Highway autonomous driving function HWP function definition

1. Function definition

The highway autonomous driving function HWP means that on a generally smooth highway or urban expressway, the driver can let go of his hands and feet, and at the same time, his attention can be diverted from the driving environment for a long period of time, such as looking at his mobile phone, answering calls, For activities such as sightseeing, the system operates at a minimum speed of 60kph.

The autonomous driving functions in the above two different environments and speed ranges need to alert the driver when the scene exceeds its limited ODD range, the system itself is degraded due to operational failures, and other vehicles may have obvious failures. At this time, the driver is The system can react and take over the vehicle within the maximum time it can override the entire vehicle. Therefore, during this process, all the driver's in-car performance requires the driver to have the ability to take over in a timely manner within a sufficient period of time. Therefore, for limited autonomous driving, the driver cannot be allowed to perform actions that require longer reaction times, such as moderate or severe fatigue or leaving the driving seat.

2. The corresponding main functional states of HWP include the following:

1. Standby Passive:

The initialization process includes checking the TJP/HWP activation conditions when TJP/HWP is not activated to ensure that any conditions outside the ODD range cannot activate the TJP/HWP system. When it is checked that the TJP/HWP system activation conditions are met, the driver is reminded visually or audibly that the system can be activated at this time. When it is detected that the activation conditions are not met, the system will automatically filter and sort the parts that do not meet the conditions, and prompt the driver through instruments or sounds as to why activation is not possible. Since the autonomous driving function requires a high-precision map with navigation function, when the system receives the forward environment information and destination information sent by the navigation map, it can proactively remind the driver to turn on TJP/HWP on a certain section of road with better environment. function for autonomous driving experience. Of course, users can also manually choose to turn off the TJP/HWP system through personalized settings through the car. The TJP/HWP system overrides the standby strategy of the L2 system, so the standby conditions of the two should be set based on the L2 level, distinguishing between horizontal and vertical standby activation states;

1 ) Meet TJA/ICA activation conditions:

• All sensors are faultless;
• The actuator is fault-free and the supported ADAS additional functions are available (such as the VAF function of ESP is available and the steering status of EPS is available);
• Vehicle information input is normal (such as wheel speed, turning angle, yaw angle, etc.);
• The driver's driving status is normal (such as the seat belt has been fastened, the door has been closed, the hood has been closed, and the gear has been shifted to D/S);

2 ) Meet TJP/HWP individual requirements for activation:

• It is detected that the vehicle road environment input by the high-precision map is within the ODD range;
• It is detected that the driver is not in a state of severe fatigue or severe distraction when activating the function;
• It is detected that both the main and auxiliary controllers are faultless and in normal condition;

Note: ① For the activation conditions required by TJP/HWP alone, the detected vehicle is within the ODD range, the system is required to be equipped with a high-precision map with higher precision and accuracy, and the high-precision map is required to achieve lane-level positioning.

② The above environmental perception is a key item of function activation. For high-precision map positioning and perception, the environmental information needs to be integrated with lidar information for corresponding point cloud data reconstruction, so that both environment and lane information can be detected more accurately.

③ For automatic driving control, corresponding requirements need to be put forward for the driver's ability to take over. When severe fatigue or long-term inattention of the driver has been detected before activation, the driver should be prohibited from activating automatic driving. Of course, if it is after activation When you are severely fatigued or distracted, the time for reporting to take over can be appropriately shortened. ④ For autonomous driving, it is required that when the controller fails, if it has been activated, the backup controller can be enabled and downgraded for driving control. However, if the controller fails before activation, it cannot be activated to ensure safety.

