Patent Description:
In recent years, automatic driving related technologies have gradually emerged. The automatic driving capabilities of transportation means, especially vehicles, are increasingly expected. The safety capacity of a system is the most important performance in the automatic driving capabilities.

In an automatic driving implementation, a system on chip (SoC) has been proposed as a main control unit. The functional safety of the SoC for automatic driving plays a crucial role in the safety capacity of the system. The SoC for automatic driving typically includes a plurality of subsystems or modules. As an example, at least a portion of the plurality of modules are, for example, intellectual property (IP) cores or modules. The functional safety of the module directly affects the functional safety of the SoC for automatic driving.

Therefore, it is desirable to provide an automatic driving module with an improved functional safety or an SoC for automatic driving. <CIT> discloses a device, method, and program for detecting object. In <CIT>, a device that detects an object includes a receiver that receives information about the object detected by a sensor, multiple circuits that detect the object by performing different detection processes, and a control circuit that controls the circuits. The control circuit detects whether the detection circuits are in an abnormal state, based on a change in a state of the circuits, when the control circuit detects that a first circuit of the circuits is in an abnormal state, the control circuit causes the first circuit to stop a detection process being performed by the first circuit and causes one or more circuits, other than the first circuit, to detect the object by causing the one or more circuits to stop performing detection processes performed by the one or more circuits, and to perform detection processes different from the detection processes being performed by the one or more circuits. <CIT> discloses an apparatus and a method for providing an output parameter and a sensor device. In <CIT>, the apparatus for providing an output parameter includes an output parameter generator circuit configured to determine a value of an output parameter repeatedly. The output parameter generator circuit includes at least one circuit block mandatory for the determination of a value of the output parameter. Further, the apparatus includes an output interface circuit configured to transmit the output parameter repeatedly to a receiver and a test circuit configured to test a basic functionality of the at least one mandatory circuit block of the output parameter generator circuit repeatedly. The at least one mandatory circuit block of the output parameter generator circuit is unavailable for the determination of a value of the output parameter during the basic functionality test.

The invention proposes an automatic driving processing system with the features of claim <NUM>, a system on chip for autonomous driving with the features of claim <NUM>, and a method for monitoring the automatic driving processing module with the features of claim <NUM>, which can provide a system and a method with improved function safety.

In a first aspect of the present disclosure, an automatic driving processing system is provided. The system includes an automatic driving processing module, configured for receiving an input data stream and processing the input data stream based on a deep learning model so as to generate a processing result; a fault detection module, configured for generating a control signal and a fault detection stimulating data stream, and receiving the processing result from the automatic driving processing module; and a multi-way selection module, configured for receiving an automatic driving data stream as well as the control signal and the fault detection stimulating data stream from the fault detection module, and selectively outputting the automatic driving data stream or the fault detection stimulating data stream to the automatic driving processing module based on the control signal, as the input data stream of the automatic driving processing module, where the fault detection module is further configured for comparing a processing result of the fault detection stimulating data stream received from the automatic driving processing module with a predetermined result corresponding to the fault detection stimulating data stream, and determining whether a fault occurs in the automatic driving processing module in response to the comparison; and where the fault detection module is further configured for: receiving from the automatic driving processing module a processing result of the automatic driving data stream; generating the control signal and the fault detection stimulating data stream in response to the determining that a fluctuation of the processing result of the automatic driving data stream exceeds a threshold, such that the multi-way selection module outputs the fault detection stimulating data to the automatic driving processing module based on the control signal; and receiving the processing result of the fault detection stimulating data stream from the automatic driving processing module.

In a second aspect of the present disclosure, a system on chip for autonomous driving is provided. The system on chip includes the above described automatic driving processing system.

