CN118163810A - Vehicle control method, device, vehicle and storage medium - Google Patents

Abstract

The present application discloses a vehicle control method, device, vehicle and readable storage medium, the method comprising: when the vehicle is running according to the instructions of the first chip and the second chip SOC of the vehicle, if the first condition or the second condition is met, determining whether the running state of the SOC is abnormal; if the running state of the SOC is abnormal, controlling the vehicle to disable the instructions of the SOC and controlling the vehicle to continue running according to the instructions of the MCU. In the present application, after the automatic driving function of the vehicle has an unexpected exit behavior under the instruction of the SOC, the vehicle can continue to be controlled by the MCU to continue running, avoiding the vehicle operation failure caused by the continued use of the instructions of the SOC.

Description

Vehicle control method, device, vehicle and storage medium

Technical Field

The present application relates to the field of vehicle technology, and more specifically, to a vehicle control method, device, vehicle, and computer-readable storage medium.

Background technique

An intelligent driving system is a technology that assists the driver in driving during the vehicle driving process, and can completely replace human driving in special circumstances. Therefore, the intelligent driving system has an extremely high level of safety to ensure that the vehicle is safe enough when being controlled by the system.

In the intelligent driving system, the driver is allowed to take their eyes and hands off the wheel. At this time, the unexpected exit of the vehicle's automatic driving function will cause the driver to be unable to fulfill the takeover requirements in time. Therefore, there is an urgent need for a means to control the vehicle to continue running after the vehicle's automatic driving function has an unexpected exit.

Summary of the invention

The present application proposes a vehicle control method, device, vehicle and computer-readable storage medium to improve the above-mentioned defects.

In a first aspect, an embodiment of the present application provides a vehicle control method, the method comprising: when a vehicle is operating according to an instruction of the vehicle's SOC, if the vehicle's MCU monitors that the operating state of the vehicle's automatic driving function under the control of the SOC's instruction satisfies a first condition within a first time period after the vehicle jumps from a normal state to an inactivated state, or satisfies a second condition within a second time period after the vehicle jumps from a standby state to an inactivated state, determining whether an abnormality occurs in the operating state of the SOC; if the operating state of the SOC is abnormal, controlling the vehicle to disable the SOC's instruction, and controlling the vehicle to continue operating according to the MCU's instruction.

In a second aspect, an embodiment of the present application further provides a vehicle control device, the device comprising: a determination module, for determining whether an abnormality occurs in the operating state of the SOC when the vehicle is operating according to the instructions of the vehicle's SOC, if the vehicle's MCU monitors that the operating state of the vehicle's automatic driving function under the control of the SOC's instructions satisfies a first condition within a first time period after the vehicle jumps from a normal state to an inactivated state, or satisfies a second condition within a second time period after the vehicle jumps from a standby state to an inactivated state; a control module, for controlling the vehicle to disable the SOC's instructions if the operating state of the SOC is abnormal, and controlling the vehicle to continue operating according to the instructions of the MCU.

In a third aspect, an embodiment of the present application also provides a vehicle, characterized in that the vehicle includes: one or more processors; a memory; one or more applications, wherein the one or more applications are stored in the memory and configured to be executed by one or more processors, and the one or more programs are configured to execute the above method.

In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, which stores a program code executable by a processor, and when the program code is executed by the processor, the processor executes the above method.

The present application provides a vehicle control method, device, vehicle and computer-readable storage medium. In the present application, when the vehicle is running according to the instructions of the SOC, if the first condition or the second condition is met, it indicates that the automatic driving function of the vehicle has an unexpected exit behavior, and then it is determined whether the operating state of the SOC is abnormal. If the operating state of the SOC of the vehicle is abnormal, the vehicle is controlled to disable the instructions of the SOC, and the vehicle is controlled to continue to run according to the instructions of the MCU, thereby avoiding the situation where the vehicle operation failure caused by continuing to use the instructions of the SOC, so that after the automatic driving function has an unexpected exit behavior under the instructions of the SOC, the vehicle can continue to run under the control of the MCU.

Other features and advantages of the embodiments of the present application will be described in the subsequent description, and partly become apparent from the description, or can be understood by practicing the embodiments of the present application. The purposes and other advantages of the embodiments of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

FIG1 shows a schematic diagram of a vehicle hardware environment suitable for an embodiment of the present application.

FIG2 shows a flow chart of a vehicle control method according to an embodiment of the present application.

