, which can also be referred to as the second-level health level, indicating that the driver and passenger have serious health problems and the driver and passenger are seriously unwell.
  • the above healthy heart rate range can be preset according to the big data range, for example, it can also be set from 65 times/min to 105 times/min, which is not limited here; it is determined according to the real-time heart rate what health level it belongs to.
  • the difference and duration can also be preset, for example, the real-time heart rate of the driver and passenger can be set at 30 beats/min to 65 beats/min for 4 minutes, or the real-time heart rate of the driver and passenger can be set at 105 beats/min
  • the health level when it reaches 165 times/minute and lasts for 3 minutes is mildly abnormal, which is not limited here.
  • the takeover capability level for the driver and passenger to take over the control of the vehicle can be correspondingly obtained, as shown below.
  • a. Takeover capability level 1 The corresponding health level is normal (or the health level is level 1), the automatic driving business is not affected, and the driver and passenger can take over the control of the vehicle at any time.
  • Level 2 takeover capability When the health level is mildly abnormal (or the health level is level 2), the ADS controls the autonomous vehicle to downgrade the autonomous driving business, reduce the speed to within 60km/h, drive on the side road, and double-jump the lights Open, the control of the vehicle cannot be transferred to the driver and occupant.
  • Level 3 Takeover Ability Corresponding to Level 3 Health Level (or Level 3 Health Level), ADS controls the self-driving vehicle to continuously downgrade the self-driving business, slowly decelerates to 0 and then exits, pulls over to the sidewalk, and turns on the double jump lights.
  • the vehicle is idling, the vehicle ventilation and external circulation are turned on, the target temperature inside the vehicle is set to 22°C, the air conditioner is turned on, and the central control door lock is unlocked.
  • the in-vehicle communication device eg, TBOX
  • health levels namely normal, mildly abnormal, and severely abnormal, corresponding to the first, second and third levels respectively.
  • more or less health levels may be set according to actual application scenarios.
  • health levels may only be divided into normal and abnormal, that is, corresponding to two levels; health levels may also be divided into normal and light levels.
  • Severe abnormality, moderate abnormality, and severe abnormality correspond to four levels.
  • the embodiments of the present application are only used to illustrate the classification of mild abnormality and severe abnormality, and are used to illustrate this
  • the application embodiment can adopt different first driving strategies based on different health levels, which is more targeted.
  • takeover capability levels namely first, second, and third.
  • more or less takeover capability levels may be set according to actual application scenarios, and there is no specific limitation on how to divide the takeover capability levels.
  • the above only takes the real-time physiological data as the real-time heart rate as an example to illustrate one of the ways of dividing the health level of the driver and passengers.
  • the real-time physiological data collected by the monitoring device is The data can also be real-time physiological data such as heart rate, blood pressure, blood oxygen, body temperature, premature heart beat, atrial fibrillation, etc. of the driver and passenger, as long as it is the physiological data that can be collected by the monitoring equipment and can reflect the health status of the driver and passenger. There is no limitation here.
  • the following describes the division of the health level of the driver and the passenger and the corresponding first driving strategy in the case of taking the real-time physiological data as the real-time heart rate as an example to classify the health level of the driver and passenger, as shown in Table 2.
  • the range of healthy physiological data in the ODD corresponds to the range of healthy heart rate
  • the embodiment of the present application assumes that the range of healthy heart rate is 60 beats/min to 100 beats/min, and the health level is normal corresponds to the first level, indicating that the driver and passenger take over If the capability is level 1, the autonomous driving business being executed by the autonomous vehicle will not be affected; if the health level is mildly abnormal, it corresponds to level 2.
  • the ADS controls the downgrade of the autonomous driving business being performed by the autonomous driving vehicle and controls the execution speed of the autonomous driving vehicle. Drop below the preset speed, pull over to the side lane, and turn on any one or more of the double-jump lights; if the health level is severely abnormal, it corresponds to level 3, and the automatic driving business that the ADS controls the autonomous vehicle to perform continues to degrade, and Control the automatic driving vehicle to slow down the speed to zero, pull over to the sidewalk, turn on the double jump lights, idle running, turn on the outer circulation of the vehicle, turn on the inner circulation of the vehicle, set the target temperature in the vehicle, unlock the central door lock, or multiple.
  • the embodiment of the present application determines the health level based on how much the real-time physiological data deviates from the range of the healthy physiological data and the duration of the deviation, and takes different steps based on different health levels.
  • a driving strategy is more targeted.
  • the driver and passenger only when the health level of the driver and passenger is normal, the driver and passenger have the right to take over the vehicle control, otherwise the vehicle control cannot be handed over to the driver and the ADS will execute the first step.
  • a driving strategy thereby avoiding the vehicle risk and personal safety caused by the fact that the driver and occupant are not actually able to take over for a certain period of time due to physical health problems.
  • the person in the driving position of the automatic driving vehicle does not have the vehicle control right to control the automatic driving vehicle. occupants.
  • the difference between the real-time physiological data deviating from the healthy physiological data range is greater than the preset value, and the duration of the real-time physiological data deviating from the healthy physiological data range is greater than the first preset duration, it means that there is a high probability that the driver and passenger have a health condition.
  • the ADS further determines the health level of the driver and occupant according to the difference of the deviation and the duration of the deviation, and executes the corresponding first driving strategy according to the health level, which is similar to the above-mentioned situation where the automatic driving level is L3.
  • the first driving strategy can be: ADS controls the speed of the autonomous vehicle to drop below the preset speed (for example, below 60km/h), drive to the side lane, or turn on the double jump lights.
  • the first driving strategy can be: ADS controls the speed of the autonomous vehicle to slowly reduce to zero, pull over to the sidewalk, turn on double jump lights, run at idle speed, and turn on the outer circulation of the vehicle , any one or more of opening the circulation in the vehicle, setting the target temperature in the vehicle, and unlocking the central door lock.
  • the health level is divided into mild abnormality and severe abnormality (if the real-time physiological data is Within the range of the health physiological data, the health level is normal).
  • the above-mentioned L3 situation which will not be repeated here.
  • the embodiment of this application assumes that the range of healthy physiological data in the ODD corresponds to the range of healthy heart rate, the embodiment of this application assumes that the range of healthy heart rate is 60 beats/min to 100 beats/min, the health level is normal and corresponds to level 1, and the autonomous vehicle is executing The self-driving business of the self-driving vehicle is not affected; if the health level is mildly abnormal, it corresponds to the second-level.
  • ADS controls the automatic driving business of the self-driving vehicle to downgrade, and controls the self-driving vehicle to reduce the execution speed below the preset speed and drive to the side lane. , Turn on any one or more of the double jump lights; if the health level is severe abnormality, it corresponds to level 3.
  • ADS controls the automatic driving business that the autonomous driving vehicle is executing to continuously degrade, and controls the automatic driving vehicle to slow down to zero. , pull over to the sidewalk, turn on the double jump lights, idle running, turn on the outer circulation of the vehicle, turn on the inner circulation of the vehicle, set the target temperature in the vehicle, and unlock the central control door lock.
  • Table 3 and Table 2 is that the first driving strategy in Table 3 does not involve the transfer of vehicle control, because at the L4 or L5 level, drivers and passengers have no obligation or way to take over the vehicle.
  • the embodiment of the present application determines the health level based on the difference between the real-time physiological data and the range of the healthy physiological data and the duration of the deviation, and adopts different health levels based on different health levels.
  • the first driving strategy is more targeted.
  • the ADS sends an authorization request.
  • the ADS will issue an authorization request to the driver and passenger.
  • the authorization request can be communicated to the driver and passenger through voice broadcast, or it can be communicated to the driver and passenger through interface display (provided that a display screen is deployed on the autonomous driving vehicle), which is not limited here.
  • the authorization request is used to ask the driver and passenger whether the second driving strategy needs to be executed.
  • the ADS executes the second driving strategy.
  • the ADS executes the second driving strategy. Any one or more of the communication connection, planning the driving path between the autonomous vehicle and the medical institution, reserving medical resources, and requesting the arrangement of emergency medical channels.
  • the second driving strategy is essentially an upgrade of the original risk mitigation strategy. No matter which automatic driving level the existing risk mitigation strategy is at, when there is an ADS that cannot perform dynamic driving tasks or the driver and passenger When the dynamic driving task cannot be taken over, the ultimate focus of the risk mitigation strategy is to "stop the vehicle", that is, only consider the vehicle safety in a narrow sense.
  • the ultimate focus of the risk mitigation strategy is to "stop the vehicle", that is, only consider the vehicle safety in a narrow sense.
  • there are more efforts to be done in the vehicle including but not limited to calling for help, organizing rescue, and requesting emergency access. , booking medical resources and other measures.
  • “First Aid Platinum 10 minutes” means that after an emergency occurs, no matter what the procedures are, the starting point is to be sent to the emergency department of the hospital or the emergency room of a related department. , until the first 10 minutes of the doctor's emergency treatment. The earlier these 10 1-minutes are, the higher the value is, and it has a very important role and significance in guiding physicians to establish the time-valence concept of emergency medicine.
  • steps 503 and 504 may not be included.
  • ADS can be implemented in accordance with the original risk mitigation strategy. For example, assuming that the real-time physiological data is real-time heart rate, in the heart rate scenario, even if the health level of the driver and passenger is abnormal, the driver and passenger will still be conscious, and the ADS will call for help and emergency through the communication device (such as TBOX) in the car.
  • the wishes of the drivers and passengers should be consulted first, so that the wishes of the drivers and passengers are respected, and at the same time, the occasional uncertain and false alarms of the monitoring equipment can be avoided, because if there are frequent false alarms, the user experience will be poor, and the The autonomous driving business executed will also be frequently downgraded.
  • the time when health problems are discovered can also be advanced (because if it is a mild abnormality, the driver and passengers may not be able to perceive obvious discomfort), so as to detect in advance , timely response, good user experience, and the health of drivers and passengers are also guaranteed, which not only reduces the incidence of traffic accidents, but also brings huge social benefits.
  • the ADS can control the self-driving vehicle to restore the degraded self-driving business.
  • the speed is 100km/h
  • the difference between the real-time physiological data and the healthy physiological data range exceeds the preset value and lasts for the first preset time period (for example, 3 minutes)
  • the ADS will downgrade the automatic driving service to “high-speed car-following” Driving at a speed of 60km/h” and continuously monitor the real-time physiological data collected subsequently. If the monitored real-time physiological data returns to the range of healthy physiological data within the second preset time period (eg, 8 minutes), the ADS will be downgraded
  • the automatic driving business of "following the car at high speed, speed of 60km/h" was restored to the original "following car at high speed, speed of 100km/h”.
  • the ADS may also generate an event log based on the real-time physiological data, and the event log is used to record abnormal real-time physiological data during the period when the real-time physiological data deviates from the range of the healthy physiological data. Data and a series of subsequent ADS operations, and periodically report the event log to the cloud server corresponding to the self-driving vehicle, thereby facilitating the definition of human and vehicle responsibilities.
  • ADS adopts the first driving strategy for this health level, and when the driver and passenger refuses the authorization request, the ADS controls the autonomous vehicle to execute the original risk mitigation strategy. Then, corresponding to the time period from 10:00-10:10 on September 6, 2020, an event log will be generated, which records the real-time physiological data corresponding to this time period and a series of operations of ADS. The operation is: adopt the first driving strategy for the health level, and control the autonomous vehicle to execute the original risk mitigation strategy when the driver and passenger refuse the authorization request.
  • the second driving strategy does not distinguish the automatic driving level, that is, whether it is at the L3 level, or at the L4 or L5 level
  • the second driving strategy can be Any one or more of the above mentioned parking on the sidewalk, calling for rescue, establishing a communication connection with a medical institution, planning a driving path between the autonomous vehicle and the medical institution, reserving medical resources, and requesting an emergency medical channel.
  • different second driving strategies can be adopted, which are more targeted and can also improve the user experience, which will be explained below.
  • ADS can consult the driver and passenger in advance in each step of executing the second driving strategy. Opinion. For example, when the driver and passenger accept the authorization request, if the health level of the driver and passenger is mildly abnormal, the ADS can plan a route to the nearest medical institution, and re-issue "The nearest medical institution has been planned.
  • ADS can control the autonomous driving vehicle to go to the medical institution; for another example, if the driver and passenger accepts the authorization request, if the driver The health level of the personnel is severely abnormal, and ADS can issue authorization requests such as "whether to call for rescue" or "whether to reserve medical resources", and at the same time plan the route to the nearest medical institution, and send out "the nearest medical institution has been planned.
  • the following takes the real-time physiological data as the real-time heart rate as an example, in the case of dividing the health levels of the drivers and passengers, the health levels of the drivers and passengers and the corresponding first driving strategy, second driving strategy and event log.
  • the report is described in detail, as shown in Table 4, where the healthy physiological data range in the ODD corresponds to the healthy heart rate range, and the embodiment of the present application assumes that the healthy heart rate range is 60 beats/min to 100 beats/min.
  • the ADS sends After the authorization request is received, the ADS directly executes the second driving strategy under the condition that the driver and passenger accepts the authorization request, and does not ask the driver and passenger's wishes subsequently.
  • the predetermined second driving strategy is "plan the driving route between the autonomous vehicle and the nearest medical institution and go there, and request the nearest medical institution to arrange an emergency medical channel"
  • the ADS will directly Control the self-driving vehicle to plan the driving path between the self-driving vehicle and the nearest medical institution, and at the same time request the nearest medical institution to arrange an emergency medical channel through the communication device on the self-driving vehicle.
  • the ADS can send the driver to the driver The personnel broadcast the implementation of the second driving strategy in real time.
  • the following takes the real-time physiological data as the real-time heart rate as an example, and in the case of dividing the health levels of the drivers and passengers, the health levels of the drivers and passengers and the corresponding first driving strategy and second driving strategy and event log reporting for description, as shown in Table 5, where the healthy physiological data range in the ODD corresponds to the healthy heart rate range, and the embodiment of the present application assumes that the healthy heart rate range is 60 times/min to 100 times/min.
  • the difference between Table 5 and Table 4 is that the first driving strategy in Table 5 does not involve the transfer of vehicle control, because at the L4 or L5 level, drivers and passengers have no obligation or way to take over the vehicle.
  • the automatic driving method provided by the embodiments of the present application when the automatic driving level is L3 and the automatic driving level is L4 or L5.
  • the real-time physiological data is the heart rate
  • the healthy physiological data range is a healthy heart rate range of 60 beats/min to 100 beats/min as an example for illustration.
  • the health level of the driver and passenger is defined (in the case of L3, the driver and passenger are actually the driver), and the details can be found in Table 2, which will not be repeated here.
  • an autonomous vehicle needs to meet several prerequisites: 1) The driver and passenger wear a monitoring device (such as a smart watch) that collects real-time physiological data, which can be used to collect the heart rate, blood pressure, blood oxygen, body temperature, heart rate, and heart rate of the driver and passenger. Premature beats, atrial fibrillation, etc.
  • ADS ADS through communication protocols (such as Bluetooth, WiFi, etc.); 2) Autonomous vehicles have certain human-computer interaction capabilities (such as voice question-and-answer function); 3 ) The autonomous vehicle has the function of basic voice communication with the outside world.
  • communication protocols such as Bluetooth, WiFi, etc.
  • Autonomous vehicles have certain human-computer interaction capabilities (such as voice question-and-answer function); 3 ) The autonomous vehicle has the function of basic voice communication with the outside world.
  • FIG. 6 is an example of an automatic driving method in an L3 level situation provided by an embodiment of the present application.
  • the example may include the following steps:
  • Step 1 The monitoring device collects the real-time heart rate of the driver and passenger.
  • Step 2 The monitoring device sends the collected real-time heart rate to the first sub-module of the ADS, where the first sub-module is used to determine whether the real-time heart rate deviates from the healthy heart rate range in the ODD.
  • Step 3 when ADS determines that this real-time heart rate deviates from the healthy heart rate range in the ODD, the difference exceeds a preset value and continues for the first preset duration (such as 3 minutes), the first submodule of ADS is to the second submodule of ADS.
  • a service downgrade request is sent, where the service downgrade request is used to instruct the second sub-module of the ADS to perform downgrade processing on the automatic driving service being executed by the automatic driving vehicle, for example, reduce the speed.
  • Step 4. the second sub-module of the ADS performs downgrade processing on the automatic driving service being executed by the automatic driving vehicle according to the service degradation request, while the second sub-module of the ADS controls the automatic driving vehicle to execute the first driving strategy, such as locking the ADS to occupy. Vehicle control, turn on double jump lights, pull over, etc.
  • Step 5 The second sub-module of the ADS periodically reports the event log to the cloud server, so that the cloud server corresponding to the ADS needs to record the operations such as the service downgrade of the ADS and the implementation of the first driving strategy by the ADS, so as to facilitate the subsequent division of responsibilities between people and vehicles .
  • step 6 the second sub-module of the ADS further determines whether the collected real-time heart rate returns to the healthy heart rate range in the ODD within a second preset time period (eg, 5 minutes).
  • Step 7 If the collected real-time heart rate returns to the healthy heart rate range in the ODD, trigger the first sub-module of the ADS to perform state self-check.
  • Step 8 After the self-check of the first sub-module of the ADS is completed, a service recovery request is sent to the second sub-module of the ADS, and the service recovery request is used to instruct the second sub-module of the ADS to recover the degraded automatic driving service, such as , accelerate to the original driving speed.
  • Step 9 If the collected real-time heart rate does not return to the healthy heart rate range in the ODD, an authorization request is issued to the driver and passenger through the communication device in the car, and the authorization request is used to inquire whether rescue or medical treatment is needed. driving strategy.
  • Step 10 If the driver and passenger refuses the authorization request, it means that the driver and passenger believes that their health status can be recovered (for example, carry emergency medicine with them), and the driver and passenger can take measures by themselves.
  • the second sub-module of the ADS can execute the second driving strategy, and the driver and passenger's wishes must be consulted for each step of execution.
  • the automatic driving level is L3
  • the driver and passenger can take over the control of the vehicle only when the health level of the driver and passenger is normal.
  • the business is downgraded and controls the autonomous vehicle to execute the first driving strategy and the second driving strategy.
  • the time when health problems are discovered can also be advanced (because if it is a mild abnormality, the driver and passengers may not perceive obvious discomfort), so that Early detection and timely response, the user experience is good, and the health of drivers and passengers is also guaranteed, which not only reduces the incidence of traffic accidents, but also brings huge social benefits.
  • ADS can record all health-related data and operations during the period of abnormal real-time physiological data as event logs and periodically (for example, every 5 minutes) report to the cloud corresponding to the autonomous vehicle for backup.
  • the health level of the driver and passenger also needs to be defined first.
  • self-driving vehicles also need to meet several prerequisites: 1) The driver and passengers wear monitoring equipment (such as smart watches) that collect real-time physiological data, which can be used to collect the heart rate, blood pressure, blood oxygen, body temperature, Premature heart beat, atrial fibrillation, etc.
  • the real-time physiological data collected can be connected to ADS through communication protocols (such as Bluetooth, WiFi, etc.); 2)
  • Autonomous vehicles have certain human-computer interaction capabilities (such as voice question-and-answer function); 3)
  • the autonomous vehicle has the function of basic voice communication with the outside world.
  • FIG. 7 is an example of an automatic driving method under the condition of L4 or L5 level provided by an embodiment of the present application.
  • the example may include the following steps:
  • Step 1 The monitoring device collects the real-time heart rate of the driver and passenger.
  • Step 2 The monitoring device sends the collected real-time heart rate to the first sub-module of the ADS, where the first sub-module is used to determine whether the real-time heart rate deviates from the healthy heart rate range in the ODD.
  • Step 3 when ADS determines that this real-time heart rate deviates from the healthy heart rate range in the ODD, the difference exceeds a preset value and continues for the first preset duration (such as 3 minutes), the first submodule of ADS is to the second submodule of ADS.
  • a service downgrade request is sent, where the service downgrade request is used to instruct the second sub-module of the ADS to perform downgrade processing on the automatic driving service being executed by the automatic driving vehicle, for example, reduce the speed.
  • Step 4. the second sub-module of the ADS performs downgrade processing on the automatic driving service being executed by the autonomous driving vehicle according to the service degradation request, while the second sub-module of the ADS controls the autonomous driving vehicle to execute the first driving strategy, such as enabling double jump Lights, pull over, etc.
  • Step 5 The second sub-module of the ADS periodically reports the event log to the cloud server, so that the cloud server corresponding to the ADS needs to record the operations such as the service downgrade of the ADS and the implementation of the first driving strategy by the ADS, so as to facilitate the subsequent division of responsibilities between people and vehicles .
  • step 6 the second sub-module of the ADS further determines whether the collected real-time heart rate returns to the healthy heart rate range in the ODD within a second preset time period (eg, 5 minutes).
  • Step 7 If the collected real-time heart rate returns to the healthy heart rate range in the ODD, trigger the first sub-module of the ADS to perform state self-check.
  • Step 8 After the self-check of the first sub-module of the ADS is completed, a service recovery request is sent to the second sub-module of the ADS, and the service recovery request is used to instruct the second sub-module of the ADS to recover the degraded automatic driving service, such as , accelerate to the original driving speed.
  • Step 9 If the collected real-time heart rate does not return to the healthy heart rate range in the ODD, an authorization request is issued to the driver and passenger through the communication device in the car, and the authorization request is used to inquire whether rescue or medical treatment is needed. driving strategy.
  • Step 10 If the driver and passenger refuses the authorization request, it means that the driver and passenger believes that their health status can be recovered (for example, carry emergency medicine with them), and the driver and passenger can take measures by themselves.
  • the second sub-module of the ADS can execute the second driving strategy. Specifically, the second sub-module of the ADS can control the autonomous vehicle to pull over to the side, turn on the double-jump lights, and establish communication with medical institutions. Communicate and call for assistance, inform drivers and passengers of the estimated time of arrival of assistance, etc.
  • the time when health problems are discovered can also be advanced (because if it is a mild abnormality, the driver and passengers may not perceive obvious discomfort), so that Early detection and timely response, the user experience is good, and the health of drivers and passengers is also guaranteed, which not only reduces the incidence of traffic accidents, but also brings huge social benefits.
  • ADS can record all health-related data and operations during the period of abnormal real-time physiological data as event logs and periodically (for example, every 5 minutes) report to the cloud corresponding to the autonomous vehicle for backup.
  • the first driving strategy in this case includes locking the ADS to occupy the vehicle control; in the case of L4 or L5, the driver and passenger did not take over control.
  • the vehicle's obligations and ways, so the first driving strategy in this case does not involve the transfer of vehicle control.
  • ADS can consult the driver and passenger in advance in each step of implementing the second driving strategy. For example, when the driver and passenger accept the authorization request, if the health level of the driver and passenger is mildly abnormal, the ADS can plan a route to the nearest medical institution, and re-issue "The nearest medical institution has been planned. If the driver and passenger agree to go to the medical institution, the ADS can control the autonomous vehicle to go to the medical institution; in the case of L4 or L5, the driver and passenger have no obligation to take over the vehicle.
  • the ADS directly executes the first Second driving strategy, no further questions about the wishes of the driver and passengers are required.
  • the predetermined second driving strategy is "plan the driving route between the autonomous vehicle and the nearest medical institution and go there, and request the nearest medical institution to arrange an emergency medical channel"
  • the ADS will directly Control the self-driving vehicle to plan the driving path between the self-driving vehicle and the nearest medical institution, and at the same time request the nearest medical institution to arrange an emergency medical channel through the communication device on the self-driving vehicle.
  • the ADS can send the driver to the driver The personnel broadcast the implementation of the second driving strategy in real time.
  • FIG. 8 is a schematic structural diagram of an ADS 800 provided by an embodiment of the application.
  • the ADS 800 may specifically include: a receiving module 801 and a first execution module 802, wherein the receiving module 801 is used to receive monitoring equipment The collected real-time physiological data of the driver and passenger; the first execution module 802 is used for when the difference value of the real-time physiological data deviating from the healthy physiological data range is greater than a preset value, and the duration of the real-time physiological data deviating from the healthy physiological data range If it is greater than the first preset duration (eg, 3 minutes), the automatic driving service being executed by the autonomous vehicle is downgraded, and the first driving strategy is executed according to the difference and the duration.
  • the range of the health and physiological data is added in advance.
  • a set of scopes for the ODD that is deployed on the ADS.
  • the ADS determines that the driver and passenger have abnormal health , and implement the corresponding first driving strategy according to the degree of deviation and duration, so as to timely respond to sudden health accidents of drivers and passengers and reduce the incidence of traffic accidents.
  • the ADS 800 further includes a request module 803 and a second execution module 804, wherein the request module 803 is configured to be used when the real-time physiological data is not available within a second preset time period (eg, 8 minutes). Return to the range of the health and physiological data, and issue an authorization request; the second execution module 804 is configured to execute a second driving strategy when the driver and passenger accepts the authorization request.
  • a second preset time period eg, 8 minutes
  • the second driving strategy is essentially an upgrade of the original risk mitigation strategy. No matter which automatic driving level the existing risk mitigation strategy is at, when there is an ADS that cannot perform dynamic driving tasks or the driver and passenger When the dynamic driving task cannot be taken over, the ultimate focus of the risk mitigation strategy is to "stop the vehicle", that is, only consider the vehicle safety in a narrow sense.
  • the ultimate focus of the risk mitigation strategy is to "stop the vehicle", that is, only consider the vehicle safety in a narrow sense.
  • there are more efforts to be done in the vehicle including but not limited to calling for help, organizing rescue, and requesting emergency access. , booking medical resources and other measures.
  • the second driving strategy at least includes at least one of the following strategies: pulling over to the sidewalk, calling for rescue, establishing a communication connection with a medical institution, and planning a driving path between the autonomous vehicle and the medical institution , Reserving medical resources, and requesting any one or more of emergency medical channels.
  • the first execution module 802 is specifically configured to: determine the health level of the driver and passenger according to the difference and the duration, And when it is determined that the health level is mildly abnormal, the first driving strategy is executed according to the health level, and the first driving strategy includes the ADS controlling the speed of the autonomous vehicle to drop below a preset speed (eg, below 60km/h). ), pull over to the side lane, and turn on any one or more of the double jump lights.
  • a preset speed eg, below 60km/h
  • the first driving strategy is when the automatic driving level is L4 or L5, when the health level of the driver and passenger is slightly abnormal, that is, the deviation based on real-time physiological data
  • the difference between the health and physiological data ranges and the duration of the deviation determine the health level, and different first driving strategies are adopted based on different health levels, which are more targeted.
  • the first execution module 802 is further configured to: when it is determined that the health level is severely abnormal, execute the first driving strategy according to the health level, where the first driving strategy includes the ADS controlling the The speed of the self-driving vehicle slowly drops to zero, pulls over to the sidewalk, turns on the double jump lights, idling, turns on the vehicle's external circulation, turns on the vehicle's internal circulation, sets the target temperature in the vehicle, and unlocks the central door lock. item.
  • the first driving strategy is when the level of automatic driving is L4 or L5, when the health level of the driver and passenger is severely abnormal, that is, the deviation from health based on real-time physiological data
  • the difference in the range of physiological data and the duration of the deviation determine the health level, and different first driving strategies are adopted based on different health levels, which is more targeted.
  • the first execution module 802 is specifically configured to: lock the ADS to occupy the control right of the automatic driving vehicle; according to the difference and the duration Determine the health level of the driver and passenger; when it is determined that the health level is mildly abnormal, the first driving strategy is executed according to the health level, and the first driving strategy includes the ADS controlling the speed of the autonomous vehicle to drop below the preset speed (For example, below 60km/h), driving on the side road, and turning on any one or more of the double jump lights.
  • the preset speed For example, below 60km/h
  • the first driving strategy can also be any one of the ADS controlling the speed of the autonomous vehicle to drop below the preset speed, driving over to the side lane, turning on the double jump lights, or Multiple items, that is, the health level is determined based on how much the real-time physiological data deviates from the range of healthy physiological data and the duration of the deviation, and different first driving strategies are adopted based on different health levels, which is more targeted.
  • the first execution module 802 is further configured to: when it is determined that the health level is severely abnormal, execute the first driving strategy according to the health level , the first driving strategy includes that the ADS controls the speed of the self-driving vehicle to slowly drop to zero, pull over to the sidewalk, turn on the double jump lights, idling, turn on the outer circulation of the vehicle, turn on the inner circulation of the vehicle, set the target temperature in the vehicle, medium Control any one or more of the door lock unlocking.
  • the first driving strategy can also control the speed of the self-driving vehicle to slowly drop to zero, pull over to the sidewalk, turn on the double jump lights, run at an idle speed, turn on the outer loop of the vehicle, and turn on the vehicle.
  • any one or more of the internal circulation, setting the target temperature in the car, and unlocking the central door lock that is, based on the difference between the real-time physiological data and the range of the healthy physiological data and the duration of the deviation to determine the health level, and Different first driving strategies are adopted based on different health levels, which are more targeted. And in the above-mentioned embodiment of the present application, only when the health level of the driver and passenger is normal, the driver and passenger has the right to take over the vehicle control, otherwise the vehicle control cannot be handed over to the driver, thus avoiding the problem of the driver and passenger. Vehicle risk and personal safety due to physical inability to actually take over for a period of time.
  • the first execution module is further configured to: control the autonomous vehicle when the real-time physiological data returns to the healthy physiological data range within a second preset time period (eg, within 8 minutes) Resume the execution of the autonomous driving business.
  • a second preset time period eg, within 8 minutes
  • the ADS can control the self-driving vehicle to restore the degraded self-driving service, which improves the user experience.
  • the first execution module 802 is further configured to: generate an event log based on the real-time physiological data, where the event log is used to record the real-time physiological data when the real-time physiological data deviates from the range of the healthy physiological data and the operation of the ADS; periodically reporting the event log to the cloud server corresponding to the autonomous vehicle.
  • the ADS can also generate an event log based on the real-time physiological data, and the event log is used to record abnormal real-time physiological data and a series of subsequent operations of the ADS during the period when the real-time physiological data deviates from the range of the healthy physiological data. , and periodically report the event log to the cloud server corresponding to the self-driving vehicle, so as to facilitate the definition of the responsibility of the person and the vehicle.
  • the real-time physiological data includes at least one of the following physiological data: real-time blood pressure, real-time heart rate, real-time blood oxygen, real-time body temperature, premature heart beat, atrial fibrillation and other real-time physiological data of the driver , as long as it is the physiological data that can be collected by the monitoring equipment and can reflect the health status of the driver and passenger, which is not limited here.
  • FIG. 9 is a schematic structural diagram of an ADS provided by an embodiment of the present application. For the convenience of description, only the part related to the embodiment of the present application is shown. If the details are not disclosed, please refer to the method part of the embodiments of the present application.
  • the ADS module described in the embodiment corresponding to FIG. 8 can be deployed on the ADS 900 to implement the functions of the ADS in the embodiment corresponding to FIG. 8 .
  • the ADS 900 is implemented by one or more servers, and the ADS 900 can be configured according to the configuration.
  • the memory 932 and the storage medium 930 may be short-term storage or persistent storage.
  • the program stored in the storage medium 930 may include one or more modules (not shown in the figure), and each module may include operations on a series of instructions in the ADS 900 .
  • the central processing unit 922 may be configured to communicate with the storage medium 930 to execute a series of instruction operations in the storage medium 930 on the ADS 900.
  • ADS 900 may also include one or more power supplies 926, one or more wired or wireless network interfaces 950, one or more input and output interfaces 958, and/or, one or more operating systems 941, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM and many more.
  • operating systems 941 such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM and many more.
  • the steps performed by the ADS in the embodiments corresponding to FIG. 5 to FIG. 7 can be implemented based on the structure shown in FIG. 9 , and details are not repeated here.
  • the device embodiments described above are only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be A physical unit, which can be located in one place or distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.
  • U disk U disk
  • mobile hard disk ROM
  • RAM random access memory
  • disk or CD etc.
  • a computer device which can be a personal computer, training equipment, or network equipment, etc. to execute the methods described in the various embodiments of the present application.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general purpose computer, special purpose computer, computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be retrieved from a website, computer, training device, or data
  • the center transmits to another website site, computer, training equipment, or data center by wire (eg, coaxial cable, optical fiber, digital subscriber line) or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be stored by a computer, or a data storage device such as a training device, a data center, or the like that includes an integration of one or more available media.
  • the available media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, high-density digital video discs (DVDs)), or semiconductor media (eg, solid state disks) , SSD)) etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Automation & Control Theory (AREA)
  • Mechanical Engineering (AREA)
  • Transportation (AREA)
  • Human Computer Interaction (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Physics & Mathematics (AREA)
  • Heart & Thoracic Surgery (AREA)
  • Public Health (AREA)
  • Surgery (AREA)
  • Medical Informatics (AREA)
  • General Health & Medical Sciences (AREA)
  • Animal Behavior & Ethology (AREA)
  • Veterinary Medicine (AREA)
  • Molecular Biology (AREA)
  • Biomedical Technology (AREA)
  • Pathology (AREA)
  • Biophysics (AREA)
  • Mathematical Physics (AREA)
  • Traffic Control Systems (AREA)
  • Control Of Driving Devices And Active Controlling Of Vehicle (AREA)