In a third aspect of the present disclosure, a method for monitoring an automatic driving processing module is provided. The method includes: selectively inputting an automatic driving data stream or a fault detection stimulating data stream, as an input data stream, into the automatic driving processing module based on a control signal, wherein the automatic driving processing module is configured for processing the input data stream based on a deep learning model so as to generate a processing result; receiving the processing result of the fault detection stimulating data stream from the automatic driving processing module; setting the control signal in response to the determining that a fluctuation of the processing result of the automatic driving data stream exceeds a threshold, so as to input the fault detection stimulating data stream into the automatic driving processing module to generate a processing result of the fault detection stimulating data; receiving the processing result of the fault detection stimulating data stream from the automatic driving processing module; and comparing the processing result of the fault detection stimulating data stream with a predetermined result corresponding to the fault detection stimulating data stream, and determining whether a fault occurs in the automatic driving processing module in response to the comparison.

It should be understood that the content described in the summary section of the disclosure is not intended to limit the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood by the following description.

With reference to the following accompanying drawings and detailed descriptions, other features, advantages and aspects of some embodiments of the present disclosure will become more apparent. In these accompanying drawings, the same or similar marks indicate the same or similar elements.

The embodiments of the present disclosure will be described in more detail hereinafter with reference to the accompanying drawings. Although some embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure may be embodied in various forms and should not be construed as limited to the embodiments set forth herein. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete. The accompanying drawings and embodiments of the present disclosure are to be considered as illustrative only but not limiting the scope of protection of the present disclosure.

In the description of some embodiments of the present disclosure, the term "including" and the like should be understood as open terms, i.e., "including but not limited to". The term "based on" should be understood as "at least partially based on. " The term "an embodiment" or "the present embodiment" should be understood as "at least one embodiment. " The terms "first," "second" and the like may refer to different or identical objects. Other explicit and implicit definitions may also be included below.

As mentioned above, the functional safety of an SoC for automatic driving plays a key role in the safety of an automatic driving system. The SoC for automatic driving generally include an automatic driving module that processes data based on a deep learning model and may also be referred to as an artificial intelligence (AI) module. Since an AI algorithm is applied more and more in automatic driving sensing, planning and control, the requirements thereof for large computing power and low latency pose challenges to the safety of a traditional chip function.

Conventional schemes such as logic built-in self-test (LBIST) and error checking and correction (ECC) are used in an automatic driving module to ensure functional safety. The system safety capacities of such scheme generally reach an Automotive Safety Integration Level (ASIL) B. However, it is desirable to further increase the ASIL level of automatic driving without affecting the requirements of the automatic driving module for high computing power, low latency and the like. In addition, it is desirable to take a safety measure for ensuring the functional safety of the entire SoC for automatic driving. Such safety measure may need to cover hardware and software errors of the SoC for automatic driving and also cover AI algorithm deficiencies, so as to further improve the safety capacity of the system.

According to an embodiment of the present disclosure, an automatic driving processing system with an improved functional safety is provided, and the automatic driving processing system is included in an SoC for automatic driving as a subsystem of the SoC for automatic driving. In the automatic driving processing system, a multi-way selection module is configured for receiving an automatic driving data stream as well as a control signal and a fault detection stimulating data stream from a fault detection module, and selectively outputting one of the automatic driving data stream and the fault detection stimulating data stream to the automatic driving processing module based on the control signal. The automatic driving processing module is configured for processing one of the received automatic driving data stream and the received fault detection stimulating data stream based on a deep learning model so as to generate a processing result; and the fault detection module is configured for comparing a processing result of the fault detection stimulating data stream received from the automatic driving processing module with a predetermined result corresponding to the fault detection stimulating data stream, and determining whether a fault occurs in the automatic driving processing module. In this way, whether a fault occurs in the automatic driving processing module may be determined by a less complicated detection scheme without affecting the requirements of the automatic driving processing module for high computing power, low latency and the like. Hence, the data processing speed and the safe processing speed of the automatic driving processing system may be increased, thereby obtaining an SoC for automatic driving that ensures function safety and has an increased processing speed.

<FIG> shows a schematic diagram of an example environment in which some embodiments of the present disclosure may be implemented. The example environment may be a vehicle. Referring to <FIG>, the example environment may include an SoC <NUM> for automatic driving, a micro control unit (MCU) <NUM>, a camera system <NUM>, and a light detection and ranging (LIDAR) system <NUM>.