FIG3 shows a schematic diagram of a vehicle control logic in an embodiment of the present application.

FIG4 shows a structural block diagram of a vehicle control device proposed in an embodiment of the present application.

Detailed ways

In order to make those skilled in the art better understand the present application scheme, the technical scheme in the present application embodiment will be clearly and completely described below in conjunction with the drawings in the present application embodiment. Obviously, the described embodiment is only a part of the present application embodiment, rather than all the embodiments. The components of the present application embodiment usually described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the present application for protection, but merely represents the selected embodiment of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

Please refer to FIG. 1 , which shows a schematic diagram of a vehicle hardware environment applicable to an embodiment of the present application. A vehicle 100 includes a processor 111 and a memory 112 .

The processor 111 may include a microcontroller unit (MCU) and a system on chip (SOC). The microcontroller unit and the SOC may have a built-in memory 112, which stores programs that can execute the contents of the following embodiments, and the processor 111 can execute the programs stored in the memory 112.

The processor 112 may include one or more processors. The processor 111 uses various interfaces and lines to connect various parts of the entire vehicle 100, and executes various functions of the vehicle 100 and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 112, and calling data stored in the memory 112.

The memory 112 may include a random access memory (RAM) or a read-only memory (ROM). The memory 112 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 112 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc.

Please refer to FIG. 2 , which shows a flow chart of a vehicle control method proposed in one embodiment of the present application, which is used for a vehicle, and the method includes:

S101. When the vehicle is operating according to the instructions of the vehicle's SOC, if the vehicle's MCU monitors that the operating state of the vehicle's automatic driving function under the control of the SOC's instructions satisfies the first condition within a first period of time after the vehicle jumps from a normal state to an inactivated state, or satisfies the second condition within a second period of time after the vehicle jumps from a standby state to an inactivated state, it is determined whether there is an abnormality in the operating state of the SOC.

Among them, the Automotive Safety Integrity Level (ASIL) of MCU (Microprogrammed Control Unit) is higher than that of SOC (System on Chip). MCU can be connected to SOC, so that MCU can monitor the state machine of SOC.

The vehicle can be an electric vehicle or a fuel vehicle, and the vehicle can be a sedan, SUV, bus, truck, etc. The vehicle can have an intelligent driving system, and the vehicle can be driven automatically through the intelligent driving system.

In some embodiments, the MCU is a chip with an independent controller area network (CAN) bus interface; bus data of other controllers in the vehicle are sent to the MCU and the SOC at the same time; other controllers refer to other controllers in the vehicle except the MCU and the SOC.

That is to say, in this application, an MCU chip with an independent CAN bus interface can be selected as the vehicle's MCU, so that the MCU can communicate directly with other controllers in the vehicle through the CAN bus, thereby reading the bus data of other controllers through the CAN network, and realizing that the bus data of other controllers will be sent to the MCU and SOC at the same time. Among them, other controllers can be central controllers, steering system controllers, brake system controllers, power system controllers, etc.

Generally speaking, either the SOC or the MCU of the vehicle acts as a control center to send instructions to the vehicle so that the vehicle operates according to the received instructions. In the present application, when the vehicle operates under the control of the instructions of the SOC of the vehicle, the vehicle control method of the present application is executed; when the vehicle operates under the control of the instructions of the MUC of the vehicle, the vehicle control method of the present application may not be executed.

In this embodiment, the operating state of the vehicle's automatic driving function under the control of the SOC's instructions is also called the SOC's state machine; the states of the SOC's state machine may include: normal (normal state), disable (unusable state), failure (error state), passive (inactivated state), standby (standby state, which can be used upon receiving instructions), active (activated state), override (intervention state, the state in which the driver intervenes in the automatic driving function), TOR (takeover alarm state, the state in which the vehicle prompts the driver to take over the vehicle's driving function), MRM (the state in which the minimum risk operation is performed, which may include, for example, deceleration and parking), MRC (the state in which the minimum risk environment is present, also called a safe state, such as being in a parking state, with the vehicle's handbrake being pulled up), etc.