Abstract

一种自动驾驶方法，包括在设计运行范围ODD增加健康生理数据范围作为ODD的一组适用范围，自动驾驶系统ADS接收监测设备采集的驾乘人员的实时生理数据；当所述实时生理数据偏离健康生理数据范围的差值大于预设值，且所述实时生理数据偏离所述健康生理数据范围的持续时长大于第一预设时长，所述ADS对自动驾驶车辆正执行的自动驾驶业务进行降级，并根据所述差值与所述持续时长执行第一驾驶策略。还公开了一种自动驾驶系统ADS、自动驾驶车辆、计算机可读存储介质、包含指令的计算机程序产品及芯片系统。该方法做到对驾乘人员的突发健康事故的及时应对，降低交通事故发生率。

Description

一种自动驾驶方法、ADS及自动驾驶车辆
本申请要求于2020年9月17日提交中国专利局、申请号为202010982543.3、申请名称为“一种自动驾驶方法、ADS及自动驾驶车辆”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及自动驾驶领域，尤其涉及一种自动驾驶方法、ADS及自动驾驶车辆。
背景技术
汽车自发明以来，经历一百多年的发展，已经成为人们生活中不可或缺的一部分，随着生活水平的提高，人们对出行的舒适性、便捷性等要求越来越高，汽车随之朝着智能化方向演进，自动驾驶技术应运而生。
但近几年，自动驾驶汽车事故频发，如：2016年5月7日，特斯拉一辆开启“自动辅助驾驶”的轿车撞上一辆货柜车，驾驶员身亡；2018年3月18日晚，美国亚利桑那州一名女子被Uber自动驾驶汽车撞伤后，不幸身亡。这引起人们对自动驾驶安全性的担忧，并迫使人们重新审视和思考自动驾驶技术的发展。
当前，业界广泛采用国际自动机工程师学会(society of automotive engineers，SAE)的自动驾驶分级标准J3016TM，该标准也称为《标准道路机动车驾驶自动化系统分类与定义》，该标准依据动态驾驶任务(dynamic driving task，DDT)定义自动驾驶等级(即L0～L5共6个自动驾驶等级)，但缺少对驾驶安全的考量。基于此，根据当前自动驾驶技术发现现状，一种以驾驶安全为核心，尤其是针对驾乘人员自身健康状况不确定场景的自动驾驶策略亟待推出。
发明内容
本申请实施例提供了一种自动驾驶方法、ADS及自动驾驶车辆，用于在设计运行范围(operational design domain，ODD)内新增加健康生理数据范围作为ODD的一组适用范围，当驾乘人员的实时生理数据偏离该范围且持续一定时长，自动驾驶系统(automation driving system，ADS)将判定驾乘人员出现健康异常，并根据偏离程度和持续时长执行对应的第一驾驶策略，从而做到对驾乘人员的突发健康事故的及时应对，降低交通事故发生率。
基于此，本申请实施例提供以下技术方案：
第一方面，本申请实施例首先提供一种自动驾驶方法，可用于自动驾驶领域中，该方法包括：首先，部署有ADS的自动驾驶车辆内的驾乘人员佩戴有监测设备(如，智能手表、智能手环、智能心率计等可穿戴设备)，该监测设备可实时采集驾乘人员的实时生理数据，这些采集得到的实时生理数据再通过通讯协议(如，蓝牙、WiFi等)接入ADS。ADS接收到监测设备发送的驾乘人员的实时生理数据后，将判断该实时生理数据是否偏离健康生理数据范围，当ADS确定接收到的实时生理数据偏离健康生理数据范围的差值大于预设值，则进一步判断实时生理数据偏离健康生理数据范围的持续时长是否大于第一预设时长， 当ADS确定该实时生理数据偏离健康生理数据范围的持续时长大于第一预设时长，那么ADS对自动驾驶车辆正执行的自动驾驶业务进行降级处理，并根据所述差值与所述持续时长的具体取值情况执行第一驾驶策略。该健康生理数据范围为事先添加入ODD的一组适用范围，在自动驾驶分级标准J3016TM已定义的ODD中额外增加一组用于表示驾乘人员健康指标的适用范围，即健康生理数据范围，例如，正常的心率范围、正常的血压范围等，该ODD部署在该ADS上。
在本申请上述实施方式中，通过在ODD内新增加健康生理数据范围作为ODD的一组适用范围，当驾乘人员的实时生理数据偏离该范围且持续一定时长，ADS判定驾乘人员出现健康异常，并根据偏离程度和持续时长执行对应的第一驾驶策略，从而做到对驾乘人员的突发健康事故的及时应对，降低交通事故发生率。
在第一方面的一种可能的设计中，不管是在哪个自动驾驶等级下，当监测设备采集的实时生理数据在第二预设时长内(如，8分钟内)还未恢复到健康生理数据范围，则ADS会向驾乘人员发出授权请求，该授权请求可以通过语音播报的方式向驾乘人员传达，也可以是通过界面显示(前提是自动驾驶车辆上部署有显示屏)的方式向驾乘人员传达，具体此处不做限定。该授权请求用于向驾乘人员请示是否需要执行第二驾驶策略。驾乘人员在接收到ADS发送的授权请求后，在驾乘人员接受授权请求的情况下，ADS执行第二驾驶策略。
在本申请上述实施方式中，第二驾驶策略实质是对原本的风险减缓策略的升级，原来已有的风险减缓策略不管是在哪个自动驾驶等级，当存在ADS无法执行动态驾驶任务或驾乘人员无法接管动态驾驶任务时，该风险减缓策略最终的着力点均落在“将车辆停下来”，即只考虑到狭义的车辆安全。而在本申请实施例中，第二驾驶策略除了考虑到把车辆停止下来，在实际情况情况下，车里还有更多的努力可以做，包括但不限于呼救，组织救援，请求安排紧急通道，预定医疗资源等措施。
在第一方面的一种可能的设计中，该第二驾驶策略可以是：靠边道停车、呼叫救援、建立与医疗机构的通信连接、规划所述自动驾驶车辆与所述医疗机构的行驶路径、预定医疗资源、请求安排紧急就医通道中的任意一项或多项。
在本申请上述实施方式中，具体阐述了第二驾驶策略的几种表现形式，充分考虑到了“急救白金10分钟”的需求，即将健康问题发现的时间提前，做到提前侦测、及时应对，用户体验好，驾乘人员的健康也得到保证，不仅降低了交通事故的发生率，还带来了巨大的社会效益。
在第一方面的一种可能的设计中，在自动驾驶等级为L4级或L5的情况下，位于自动驾驶车辆驾驶位上的人员不具备控制自动驾驶车辆的车辆控制权，那么在这种情况下，则不能称其为驾驶员，一般称为驾乘人员。这种情况下，ADS根据所述差值与所述持续时长执行第一驾驶策略具体可以是：根据所述差值与所述持续时长确定所述驾乘人员的健康等级，当ADS确定健康等级为轻度异常，则第一驾驶策略可以是ADS控制该自动驾驶车辆的速度降到预设速度以下(如，60km/h以下)、靠边道行驶、开启双跳灯中的任意一项或多项。
在本申请上述实施方式中，阐述了在自动驾驶等级为L4级或L5的情况下，当驾乘人员的健康等级为轻度异常时，第一驾驶策略是怎样的，即基于实时生理数据偏离健康生理数据范围的差值的多少以及偏离的持续时长的长短确定健康等级，并基于不同的健康等级采取不同的第一驾驶策略，更有针对性。
在第一方面的一种可能的设计中，在自动驾驶等级为L4级或L5的情况下，当ADS确定健康等级为重度异常，则第一驾驶策略可以是ADS控制自动驾驶车辆的速度缓慢降到零、靠边道停车、开启双跳灯、怠速运行、开启车辆外循环、开启车辆内循环、设置车内目标温度、中控门锁解锁中的任意一项或多项。
在本申请上述实施方式中，阐述了在自动驾驶等级为L4级或L5的情况下，当驾乘人员的健康等级为重度异常时，第一驾驶策略是怎样的，即基于实时生理数据偏离健康生理数据范围的差值的多少以及偏离的持续时长的长短确定健康等级，并基于不同的健康等级采取不同的第一驾驶策略，更有针对性。
在第一方面的一种可能的设计中，在自动驾驶等级为L3级的情况下，驾乘人员为位于自动驾驶车辆驾驶位上的驾驶员。当实时生理数据偏离健康生理数据范围的差值大于预设值，且实时生理数据偏离健康生理数据范围的持续时长大于第一预设时长，此时说明大概率驾乘人员出现健康状况，ADS将锁定ADS占据自动驾驶车辆的控制权，即车辆控制权不可移交给驾乘人员。之后，ADS进一步根据偏离的差值和偏离的持续时长确定驾乘人员的健康等级，并根据健康等级执行对应的第一驾驶策略。具体地，当ADS确定健康等级为轻度异常，则第一驾驶策略除了锁定ADS占据自动驾驶车辆的控制权之外，还可以是ADS控制该自动驾驶车辆的速度降到预设速度以下(如，60km/h以下)、靠边道行驶、开启双跳灯中的任意一项或多项。
在本申请上述实施方式中，阐述了在自动驾驶等级为L3的情况下，当驾乘人员(L3级情况下驾乘人员实际为位于驾驶位上的驾驶员)的健康等级为轻度异常时，第一驾驶策略除了锁定ADS占据自动驾驶车辆的控制权之外，还可以是ADS控制该自动驾驶车辆的速度降到预设速度以下、靠边道行驶、开启双跳灯中的任意一项或多项，即基于实时生理数据偏离健康生理数据范围的差值的多少以及偏离的持续时长的长短确定健康等级，并基于不同的健康等级采取不同的第一驾驶策略，更有针对性。且在本申请上述实施例中，仅在驾乘人员健康等级正常的情况下，驾乘人员才具有接管车辆控制权的权利，否则车辆控制权不可移交给驾乘人员，从而避免了驾乘人员由于身体健康问题在某时间段内实际上没有接管能力而导致的车辆风险和人身安全。
在第一方面的一种可能的设计中，在自动驾驶等级为L3级的情况下，当ADS确定健康等级为重度异常，则第一驾驶策略除了锁定ADS占据自动驾驶车辆的控制权外，还可以是：ADS控制该自动驾驶车辆的速度缓慢降到零、靠边道停车、开启双跳灯、怠速运行、开启车辆外循环、开启车辆内循环、设置车内目标温度、中控门锁解锁中的任意一项或多项。
在本申请上述实施方式中，阐述了在自动驾驶等级为L3的情况下，当驾乘人员(L3级情况下驾乘人员实际为位于驾驶位上的驾驶员)的健康等级为重度异常时，第一驾驶策 略除了锁定ADS占据自动驾驶车辆的控制权之外，还可以是控制自动驾驶车辆的速度缓慢降到零、靠边道停车、开启双跳灯、怠速运行、开启车辆外循环、开启车辆内循环、设置车内目标温度、中控门锁解锁中的任意一项或多项，即基于实时生理数据偏离健康生理数据范围的差值的多少以及偏离的持续时长的长短确定健康等级，并基于不同的健康等级采取不同的第一驾驶策略，更有针对性。且在本申请上述实施例中，仅在驾乘人员健康等级正常的情况下，驾乘人员才具有接管车辆控制权的权利，否则车辆控制权不可移交给驾乘人员，从而避免了驾乘人员由于身体健康问题在某时间段内实际上没有接管能力而导致的车辆风险和人身安全。
在第一方面的一种可能的设计中，不管是在哪个自动驾驶等级下，当监测设备采集的实时生理数据在第二预设时长内(如，8分钟内)恢复到健康生理数据范围，说明驾乘人员的健康状况暂时恢复了，此时ADS可控制自动驾驶车辆将降级的自动驾驶业务进行恢复，例如，假设原来自动驾驶车辆正在执行的自动驾驶业务为“高速跟车行驶，速度100km/h”，实时生理数据与健康生理数据范围的差值超过预设值且持续了第一预设时长(如，3分钟)，那么ADS对该自动驾驶业务降级为“高速跟车行驶，速度60km/h”，并持续监测后续采集的实时生理数据，若在第二预设时长(如，8分钟)内，监测的实时生理数据恢复到健康生理数据范围内，那么ADS将降级后的“高速跟车行驶，速度60km/h”自动驾驶业务恢复到原来的“高速跟车行驶，速度100km/h”。
在本申请上述实施方式中，不管是在哪个自动驾驶等级下(L3、L4或L5)，当监测设备采集的实时生理数据在第二预设时长内恢复到健康生理数据范围，说明驾乘人员的健康状况暂时恢复了，此时ADS可控制自动驾驶车辆将降级的自动驾驶业务进行恢复，提高了用户体验。
在第一方面的一种可能的设计中，ADS还可以基于实时生理数据生成事件日志，该事件日志就用于记录在实时生理数据偏离所述健康生理数据范围期间，异常的实时生理数据和后续ADS的一系列操作，并向与该自动驾驶车辆对应的云服务器周期性(如，每隔5分钟)上报该事件日志。
在本申请上述实施方式中，ADS可将实时生理数据异常期间内的一切与健康相关的数据及操作记录为事件日志周期性上报与自动驾驶车辆对应的云端进行备份，从而便于界定人车责任。
在第一方面的一种可能的设计中，该实时生理数据至少包括如下生理数据中的至少一种：该驾乘人员的实时血压、实时心率、实时血氧、实时体温、心脏早搏、房颤等实时生理数据，只要是监测设备能够采集到的、能够反映驾乘人员健康状况的生理数据都可以，具体此处不做限定。
在本申请上述实施方式中，阐述了实时生理数据的几种常见形式，具备选择性和灵活性。
本申请实施例第二方面提供一种ADS，该ADS具有实现上述第一方面或第一方面任意一种可能实现方式的方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
本申请实施例第三方面提供一种ADS，可以包括存储器、处理器以及总线系统，其中，存储器用于存储程序，处理器用于调用该存储器中存储的程序以执行本申请实施例第一方面或第一方面任意一种可能实现方式的方法。
本申请实施例第四方面提供一种自动驾驶车辆，该自动驾驶车辆包括处理器和存储器，其中，存储器用于存储程序，处理器用于调用该存储器中存储的程序以执行本申请实施例第一方面或第一方面任意一种可能实现方式的方法。
本申请第五方面提供一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行上述第一方面或第一方面任意一种可能实现方式的方法。
本申请实施例第六方面提供了一种计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面或第一方面任意一种可能实现方式的方法。
本申请实施例第六方面提供了一种芯片，该芯片包括至少一个处理器和至少一个接口电路，该接口电路和该处理器耦合，至少一个接口电路用于执行收发功能，并将指令发送给至少一个处理器，至少一个处理器用于运行计算机程序或指令，其具有实现如上述第一方面或第一方面任意一种可能实现方式的方法的功能，该功能可以通过硬件实现，也可以通过软件实现，还可以通过硬件和软件组合实现，该硬件或软件包括一个或多个与上述功能相对应的模块。此外，该接口电路用于与该芯片之外的其它模块进行通信。
附图说明
图1为自动驾驶分级标准J3016TM第六章在Figure 11中定义的ODD的示意图；
图2为本申请实施例在已定义的ODD中额外增加一组用于表示驾乘人员健康指标的适用范围的一种示意图；
图3为本申请实施例提供的不同自动驾驶等级与人工驾驶之间关系的一种示意图；
图4为本申请实施例提供的自动驾驶车辆的一种结构示意图；
图5为本申请实施例提供的自动驾驶方法的一种流程示意图；
图6为本申请实施例提供的自动驾驶方法的一个实例示意图；
图7为本申请实施例提供的自动驾驶方法的另一实例示意图；
图8为本申请实施例提供的ADS的一个结构示意图；
图9为本申请实施例提供的ADS的另一结构示意图。
具体实施方式
本申请实施例提供了一种自动驾驶方法、ADS及自动驾驶车辆，用于在ODD内新增加健康生理数据范围作为ODD的一组适用范围，当驾乘人员的实时生理数据偏离该范围且持续一定时长，那么ADS将判定驾乘人员出现健康异常，并根据偏离程度和持续时长执行对应的第一驾驶策略，从而做到对驾乘人员的突发健康事故的及时应对，降低交通事故发生率。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类 似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的术语在适当情况下可以互换，这仅仅是描述本申请的实施例中对相同属性的对象在描述时所采用的区分方式。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，以便包含一系列单元的过程、方法、系统、产品或设备不必限于那些单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它单元。
本申请实施例涉及了许多关于自动驾驶的相关知识，为了更好地理解本申请实施例的方案，下面先对本申请实施例可能涉及的相关术语和概念进行介绍。应理解的是，相关的概念解释可能会因为本申请实施例的具体情况有所限制，但并不代表本申请仅能局限于该具体情况，在不同实施例的具体情况可能也会存在差异，具体此处不做限定。
(1)自动驾驶系统(automation driving system，ADS)
ADS是由实现驾驶自动化的硬件和软件所共同组成的系统，也可称为控制系统，部署有ADS的车辆则称为自动驾驶车辆，也可称为无人驾驶车辆、电脑驾驶车辆或轮式移动机器人等。自动驾驶车辆在ADS的控制下，通过搭载先进的车载传感器、控制器和数据处理器、执行机构等装置，借助车联网、5G和V2X等现代移动通信与网络技术实现交通参与物与彼此间的互换与共享，从而具备在复杂环境下的传感感知、决策规划、控制执行等功能。