The SoC <NUM> for automatic driving is a main control unit for automatic driving. The SoC <NUM> for automatic driving may receive image data from the camera system <NUM> and receive LIDAR data from the LIDAR system <NUM>. The SoC <NUM> for automatic driving may use sensing data received from a vehicle as an automatic driving data stream and processing the automatic driving data stream. The SoC <NUM> for automatic driving may process received data at least partially based on a deep learning model to generate processing information. The SoC <NUM> for automatic driving may send the processing information to the MCU <NUM>.

The MCU <NUM> is an auxiliary control unit for automatic driving. The MCU <NUM> may control various components of the vehicle based on the received processing information. The MCU <NUM> may receive status information from the various components of the vehicle, and the MCU <NUM> may generate a control signal based on the status information so as to control the various components of the vehicle, or may request the SoC <NUM> for automatic driving to process a status signal so as to generate a control signal, thus controlling the various components of the vehicle.

It should be understood that the example environment shown in <FIG> may further include other sensing systems and interface systems that are electrically coupled to the SoC <NUM> for automatic driving and/or the MCU <NUM>. The SoC <NUM> for automatic driving may receive input signals from at least a portion of the other sensing systems and interface systems, and process such input signals. The MCU <NUM> may also receive input signals from at least a portion of the other sensing systems and interface systems, and process such input signals.

Example embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

<FIG> shows a block diagram of an SoC for automatic driving according to an embodiment of the present disclosure. Referring to <FIG>, the SoC <NUM> for automatic driving may include an automatic driving processing system <NUM>. The automatic driving processing system <NUM> is configured for processing input data at least partially based on an AI algorithm, so as to generate a processing result. The automatic driving processing system <NUM> is configured as an AI subsystem of the SoC <NUM> for automatic driving. The automatic driving processing system <NUM> is configured for processing the input data at least partially based on a deep learning model so as to generate a processing result. The automatic driving processing system <NUM> is configured for receiving at least a portion of the automatic driving data stream from the camera system <NUM> and/or the LIDAR system <NUM> as shown in <FIG>. The automatic driving processing system <NUM> according to an embodiment of the present disclosure will be described in further detail later with reference to <FIG>.

Referring to <FIG>, the SoC <NUM> for automatic driving further includes an application processing (AP) system <NUM> which may include a central processing unit (CPU). The AP system <NUM> is configured for receiving the processing result from the automatic driving processing system <NUM> and processing the processing result so as to generate application processing information. The SoC <NUM> for automatic driving sends the application processing information to the MCU <NUM> as shown in <FIG> so as to generate control signals for controlling various components of a vehicle. The AP system <NUM> is configured for receiving signals from other subsystems included in the SoC <NUM> for automatic driving and processing the received signals.

Referring to <FIG>, the SoC <NUM> for automatic driving further includes a safety system <NUM> that may be disposed separately and independently from the automatic driving processing system <NUM> and the AP system <NUM>. The safety system <NUM> is configured for receiving an alarm signal from the automatic driving processing system <NUM> and performing a predetermined processing based on the alarm signal. The predetermined processing includes alarming a user, initializing the automatic driving processing system <NUM>, and enabling a redundant system. The safety system <NUM> is configured for receiving an internal signal generated within the SoC <NUM> for automatic driving and determining whether the internal signal conforms to a normal standard. The safety system <NUM> is configured for receiving application processing information output from the SoC <NUM> for automatic driving and determining whether the application processing information conforms to the normal standard. The safety system <NUM> is configured for performing a safety processing in response to non-conforming to the normal standard, the processing including reducing the speed of the vehicle, traveling along an open road, restarting the system, and enabling the redundant system.