In this embodiment, a monitoring function may be set, which refers to a function of monitoring the state of the state machine of the SOC through the MCU, that is, the monitoring function refers to a function of monitoring the running state of the automatic driving function of the vehicle under the control of the command of the SOC through the MCU. If the MCU detects that the state machine of the SOC jumps from the normal state to the passive state, it continues to monitor whether the first condition is met within the first time after the state machine of the SOC jumps from the normal state to the passive state. If the first condition is met, it indicates that the automatic driving function has an unexpected exit behavior, or if the MCU detects that the state machine of the SOC jumps from the standby state to the inactive state, it continues to monitor whether the second condition is met within the second time after the state machine of the SOC jumps from the standby state to the inactive state. If the second condition is met, it indicates that the automatic driving function has an unexpected exit behavior. The first time and the second time can be time lengths set based on demand. For example, the first time length and the second time length can both be 500ms.

In one embodiment, the first condition includes:

The state of the MCU's state machine is a takeover alarm state, a state of performing a minimum risk operation, or a state of being in a minimum risk environment;

The vehicle's automatic driving function requests to exit under the control of the SOC's instructions;

The vehicle's emergency lane keeping function did not trigger lateral behavior before or during operation;

The vehicle's digital electronic ignition system triggers control behavior;

The vehicle's automatic emergency steering system triggers control actions;

The vehicle's automatic emergency braking system triggers control actions;

The vehicle's handbrake is not in the applied position;

The vehicle's brake pedal is not depressed;

The hand torque applied by the driver to the vehicle does not exceed the set torque threshold; the torque threshold can be set based on demand, such as 500 Newton meters;

The vehicle's Traffic Jam Assist Autopilot function is turned on;

The vehicle's unrequested driving state machine is dormant;

The SOC did not generate an alarm request.

Among them, the MCU's state machine request to exit can be determined when Request_TJP (Traffic Jam Pilot, traffic congestion assisted automatic driving function)_Exit (exit) = False; generally speaking, Request_TJP_Exit (TJP request to exit) = False can be determined when the SOC's TJP exit takes over and the intelligent transportation system takes over, or when the SOC directly exits the takeover and does not output any instructions.

The vehicle's digital electronically controlled ignition system triggering control behavior may be issued by the AS routing point in the SOC, and when IFC (Intelligent Freeway Communication System, Intelligent Transportation System)_ESA (digital electronically controlled ignition system)_St! (state) = Active, the vehicle's digital electronically controlled ignition system triggering control behavior is determined.

The automatic emergency steering system triggering control behavior of the vehicle may be issued by the AS routing point in the SOC. When IFC_AES (automatic emergency steering system)_St!=Active, the automatic emergency steering system triggering control behavior of the vehicle is determined.

The automatic emergency braking system triggering control behavior of the vehicle may be issued by the AS routing point in the SOC, and when IFC_MRR (Mean reciprocal rank, search algorithm evaluation score)_AEB (automatic emergency steering system) Intervention_St!=1=Intervention, the automatic emergency braking system triggering control behavior of the vehicle is determined.

When the flag bit of the user pulling up the handbrake = False, it is determined that the vehicle's handbrake is not in the pulled up state; when the flag bit of whether the brake is pressed = Not Pressed, it is determined that the vehicle's brake pedal is not pressed; when the flag bit of the driver's hand torque is not exceeding, it is determined that the hand torque applied by the driver to the vehicle does not exceed the set torque threshold; when the state of the TJP activation button is ON, it is determined that the traffic congestion assistance automatic driving function is in the on state; when the flag bit of requesting the driving state machine to sleep = False, it is determined that the vehicle's non-requested driving state machine is in sleep; when the flag bit of ALARM (alarm) _SOC_REQUEST (SOC request alarm) = False, it is determined that the SOC (SOC) has not generated an alarm request.

In yet another embodiment, the second condition may include:

The vehicle's handbrake is not in the applied position;

The vehicle's brake pedal is not depressed;

The monitoring function of the SOC is turned on; the monitoring function refers to the function of monitoring the operating status of the vehicle's automatic driving function under the control of the SOC's instructions through the MCU;

The absolute value of the vehicle's steering wheel angle is less than a preset angle threshold.

The preset turning angle threshold (K_StandStStrAngChanged) may be a value set based on demand, such as 20°.