在ADS的控制下，自动驾驶车辆的整个工作流程是：首先，通过雷达、激光雷达、摄像头、车载网联系统等对外界的环境进行感知识别，得到外界环境的感知信息；然后，在融合多方面感知信息的基础上，通过智能算法学习外界场景信息，预测场景中交通参与者的轨迹，规划自车运行轨迹；最后，跟踪决策规划的轨迹目标，控制车辆的油门、刹车和转向等驾驶动作，调节车辆行驶速度、位置和方向等状态，以保证车辆的安全性、操纵性和稳定性。
(2)设计运行范围(operational design domain，ODD)
ODD也可称为设计运行域、设计适用域、设计行驶区域等，指的是自动驾驶车辆安全工作的环境，其实质就是一系列参数的集合，是ADS被设计的起作用的条件及适用范围(即自动驾驶的适用范围)。
具体地，是把天气环境、道路情况(如，直路、弯路的半径等)、车速、车流量等信息做出测定，以确保系统的能力在安全的环境之内。可以理解成自动驾驶车辆的安全工作环境，包括速度(高速、低速等)、地形(平原、山地等)、路面情况(直路、弯路等)、环境(天气、气候、基础设施等)、交通情况(简单、复杂、违规行为、路线固定等)、时段(白天、晚上)、……，因为高速还是低速，平原还是山地，直路还是弯路，天气状况如何，基础设施怎样，交通情况简单还是复杂，处于白天还是晚上等这一系列的条件都会对自动驾驶的表现产生决定性的作用。如图1所示，图1为自动驾驶分级标准J3016TM第六章在Figure 11中定义的ODD，考虑的要素包含了车速、地形、道路类型、天气环境、交通状态、时间等。不同的自动驾驶等级对应的ODD需满足的运行条件可以不同，如图1所示，Level 2(即L2级)对应ODD的运行条件需满足的要素为：白天、高速公路、车速小于等于35英里每小时(单位：mph)；而Level 4(即L4级)对应ODD的运行条件需满足的要素则 为：白天、校园道路、车速小于等于25mph。
ODD是否全面细致，可以一定程度上反映出自动驾驶方案是否成熟；而ODD设定的条件宽松与否，也能一定程度上反映出同级别方案的水平高低。如果只能在严格限制的范围内使用，那么车辆的“智能化”程度可能就相对较低，实际使用时的场景也相对较少、体验稍差。
需要说明的是，在本申请实施例中，如图2所示，在自动驾驶分级标准J3016TM已定义的ODD中额外增加一组用于表示驾乘人员健康指标的适用范围，即健康生理数据范围，例如，正常的心率范围、正常的血压范围等，从而可避免车辆接管人员由于身体健康问题在某时间段内实际上没有接管能力导致的车辆风险。该新增的健康生理数据范围可添加在各个自动驾驶等级下的ODD，尤其需要添加入L3至L5级下的ODD。具体地，在自动驾驶等级L3相关的自动驾驶业务中，ODD融合驾乘人员(L3级的驾乘人员为驾驶员)的健康指标，即考虑到驾驶员接管能力；在自动驾驶等级L4和L5相关的自动驾驶业务中，驾乘人员没有接管义务和途径，对应的ODD也需融合驾乘人员的健康指标，用于指导ADS执行后续的风险减缓策略。
(3)设计运行条件(operational design condition，ODC)
设计运行时确定的驾驶自动化功能可以正常工作的条件，包括设ODD、驾驶员状态以及其他必要条件。
(4)动态驾驶任务(dynamic driving task，DDT)
动态驾驶任务是指车辆在道路上行驶所需的所有实时操作和策略上的功能(决策类的行为)，不包括行程安排、目的地和途径地的选择等战略上的功能。具体地，指的是在道路上驾驶车辆需要做的操作和决策，包括对车辆进行横向运动和纵向运动方向的操作，对车辆周围环境的监测和执行对应操作等等。简单来说，动态驾驶任务可以理解为自动驾驶方案实现的若干具体功能。在现今已量产的辅助驾驶、自动驾驶车型中，比较常见的跟车行驶、自适应巡航、紧急制动，以及极少数车型配备的拨杆换道、主动超车，便都是典型的动态驾驶任务。
(5)动态驾驶任务支援(dynamic driving task fallback，DDT Fallback)
自动驾驶在设计时，需要考虑系统性的失效(即导致系统不工作的故障)发生或者出现超过系统原有的运行设计范围之外的情况，当这两者发生的时候，需给出最小化风险的解决路径。在当前的量产方案中，分级预警是较为常见的动态驾驶任务支援操作，虽然各厂商的最小风险状态设计不尽相同，但减速停车是较为常见且通用的设计。
以Nullmax的方案为例，系统在检测到需要驾驶员接管时，会分级发出接管提示。如果限定时间内驾驶员没有响应一级提示，那么会发出二级提示，提示强度全面升级。在超出时间仍未接管的情况下，车辆将进入最小风险状态，降低车速并停车。
(6)风险减缓策略(risk mitigation strategy，RMS)
在ADS无法执行动态驾驶任务，或，驾乘人员无法接管动态驾驶任务时，ADS所采取的降低风险的措施，例如车道内停车。
具体地，在自动驾驶分级标准J3016TM第8.6章节里，定义了：在装备有L2级和L3 级自动驾驶特征的车辆也许有一个额外的失效缓解策略(即风险减缓策略)，无论车辆发生了什么(或者是在L2情况下驾驶员无法控制L2自动驾驶特征，或者是在L3情况下车辆接管员无法执行车辆接管)，这个策略会控制车辆停止；而在装备有L4级和L5级自动驾驶特征的车辆也有一个类似的失效缓解策略，当某种少有发生的灾难失效导致ADS退出，那么ADS在退出前将控制车辆缓慢减速直至停止。也就是说，不管是在哪个自动驾驶等级，当存在ADS无法执行动态驾驶任务或驾乘人员无法接管动态驾驶任务时，该风险减缓策略最终的着力点均落在“将车辆停下来”。
(7)最小风险状态(minimal risk condition，MRC)
当车辆无法完成预定的行程时，由驾乘人员或ADS执行并最终使车辆事故风险达到可接受的状态。
(8)自动驾驶分级标准J3016TM
按照驾乘人员和车辆在行驶时对车辆介入的程度，自动驾驶分级标准J3016TM将自动驾驶技术定为六级，分别为Level0、Level1、Level2、Level3、Level4、Level5，也可简称为L0、L1、L2、L3、L4、L5。如图3所示，自动驾驶分级标准J3016TM指出，ODD是满足不同自动驾驶等级的充分条件，当满足ODD对应的设计运行条件时，则ADS可实现对应自动驾驶等级的自动驾驶，当不满足ODD对应的设计运行条件时，则只能由驾驶员人工驾驶。
具体地，每个自动驾驶等级与对应的划分要素关系如表1所示，其中，表1中的系统为ADS。这里对各个自动驾驶等级进行说明：
L0级：也称为应急辅助，驾驶员完全掌控车辆，没有任何主动安全配置，目前该自动驾驶等级的车辆在市面上已几乎消失。
L1级：也称为部分驾驶辅助，在一些情况下，ADS能够协助驾驶员完成某些驾驶任务。
L2级：也称为组合驾驶辅助，ADS能够完成某些驾驶任务，但驾驶员需要监控驾驶环境，同时保证出现问题随时对车辆进行接管，在该自动驾驶等级，ADS的错误感知和判断有驾驶员随时纠正，目前大多数车企都能提供L2级的ADS，L2级可以通过速度、环境等将交通场景分割为不同的使用场景，如环路低速堵车、高速路上快速行车、驾驶员在车内的自动泊车等。
L3级：也称为有条件的自动驾驶，ADS既能完成某些驾驶任务，也能在某些情况下监控驾驶环境，即要求在限定的ODD内ADS能够控制车辆完成所有的动态驾驶任务，但要求驾驶员必须准备好重新取得车辆控制权。具体地，ADS在自身失效或超出对应该自动驾驶等级的ODD范围时会发出控制权移交请求，自动驾驶分级标准J3016TM也定义了ADS在发出控制权移交请求后能够继续控制车辆几秒时间，这段时间用于驾驶员做好接管车辆控制权的准备，如，驾驶员的手在方向盘上放好、驾驶员眼睛正视车辆前方等，ADS可通过电容方向盘来探测驾驶员的手是否在方向盘上、通过车内驾驶位的监控摄像头探测驾驶员眼睛是否看路等确定驾驶员是否做好了接管车辆的准备，若ADS确定驾驶员做好接管车辆的准备，则ADS将车辆控制权移交给驾驶员。因此，在该自动驾驶等级下，驾驶员仍无法睡觉或深度休息。
L4级：也可称为高度自动驾驶，ADS在某些环境和特定条件下，能够完成驾驶任务并监控驾驶环境，即要求ADS在ODD内不止能完成动态驾驶任务还要能够应对系统失效，无需驾乘人员(由于L4级的车辆无需驾驶员，因此在该自动驾驶等级下没有驾驶员，只有驾乘人员)介入。目前，L4级的自动驾驶多是基于城市的使用，可以是全自动的代客泊车，也可以是直接结合打车服务使用。在该自动驾驶等级下，在对应的ODD范围内，驾驶相关的所有任务和驾乘人员已经没关系，感知外界责任全在ADS。
L5级：也可称为完全自动驾驶，ADS在所有条件下都能完成的所有驾驶任务，即全工况无人驾驶，无需定义ODD，能够完成所有的动态驾驶任务以及处理所有的动态驾驶任务支援。
表1：自动驾驶等级与对应的划分要素关系
Figure PCTCN2021117595-appb-000001
(9)驾乘人员
在本申请实施例中，驾乘人员实质就是指位于自动驾驶车辆驾驶位上的人员，当自动驾驶等级为L3级及以下的自动驾驶等级时，此时驾乘人员也可称为驾驶员，在一些驾驶任务中，具备控制自动驾驶车辆的车辆控制权；但在自动驾驶等级为L4或L5级，位于自动驾驶车辆驾驶位上的人员不具备控制自动驾驶车辆的车辆控制权，在这种情况下，则不能称其为驾驶员，一般称为驾乘人员。因此，在本申请实施例中，所述驾乘人员在L3级及以下为驾驶员，在L4、L5级，则为驾乘人员，本申请实施例则统一称为驾乘人员。
下面结合附图，对本申请的实施例进行描述。本领域普通技术人员可知，随着技术的发展和新场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
为了能更好的理解本方案，本申请实施例首先对自动驾驶车辆内部各个结构的具体功能进行介绍，请先参阅图4，图4为本申请实施例提供的自动驾驶车辆的一种结构示意图，自动驾驶车辆100配置为完全或部分地自动驾驶模式，例如，自动驾驶车辆100可以在处于自动驾驶模式中的同时控制自身，并且可通过人为操作来确定车辆及其周边环境的当前 状态，确定周边环境中的至少一个其他车辆的可能行为，并确定其他车辆执行可能行为的可能性相对应的置信水平，基于所确定的信息来控制自动驾驶车辆100。在自动驾驶车辆100处于自动驾驶模式中时，也可以将自动驾驶车辆100置为在没有和人交互的情况下操作。
自动驾驶车辆100可包括各种子系统，例如行进系统102、传感器系统104(如，图3中的摄像机、SICK、IBEO、激光雷达等均属于传感器系统104中的模块)、自动驾驶系统106、一个或多个外围设备108以及电源110、计算机系统112和用户接口116。可选地，自动驾驶车辆100可包括更多或更少的子系统，并且每个子系统可包括多个部件。另外，自动驾驶车辆100的每个子系统和部件可以通过有线或者无线互连。
行进系统102可包括为自动驾驶车辆100提供动力运动的组件。在一个实施例中，行进系统102可包括引擎118、能量源119、传动装置120和车轮/轮胎121。
其中，引擎118可以是内燃引擎、电动机、空气压缩引擎或其他类型的引擎组合，例如，汽油发动机和电动机组成的混动引擎，内燃引擎和空气压缩引擎组成的混动引擎。引擎118将能量源119转换成机械能量。能量源119的示例包括汽油、柴油、其他基于石油的燃料、丙烷、其他基于压缩气体的燃料、乙醇、太阳能电池板、电池和其他电力来源。能量源119也可以为自动驾驶车辆100的其他系统提供能量。传动装置120可以将来自引擎118的机械动力传送到车轮121。传动装置120可包括变速箱、差速器和驱动轴。在一个实施例中，传动装置120还可以包括其他器件，比如离合器。其中，驱动轴可包括可耦合到一个或多个车轮121的一个或多个轴。
传感器系统104可包括感测关于自动驾驶车辆100周边的环境的信息的若干个传感器。例如，传感器系统104可包括定位系统122(定位系统可以是全球定位GPS系统，也可以是北斗系统或者其他定位系统)、惯性测量单元(inertial measurement unit，IMU)124、雷达126、激光测距仪128以及相机130。传感器系统104还可包括被监视自动驾驶车辆100的内部系统的传感器(例如，车内空气质量监测器、燃油量表、机油温度表等)。来自这些传感器中的一个或多个的传感数据可用于检测对象及其相应特性(位置、形状、方向、速度等)。这种检测和识别是自主自动驾驶车辆100的安全操作的关键功能。在本申请实施例中，激光传感器是属于传感器系统104中非常重要的一个感知模块。
其中，定位系统122可用于估计自动驾驶车辆100的地理位置，在本申请实施例中，激光传感器可作为定位系统122中的一种，用于实现自动驾驶车辆100的精确定位，IMU 124用于基于惯性加速度来感知自动驾驶车辆100的位置和朝向变化。在一个实施例中，IMU 124可以是加速度计和陀螺仪的组合。雷达126可利用无线电信号来感知自动驾驶车辆100的周边环境内的物体，具体可以表现为毫米波雷达或激光雷达。在一些实施例中，除了感知物体以外，雷达126还可用于感知物体的速度和/或前进方向。激光测距仪128可利用激光来感知自动驾驶车辆100所位于的环境中的物体。在一些实施例中，激光测距仪128可包括一个或多个激光源、激光扫描器以及一个或多个检测器，以及其他系统组件。相机130可用于捕捉自动驾驶车辆100的周边环境的多个图像。相机130可以是静态相机或视频相机。
自动驾驶系统106为控制自动驾驶车辆100及其组件的操作，因此在本申请实施例中，自动驾驶系统106也可称为控制系统。自动驾驶系统106可包括各种部件，其中包括转向系统132、油门134、制动单元136、计算机视觉系统140、线路控制系统142以及障碍避免系统144。
其中，转向系统132可操作来调整自动驾驶车辆100的前进方向。例如在一个实施例中可以为方向盘系统。油门134用于控制引擎118的操作速度并进而控制自动驾驶车辆100的速度。制动单元136用于控制自动驾驶车辆100减速。制动单元136可使用摩擦力来减慢车轮121。在其他实施例中，制动单元136可将车轮121的动能转换为电流。制动单元136也可采取其他形式来减慢车轮121转速从而控制自动驾驶车辆100的速度。计算机视觉系统140可以操作来处理和分析由相机130捕捉的图像以便识别自动驾驶车辆100周边环境中的物体和/或特征。所述物体和/或特征可包括交通信号、道路边界和障碍体。计算机视觉系统140可使用物体识别算法、运动中恢复结构(structure from motion，SFM)算法、视频跟踪和其他计算机视觉技术。在一些实施例中，计算机视觉系统140可以用于为环境绘制地图、跟踪物体、估计物体的速度等等。线路控制系统142用于确定自动驾驶车辆100的行驶路线以及行驶速度。在一些实施例中，线路控制系统142可以包括横向规划模块1421和纵向规划模块1422，横向规划模块1421和纵向规划模块1422分别用于结合来自障碍避免系统144、GPS 122和一个或多个预定地图的数据为自动驾驶车辆100确定行驶路线和行驶速度。障碍避免系统144用于识别、评估和避免或者以其他方式越过自动驾驶车辆100的环境中的障碍体，前述障碍体具体可以表现为实际障碍体和可能与自动驾驶车辆100发生碰撞的虚拟移动体。在一个实例中，自动驾驶系统106可以增加或替换地包括除了所示出和描述的那些以外的组件。或者也可以减少一部分上述示出的组件。
自动驾驶车辆100通过外围设备108与外部传感器、其他车辆、其他计算机系统或用户之间进行交互。外围设备108可包括无线通信系统146、车载电脑148、麦克风150和/或扬声器152。在一些实施例中，外围设备108为自动驾驶车辆100的用户提供与用户接口116交互的手段。例如，车载电脑148可向自动驾驶车辆100的用户提供信息。用户接口116还可操作车载电脑148来接收用户的输入。车载电脑148可以通过触摸屏进行操作。在其他情况中，外围设备108可提供用于自动驾驶车辆100与位于车内的其它设备通信的手段。例如，麦克风150可从自动驾驶车辆100的用户接收音频(例如，语音命令或其他音频输入)。类似地，扬声器152可向自动驾驶车辆100的用户输出音频。无线通信系统146可以直接地或者经由通信网络来与一个或多个设备无线通信。例如，无线通信系统146可使用3G蜂窝通信，例如CDMA、EVD0、GSM/GPRS，或者4G蜂窝通信，例如LTE。或者5G蜂窝通信。无线通信系统146可利用无线局域网(wireless local area network，WLAN)通信。在一些实施例中，无线通信系统146可利用红外链路、蓝牙或ZigBee与设备直接通信。其他无线协议，例如各种车辆通信系统，例如，无线通信系统146可包括一个或多个专用短程通信(dedicated short range communications，DSRC)设备，这些设备可包括车辆和/或路边台站之间的公共和/或私有数据通信。