2. Activate Active:

When all the activation standby conditions proposed above are met and the driver enters the normal use of the TJP/HWP function through active activation or push, the system can achieve normal automatic driving and perform the entire dynamic driving task. The entire control logic includes The following are environmental perception, behavioral decision-making, horizontal and vertical motion control, execution feedback adjustment, display alarm, etc. Specifically, it can include the following functional comparisons:
 

functional state system	TJP	HWP
Portrait function	1 ) Automatically maintain a certain distance from the vehicle in front within the error range; 2) Automatically maintain a certain speed from the vehicle in front within the error range; 3) Automatically follow the vehicle in front to stop and start; 4) When a new target cuts in, the target switch is automatically completed. Appropriate deceleration is performed at the same time; 5) When the target in front of the vehicle is cut out, the target switch is automatically completed and appropriate acceleration is performed at the same time; 6) The vehicle speed is automatically limited after recognizing the environmental speed limit information (including map information or traffic flow information); 7 ) After the speed is higher than the TJP action speed range, it automatically enters the HWP function control	1 ) Automatically maintain a certain distance from the vehicle in front within the error range; 2) Automatically maintain a certain speed from the vehicle in front within the error range; 3) When a new target cuts in, the target switch is automatically completed and appropriate deceleration is performed; 4) When the vehicle When the target ahead is cut out, the target switch is automatically completed and appropriate acceleration is performed; 5) The vehicle speed is automatically limited after recognizing the environmental speed limit information (including map information or traffic flow information); 6) After the speed is lower than the HWP action speed, the vehicle is automatically Enter TJP function control;
Horizontal functionality	1 ) Calculate the corresponding lateral control trajectory according to the navigation information, and use the heading angle or lateral displacement output for lateral angle control; 2) Automatically maintain the lateral trajectory centering function within a certain deviation; 3) Automatically adjust the lateral direction of the vehicle according to the radius of the curve Centering offset; 4) Automatically adjust the lateral centering offset based on the risk of vehicles in the lane next to the lane deviating from the lane; 5) Automatically adjust the lateral trajectory deviation based on the lateral execution feedback results and environmental changes; 6) The speed is higher than TJP After entering the speed range, it automatically enters HWP function control.	1 ) Calculate the corresponding lateral control trajectory according to the navigation information, and use the heading angle or lateral displacement output for lateral angle control; 2) Automatically maintain the lateral trajectory centering function within a certain deviation; 3) Automatically adjust the lateral direction of the vehicle according to the radius of the curve Centering offset; 4) Automatically adjust the lateral centering offset based on the risk of vehicles in the lane next to the lane deviating from the lane; 5) Automatically adjust the lateral trajectory deviation based on the lateral execution feedback results and environmental changes; 6) The speed is lower than the HWP After the speed is applied, it automatically enters TJP function control;
Monitoring function	Automatically monitor the driver's status and implement corresponding countermeasures based on the monitoring results. 1) When TJP is activated and it is detected that the driver's status is severe fatigue or the distraction time is long, the TJP control time will be shortened and the TJP system will alarm itself in advance ; 2) When it is detected that the driver's status is severe fatigue or distraction When the distraction time is long, the TJP system availability standby state cannot be entered; 3) When the driver monitoring system detects that TJP is turned on, it will delay for a certain period of time and enter the DMS system to alarm itself;	Automatically monitor the driver's status and implement corresponding countermeasures based on the monitoring results. 1) When HWP is activated and it is detected that the driver's status is severe fatigue or the distraction is long, the HWP control time will be shortened and the alarm will be entered in advance; 2) When it is detected that the driver's status is severe fatigue or distraction When the time is long, it will not be able to enter the HWP system availability standby state; 3) When the driver monitoring system detects that HWP is turned on, it will delay for a certain period of time and enter the DMS system to alarm itself;
Alarm function	When the system detects a certain risk of collision, it automatically classifies the risk and prompts the driver through different levels of alarms;	When the system detects a certain risk of collision, it automatically classifies the risk and prompts the driver through different levels of alarms;
Safe collision avoidance	The TJP system must avoid any collision accidents within the ODD range and avoid possible liability accidents of the vehicle, including avoiding collisions with vehicles in front, pedestrians, cyclists, general obstacles, etc.; the collision avoidance process includes collisions within a certain speed range. Slow down to stop and alert the driver.	The HWP system must avoid any collision accidents within the ODD range and avoid possible safety accidents in the vehicle, including front collisions with the vehicle in front and side collisions with the vehicles next to it; the collision avoidance process includes deceleration within a certain speed range (after deceleration) may exit to TJP function control) and alert the driver.