In this embodiment, within the first 500ms after monitoring that the state machine of the SOC jumps from Standby (standby state) to PASSIVE (inactive state), the flag bit of whether the user pulls up the handbrake, the flag bit of whether the brake is pressed, the state of the monitoring function activation button and the steering angle (SteeringAngle) of the electric power steering system (EPS, Electric Power Steering) are obtained. If the flag bit of the user pulling up the handbrake = False (indicating that the handbrake of the vehicle is not in the pulled up state), the flag bit of whether the brake is pressed = Not Pressed (indicating that the brake pedal is not pressed), the state of the monitoring function activation button is ON (indicating that the monitoring function is in the on state) and EPS_SteeringAngle＜K_StandStStrAngChanged (indicating that the absolute value of the steering wheel angle of the vehicle is less than the preset angle threshold), it is determined that the second condition is met, and the monitoring flag bit of the unexpected exit behavior of the automatic driving function is set to True (the default value of this value is False, and False indicates that the automatic driving function has not undergone unexpected exit behavior), this value is True for indicating that the automatic driving function has undergone unexpected exit behavior. Among them, K_StandStStrAngChanged refers to the threshold corresponding to EPS_SteeringAngle, which can be a value set based on a preset turning angle threshold, and is not limited in this application.

If the vehicle's MCU monitors that the operating state of the vehicle's automatic driving function under the control of the SOC's command satisfies the first condition within the first time period after the vehicle jumps from the normal state to the inactivated state, or satisfies the second condition within the second time period after jumping from the standby state to the inactivated state, the monitoring flag of unexpected exit behavior will be set to True, indicating that the automatic driving function has an unexpected exit behavior under the command of the SOC.

If the vehicle's MCU monitors that the operating state of the vehicle's automatic driving function under the control of the SOC's command satisfies the first condition within the first time period after the vehicle jumps from the normal state to the inactivated state, or satisfies the second condition within the second time period after the vehicle jumps from the standby state to the inactivated state, it indicates that the automatic driving function has an unexpected exit behavior under the command of the SOC. At this time, it is possible to continue to determine whether the operating state of the SOC is abnormal.

S102: If the operating state of the SOC is abnormal, control the vehicle to disable the SOC command, and control the vehicle to continue running according to the MCU command.

After determining that the autonomous driving function has unexpectedly exited under the instructions of the SOC, it is possible to continue to determine whether the operating status of the SOC is abnormal. If the operating status of the SOC is abnormal, the vehicle can be controlled to disable the instructions of the SOC and control the vehicle to continue operating according to the instructions of the MCU.

When it is determined that the autonomous driving function has an unexpected exit behavior under the instruction of the SOC, the status error flag bit obtained by the MCU monitoring the SOC can be obtained. If the status error flag bit = True (the default value of this value is False, and this value False is used to indicate that the operating status of the SOC is normal), it is determined that the operating status of the SOC is abnormal.

As an implementation manner, S102 may also include: if the operating state of the SOC is abnormal, controlling the vehicle to perform a minimum risk operation; in response to completion of the minimum risk operation, controlling the vehicle to disable the SOC instruction, and controlling the vehicle to continue operating according to the instruction of the MCU.

In the event of an unexpected exit of the autonomous driving function, after determining that the operating status of the SOC is abnormal, the vehicle can be controlled to perform minimum risk operations, and after the vehicle completes the minimum risk operation, the vehicle can be controlled to disable the SOC instructions and continue to operate according to the instructions of the MCU.

As another implementation, after S102, the method may further include: requesting the intelligent transportation system of the vehicle to perform a safe parking operation through the MCU, so that the vehicle enters a safe state.

Optionally, if the vehicle's MCU monitors that the operating state of the vehicle's automatic driving function under the control of the SOC's instructions jumps from a standby state to an inactivated state, after requesting the vehicle's intelligent transportation system to perform a safe parking operation through the MCU, the method also includes: controlling the MCU to stop the monitoring function; the monitoring function refers to the function of monitoring the operating state of the vehicle's automatic driving function under the control of the SOC's instructions through the MCU.

After determining that the autonomous driving function has unexpectedly exited under the command of the SOC, if it is determined that the SOC operating state is abnormal, at this time, the MCU can also be controlled to stop the monitoring function so as to no longer monitor the state of the SOC state machine and save energy.