电源110可向自动驾驶车辆100的各种组件提供电力。在一个实施例中，电源110可 以为可再充电锂离子或铅酸电池。这种电池的一个或多个电池组可被配置为电源为自动驾驶车辆100的各种组件提供电力。在一些实施例中，电源110和能量源119可一起实现，例如一些全电动车中那样。
自动驾驶车辆100的部分或所有功能受计算机系统112控制。计算机系统112可包括至少一个处理器113，处理器113执行存储在例如存储器114这样的非暂态计算机可读介质中的指令115。计算机系统112还可以是采用分布式方式控制自动驾驶车辆100的个体组件或子系统的多个计算设备。处理器113可以是任何常规的处理器，诸如商业可获得的中央处理器(central processing unit，CPU)。可选地，处理器113可以是诸如专用集成电路(application specific integrated circuit，ASIC)或其它基于硬件的处理器的专用设备。尽管图1功能性地图示了处理器、存储器、和在相同块中的计算机系统112的其它部件，但是本领域的普通技术人员应该理解该处理器、或存储器实际上可以包括不存储在相同的物理外壳内的多个处理器、或存储器。例如，存储器114可以是硬盘驱动器或位于不同于计算机系统112的外壳内的其它存储介质。因此，对处理器113或存储器114的引用将被理解为包括可以并行操作或者可以不并行操作的处理器或存储器的集合的引用。不同于使用单一的处理器来执行此处所描述的步骤，诸如转向组件和减速组件的一些组件每个都可以具有其自己的处理器，所述处理器只执行与特定于组件的功能相关的计算。
在此处所描述的各个方面中，处理器113可以位于远离自动驾驶车辆100并且与自动驾驶车辆100进行无线通信。在其它方面中，此处所描述的过程中的一些在布置于自动驾驶车辆100内的处理器113上执行而其它则由远程处理器113执行，包括采取执行单一操纵的必要步骤。
在一些实施例中，存储器114可包含指令115(例如，程序逻辑)，指令115可被处理器113执行来执行自动驾驶车辆100的各种功能，包括以上描述的那些功能。存储器114也可包含额外的指令，包括向行进系统102、传感器系统104、自动驾驶系统106和外围设备108中的一个或多个发送数据、从其接收数据、与其交互和/或对其进行控制的指令。除了指令115以外，存储器114还可存储数据，例如道路地图、路线信息，车辆的位置、方向、速度以及其它这样的车辆数据，以及其他信息。这种信息可在自动驾驶车辆100在自主、半自主和/或手动模式中操作期间被自动驾驶车辆100和计算机系统112使用。用户接口116，用于向自动驾驶车辆100的用户提供信息或从其接收信息。可选地，用户接口116可包括在外围设备108的集合内的一个或多个输入/输出设备，例如无线通信系统146、车载电脑148、麦克风150和扬声器152。
计算机系统112可基于从各种子系统(例如，行进系统102、传感器系统104和自动驾驶系统106)以及从用户接口116接收的输入来控制自动驾驶车辆100的功能。例如，计算机系统112可利用来自自动驾驶系统106的输入以便控制转向系统132来避免由传感器系统104和障碍避免系统144检测到的障碍体。在一些实施例中，计算机系统112可操作来对自动驾驶车辆100及其子系统的许多方面提供控制。
可选地，上述这些组件中的一个或多个可与自动驾驶车辆100分开安装或关联。例如，存储器114可以部分或完全地与自动驾驶车辆100分开存在。上述组件可以按有线和/或无 线方式来通信地耦合在一起。
可选地，上述组件只是一个示例，实际应用中，上述各个模块中的组件有可能根据实际需要增添或者删除，图4不应理解为对本申请实施例的限制。在道路行进的自动驾驶车辆，如上面的自动驾驶车辆100，可以识别其周围环境内的物体以确定对当前速度的调整。所述物体可以是其它车辆、交通控制设备、或者其它类型的物体。在一些示例中，可以独立地考虑每个识别的物体，并且基于物体的各自的特性，诸如它的当前速度、加速度、与车辆的间距等，可以用来确定自动驾驶车辆所要调整的速度。
可选地，自动驾驶车辆100或者与自动驾驶车辆100相关联的计算设备如图4的计算机系统112、计算机视觉系统140、存储器114可以基于所识别的物体的特性和周围环境的状态(例如，交通、雨、道路上的冰、等等)来预测所识别的物体的行为。可选地，每一个所识别的物体都依赖于彼此的行为，因此还可以将所识别的所有物体全部一起考虑来预测单个识别的物体的行为。自动驾驶车辆100能够基于预测的所识别的物体的行为来调整它的速度。换句话说，自动驾驶车辆100能够基于所预测的物体的行为来确定车辆将需要调整到(例如，加速、减速、或者停止)什么稳定状态。在这个过程中，也可以考虑其它因素来确定自动驾驶车辆100的速度，诸如，自动驾驶车辆100在行驶的道路中的横向位置、道路的曲率、静态和动态物体的接近度等等。除了提供调整自动驾驶车辆的速度的指令之外，计算设备还可以提供修改自动驾驶车辆100的转向角的指令，以使得自动驾驶车辆100遵循给定的轨迹和/或维持与自动驾驶车辆100附近的物体(例如，道路上的相邻车道中的轿车)的安全横向和纵向距离。
上述自动驾驶车辆100可以为轿车、卡车、摩托车、公共汽车、船、飞机、直升飞机、割草机、娱乐车、游乐场车辆、施工设备、电车、高尔夫球车、火车、和手推车等，本申请实施例不做特别的限定。
基于图4对应的实施例所述的自动驾驶车辆，本申请实施例提供了一种自动驾驶方法，请参阅图5，图5为本申请实施例提供的自动驾驶方法的一种流程示意图，可以包括如下步骤：
501、自动驾驶系统ADS接收监测设备采集的驾乘人员的实时生理数据。
首先，部署有ADS的自动驾驶车辆内的驾乘人员佩戴有监测设备(如，智能手表、智能手环、智能心率计等可穿戴设备)，该监测设备可实时采集驾乘人员的实时生理数据，如，可以采集驾乘人员的心率、血压、血氧、体温、心脏早搏、房颤等实时生理数据，这些采集得到的实时生理数据再通过通讯协议(如，蓝牙、WiFi等)接入ADS。
需要说明的是，在本申请实施例中，驾乘人员实质就是指位于自动驾驶车辆驾驶位上的人员，当自动驾驶等级为L3级及以下的自动驾驶等级时，此时驾乘人员也可称为驾驶员，在一些驾驶任务中，具备控制自动驾驶车辆的车辆控制权；但在自动驾驶等级为L4或L5级，位于自动驾驶车辆驾驶位上的人员不具备控制自动驾驶车辆的车辆控制权，在这种情况下，则不能称其为驾驶员，一般称为驾乘人员。因此，在本申请实施例中，所述驾乘人员在L3级及以下为驾驶员，在L4、L5级，则为驾乘人员，本申请实施例则统一称为驾乘人员。
502、当实时生理数据偏离健康生理数据范围的差值大于预设值，且实时生理数据偏离健康生理数据范围的持续时长大于第一预设时长，ADS对自动驾驶车辆正执行的自动驾驶业务进行降级，并根据所述差值与所述持续时长执行第一驾驶策略，该健康生理数据范围为事先添加入设计运行范围ODD的一组适用范围。
ADS接收到监测设备发送的驾乘人员的实时生理数据后，将判断该实时生理数据是否偏离健康生理数据范围，当ADS确定接收到的实时生理数据偏离健康生理数据范围的差值大于预设值，则进一步判断实时生理数据偏离健康生理数据范围的持续时长是否大于第一预设时长，当ADS确定该实时生理数据偏离健康生理数据范围的持续时长大于第一预设时长，那么ADS对自动驾驶车辆正执行的自动驾驶业务进行降级处理，并根据所述差值与所述持续时长的具体取值情况执行第一驾驶策略。
这里需要注意的是，该健康生理数据范围为事先添加入ODD的一组适用范围，如图2所示，在自动驾驶分级标准J3016TM已定义的ODD中额外增加一组用于表示驾乘人员健康指标的适用范围，即健康生理数据范围，例如，正常的心率范围、正常的血压范围等，该ODD部署在该ADS上。从而可避免车辆接管人员由于身体健康问题在某时间段内实际上没有接管能力导致的车辆风险。该新增的健康生理数据范围可添加在各个自动驾驶等级下的ODD，尤其需要添加入L3至L5级下的ODD。具体地，在自动驾驶等级L3相关的自动驾驶业务中，ODD融合驾乘人员(L3级的驾乘人员为驾驶员)的健康指标，即考虑到驾驶员接管能力；在自动驾驶等级L4和L5相关的自动驾驶业务中，驾乘人员没有接管义务和途径，对应的ODD也需融合驾乘人员的健康指标，用于指导ADS执行后续的风险减缓策略。
为便于理解，下面以监测设备采集的实时生理数据为实时心率、健康生理数据范围为健康心率范围为例，对上述步骤502进行说明：假设健康心率范围在60次/分钟至100次/分钟，若监测设备采集到的驾乘人员在某时刻的实时心率在120次/分钟至160次/分钟，超过了健康心率范围，那么将触发ADS开始计时，假设事先设置的第一预设时长为3分钟，当达到3分钟后，监测设备在这3分钟内采集到的实时心率依然在120次/分钟至160次/分钟，即该异常实时心率的持续时长达到了3分钟，且实时心率与健康心率范围的差值为20次/分钟至60次/分钟，大于预设值(假设预设值为20次/分钟)，那么大概率说明该驾乘人员出现突发的健康状况，此时ADS将对自动驾驶车辆正在执行的“高速跟车行驶”业务(假设正在执行的自动驾驶业务是“高速跟车行驶”业务)进行降级，比如，将原来的速度由100千米/小时(单位:km/h)缓慢降速为70km/h，并根据差值与持续时长执行第一驾驶策略，比如，第一驾驶策略可以是靠边道行驶，并开启双跳灯进行警示。
由于自动驾驶车辆的自动驾驶等级具体分为L0至L5，不同的自动驾驶等级对应的ODD也不同，在本申请实施例中，主要考虑的是L3、L4和L5级下的第一驾驶策略，下面分别进行说明：
(1)自动驾驶等级为L3下的第一驾驶策略
在自动驾驶等级为L3级的情况下，驾乘人员为位于自动驾驶车辆驾驶位上的驾驶员。首先，当实时生理数据偏离健康生理数据范围的差值大于预设值，且实时生理数据偏离健 康生理数据范围的持续时长大于第一预设时长，此时说明大概率驾乘人员出现健康状况，ADS将锁定ADS占据自动驾驶车辆的控制权，即车辆控制权不可移交给驾乘人员。之后，ADS进一步根据偏离的差值和偏离的持续时长确定驾乘人员的健康等级，并根据健康等级执行对应的第一驾驶策略，例如，当ADS确定健康等级为轻度异常，则第一驾驶策略除了锁定ADS占据自动驾驶车辆的控制权之外，还可以是：ADS控制该自动驾驶车辆的速度降到预设速度以下(如，60km/h以下)、靠边道行驶、开启双跳灯中的任意一项或多项；当确定健康等级为重度异常，则第一驾驶策略除了锁定ADS占据自动驾驶车辆的控制权外，还可以是：ADS控制该自动驾驶车辆的速度缓慢降到零、靠边道停车、开启双跳灯、怠速运行、开启车辆外循环、开启车辆内循环、设置车内目标温度、中控门锁解锁中的任意一项或多项。
需要说明的是，在本申请实施例中，当驾乘人员出现健康状况时，是将健康等级分为轻度异常和重度异常(若实时生理数据是在健康生理数据范围内，则健康等级为正常)，为便于理解，下面以实时生理数据为实时心率为例，对驾乘人员的健康等级划分的其中一种方式进行示意，本申请实施例假设健康心率范围为60次/分钟至100次/分钟。
a、健康等级为正常：驾乘人员的实时心率在60次/分钟至100次/分钟，此时驾乘人员的健康等级为正常，也可称健康等级为一级，表明驾乘人员健康状况良好。
b、健康等级为轻度异常：驾乘人员的实时心率在40次/分钟至60次/分钟且持续3分钟，或，驾乘人员的实时心率在100次/分钟至160次/分钟且持续3分钟，此时驾乘人员的健康等级为轻度异常，也可称为健康等级为二级，表明驾乘人员出现轻度健康问题，驾乘人员轻度身体不适。
c、健康等级为重度异常：驾乘人员的实时心率小于40次/分钟且持续5分钟，或，驾乘人员的实时心率大于160次/分钟且持续5分钟，此时驾乘人员的健康等级为重度异常，也可称为健康等级为二级，表明驾乘人员出现重度健康问题，驾乘人员严重身体不适。
需要说明的是，上述健康心率范围可根据大数据范进行预设，如，也可设置为65次/分钟至105次/分钟，具体此处不做限定；根据实时心率判定是属于什么健康等级的差值和持续时长也可以预设，如，也可设置驾乘人员的实时心率在30次/分钟至65次/分钟且持续4分钟，或，驾乘人员的实时心率在105次/分钟至165次/分钟且持续3分钟时的健康等级为轻度异常，具体此处不做限定。
还需要说明的是，在本申请的一些实施方式中，根据驾乘人员的健康等级，可对应得到驾乘人员接管车辆控制权的接管能力等级，分别如下所示。
a、接管能力一级：对应健康等级为正常(或健康等级为一级)，自动驾驶业务不受影响，驾乘人员可随时接管车辆控制权。
b、接管能力二级：对应健康等级为轻度异常(或健康等级为二级)，ADS控制自动驾驶车辆对自动驾驶业务进行降级，降速到60km/h以内，靠边道行驶，双跳灯打开，车辆控制权不可移交给驾乘人员。
c、接管能力三级：对应健康等级三级(或健康等级为三级)，ADS控制自动驾驶车辆对自动驾驶业务持续降级，缓慢降速到0后退出，靠边道停车，双跳灯打开，车辆怠速， 车辆通风外循环开，设置车内目标温度22℃，空调开启，中控门锁解锁。车内通讯设备(如，TBOX)呼救，周期性发定位信息。
还需要说明的是，上述只是划分了3种健康等级，即正常、轻度异常、重度异常，分别对应一级、二级、三级。在本申请的一些实施方式中，可根据实际应用场景设置更多或更少的健康等级，例如，健康等级可以只分为正常和异常，即对应两级；健康等级也可以分为正常、轻度异常、中度异常、重度异常，即对应四级，具体此处对如何划分健康等级不做限定，本申请实施例仅是以划分轻度异常和重度异常为例进行示意，用于说明本申请实施例可基于不同的健康等级采取不同的第一驾驶策略，更有针对性。
类似地，上述也只是划分了3种接管能力等级，即一级、二级、三级。在本申请的一些实施方式中，可根据实际应用场景设置更多或更少的接管能力等级，具体此处对如何划分接管能力等级不做限定。
还需要说明的是，上述仅是以实时生理数据为实时心率为例，对驾乘人员的健康等级划分的其中一种方式进行示意，在本申请的一些实施方式中，监测设备采集的实时生理数据还可以是驾乘人员的心率、血压、血氧、体温、心脏早搏、房颤等实时生理数据，只要是监测设备能够采集到的、能够反映驾乘人员健康状况的生理数据都可以，具体此处不做限定。
下面在上述以实时生理数据为实时心率为例、对驾乘人员的健康等级划分的情形下，对驾乘人员的健康等级划分及对应的第一驾驶策略进行说明，具体可如表2所示，其中，ODD中的健康生理数据范围对应为健康心率范围，本申请实施例假设健康心率范围为60次/分钟至100次/分钟，健康等级为正常则对应为一级，表明驾乘人员接管能力为一级，自动驾驶车辆正在执行的自动驾驶业务不受影响；健康等级为轻度异常则对应为二级，ADS控制自动驾驶车辆正在执行的自动驾驶业务降级，并控制自动驾驶车辆执行速度降到预设速度以下、靠边道行驶、开启双跳灯中的任意一项或多项；健康等级为重度异常则对应为三级，ADS控制自动驾驶车辆正在执行的自动驾驶业务持续降级，并控制自动驾驶车辆执行速度缓慢降到零、靠边道停车、开启双跳灯、怠速运行、开启车辆外循环、开启车辆内循环、设置车内目标温度、中控门锁解锁中的任意一项或多项。
表2：L3情况下，驾乘人员的健康等级划分与对应的第一驾驶策略
Figure PCTCN2021117595-appb-000002
Figure PCTCN2021117595-appb-000003
在上述自动驾驶等级为L3的情况下，本申请实施例基于实时生理数据偏离健康生理数据范围的差值的多少以及偏离的持续时长的长短确定健康等级，并基于不同的健康等级采取不同的第一驾驶策略，更有针对性。且在本申请上述实施例中，仅在驾乘人员健康等级为正常的情况下，驾乘人员才具有接管车辆控制权的权利，否则车辆控制权不可移交给驾乘人员，并由ADS执行第一驾驶策略，从而避免了驾乘人员由于身体健康问题在某时间段内实际上没有接管能力而导致的车辆风险和人身安全。