Note: 1) HWP is mainly used for high-speed automatic driving, and TJP is mainly used for medium and low-speed automatic driving. The two are mainly distinguished by speed in longitudinal control; 2) HWP is mainly used for automatic driving at high speeds. When TJP controls When the automatic driving speed increases outside its range due to the following reasons, TJP needs to switch to HWP automatic driving control;

Working conditions description:

• The vehicle follows the vehicle in front for TJP follow-up control. The vehicle's set speed (the vehicle speed is greater than the TJP operating speed) is greater than the vehicle speed in front. After the vehicle in front accelerates away, the vehicle accelerates to the set speed. During this process, the vehicle will directly switch from TJP to HWP performs automatic driving control;
• The vehicle follows the vehicle in front and performs TJP cruise control. The driver sets the vehicle speed to be greater than the TJP operating speed by pressing the button or stepping on the accelerator pedal. The vehicle accelerates to the set speed. During this process, TJP will be directly switched to HWP for automatic control. driving controls;

Working conditions description:

• This vehicle follows the vehicle in front and performs HWP cruise control. The driver sets the speed of the vehicle to be greater than the speed of the vehicle in front, and the vehicle in front decelerates and brakes. After the vehicle decelerates and brakes following the vehicle in front, its speed is less than the HWP operating speed range. This process It will directly switch from HWP to TJP for automatic driving control;
• The vehicle follows the vehicle in front and performs TJP cruise control. The driver sets the vehicle speed by pressing the button and decelerates to less than the HWP operating speed. The vehicle decelerates to the set speed. During this process, the vehicle will directly switch from HWP to TJP for automatic driving control;

Note that when the speed change caused by the driver stepping on the brake pedal will directly exit TJP and HWP, the entire automatic driving will exit; 3) For the lateral function, when performing corner or torque control, functional safety factors need to be taken into consideration The resulting corner or corner rate limit changes with speed. In some low-speed situations, the corner or corner speed will have a wider range than at high speed.

4) For the safe collision avoidance function, after the TJP system completes collision avoidance, if the deceleration process is urgent and the deceleration value exceeds the threshold condition for AEB triggering (generally AEB-P partial braking is -3.5m/s2, AEB -M full braking is -6 to -8m/s2), then TJP control pulls up the handbrake to keep the vehicle stationary after following the car and exits longitudinal control directly. If the deceleration value is less than the AEB threshold trigger condition, TJP follows the car After stopping, you can start following the car in front. 5) The safety collision avoidance function includes forward collision avoidance and lateral collision avoidance functions. Forward collision avoidance triggering should fully consider the AEB collision function triggering conditions, and lateral collision avoidance should fully consider the ELK emergency correction conditions. When the above two When the function is triggered, TJP will no longer send braking or steering instructions to the associated actuator (it can be considered to be in a temporary exit state at this time). After the above two safety functions are executed, TJP will re-intervene and perform driving control;

3. Driver overtaking:

The driver's overtaking here includes horizontal overtaking and longitudinal overtaking, and the principles are consistent with the original overtaking logic below L2 level.

Longitudinal overtaking: When the driver steps on the accelerator pedal, if the pedal opening reaches a certain threshold (usually 2%-5%), the vehicle is deemed to meet the requirement of longitudinal overtaking. At this time, the vehicle's longitudinal direction is completely controlled by the driver, and the vehicle's longitudinal direction is completely controlled by the driver. It will be accelerated to a certain speed (the speed is less than the system's maximum operating range of 130kph). When the driver releases the pedal and the pedal opening is less than a certain threshold, longitudinal control is exited and TJP/HWP resumes longitudinal system control.