The AP system <NUM> includes a checking module. The safety system <NUM> includes a checking module. The checking module is configured for receiving a processing result from the automatic driving processing system <NUM> and determining whether the processing result conforms to a predetermined safety standard. The checking module is configured for performing a safety processing in response to the determining that the processing result does not conform to the predetermined safety standard. In such case, the automatic driving processing system <NUM> is configured as a doer, and the checking module is configured as a checker. The checking module is configured for receiving the application processing information from the AP system <NUM> and determining whether the application processing information conforms to the predetermined safety standard. The checking module is configured for performing a safety processing in response to the determining that the application processing information does not conform to the predetermined safety standard. In such case, the AP system <NUM> is configured as a doer, and the checking module is configured as a checker. The determining of conforming to the predetermined safety standard includes determining whether the vehicle is in a hazardous scenario, for example, the vehicle will suffer from a collision, and the vehicle is driving on a wrong road. The checking module is configured for performing an emergency processing in response to the determining that the vehicle is in a hazardous scenario. The performing an emergency processing includes braking the vehicle emergently, and stopping the vehicle by the side.

The checking module, as checker, is configured for determining whether an operation of the doer conforms to the predetermined safety standard. The checking module is configured for performing an emergency processing in response to the determining that the operation of the doer does not conform to the predetermined safety standard. The checking module is configured for performing an emergency processing such that the SoC <NUM> for automatic driving enters a safe mode. The checking module is configured for inhibiting the application processing information from the AP system <NUM> from being output from the SoC <NUM> for automatic driving in the safe mode. The checking module is configured for outputting safe mode information as an output of the SoC <NUM> for automatic driving in the safe mode.

The automatic driving processing system <NUM> is configured as a doer, and the checking module included in the AP system <NUM> or the safety system <NUM> is configured as a checker. The AP system <NUM> is configured as a doer and the checking module included in the safety system <NUM> is configured as a checker. The doer is configured for performing an algorithm for the SoC <NUM> for automatic driving. As an example, the doer is configured for performing an AI algorithm. The checker is configured for checking a hazard scenario, for example, the vehicle will suffer from a collision, and the vehicle is driving on a wrong road. In response to the determining that the vehicle is in the hazardous scenario, the checker takes over an operation of the SoC for automatic driving and performs emergency operations such as emergency braking of the vehicle and stopping of the vehicle by the side while disabling the operation of the doer. In this way, the checker may compensate for a damage caused by doer's mistake, such as hardware and software errors and AI algorithm errors. In addition, in this way, policies of the doer and checker allow the safety level of the doer to be lower, thus reducing the design complexity and cost of the doer, and allowing the safety level of the SoC for automatic driving to reach a high standard by configuring an independent redundant checker with a high safety level. As an example, the safety level of the checker may reach an ASIL D. In this way, the checker may compensate for deficiencies in the SoC for automatic driving, such as deficiencies in expected functional safety requirements and AI algorithms, so that the safety capacity of the of SoC for automatic driving reaches the ASIL D.

It should be understood that the AP system <NUM> and/or the safety system <NUM> may be further configured for performing other signal processing as is known in the art. Moreover, the SoC <NUM> for automatic driving may further include other subsystems. The other subsystems include a memory control system, an audio processing system, an image processing system, and an input and output system.

According to an embodiment of the present disclosure, the automatic driving processing system <NUM> may be of a redundancy mechanism. The SoC <NUM> for automatic driving further includes a redundant automatic driving processing system. The redundant automatic driving processing system is configured for receiving an automatic driving data stream and processing the automatic driving data stream based on a deep learning model so as to generate a redundant processing result. In this way, when it is determined that the automatic driving processing system <NUM> fails, the redundant automatic driving processing system is enabled in response to a corresponding alarm signal so as to continue the processing for automatic driving. Hence, the safety capacity of the system for automatic driving of the vehicle is improved.

<FIG> shows a block diagram of an automatic driving processing system according to an embodiment of the present disclosure. Referring to <FIG>, the automatic driving processing system <NUM> includes an automatic driving processing module <NUM>, a fault detection module <NUM> and a multi-way selection module <NUM>. A processing result output by the automatic driving processing module <NUM> is transmitted to an AP system <NUM> as shown in <FIG> for processing therein.