(2)自动驾驶等级为L4或L5下的第一驾驶策略
在自动驾驶等级为L4级或L5的情况下，位于自动驾驶车辆驾驶位上的人员不具备控制自动驾驶车辆的车辆控制权，在这种情况下，则不能称其为驾驶员，一般称为驾乘人员。首先，当实时生理数据偏离健康生理数据范围的差值大于预设值，且实时生理数据偏离健康生理数据范围的持续时长大于第一预设时长，此时说明大概率驾乘人员出现健康状况，之后，ADS进一步根据偏离的差值和偏离的持续时长确定驾乘人员的健康等级，并根据健康等级执行对应的第一驾驶策略，与上述自动驾驶等级为L3的情况类似，例如，当ADS确定健康等级为轻度异常，则第一驾驶策略可以是：ADS控制该自动驾驶车辆的速度降到预设速度以下(如，60km/h以下)、靠边道行驶、开启双跳灯中的任意一项或多项；当确定健康等级为重度异常，则第一驾驶策略可以是：ADS控制该自动驾驶车辆的速度缓慢降到零、靠边道停车、开启双跳灯、怠速运行、开启车辆外循环、开启车辆内循环、设置车内目标温度、中控门锁解锁中的任意一项或多项。
需要说明的是，在本申请实施例中，与上述自动驾驶等级为L3的情况类似，当驾乘人员出现健康状况时，是将健康等级分为轻度异常和重度异常(若实时生理数据是在健康生理数据范围内，则健康等级为正常)，具体可参阅上述L3的情况，此处不再赘述。
下面在上述以实时生理数据为实时心率为例，对驾乘人员的健康等级划分的情形下，对驾乘人员的健康等级划分及对应的第一驾驶策略进行说明，具体可如表3所示，其中，ODD中的健康生理数据范围对应为健康心率范围，本申请实施例假设健康心率范围为60次/分钟至100次/分钟，健康等级为正常则对应为一级，自动驾驶车辆正在执行的自动驾驶业务不受影响；健康等级为轻度异常则对应为二级，ADS控制自动驾驶车辆正在执行的自动驾驶业务降级，并控制自动驾驶车辆执行速度降到预设速度以下、靠边道行驶、开启双跳灯中的任意一项或多项；健康等级为重度异常则对应为三级，ADS控制自动驾驶车辆正在执行的自动驾驶业务持续降级，并控制自动驾驶车辆执行速度缓慢降到零、靠边道停车、开启双跳灯、怠速运行、开启车辆外循环、开启车辆内循环、设置车内目标温度、中控门锁解锁中的任意一项或多项。表3与表2不同的地方在于，表3中的第一驾驶策略没有涉 及车辆控制权移交这一项，这是因为在L4或L5级下，驾乘人员没有接管车辆的义务和途径。
表3：L4或L5情况下，驾乘人员的健康等级划分与对应的第一驾驶策略
Figure PCTCN2021117595-appb-000004
在上述自动驾驶等级为L4或L5的情况下，本申请实施例基于实时生理数据偏离健康生理数据范围的差值的多少以及偏离的持续时长的长短确定健康等级，并基于不同的健康等级采取不同的第一驾驶策略，更有针对性。
503、当所述实时生理数据在第二预设时长内未恢复到健康生理数据范围，ADS发出授权请求。
不管是在哪个自动驾驶等级下，当监测设备采集的实时生理数据在第二预设时长内(如，8分钟内)还未恢复到健康生理数据范围，则ADS会向驾乘人员发出授权请求，该授权请求可以通过语音播报的方式向驾乘人员传达，也可以是通过界面显示(前提是自动驾驶车辆上部署有显示屏)的方式向驾乘人员传达，具体此处不做限定。该授权请求用于向驾乘人员请示是否需要执行第二驾驶策略。
504、在驾乘人员接受授权请求的情况下，ADS执行第二驾驶策略。
驾乘人员在接收到ADS发送的授权请求后，在驾乘人员接受授权请求的情况下，ADS执行第二驾驶策略，该第二驾驶策略可以是：靠边道停车、呼叫救援、建立与医疗机构的通信连接、规划所述自动驾驶车辆与所述医疗机构的行驶路径、预定医疗资源、请求安排紧急就医通道中的任意一项或多项。
在本申请上述实施方式中，第二驾驶策略实质是对原本的风险减缓策略的升级，原来已有的风险减缓策略不管是在哪个自动驾驶等级，当存在ADS无法执行动态驾驶任务或驾乘人员无法接管动态驾驶任务时，该风险减缓策略最终的着力点均落在“将车辆停下来”，即只考虑到狭义的车辆安全。而在本申请实施例中，第二驾驶策略除了考虑到把车辆停止 下来，在实际情况情况下，车里还有更多的努力可以做，包括但不限于呼救，组织救援，请求安排紧急通道，预定医疗资源等措施。尤其是探知到驾乘人员身体不适的“急救白金10分钟”内，“急救白金10分钟”是指紧急事件发生后，无论经过怎样的程序，以送到医院急诊科或相关科室抢救间为起点，到医生进行紧急救治的最初10分钟为止。这10个1分钟越早，价值越高，它对于指导医师树立急诊专业的时间-效价观有十分重要的作用和意义。
需要说明的是，在本申请的一些实施方式中，可以不包括步骤503和步骤504。
还需要说明的是，在本申请的一些实施方式中，若驾乘人员不接受该授权请求，说明驾乘人员认为自己可以处理好突发的健康状况，比如，随身携带有急救药品，在这种情况下，ADS可按照原本的风险减缓策略进行执行。例如，假设实时生理数据是实时心率，那么在心率场景中，驾乘人员即使健康等级为异常，但驾乘人员仍然会有意识，ADS通过车内的通讯设备(如，TBOX)进行呼救、呼叫紧急医疗资源等第二驾驶策略前应该首先咨询驾乘人员意愿，这样即尊重了驾乘人员意愿，同时也可以规避监测设备的偶发不确定性误报，因为如果频繁误报，用户体验差，正在执行的自动驾驶业务也会频繁被降级，此外，也可以将健康问题发现的时间提前(因为如果是轻度异常的话，驾乘人员自身可能并不能感知到明显的不适)，做到提前侦测、及时应对，用户体验好，驾乘人员的健康也得到保证，不仅降低了交通事故的发生率，还带来了巨大的社会效益。
还需要说明的是，在本申请的一些实施方式中，不管是在哪个自动驾驶等级下，当监测设备采集的实时生理数据在第二预设时长内(如，8分钟内)恢复到健康生理数据范围，说明驾乘人员的健康状况暂时恢复了，此时ADS可控制自动驾驶车辆将降级的自动驾驶业务进行恢复，例如，假设原来自动驾驶车辆正在执行的自动驾驶业务为“高速跟车行驶，速度100km/h”，实时生理数据与健康生理数据范围的差值超过预设值且持续了第一预设时长(如，3分钟)，那么ADS对该自动驾驶业务降级为“高速跟车行驶，速度60km/h”，并持续监测后续采集的实时生理数据，若在第二预设时长(如，8分钟)内，监测的实时生理数据恢复到健康生理数据范围内，那么ADS将降级后的“高速跟车行驶，速度60km/h”自动驾驶业务恢复到原来的“高速跟车行驶，速度100km/h”。
还需要说明的是，在本申请的一些实施方式中，ADS还可以基于实时生理数据生成事件日志，该事件日志就用于记录在实时生理数据偏离所述健康生理数据范围期间，异常的实时生理数据和后续ADS的一系列操作，并向与该自动驾驶车辆对应的云服务器周期性上报该事件日志，从而便于界定人车责任。为便于理解，下面举例进行说明：假设监测设备采集的驾乘人员的实时生理数据偏离健康生理数据范围的时间在2020年9月6日10:00-10:10，健康等级为轻度异常，ADS针对该健康等级采取了第一驾驶策略，并且在驾乘人员拒绝授权请求的情况下，ADS控制自动驾驶车辆执行了原本的风险减缓策略。那么，对应时间2020年9月6日10:00-10:10这个时间段，会生成一个事件日志，该事件日志记录有该时间段对应的实时生理数据以及ADS的一系列操作，该一系列操作就为：针对该健康等级采取了第一驾驶策略，并在驾乘人员拒绝授权请求的情况下，控制自动驾驶车辆执行了原本的风险减缓策略。
需要说明的是，在本申请上述实施例中，第二驾驶策略并未区分自动驾驶等级，也就是说，不管是在L3级下，还是在L4或L5级下，第二驾驶策略都可以是上述靠边道停车、呼叫救援、建立与医疗机构的通信连接、规划所述自动驾驶车辆与所述医疗机构的行驶路径、预定医疗资源、请求安排紧急就医通道中的任意一项或多项。但在实际应用过程中，针对自动驾驶等级的不同，可以采取不同的第二驾驶策略，这样更有针对性，也能提升用户体验，下面分别进行说明。
(1)自动驾驶等级为L3下的第二驾驶策略
在自动驾驶等级为L3的情况下，这种情况驾乘人员(L3级下实际为驾驶员)的话语权更重，因此ADS在执行第二驾驶策略的每一步均可事先咨询驾乘人员的意见。例如，在驾乘人员接受授权请求的情况下，若驾乘人员的健康等级为轻度异常，ADS可规划出距离与自身距离最近的医疗机构的路线，并再次发出“已规划好距离最近的医疗机构的路线，是否前往”的授权请求，若驾乘人员同意前往，那么ADS就可控制该自动驾驶车辆前往该医疗机构；又例如，在驾乘人员接受授权请求的情况下，若驾乘人员的健康等级为重度异常，ADS可发出“是否呼叫救援”或“是否预定医疗资源”等授权请求，同时规划出距离与自身距离最近的医疗机构的路线，并发出“已规划好距离最近的医疗机构的路线，是否前往”的另一授权请求，若驾乘人员均同意，那么ADS就可同步呼叫救援，同时控制该自动驾驶车辆前往该医疗机构。
为便于理解，下面以实时生理数据为实时心率为例、对驾乘人员的健康等级划分的情形下，对驾乘人员的健康等级划分及对应的第一驾驶策略、第二驾驶策略以及事件日志上报进行说明，具体可如表4所示，其中，ODD中的健康生理数据范围对应为健康心率范围，本申请实施例假设健康心率范围为60次/分钟至100次/分钟。
表4：L3情况下，驾乘人员的健康等级划分与对应的第一/二驾驶策略以及事件日志上报
Figure PCTCN2021117595-appb-000005
Figure PCTCN2021117595-appb-000006
需要说明的是，上述所述的自动驾驶等级为L3下的第二驾驶策略仅为示意，在实际应用场景中，可根据需要自设置第二驾驶策略的具体实现方式，此处不做限定。
(2)自动驾驶等级为L4或L5下的第二驾驶策略
在自动驾驶等级为L4或L5的情况下，这种情况驾乘人员没有接管车辆的义务和途径，因此当实时生理数据在第二预设时长内未恢复到所述健康生理数据范围，ADS发出授权请求后，在得到驾乘人员接受所述授权请求的情况下，ADS就直接执行第二驾驶策略，后续不再询问驾乘人员的意愿。例如，假设已定的第二驾驶策略为“规划自动驾驶车辆与最近医疗机构的行驶路径并前往，请求最近医疗机构安排紧急就医通道”，那么在驾乘人员接受授权请求的情况下，ADS直接控制自动驾驶车辆规划自动驾驶车辆与最近医疗机构的行驶路径并前往，同时通过自动驾驶车辆上的通讯设备请求最近医疗机构安排紧急就医通道，在本申请的一些实施方式中，ADS可向驾乘人员实时播报该第二驾驶策略的执行情况。
同样地，为便于理解，下面以实时生理数据为实时心率为例、对驾乘人员的健康等级划分的情形下，对驾乘人员的健康等级划分及对应的第一驾驶策略、第二驾驶策略以及事件日志上报进行说明，具体可如表5所示，其中，ODD中的健康生理数据范围对应为健康心率范围，本申请实施例假设健康心率范围为60次/分钟至100次/分钟。表5与表4不同的地方在于，表5中的第一驾驶策略没有涉及车辆控制权移交这一项，这是因为在L4或L5级下，驾乘人员没有接管车辆的义务和途径。
表5：L4或L5情况下，驾乘人员的健康等级划分与对应的第一/二驾驶策略以及事件日志上报
Figure PCTCN2021117595-appb-000007
Figure PCTCN2021117595-appb-000008
需要说明的是，类似地，上述所述的自动驾驶等级为L4或L5级下的第二驾驶策略仅为示意，在实际应用场景中，可根据需要自设置第二驾驶策略的具体实现方式，此处不做限定。
为便于理解，下面以两个具体的实例，分别介绍在自动驾驶等级为L3级的情况下和自动驾驶等级为L4或L5级的情况下，本申请实施例所提供的自动驾驶方法。其中，假设实时生理数据为心率、健康生理数据范围为60次/分钟至100次/分钟的健康心率范围为例进行示意。
A、在L3级情况下，一种自动驾驶方法的实例
首先，对驾乘人员的健康等级进行定义(在L3情况下，驾乘人员实际为驾驶员)，具体可参阅表2，此处不予赘述。其次，自动驾驶车辆需具备几个前提条件：1)驾乘人员佩戴有采集实时生理数据的监测设备(如，智能手表)，可用于采集驾乘人员的心率、血压、血氧、体温、心脏早搏、房颤等，这些采集得到的实时生理数据可通过通讯协议(如，蓝牙、WiFi等)接入ADS；2)自动驾驶车辆具备一定的人机交互能力(如，语音问答功能)；3)自动驾驶车辆具备与外界基本语音通讯的功能。
请参阅图6，图6为本申请实施例提供的一种在L3级情况下的自动驾驶方法的实例，该实例可以包括如下步骤：
步骤①、监测设备采集驾乘人员的实时心率。
步骤②、监测设备将采集到的实时心率向ADS的第一子模块发送，该第一子模块用于判断该实时心率是否偏离ODD中的健康心率范围。
步骤③、当ADS确定该实时心率偏离ODD中的健康心率范围的差值超过预设值且持 续第一预设时长(如，3分钟)，ADS的第一子模块向ADS的第二子模块发送业务降级请求，该业务降级请求用于指示ADS的第二子模块对自动驾驶车辆正在执行的自动驾驶业务进行降级处理，例如，降速。
步骤④、ADS的第二子模块根据该业务降级请求对自动驾驶车辆正在执行的自动驾驶业务进行降级处理，同时ADS的第二子模块控制自动驾驶车辆执行第一驾驶策略，如，锁定ADS占据车辆控制权、开启双跳灯、靠边道行驶等。
步骤⑤、ADS的第二子模块向云服务器周期性上报事件日志，使得与ADS对应的云服务器需对ADS的业务降级、ADS执行第一驾驶策略等操作进行备案，便于后续的人车责任划分。
步骤⑥、ADS的第二子模块进一步判断第二预设时长(如，5分钟)内，采集到的实时心率是否恢复到ODD中的健康心率范围。
步骤⑦、若采集到的实时心率恢复到ODD中的健康心率范围，触发ADS的第一子模块进行状态自检。
步骤⑧、ADS的第一子模块自检完成后，向ADS的第二子模块发送业务恢复请求，该业务恢复请求用于指示ADS的第二子模块对降级后的自动驾驶业务进行恢复，例如，加速到原来的驾驶速度。
步骤⑨、若采集到的实时心率未恢复到ODD中的健康心率范围，则通过车内的通讯设备向驾乘人员发出授权请求，该授权请求用于问询是否需要救援、就近就医等第二驾驶策略。
步骤⑩、若驾乘人员拒绝该授权请求，说明驾乘人员认为自身健康状况可恢复(如，随身携带急救药品)，此时驾乘人员可自行采取措施。
步骤
Figure PCTCN2021117595-appb-000009
若驾乘人员同意该授权请求，ADS的第二子模块即可执行第二驾驶策略，执行的每一步需咨询驾乘人员意愿。
由上述步骤可知，本申请实施例提供的自动驾驶方法的实例具有如下优势：
1)自动驾驶等级为L3的情况下，考虑到了驾乘人员健康，仅在驾乘人员健康等级为正常的情况下，驾乘人员才可以接管车辆控制权，否则就按照如上步骤逻辑对自动驾驶业务进行降级并控制自动驾驶车辆执行第一驾驶策略和第二驾驶策略。
2)充分考虑到了“急救白金10分钟”的需求，在心率场景中，驾乘人员即使健康等级为异常，但驾乘人员仍然会有意识，ADS通过车内的通讯设备(如，TBOX)进行呼救、呼叫紧急医疗资源等第二驾驶策略前应该首先咨询驾乘人员意愿，这样即尊重了驾乘人员意愿，同时也可以规避监测设备的偶发不确定性误报，因为如果频繁误报，用户体验差，正在执行的自动驾驶业务也会频繁被降级，此外，也可以将健康问题发现的时间提前(因为如果是轻度异常的话，驾乘人员自身可能并不能感知到明显的不适)，做到提前侦测、及时应对，用户体验好，驾乘人员的健康也得到保证，不仅降低了交通事故的发生率，还带来了巨大的社会效益。
3)自动驾驶业务的连续性得到保证，如果驾驾乘人员身体状态恢复(考虑到自身携带急救药服用)，接管能力等级逐步降低(例如由等级3降到等级2)，且自动驾驶业务的 ODD没有除驾乘人员接管能力指标之外不正常，那么当驾乘人员的实时生理数据恢复到健康生理数据范围内，ADS控制自动驾驶业务恢复。
4)人车责任清晰，ADS可将实时生理数据异常期间内的一切与健康相关的数据及操作记录为事件日志周期性(如，每隔5分钟)上报与自动驾驶车辆对应的云端进行备份。
B、在L4或L5级情况下，一种自动驾驶方法的实例
类似地，首先也需对驾乘人员的健康等级进行定义，具体可参阅表3，此处不予赘述。其次，自动驾驶车辆同样需具备几个前提条件：1)驾乘人员佩戴有采集实时生理数据的监测设备(如，智能手表)，可用于采集驾乘人员的心率、血压、血氧、体温、心脏早搏、房颤等，这些采集得到的实时生理数据可通过通讯协议(如，蓝牙、WiFi等)接入ADS；2)自动驾驶车辆具备一定的人机交互能力(如，语音问答功能)；3)自动驾驶车辆具备与外界基本语音通讯的功能。
具体请参阅图7，图7为本申请实施例提供的一种在L4或L5级情况下的自动驾驶方法的实例，该实例可以包括如下步骤：