As shown in Figure 3, SOC includes a main function layer, a function monitoring layer, a platform monitoring layer, and an external monitoring layer. The main function layer is used to locate the vehicle, sense and fuse the vehicle's perception data (data collected by the vehicle's sensors, which may include cameras and radars, etc.), make decisions based on the sensed fusion data, and plan trajectories based on the decision-making data; the function monitoring layer is used to monitor various software functions in the vehicle, the platform monitoring layer is used to monitor the operating status of different platforms in the vehicle (platforms refer to hardware modules, such as lights and tires, etc.), and the external monitoring layer is used to monitor environmental information outside the vehicle;

The MCU includes a downgraded functional layer, which is used to realize the positioning of the vehicle, the perception fusion of the vehicle's perception data, the decision-making based on the perception fusion data, and the trajectory planning based on the decision-making data. The downgraded functional layer can also realize the verification of the time to collision TTC (Time-To-Collision); the MCU can perform motion control according to the trajectory planning results obtained by itself, and obtain instructions during the autonomous driving process. The MCU can monitor the state machine of the SOC through its own safety state machine, and perform instruction arbitration based on the monitoring results of the SOC state machine. Instruction arbitration refers to the deactivation of the SOC instruction when it is determined that the autonomous driving function has an unexpected exit behavior, or, under the instruction control of the SOC, it is determined that the autonomous driving function has not had an unexpected exit behavior. Continue to use the SOC instruction.

MCU and SOC can be connected to actuators through communication controllers, so that MCU and SOC can send instructions to actuators through communication controllers. Actuators may include BCS (body control system), RBU (redundant brake unit), EPS (electric power steering system) and VCU (vehicle control unit).

The intelligent driving system may also include a degradation function layer, which can implement data processing at the software layer. For example, the degradation function layer is used to perform perception fusion on the vehicle's perception data, make decisions based on the perception fusion data, and perform trajectory planning based on the decision-making data.

In this embodiment, when the vehicle is running according to the instructions of the SOC, if the first condition or the second condition is met, it indicates that the automatic driving function of the vehicle has an unexpected exit behavior, and then it is determined whether the operating state of the SOC is abnormal. If the operating state of the SOC of the vehicle is abnormal, the vehicle is controlled to disable the instructions of the SOC, and the vehicle is controlled to continue to run according to the instructions of the MCU, thereby avoiding the situation where the vehicle operation failure caused by continuing to use the instructions of the SOC occurs, so that after the automatic driving function has an unexpected exit behavior under the instructions of the SOC, the vehicle can continue to run under the control of the MCU.

In addition, a higher ASIL-level MCU is used to monitor the status of a lower ASIL-level SOC, so that a higher overall safety level product can be achieved without a high SOC chip level, meeting the functional safety requirements of the intelligent driving system. At the same time, the level requirements of some chips are reduced, saving development and design costs.

Referring to FIG. 4 , FIG. 4 shows a structural block diagram of a vehicle control device proposed in one embodiment of the present application. For use in a vehicle, the device 800 includes:

The determination module 810 is used to determine whether an abnormality occurs in the operation state of the SOC if the vehicle MCU monitors that the operation state of the automatic driving function of the vehicle under the control of the command of the SOC satisfies a first condition within a first time period after the vehicle jumps from a normal state to an inactive state, or satisfies a second condition within a second time period after the vehicle jumps from a standby state to an inactive state, when the vehicle is running according to the command of the SOC of the vehicle;

The control module 820 is used to control the vehicle to disable the SOC instruction if the operating state of the SOC is abnormal, and control the vehicle to continue to operate according to the instruction of the MCU.

Optionally, the control module 820 is also used to control the vehicle to perform a minimum risk operation if the operating state of the SOC is abnormal; in response to the completion of the minimum risk operation, control the vehicle to disable the SOC instruction, and control the vehicle to continue operating according to the instruction of the MCU.

Optionally, the control module 820 is further configured to request the intelligent transportation system of the vehicle to perform a safe parking operation through the MCU.

Optionally, if the vehicle's MCU monitors that the operating state of the vehicle's automatic driving function under the control of the SOC's instructions jumps from a standby state to an inactivated state, the control module 820 is also used to control the MCU to stop the monitoring function; the monitoring function refers to the function of monitoring the operating state of the vehicle's automatic driving function under the control of the SOC's instructions through the MCU.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and modules can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here.

In addition, each function in each embodiment of the present application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated module can be implemented in the form of hardware or in the form of software function module.

In addition, each function in each embodiment of the present application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated module can be implemented in the form of hardware or in the form of software function module.

On the other hand, the present application also provides a computer-readable storage medium, in which program code is stored. The program code can be called by a processor to execute the method described in the above method embodiment.