The automatic driving processing module <NUM> is configured for receiving an input data stream and processing the input data stream based on a deep learning model so as to generate a processing result. The automatic driving processing module <NUM> is an AI module for automatic driving. The module, for example, is an IP core of an SoC. The automatic driving processing module <NUM> is configured for performing at least a portion of automatic driving sensing, planning and control processing at least partially based on an AI algorithm, so as to generate processing results of at least a portion of the sensing, planning and control processing. The automatic driving processing module <NUM> outputs a processing result of at least one of obstacle recognition, environment identification, driving information, route selection, vehicle status information and the like. The automatic driving processing module <NUM> may be an AI module of an SoC for automatic driving as is known in the art.

The fault detection module <NUM> is configured for generating a control signal and a fault detection stimulating data stream, and receiving the processing result from the automatic driving processing module <NUM>. The fault detection module <NUM> and the automatic driving processing module <NUM> are separately disposed in the automatic driving processing system <NUM>, as shown in <FIG>. It should be understood that the present embodiment of the present disclosure is not limited thereto, and in other embodiments, the fault detection module <NUM> is included in the automatic driving processing module <NUM> and operates independently of the deep learning model of the automatic driving processing module <NUM>, so that the automatic driving processing module <NUM> outputs the control signal and the fault detection stimulating data stream besides the processing result.

The multi-way selection module <NUM> is configured for receiving an automatic driving data stream as well as the control signal and the fault detection stimulating data stream from the fault detection module <NUM>, and selectively outputting the automatic driving data stream or the fault detection stimulating data stream to the automatic driving processing module <NUM> based on the control signal, as an input data stream of the automatic driving processing module <NUM>. The multi-way selection module <NUM> receives the automatic driving data stream from a camera system <NUM> and/or an LIDAR system <NUM> as shown in <FIG>. The multi-way selection module <NUM> is further configured for outputting the automatic driving data stream to the automatic driving processing module <NUM> as the input data stream when the control signal has a first logic level, and outputting the fault detection stimulating data stream to the automatic driving processing module <NUM> as the input data stream when the control signal has a second logic level different from the first logic level. The multi-way selection module <NUM> is further configured for receiving other types of control signals, for example, control signals for enabling or disabling the multi-way selection module <NUM> and control signals for changing the frequency of output and input data streams.

During a normal data stream processing, the automatic driving processing module <NUM> is configured for receiving the automatic driving data stream so as to generate a processing result of the automatic driving data stream. During a fault detection process, the automatic driving processing module <NUM> is configured for receiving the fault detection stimulating data stream so as to generate a processing result of the fault detection stimulating data stream.

The fault detection module <NUM> is further configured for comparing the processing result of the fault detection stimulating data stream received from the automatic driving processing module <NUM> with a predetermined result corresponding to the fault detection stimulating data stream, and determining whether a fault occurs in the automatic driving processing module <NUM> in response to the comparison. The fault detection module <NUM> associatively stores at least one fault detection stimulating data stream and at least one predetermined result corresponding thereto in a memory. The fault detection module <NUM> is configured for determine at least one predetermined result corresponding to the output fault detection stimulating data stream by a lookup table. The predetermined result includes a processing result of at least a portion of automatic driving sensing, planning and control processing.

The fault detection module <NUM> is further configured for determining no fault occurring in the automatic driving processing module <NUM> in response to a difference between the processing result of the fault detection stimulating data stream and the predetermined result being within a predetermined range. The fault detection module <NUM> is further configured for generating the control signal in response to the determining that no fault occurs in the automatic driving processing module <NUM>, such that the multi-way selection module <NUM> outputs the automatic driving data stream to the automatic driving processing module <NUM> based on the control signal. The fault detection module <NUM> is further configured for determining a fault occurring in the automatic driving processing module <NUM> in response to a difference between the processing result of the fault detection stimulating data stream and the predetermined result exceeding the predetermined range, and generating an alarm signal. The alarm signal is transmitted to a safety system <NUM> as shown in <FIG>.