步骤①、监测设备采集驾乘人员的实时心率。
步骤②、监测设备将采集到的实时心率向ADS的第一子模块发送，该第一子模块用于判断该实时心率是否偏离ODD中的健康心率范围。
步骤③、当ADS确定该实时心率偏离ODD中的健康心率范围的差值超过预设值且持续第一预设时长(如，3分钟)，ADS的第一子模块向ADS的第二子模块发送业务降级请求，该业务降级请求用于指示ADS的第二子模块对自动驾驶车辆正在执行的自动驾驶业务进行降级处理，例如，降速。
步骤④、ADS的第二子模块根据该业务降级请求对自动驾驶车辆正在执行的自动驾驶业务进行降级处理，同时ADS的第二子模块控制自动驾驶车辆执行第一驾驶策略，如，开启双跳灯、靠边道行驶等。
步骤⑤、ADS的第二子模块向云服务器周期性上报事件日志，使得与ADS对应的云服务器需对ADS的业务降级、ADS执行第一驾驶策略等操作进行备案，便于后续的人车责任划分。
步骤⑥、ADS的第二子模块进一步判断第二预设时长(如，5分钟)内，采集到的实时心率是否恢复到ODD中的健康心率范围。
步骤⑦、若采集到的实时心率恢复到ODD中的健康心率范围，触发ADS的第一子模块进行状态自检。
步骤⑧、ADS的第一子模块自检完成后，向ADS的第二子模块发送业务恢复请求，该业务恢复请求用于指示ADS的第二子模块对降级后的自动驾驶业务进行恢复，例如，加速到原来的驾驶速度。
步骤⑨、若采集到的实时心率未恢复到ODD中的健康心率范围，则通过车内的通讯设备向驾乘人员发出授权请求，该授权请求用于问询是否需要救援、就近就医等第二驾驶策略。
步骤⑩、若驾乘人员拒绝该授权请求，说明驾乘人员认为自身健康状况可恢复(如， 随身携带急救药品)，此时驾乘人员可自行采取措施。
步骤
Figure PCTCN2021117595-appb-000010
若驾乘人员同意该授权请求，ADS的第二子模块即可执行第二驾驶策略，具体地，ADS的第二子模块可控制自动驾驶车辆靠边停车并开启双跳灯、建立与医疗机构的通信并呼叫救援、告知驾乘人员救援到达的预计时间等。
由上述步骤可知，本申请实施例提供的自动驾驶方法的实例同样具有如下优势：
1)充分考虑到了“急救白金10分钟”的需求，在心率场景中，驾乘人员即使健康等级为异常，但驾乘人员仍然会有意识，ADS通过车内的通讯设备(如，TBOX)进行呼救、呼叫紧急医疗资源等第二驾驶策略前应该首先咨询驾乘人员意愿，这样即尊重了驾乘人员意愿，同时也可以规避监测设备的偶发不确定性误报，因为如果频繁误报，用户体验差，正在执行的自动驾驶业务也会频繁被降级，此外，也可以将健康问题发现的时间提前(因为如果是轻度异常的话，驾乘人员自身可能并不能感知到明显的不适)，做到提前侦测、及时应对，用户体验好，驾乘人员的健康也得到保证，不仅降低了交通事故的发生率，还带来了巨大的社会效益。
2)自动驾驶业务的连续性得到保证，如果驾驾乘人员身体状态恢复(考虑到自身携带急救药服用)，接管能力等级逐步降低(例如由等级3降到等级2)，且自动驾驶业务的ODD没有除驾乘人员接管能力指标之外不正常，那么当驾乘人员的实时生理数据恢复到健康生理数据范围内，ADS控制自动驾驶业务恢复。
3)人车责任清晰，ADS可将实时生理数据异常期间内的一切与健康相关的数据及操作记录为事件日志周期性(如，每隔5分钟)上报与自动驾驶车辆对应的云端进行备份。
此外，由图6对应的实例和图7对应的实例可知，图7对应的实施例提供的自动驾驶方法的实例与上述图6对应的自动驾驶方法的实例不同的地方主要在以下两点：
1)L3级情况下，驾乘人员理论上可随时接管车辆控制权，因此这种情况下第一驾驶策略包括锁定ADS占据车辆控制权；而在L4或L5级情况下，驾乘人员没有接管车辆的义务和途径，因此该情况下第一驾驶策略没有涉及车辆控制权移交这一项。
2)L3级情况下，驾乘人员的话语权更重，因此ADS在执行第二驾驶策略的每一步均可事先咨询驾乘人员的意见。例如，在驾乘人员接受授权请求的情况下，若驾乘人员的健康等级为轻度异常，ADS可规划出距离与自身距离最近的医疗机构的路线，并再次发出“已规划好距离最近的医疗机构的路线，是否前往”的授权请求，若驾乘人员同意前往，那么ADS就可控制该自动驾驶车辆前往该医疗机构；而在L4或L5级情况下，驾乘人员没有接管车辆的义务和途径，因此当实时生理数据在第二预设时长内未恢复到所述健康生理数据范围，ADS发出授权请求后，在得到驾乘人员接受所述授权请求的情况下，ADS就直接执行第二驾驶策略，后续不再询问驾乘人员的意愿。例如，假设已定的第二驾驶策略为“规划自动驾驶车辆与最近医疗机构的行驶路径并前往，请求最近医疗机构安排紧急就医通道”，那么在驾乘人员接受授权请求的情况下，ADS直接控制自动驾驶车辆规划自动驾驶车辆与最近医疗机构的行驶路径并前往，同时通过自动驾驶车辆上的通讯设备请求最近医疗机构安排紧急就医通道，在本申请的一些实施方式中，ADS可向驾乘人员实时播报该第二驾驶策略的执行情况。
在图5至图7所对应的实施例的基础上，为了更好的实施本申请实施例的上述方案，下面还提供用于实施上述方案的相关设备。具体参阅图8，图8为本申请实施例提供的ADS 800的一种结构示意图，该ADS 800具体可以包括：接收模块801和第一执行模块802，其中，接收模块801，用于接收监测设备采集的驾乘人员的实时生理数据；第一执行模块802，用于当该实时生理数据偏离健康生理数据范围的差值大于预设值，且该实时生理数据偏离该健康生理数据范围的持续时长大于第一预设时长(如，3分钟)，对自动驾驶车辆正执行的自动驾驶业务进行降级，并根据该差值与该持续时长执行第一驾驶策略，该健康生理数据范围为事先添加入ODD的一组适用范围，该ODD部署于该ADS。
在本申请上述实施方式中，通过在ODD内新增加健康生理数据范围作为ODD的一组适用范围，当驾乘人员的实时生理数据偏离该范围且持续一定时长，ADS判定驾乘人员出现健康异常，并根据偏离程度和持续时长执行对应的第一驾驶策略，从而做到对驾乘人员的突发健康事故的及时应对，降低交通事故发生率。
在一种可能的设计中，ADS 800还包括请求模块803和第二执行模块804，其中，该请求模块803，用于当该实时生理数据在第二预设时长(如，8分钟)内未恢复到该健康生理数据范围，发出授权请求；第二执行模块804，用于在该驾乘人员接受该授权请求的情况下，执行第二驾驶策略。
在本申请上述实施方式中，第二驾驶策略实质是对原本的风险减缓策略的升级，原来已有的风险减缓策略不管是在哪个自动驾驶等级，当存在ADS无法执行动态驾驶任务或驾乘人员无法接管动态驾驶任务时，该风险减缓策略最终的着力点均落在“将车辆停下来”，即只考虑到狭义的车辆安全。而在本申请实施例中，第二驾驶策略除了考虑到把车辆停止下来，在实际情况情况下，车里还有更多的努力可以做，包括但不限于呼救，组织救援，请求安排紧急通道，预定医疗资源等措施。
在一种可能的设计中，该第二驾驶策略至少包括如下策略中的至少一种：靠边道停车、呼叫救援、建立与医疗机构的通信连接、规划该自动驾驶车辆与该医疗机构的行驶路径、预定医疗资源、请求安排紧急就医通道中的任意一项或多项。
在本申请上述实施方式中，具体阐述了第二驾驶策略的几种表现形式，充分考虑到了“急救白金10分钟”的需求，即将健康问题发现的时间提前，做到提前侦测、及时应对，用户体验好，驾乘人员的健康也得到保证，不仅降低了交通事故的发生率，还带来了巨大的社会效益。
在一种可能的设计中，在自动驾驶等级为L4级或L5级的情况下，该第一执行模块802，具体用于：根据该差值与该持续时长确定该驾乘人员的健康等级，且当确定该健康等级为轻度异常，根据该健康等级执行该第一驾驶策略，该第一驾驶策略包括该ADS控制该自动驾驶车辆的速度降到预设速度以下(如，60km/h以下)、靠边道行驶、开启双跳灯中的任意一项或多项。
在本申请上述实施方式中，阐述了在自动驾驶等级为L4级或L5的情况下，当驾乘人员的健康等级为轻度异常时，第一驾驶策略是怎样的，即基于实时生理数据偏离健康生理数据范围的差值的多少以及偏离的持续时长的长短确定健康等级，并基于不同的健康等级 采取不同的第一驾驶策略，更有针对性。
在一种可能的设计中，该第一执行模块802，具体还用于：当确定该健康等级为重度异常，根据该健康等级执行该第一驾驶策略，该第一驾驶策略包括该ADS控制该自动驾驶车辆的速度缓慢降到零、靠边道停车、开启双跳灯、怠速运行、开启车辆外循环、开启车辆内循环、设置车内目标温度、中控门锁解锁中的任意一项或多项。
在本申请上述实施方式中，阐述了在自动驾驶等级为L4级或L5的情况下，当驾乘人员的健康等级为重度异常时，第一驾驶策略是怎样的，即基于实时生理数据偏离健康生理数据范围的差值的多少以及偏离的持续时长的长短确定健康等级，并基于不同的健康等级采取不同的第一驾驶策略，更有针对性。
在一种可能的设计中，在自动驾驶等级为L3级的情况下，该第一执行模块802，具体用于：锁定该ADS占据该自动驾驶车辆的控制权；根据该差值与该持续时长确定该驾乘人员的健康等级；当确定该健康等级为轻度异常，根据该健康等级执行该第一驾驶策略，该第一驾驶策略包括ADS控制该自动驾驶车辆的速度降到预设速度以下(如，60km/h以下)、靠边道行驶、开启双跳灯中的任意一项或多项。
在本申请上述实施方式中，阐述了在自动驾驶等级为L3的情况下，当驾乘人员(L3级情况下驾乘人员实际为位于驾驶位上的驾驶员)的健康等级为轻度异常时，第一驾驶策略除了锁定ADS占据自动驾驶车辆的控制权之外，还可以是ADS控制该自动驾驶车辆的速度降到预设速度以下、靠边道行驶、开启双跳灯中的任意一项或多项，即基于实时生理数据偏离健康生理数据范围的差值的多少以及偏离的持续时长的长短确定健康等级，并基于不同的健康等级采取不同的第一驾驶策略，更有针对性。且在本申请上述实施例中，仅在驾乘人员健康等级正常的情况下，驾乘人员才具有接管车辆控制权的权利，否则车辆控制权不可移交给驾乘人员，从而避免了驾乘人员由于身体健康问题在某时间段内实际上没有接管能力而导致的车辆风险和人身安全。
在一种可能的设计中，在自动驾驶等级为L3级的情况下，该第一执行模块802，具体还用于：当确定该健康等级为重度异常，根据该健康等级执行该第一驾驶策略，该第一驾驶策略包括该ADS控制该自动驾驶车辆的速度缓慢降到零、靠边道停车、开启双跳灯、怠速运行、开启车辆外循环、开启车辆内循环、设置车内目标温度、中控门锁解锁中的任意一项或多项。
在本申请上述实施方式中，阐述了在自动驾驶等级为L3的情况下，当驾乘人员(L3级情况下驾乘人员实际为位于驾驶位上的驾驶员)的健康等级为重度异常时，第一驾驶策略除了锁定ADS占据自动驾驶车辆的控制权之外，还可以是控制自动驾驶车辆的速度缓慢降到零、靠边道停车、开启双跳灯、怠速运行、开启车辆外循环、开启车辆内循环、设置车内目标温度、中控门锁解锁中的任意一项或多项，即基于实时生理数据偏离健康生理数据范围的差值的多少以及偏离的持续时长的长短确定健康等级，并基于不同的健康等级采取不同的第一驾驶策略，更有针对性。且在本申请上述实施例中，仅在驾乘人员健康等级正常的情况下，驾乘人员才具有接管车辆控制权的权利，否则车辆控制权不可移交给驾乘人员，从而避免了驾乘人员由于身体健康问题在某时间段内实际上没有接管能力而导致的 车辆风险和人身安全。
在一种可能的设计中，该第一执行模块，还用于：当该实时生理数据在第二预设时长内(如，8分钟内)恢复到该健康生理数据范围，控制该自动驾驶车辆恢复执行该自动驾驶业务。
在本申请上述实施方式中，不管是在哪个自动驾驶等级下，当监测设备采集的实时生理数据在第二预设时长内恢复到健康生理数据范围，说明驾乘人员的健康状况暂时恢复了，此时ADS可控制自动驾驶车辆将降级的自动驾驶业务进行恢复，提高了用户体验。
在一种可能的设计中，该第一执行模块802，还用于：基于该实时生理数据生成事件日志，该事件日志用于记录在该实时生理数据偏离该健康生理数据范围期间该实时生理数据和该ADS的操作；向与该自动驾驶车辆对应的云服务器周期性上报该事件日志。
在本申请上述实施方式中，ADS还可以基于实时生理数据生成事件日志，该事件日志就用于记录在实时生理数据偏离该健康生理数据范围期间，异常的实时生理数据和后续ADS的一系列操作，并向与该自动驾驶车辆对应的云服务器周期性上报该事件日志，从而便于界定人车责任。
在一种可能的设计中，该实时生理数据至少包括如下生理数据中的至少一种：该驾乘人员的实时血压、实时心率、实时血氧、实时体温、心脏早搏、房颤等实时生理数据，只要是监测设备能够采集到的、能够反映驾乘人员健康状况的生理数据都可以，具体此处不做限定。
在本申请上述实施方式中，阐述了实时生理数据的几种常见形式，具备选择性和灵活性。
需要说明的是，图8对应实施例所述的ADS 800中各模块/单元之间的信息交互、执行过程等内容，与本申请中图5至图7对应的方法实施例基于同一构思，具体内容可参见本申请前述所示的方法实施例中的叙述，此处不再赘述。
本申请实施例还提供了一种ADS，请参阅图9，图9是本申请实施例提供的ADS一种结构示意图，为便于说明，仅示出了与本申请实施例相关的部分，具体技术细节未揭示的，请参照本申请实施例方法部分。ADS 900上可以部署有图8对应实施例中所描述的ADS的模块，用于实现图8对应实施例中ADS的功能，具体的，ADS 900由一个或多个服务器实现，ADS 900可因配置或性能不同而产生比较大的差异，可以包括一个或一个以上中央处理器(central processing units，CPU)922(例如，一个或一个以上)和存储器932，一个或一个以上存储应用程序942或数据944的存储介质930(例如一个或一个以上海量存储设备)。其中，存储器932和存储介质930可以是短暂存储或持久存储。存储在存储介质930的程序可以包括一个或一个以上模块(图示没标出)，每个模块可以包括对ADS 900中的一系列指令操作。更进一步地，中央处理器922可以设置为与存储介质930通信，在ADS 900上执行存储介质930中的一系列指令操作。
ADS 900还可以包括一个或一个以上电源926，一个或一个以上有线或无线网络接口950，一个或一个以上输入输出接口958，和/或，一个或一个以上操作系统941，例如Windows ServerTM，Mac OS XTM，UnixTM，LinuxTM，FreeBSDTM等等。
在本申请实施例中，上述图5至图7对应的实施例中由ADS所执行的步骤可以基于该图9所示的结构实现，具体此处不予赘述。
另外需说明的是，以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。另外，本申请提供的装置实施例附图中，模块之间的连接关系表示它们之间具有通信连接，具体可以实现为一条或多条通信总线或信号线。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本申请可借助软件加必需的通用硬件的方式来实现，当然也可以通过专用硬件包括专用集成电路、专用CPU、专用存储器、专用元器件等来实现。一般情况下，凡由计算机程序完成的功能都可以很容易地用相应的硬件来实现，而且，用来实现同一功能的具体硬件结构也可以是多种多样的，例如模拟电路、数字电路或专用电路等。但是，对本申请而言更多情况下软件程序实现是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在可读取的存储介质中，如计算机的软盘、U盘、移动硬盘、只读存储器(read only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，训练设备，或者网络设备等)执行本申请各个实施例所述的方法。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、训练设备或数据中心通过有线(例如同轴电缆、光纤、数字用户线)或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、训练设备或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的训练设备、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，高密度数字视频光盘(digital video disc，DVD))、或者半导体介质(例如，固态硬盘(solid state disk，SSD))等。