The computer readable storage medium can be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk, or a cluster of ROMs. Optionally, the computer readable storage medium includes a non-transitory computer-readable storage medium. The computer readable storage medium has storage space for program codes that execute any of the method steps in the above method. These program codes can be read from or written to one or more computer program products. The program code can be compressed, for example, in an appropriate form.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims (10)

1. A vehicle control method, characterized in that the method comprises:

Under the condition that a vehicle runs according to an instruction of the SOC of the vehicle, if the MCU of the vehicle monitors that the running state of the automatic driving function of the vehicle jumps from a normal state to an inactive state within a first time period after the vehicle is controlled by the instruction of the SOC, or if the running state of the SOC is abnormal within a second time period after the vehicle jumps from a standby state to the inactive state, the running state of the vehicle is determined to be abnormal;

And if the running state of the SOC is abnormal, controlling the vehicle to disable the instruction of the SOC, and controlling the vehicle to continue running according to the instruction of the MCU.

2. The method of claim 1, wherein the instructions for controlling the vehicle to disable the SOC and for controlling the vehicle to continue operating according to the instructions for the MCU if the operating state of the SOC is abnormal comprise:

if the running state of the SOC is abnormal, controlling the vehicle to execute minimum risk operation;

And responding to the completion of the minimum risk operation, controlling the vehicle to disable the instruction of the SOC, and controlling the vehicle to continue to run according to the instruction of the MCU.

3. The method of claim 1, wherein after the controlling the vehicle continues to operate according to the instructions of the MCU, the method further comprises:

and requesting an intelligent traffic system of the vehicle to execute safe parking operation through the MCU.

4. The method according to claim 3, wherein if the MCU of the vehicle monitors that the running state of the autopilot function of the vehicle jumps from a standby state to an inactive state under the control of the instruction of the SOC, the MCU requests the intelligent transportation system of the vehicle to perform a safe parking operation, the method further comprises:

Controlling the MCU to stop the monitoring function; the monitoring function is a function of monitoring an operation state of an automatic driving function of the vehicle under the control of the instruction of the SOC by the MCU.

5. The method of claim 1, wherein the first condition comprises:

The state of the state machine of the MCU is a state of taking over an alarm state, executing minimum risk operation or being in a minimum risk environment;

The vehicle requests to exit under the control of the instruction of the SOC;

the emergency lane keeping function of the vehicle does not trigger lateral behavior before and during operation;

The digital electronic control ignition system of the vehicle triggers a control action;

triggering a control action by an automatic emergency steering system of the vehicle;

triggering a control action by an automatic emergency braking system of the vehicle;

The hand brake of the vehicle is not in a pulled-up state;

the brake pedal of the vehicle is in an un-depressed state;

the driver does not apply a hand torque to the vehicle that exceeds a set torque threshold;

the traffic jam auxiliary automatic driving function of the vehicle is in an on state;

The vehicle is dormant in an unsolicited driving state machine;

the SOC does not generate an alarm request.

6. The method of claim 1, wherein the second condition comprises:

The hand brake of the vehicle is not in a pulled-up state;

the brake pedal of the vehicle is in an un-depressed state;

The monitoring function of the SOC is in an on state; the monitoring function is a function of monitoring the running state of the automatic driving function of the vehicle under the control of the instruction of the SOC through the MCU;

The absolute value of the steering wheel angle of the vehicle is smaller than a preset angle threshold.

7. The method of claim 1, wherein the MCU is a chip with an independent controller area network bus interface; bus data of other controllers in the vehicle are simultaneously sent to the MCU and the SOC; the other controllers refer to other controllers in the vehicle except the MCU and the SOC.

8. A vehicle control apparatus, characterized in that the apparatus comprises:

a determining module, configured to determine, if, in a case where a vehicle is running according to an instruction of an SOC of the vehicle, it is monitored by an MCU of the vehicle that an operation state of an autopilot function of the vehicle is skipped from a normal state to an inactive state for a first period of time after the vehicle is controlled by the instruction of the SOC, or if a second condition is satisfied for a second period of time after the vehicle is skipped from a standby state to the inactive state, whether the operation state of the SOC is abnormal;

And the control module is used for controlling the vehicle to disable the instruction of the SOC if the running state of the SOC is abnormal and controlling the vehicle to continue running according to the instruction of the MCU.

9. A vehicle, characterized by comprising:

One or more processors;

A memory;

one or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, the one or more applications configured to perform the method of any of claims 1-7.

10. A computer readable storage medium, characterized in that the computer readable storage medium stores a program code executable by a processor, which program code, when executed by the processor, causes the processor to perform the method of any of claims 1-7.