The processing result of the fault detection stimulating data stream is compared to a set of predetermined results so as to determine whether the processing result of the fault detection stimulating data stream conforms to at least one predetermined result in the set. The processing result of the fault detection stimulating data stream is compared to the at least one predetermined result so as to determine the correlation of a feature of the processing result of the fault detection stimulating data stream to a feature of the at least one predetermined result. It should be understood that the processing result and the predetermined result of the fault detection stimulating data stream may be compared using a method known in the art.

In the automatic driving processing system <NUM> according to an embodiment of the present disclosure, one of the automatic driving data flow and the fault detection stimulating data stream is input into the automatic driving processing module <NUM> so as to generate a processing result of the input data stream. In this way, there is no need to change the existing or designed automatic driving processing module <NUM>, for example, an AI module of an SoC for automatic driving. Further, the fault detection stimulating data stream is inserted between adjacent data streams in a series of automatic driving data streams based on the selection of the control signal, for the automatic driving processing module <NUM> to process. In this way, the processing load of the automatic driving processing module is not increased, a complicated operation of the automatic driving processing module is not caused, and the design complexity of the automatic driving processing module is reduced. Further, for the automatic driving processing module <NUM>, the fault detection module <NUM> is independently arranged in the same subsystem of the SoC for automatic driving, such as an automatic driving processing system <NUM>. In this way, hardware and software faults of the automatic driving processing module may be determined independently and quickly, and the safety capacity of the automatic driving processing module may be increased. Hence, compared to the SOC that using the safety measures LBIST and ECC to reach the ASIL B, the SoC for automatic driving according to some embodiments of the present disclosure may achieve the ASIL D so as to improve the safety capacity of the system for automatic driving of the vehicle.

According to some embodiments of the present disclosure, a redundancy mechanism may be used for the automatic driving processing module <NUM>. The automatic driving processing system <NUM> further includes a redundant automatic driving processing module. The redundant automatic driving processing module is configured for receiving an input data stream and processing the input data stream based on a deep learning model so as to generate a redundant processing result. In this way, when it is determined that the automatic driving processing module <NUM> fails, the redundant automatic driving processing system is enabled in response to a corresponding alarm signal so as to continue the processing for automatic driving. Hence, the safety capacity of the system for automatic driving of the vehicle is improved.

<FIG> shows a schematic diagram of a processing task of an automatic driving processing module according to an embodiment of the present disclosure. Referring to <FIG>, in a process of processing an input data stream within a cycle T1 by an automatic driving processing module <NUM>, the automatic driving processing module <NUM> processes a fault detection stimulating data stream periodically or within a cycle T2. In this way, the functional safety of the automatic driving processing module <NUM> may be ensured.

The fault detection module <NUM> is further configured for generating a control signal and a fault detection stimulating data stream within a first cycle, such that a multi-way selection module <NUM> outputs the fault detection stimulating data stream to the automatic driving processing module <NUM> based on the control signal within a cycle corresponding to the first cycle, so as to receive a processing result of the fault detection stimulating data stream from the automatic driving processing module <NUM>. The cycle is equal to the first cycle. In such case, the first cycle is equal to the cycle T2 shown in <FIG>. In an alternate embodiment, the cycle is a fraction or multiple of the first cycle. In this way, the fault detection module <NUM> may periodically monitor whether a fault occurs in the automatic driving processing module <NUM>.

The multi-way selection module <NUM> is further configured for receiving an automatic driving data stream from the outside within a second cycle, the second cycle being shorter than the first cycle. The second cycle is equal to the fraction of the first cycle. The multi-way selection module <NUM> outputs the automatic driving data stream to the automatic driving processing module <NUM> within a cycle corresponding to the second cycle. The cycle is equal to the second cycle. In such case, the second cycle is equal to the cycle T1 shown in <FIG>. In this way, depending on a particular scenario, the first cycle is adjusted so that the automatic driving processing module <NUM> primarily processes the automatic driving data stream so as not to affect the automatic driving of the vehicle. The second cycle is equal to one-fifth of the first cycle such that, for the input data stream of the automatic driving processing module <NUM>, one fault detection stimulating data stream is inserted into every four automatic driving data streams, so as to replace a fifth automatic driving data stream with the fault detection stimulating data stream as an input data stream, as shown in <FIG>.