Claims (25)

  1. 一种自动驾驶方法，其特征在于，包括：
    自动驾驶系统ADS接收监测设备采集的驾乘人员的实时生理数据；
    当所述实时生理数据偏离健康生理数据范围的差值大于预设值，且所述实时生理数据偏离所述健康生理数据范围的持续时长大于第一预设时长，所述ADS对自动驾驶车辆正执行的自动驾驶业务进行降级，并根据所述差值与所述持续时长执行第一驾驶策略，所述健康生理数据范围为事先添加入设计运行范围ODD的一组适用范围，所述ODD部署于所述ADS。
  2. 根据权利要求1所述的方法，其特征在于，在所述ADS对自动驾驶车辆正执行的自动驾驶业务进行降级，并根据所述差值与所述持续时长执行第一驾驶策略之后，所述方法还包括：
    当所述实时生理数据在第二预设时长内未恢复到所述健康生理数据范围，所述ADS发出授权请求；
    在所述驾乘人员接受所述授权请求的情况下，所述ADS执行第二驾驶策略。
  3. 根据权利要求2所述的方法，其特征在于，所述第二驾驶策略至少包括如下策略中的至少一种：
    靠边道停车、呼叫救援、建立与医疗机构的通信连接、规划所述自动驾驶车辆与所述医疗机构的行驶路径、预定医疗资源、请求安排紧急就医通道。
  4. 根据权利要求1-3中任一项所述的方法，其特征在于，在自动驾驶等级为L4级或L5级的情况下，所述根据所述差值与所述持续时长执行第一驾驶策略包括：
    根据所述差值与所述持续时长确定所述驾乘人员的健康等级；
    当确定所述健康等级为轻度异常，根据所述健康等级执行所述第一驾驶策略，所述第一驾驶策略包括所述ADS控制所述自动驾驶车辆的速度降到预设速度以下、靠边道行驶、开启双跳灯中的任意一项或多项。
  5. 根据权利要求4所述的方法，其特征在于，所述方法还包括：
    当确定所述健康等级为重度异常，根据所述健康等级执行所述第一驾驶策略，所述第一驾驶策略包括所述ADS控制所述自动驾驶车辆的速度缓慢降到零、靠边道停车、开启双跳灯、怠速运行、开启车辆外循环、开启车辆内循环、设置车内目标温度、中控门锁解锁中的任意一项或多项。
  6. 根据权利要求1-3中任一项所述的方法，其特征在于，在自动驾驶等级为L3级的情况下，所述根据所述差值与所述持续时长执行第一驾驶策略包括：
    锁定所述ADS占据所述自动驾驶车辆的控制权；
    根据所述差值与所述持续时长确定所述驾乘人员的健康等级；
    当确定所述健康等级为轻度异常，根据所述健康等级执行所述第一驾驶策略，所述第一驾驶策略包括所述ADS控制所述自动驾驶车辆的速度降到预设速度以下、靠边道行驶、开启双跳灯中的任意一项或多项。
  7. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    当确定所述健康等级为重度异常，根据所述健康等级执行所述第一驾驶策略，所述第一驾驶策略包括所述ADS控制所述自动驾驶车辆的速度缓慢降到零、靠边道停车、开启双跳灯、怠速运行、开启车辆外循环、开启车辆内循环、设置车内目标温度、中控门锁解锁中的任意一项或多项。
  8. 根据权利要求1-7中任一项所述的方法，其特征在于，在所述ADS对自动驾驶车辆正执行的自动驾驶业务进行降级，并根据所述差值与所述持续时长执行第一驾驶策略之后，所述方法还包括：
    当所述实时生理数据在第二预设时长内恢复到所述健康生理数据范围，所述ADS控制所述自动驾驶车辆恢复执行所述自动驾驶业务。
  9. 根据权利要求1-8中任一项所述的方法，其特征在于，所述方法还包括：
    基于所述实时生理数据生成事件日志，所述事件日志用于记录所述实时生理数据偏离所述健康生理数据范围期间所述实时生理数据和所述ADS的操作；
    向与所述自动驾驶车辆对应的云服务器周期性上报所述事件日志。
  10. 根据权利要求1-9中任一项所述的方法，其特征在于，所述实时生理数据至少包括如下生理数据中的至少一种：
    所述驾乘人员的实时血压、实时心率、实时血氧、实时体温。
  11. 一种自动驾驶系统ADS，其特征在于，包括：
    接收模块，用于接收监测设备采集的驾乘人员的实时生理数据；
    第一执行模块，用于当所述实时生理数据偏离健康生理数据范围的差值大于预设值，且所述实时生理数据偏离所述健康生理数据范围的持续时长大于第一预设时长，对自动驾驶车辆正执行的自动驾驶业务进行降级，并根据所述差值与所述持续时长执行第一驾驶策略，所述健康生理数据范围为事先添加入设计运行范围ODD的一组适用范围，所述ODD部署于所述ADS。
  12. 根据权利要求11所述的ADS，其特征在于，所述ADS还包括：
    请求模块，用于当所述实时生理数据在第二预设时长内未恢复到所述健康生理数据范围，发出授权请求；
    第二执行模块，用于在所述驾乘人员接受所述授权请求的情况下，执行第二驾驶策略。
  13. 根据权利要求12所述的ADS，其特征在于，所述第二驾驶策略至少包括如下策略中的至少一种：
    靠边道停车、呼叫救援、建立与医疗机构的通信连接、规划所述自动驾驶车辆与所述医疗机构的行驶路径、预定医疗资源、请求安排紧急就医通道。
  14. 根据权利要求11-13中任一项所述的ADS，其特征在于，在自动驾驶等级为L4级或L5级的情况下，所述第一执行模块，具体用于：
    根据所述差值与所述持续时长确定所述驾乘人员的健康等级；
    当确定所述健康等级为轻度异常，根据所述健康等级执行所述第一驾驶策略，所述第一驾驶策略包括所述ADS控制所述自动驾驶车辆的速度降到预设速度以下、靠边道行驶、开启双跳灯中的任意一项或多项。
  15. 根据权利要求14所述的ADS，其特征在于，所述第一执行模块，具体还用于：
    当确定所述健康等级为重度异常，根据所述健康等级执行所述第一驾驶策略，所述第一驾驶策略包括所述ADS控制所述自动驾驶车辆的速度缓慢降到零、靠边道停车、开启双跳灯、怠速运行、开启车辆外循环、开启车辆内循环、设置车内目标温度、中控门锁解锁中的任意一项或多项。
  16. 根据权利要求11-13中任一项所述的ADS，其特征在于，在自动驾驶等级为L3级的情况下，所述第一执行模块，具体用于：
    锁定所述ADS占据所述自动驾驶车辆的控制权；
    根据所述差值与所述持续时长确定所述驾乘人员的健康等级；
    当确定所述健康等级为轻度异常，根据所述健康等级执行所述第一驾驶策略，所述第一驾驶策略包括所述ADS控制所述自动驾驶车辆的速度降到预设速度以下、靠边道行驶、开启双跳灯中的任意一项或多项。
  17. 根据权利要求16所述的ADS，其特征在于，所述第一执行模块，具体还用于：
    当确定所述健康等级为重度异常，根据所述健康等级执行所述第一驾驶策略，所述第一驾驶策略包括所述ADS控制所述自动驾驶车辆的速度缓慢降到零、靠边道停车、开启双跳灯、怠速运行、开启车辆外循环、开启车辆内循环、设置车内目标温度、中控门锁解锁中的任意一项或多项。
  18. 根据权利要求11-17中任一项所述的ADS，其特征在于，所述第一执行模块，还用于：
    当所述实时生理数据在第二预设时长内恢复到所述健康生理数据范围，控制所述自动驾驶车辆恢复执行所述自动驾驶业务。
  19. 根据权利要求11-18中任一项所述的ADS，其特征在于，所述第一执行模块，还用于：
    基于所述实时生理数据生成事件日志，所述事件日志用于记录在所述实时生理数据偏离所述健康生理数据范围期间所述实时生理数据和所述ADS的操作；
    向与所述自动驾驶车辆对应的云服务器周期性上报所述事件日志。
  20. 根据权利要求11-19中任一项所述的ADS，其特征在于，所述实时生理数据至少包括如下生理数据中的至少一种：
    所述驾乘人员的实时血压、实时心率、实时血氧、实时体温。
  21. 一种自动驾驶系统ADS，所述ADS部署在自动驾驶车辆上，包括处理器和存储器，所述处理器与所述存储器耦合，其特征在于，
    所述存储器，用于存储程序；
    所述处理器，用于执行所述存储器中的程序，使得所述ADS执行如权利要求1-10中任一项所述的方法。
  22. 一种自动驾驶车辆，包括处理器和存储器，所述处理器用于获取并执行所述存储器中的代码，以执行所述权利要求1-10中任一所述的方法。
  23. 一种计算机可读存储介质，包括程序，其特征在于，当其在计算机上运行时，使 得计算机执行如权利要求1-10中任一项所述的方法。
  24. 一种包含指令的计算机程序产品，其特征在于，当其在计算机上运行时，使得计算机执行如权利要求1-10中任一项所述的方法。
  25. 一种芯片系统，其特征在于，所述芯片系统包括处理器和通信接口，所述通信接口和所述处理器耦合，所述处理器用于运行计算机程序或指令，使得权利要求1-10中任一项所述的方法被执行。
PCT/CN2021/117595 2020-09-17 2021-09-10 一种自动驾驶方法、ads及自动驾驶车辆 Ceased WO2022057728A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
JP2023517785A JP7520220B2 (ja) 2020-09-17 2021-09-10 自動運転方法、ａｄｓ、自動運転車両、コンピュータ可読記憶媒体、コンピュータプログラム、およびチップシステム
EP21868553.5A EP4201780B1 (en) 2020-09-17 2021-09-10 Autonomous driving method and system
EP25183781.1A EP4657406A3 (en) 2020-09-17 2021-09-10 Autonomous driving method, ads, and autonomous driving vehicle
US18/183,167 US12409860B2 (en) 2020-09-17 2023-03-14 Autonomous driving method, ads, and autonomous driving vehicle
US19/298,090 US20250368228A1 (en) 2020-09-17 2025-08-12 Autonomous driving method, ads, and autonomous driving vehicle

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010982543.3A CN114194207B (zh) 2020-09-17 2020-09-17 一种自动驾驶方法、ads及自动驾驶车辆
CN202010982543.3 2020-09-17

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/183,167 Continuation US12409860B2 (en) 2020-09-17 2023-03-14 Autonomous driving method, ads, and autonomous driving vehicle

Publications (1)

Publication Number Publication Date
WO2022057728A1 true WO2022057728A1 (zh) 2022-03-24

Family

ID=80644930

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/117595 Ceased WO2022057728A1 (zh) 2020-09-17 2021-09-10 一种自动驾驶方法、ads及自动驾驶车辆

Country Status (5)

Country Link
US (2) US12409860B2 (zh)
EP (2) EP4657406A3 (zh)
JP (1) JP7520220B2 (zh)
CN (1) CN114194207B (zh)
WO (1) WO2022057728A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4365047A3 (en) * 2022-11-07 2024-05-15 Volvo Car Corporation Method provided in a car that can automatically take actions in the event of health risks

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019017253A1 (ja) * 2017-07-18 2019-01-24 パイオニア株式会社 制御装置、制御方法、およびプログラム
CN114882999A (zh) * 2022-04-29 2022-08-09 上海商汤临港智能科技有限公司 生理状态检测方法、装置、设备及存储介质
CN115278595A (zh) * 2022-06-28 2022-11-01 重庆长安汽车股份有限公司 一种基于智能手表的汽车交互系统及方法
CN115150440A (zh) * 2022-09-06 2022-10-04 深圳位置网科技有限公司 一种智能网联汽车信息交互方法、系统及可读存储介质
US20240155320A1 (en) * 2022-11-07 2024-05-09 Volvo Car Corporation Method of assisting a driver if a passenger encounters a health issue
CN115626171B (zh) * 2022-12-07 2023-03-21 小米汽车科技有限公司 车辆自动驾驶方法、装置、电子设备及存储介质
CN121793905A (zh) * 2023-09-07 2026-04-03 纽尔络维吉尔公司 生物信号与交通工具和移动的集成
JP7787133B2 (ja) * 2023-10-19 2025-12-16 矢崎総業株式会社 異常検出装置
WO2025100604A1 (ko) * 2023-11-10 2025-05-15 엘지전자 주식회사 차량의 퍼스널 주행 제어 방법, 퍼스널 주행 시스템, 및 퍼스널 주행 제어 서비스를 제공하는 차량
CN118545067B (zh) * 2024-07-29 2024-09-20 吉林大学 一种针对紧急避撞的驾驶人驾驶决策失误判断方法及系统
CN118722838B (zh) * 2024-08-09 2026-03-17 中国第一汽车股份有限公司 一种线控转向的控制方法、系统、电子设备及介质
CN120135225B (zh) * 2025-05-09 2025-09-02 浙江吉利控股集团有限公司 基于自动驾驶的风险处理方法、可读存储介质及程序产品

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100007480A1 (en) * 2006-10-13 2010-01-14 Shigeyasu Uozumi On-board warning apparatus and warning method
US8874301B1 (en) * 2013-07-09 2014-10-28 Ford Global Technologies, Llc Autonomous vehicle with driver presence and physiological monitoring
US20180120837A1 (en) * 2016-11-03 2018-05-03 Ford Global Technologies, Llc Emergency evacuation using autonomous driving
US20190011914A1 (en) * 2017-07-07 2019-01-10 Lg Electronics Inc. Vehicle control device mounted on vehicle and method for controlling the vehicle
US20190061772A1 (en) * 2014-11-03 2019-02-28 Audi Ag System and method for monitoring the state of health and/or the well-being of a vehicle occupant
CN109606385A (zh) * 2018-12-05 2019-04-12 百度在线网络技术（北京）有限公司 一种基于自动驾驶的车辆控制方法、装置、设备和介质
CN111655135A (zh) * 2017-12-22 2020-09-11 瑞思迈传感器技术有限公司 用于车辆中的生理感测的设备、系统和方法

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP6432948B2 (ja) * 2014-09-30 2018-12-05 エイディシーテクノロジー株式会社 自動運転制御装置
JP2016196285A (ja) * 2015-04-03 2016-11-24 株式会社デンソー 走行制御装置及び走行制御方法
WO2017221603A1 (ja) * 2016-06-21 2017-12-28 株式会社デンソー 覚醒維持装置
US10379535B2 (en) * 2017-10-24 2019-08-13 Lear Corporation Drowsiness sensing system
WO2019208450A1 (ja) * 2018-04-27 2019-10-31 パナソニックＩｐマネジメント株式会社 運転支援装置、運転支援方法及びプログラム
WO2019221240A1 (ja) * 2018-05-16 2019-11-21 社会医療法人蘇西厚生会 まつなみリサーチパーク 安全運転支援システム
US10729378B2 (en) * 2018-11-30 2020-08-04 Toyota Motor North America, Inc. Systems and methods of detecting problematic health situations
JP2020122743A (ja) 2019-01-31 2020-08-13 パイオニア株式会社 情報処理装置
DE112019007788T5 (de) * 2019-10-04 2022-09-01 Mitsubishi Electric Corporation Fahrerverfügbarkeitsdetektionsvorrichtung und Fahrerverfügbarkeitsdetektionsverfahren

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100007480A1 (en) * 2006-10-13 2010-01-14 Shigeyasu Uozumi On-board warning apparatus and warning method
US8874301B1 (en) * 2013-07-09 2014-10-28 Ford Global Technologies, Llc Autonomous vehicle with driver presence and physiological monitoring
US20190061772A1 (en) * 2014-11-03 2019-02-28 Audi Ag System and method for monitoring the state of health and/or the well-being of a vehicle occupant
US20180120837A1 (en) * 2016-11-03 2018-05-03 Ford Global Technologies, Llc Emergency evacuation using autonomous driving
US20190011914A1 (en) * 2017-07-07 2019-01-10 Lg Electronics Inc. Vehicle control device mounted on vehicle and method for controlling the vehicle
CN111655135A (zh) * 2017-12-22 2020-09-11 瑞思迈传感器技术有限公司 用于车辆中的生理感测的设备、系统和方法
CN109606385A (zh) * 2018-12-05 2019-04-12 百度在线网络技术（北京）有限公司 一种基于自动驾驶的车辆控制方法、装置、设备和介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4201780A4

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4365047A3 (en) * 2022-11-07 2024-05-15 Volvo Car Corporation Method provided in a car that can automatically take actions in the event of health risks
US12208805B2 (en) 2022-11-07 2025-01-28 Volvo Car Corporation Method provided in a car that can automatically take actions in the event of health risk

Also Published As

Publication number Publication date
EP4657406A3 (en) 2026-01-07
US20250368228A1 (en) 2025-12-04
EP4201780B1 (en) 2025-07-23
JP2023541477A (ja) 2023-10-02
CN114194207A (zh) 2022-03-18
US12409860B2 (en) 2025-09-09
EP4201780C0 (en) 2025-07-23
EP4201780A1 (en) 2023-06-28
CN114194207B (zh) 2024-03-15
US20230219600A1 (en) 2023-07-13
EP4657406A2 (en) 2025-12-03
JP7520220B2 (ja) 2024-07-22
EP4201780A4 (en) 2024-04-10

Similar Documents

Publication Publication Date Title
CN114194207B (zh) 一种自动驾驶方法、ads及自动驾驶车辆
EP4184476B1 (en) Method and device for controlling switching of vehicle driving mode
CN112859830B (zh) 一种设计运行区域odd判断方法、装置及相关设备
CN113226884B (zh) 用于检测和动态地减轻驾驶员疲劳的系统和方法
US11427196B2 (en) Systems and methods for managing tractor-trailers
CN114056346B (zh) 一种自动驾驶行车控制方法及装置
CN113460042B (zh) 车辆驾驶行为的识别方法以及识别装置
US20240280997A1 (en) Information processing system and information processing device
CN110371132B (zh) 驾驶员接管评估方法及装置
US20210155269A1 (en) Information processing device, mobile device, information processing system, method, and program
WO2018147041A1 (ja) 走行支援装置と走行支援管理装置およびその方法と走行支援システム
WO2021000800A1 (zh) 道路可行驶区域推理方法及装置
CN110473310A (zh) 汽车行驶数据记录方法、系统、设备及存储介质
WO2022061702A1 (zh) 驾驶提醒的方法、装置及系统
CN110920619B (zh) 一种车辆调控方法、装置及电子设备
US20260054738A1 (en) Information processing apparatus, information processing method, and vehicle control system
JP2024126321A (ja) 運転支援装置および運転支援装置用のプログラム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21868553

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2023517785

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2021868553

Country of ref document: EP

Effective date: 20230323

NENP Non-entry into the national phase

Ref country code: DE

WWG Wipo information: grant in national office

Ref document number: 2021868553

Country of ref document: EP