It should be understood that the present embodiment of the present disclosure is not limited thereto. In other embodiments, the score may be set as other values, such that, for the input data stream of the automatic driving processing module <NUM>, one automatic driving data stream is inserted into every one or more automatic driving data streams, that is, in a processing task of the automatic driving processing module <NUM>, a processing task of the fault detection stimulating data stream is inserted into the processing tasks of the one or more automatic driving data streams.

The fault detection module <NUM> outputs such fault detection stimulating data stream, such that a difference between a predetermined result corresponding to the fault detection stimulating data stream and the processing result of the previously received automatic driving data stream is within a predetermined range. The predetermined result corresponding to the fault detection stimulating data stream to be output conforms to the processing result of the previously received automatic driving data stream. Hence, no abnormal value is included in the processing result received by an AP system <NUM>. In an alternate embodiment, the fault detection module <NUM> outputs such fault detection stimulating data stream such that the predetermined result corresponding to the fault detection stimulating data stream includes a mark, the mark prevent the AP system <NUM> to process a predetermined result of the fault detection stimulating data stream. Hence, an insertion fault detection for the automatic driving processing module <NUM> does not affect an information processing by the AP system <NUM>.

<FIG> shows a schematic diagram of a processing task of an automatic driving processing module according to an embodiment of the present disclosure. Referring to <FIG>, in a process that the automatic driving processing module <NUM> processes an input data stream, under a predetermined condition, the automatic driving processing module <NUM> processes a fault detection stimulating data stream inserted for replacing an automatic driving data stream. A detection is triggered in a suspicious circumstance, such that the automatic driving processing module <NUM> processes the fault detection stimulating data stream, as shown in <FIG>. Hence, it is possible to compensate for a malfunction or a defect of the automatic driving processing module <NUM> in the shortest time.

The fault detection module <NUM> is further configured for receiving a processing result of the automatic driving data stream from the automatic driving processing module <NUM> and determining whether the processing result exceeds a threshold. The threshold is a value that deviates from a corresponding feature value of the processing result of the automatic driving data stream in a previous cycle. The fault detection module <NUM> is configured for: generating a control signal and a fault detection stimulating data stream in response to the determining that a fluctuation of the processing result of the automatic driving data stream exceeds a threshold, such that a multi-way selection module <NUM> outputs the fault detection stimulating data to the automatic driving processing module <NUM> based on the control signal; and receiving the processing result of the fault detection stimulating data stream from the automatic driving processing module <NUM>.

As shown in <FIG>, in a processing task of the automatic driving processing module <NUM>, the fault detection module <NUM> finds a suspicious condition in which a fluctuation exceeds a threshold after the processing tasks of first three automatic driving data streams within a time range shown, and inserts a processing task of the fault detection stimulating data stream into such processing tasks. After the fault detection module <NUM> determines that no fault occurs, the automatic driving processing module <NUM> continues to perform the processing tasks of seven automatic driving data streams. The fault detection module <NUM> then finds a suspicious condition in which the fluctuation exceeds the threshold and inserts the processing task of the fault detection stimulating data stream into such processing tasks. After the fault detection module <NUM> determines that no fault occurs, the automatic driving processing module <NUM> continues to perform the processing tasks of two automatic driving data streams, and then the fault detection module <NUM> inserts the processing task of the fault detection stimulating data stream into such processing tasks. It should be understood that the values above are merely exemplary but not limiting, and such values may vary depending on the actual situation. In this way, the fault detection module <NUM> may monitor the processing results of the automatic driving data stream in real time and initiate a fault detection for the automatic driving processing module <NUM> in a suspicious circumstance, and then finds a fault quickly so as to handle such fault for a longer time, which improves the safety capacity of the system for automatic driving.

<FIG> shows a flowchart of a method for monitoring an automatic driving processing module according to an embodiment of the present disclosure. The automatic driving processing module is the automatic driving processing module <NUM> described above.

Referring to <FIG>, at a block <NUM>, an automatic driving data stream or a fault detection stimulating data stream, as an input data stream, is selectively input into the automatic driving processing module based on a control signal, where the automatic driving processing module is configured for processing the input data stream based on a deep learning model so as to generate a processing result. During a normal data stream processing, the control signal is set such that the automatic driving data stream is input into the automatic driving processing module as the input data stream, so as to generate a processing result of the automatic driving data stream. During a fault detection processing, the control signal is set such that the fault detection stimulating data stream is input into the automatic driving processing module as the input data stream, so as to generate a processing result of the fault detection stimulating data stream.

At a block <NUM>, the processing result of the automatic driving data stream is received from the automatic driving processing module. The processing result of the automatic driving data stream is also received from the automatic driving processing module.

At a block <NUM>, the processing result of the fault detection stimulating data stream is compared with a predetermined result corresponding to the fault detection stimulating data stream, and whether a fault occurs in the automatic driving processing module is determined in response to the comparison. The determining whether a fault occurs in the automatic driving processing module includes: determining no fault occurring in the automatic driving processing module in response to a difference between the processing result of the fault detection stimulating data stream and the predetermined result being within a predetermined range; and determining a fault occurring in the automatic driving processing module in response to the difference exceeding the predetermined range.

The control signal is set periodically such that the fault detection stimulating data stream is input into the automatic driving processing module, so as to generate a processing result of the fault detection stimulating data stream. The processing result of the automatic driving data stream is received from the automatic driving processing module, and whether a fluctuation in the processing result of the automatic driving data stream exceeds a threshold is determined. The control signal is set in response to the determining that a fluctuation of the processing result of the automatic driving data stream exceeds a threshold, such that the fault detection stimulating data stream is input into the automatic driving processing module so as to generate the processing result of the fault detection stimulating data.

It should be understood that the method for implementing some embodiments of the present disclosure may be written in any combination of one or more programming languages, so as to apply to an SoC architecture. In addition, while operations are depicted in a particular order, it should be understood as requiring such operations be performed in the particular order shown or in a sequential order, or that all shown operations be performed to achieve desired results. Multitasking and parallel processing may be advantageous in certain circumstances.

While several specific implementation details are contained in the discussions above, such details should not be construed as limitations on the scope of the present disclosure. Certain features that are describe in the context of separate implementations may also be implemented in combination in a single implementation. Conversely, various features that are described in the context of a single implementation may also be implemented in multiple implementations separately or in any suitable subcombination.

Claim 1:
An automatic driving processing system comprising:
an automatic driving processing module (<NUM>), configured for receiving an input data stream and processing the input data stream based on a deep learning model so as to generate a processing result;
a fault detection module (<NUM>), configured for generating a control signal and a fault detection stimulating data stream, and receiving the processing result from the automatic driving processing module (<NUM>); and
a multi-way selection module (<NUM>), configured for receiving an automatic driving data stream as well as the control signal and the fault detection stimulating data stream from the fault detection module (<NUM>), and selectively outputting the automatic driving data stream or the fault detection stimulating data stream to the automatic driving processing module (<NUM>) based on the control signal, as the input data stream of the automatic driving processing module (<NUM>),
wherein the fault detection module (<NUM>) is further configured for comparing a processing result of the fault detection stimulating data stream received from the automatic driving processing module (<NUM>) with a predetermined result corresponding to the fault detection stimulating data stream, and determining whether a fault occurs in the automatic driving processing module (<NUM>) in response to the comparison;
wherein the fault detection module (<NUM>) is further configured for:
receiving from the automatic driving processing module (<NUM>) a processing result of the automatic driving data stream;
generating the control signal and the fault detection stimulating data stream in response to the determining that a fluctuation of the processing result of the automatic driving data stream exceeds a threshold, such that the multi-way selection module (<NUM>) outputs the fault detection stimulating data to the automatic driving processing module (<NUM>) based on the control signal; and
receiving the processing result of the fault detection stimulating data stream from the automatic driving processing module (<NUM>).