Lateral overtaking: When the driver turns the steering wheel, if the steering wheel torque is greater than a certain threshold (usually 1.5-2Nm), the vehicle is considered to meet the lateral overtaking. At this time, the system is in a temporary exit state. When the driver loosens his grip within a certain period of time, After turning on the steering wheel, the system regains control of the entire vehicle. If the driver controls the steering wheel for a long time, the entire lateral control will be irreversibly withdrawn.

4. Functional Degradation Control:

System degradation is a type of predictable failure that often occurs during autonomous driving. In the early stages of system engineering design, the possible causes and consequences of various system failures or failures should be analyzed so that relevant logic can be activated after similar problems occur. Minimize driving risks. For example, after activation, if the TJP/HWP system detects that the vehicle is outside the ODD range, or the system has related failures, the two systems need to automatically

Continue to control the vehicle to the best of your ability to give the driver time to react and take over. If the driver does not respond or the takeover intention is not clear enough, the system needs to perform control upgrades, such as seat vibration or steering wheel vibration to prompt the driver to take immediate and strong takeover measures. For TJP and HWP, the degradation control strategies are different. For TJP, the functional working speed of the system is below 60kph. Therefore, when the TJP system is degraded, the safe parking logic can be activated to pull over the vehicle. , if the system is in the automatic driving control HWP in the high-speed section at this time, when the system is downgraded, the HWP controls the vehicle to decelerate, and tries its best to safely change lanes and then pull over. This lane-changing process can be achieved by accepting high-speed Precision map performs lane-level positioning on the emergency lane area, and controls the vehicle to change lanes to the emergency lane or dedicated parking lane.

3. Sensor architecture definition

The autonomous driving design process must require a rich set of sensors and a controller with sufficient capabilities. The sensors need to include millimeter-wave radar, lidar, angle radar, forward-looking cameras and surround-view cameras in the fused parking assistance system necessary for the star car owner system. , ultrasonic radar and other sensors. In addition, the vehicle-machine interaction unit also needs a high-precision positioning system (with inertial navigation), driver monitoring system, etc.

sensor sensor	quantity	Function Description	Detection range
front radar Front radar	1	Responsible for detecting the distance and speed of obstacles ahead, which requires different detection distances under two different beams (that is, when the horizontal opening angle range is different);	160-200m
front camera Front Camera	1	Detect the shape and type of obstacles ahead, and at the same time supplementary detection of information such as distance and speed of obstacles;	130-160m
angle radar Conner radar	4	Detect vehicle or obstacle information (including distance, speed, etc.) in adjacent lanes;	60-70m
surround camera Around View	4-6	Detect lane lines and obstacles at close range on both sides of the vehicle and output corresponding detection values;	10-30m
ultrasonic radar Ultrasonic Sensors	8-12	The detection of crossing obstacles when following a car at low speed is crucial for increasing the automatic start time of following and stopping; ultrasonic radar can also be used as a supplementary detection method for obstacles in the adjacent lane during driving;	5-8m
Driver Monitoring Camera DMS Surveillance Camera	1	Monitor driver status information and make real-time judgments on driver takeover capabilities;	1-1.5 m
Navigation positioning input GPS+IMU	1	By inputting the actual positioning information of the current vehicle and integrating it with lidar, the corresponding high-precision map positioning information of the vehicle is output, including what type of road the vehicle is on, which lane the vehicle is in, and the speed limit information in front of the vehicle, etc. ;	Real-time updates, 20cm accuracy
controller Controller	quantity	Function Description	Performance
main controller Domain Controller	1	The central unit responsible for the control of the automatic driving algorithm calculates the relevant information input by the sensor and uses a certain decision-making control algorithm to make decisions. Finally, it generates execution instructions and outputs them to the actuator for execution. The process requires real-time execution based on the execution status fed back by the actuator. Adjust output command status;	ASYLUM D
Safety redundant controller Redundancy Controller	1	When the main controller experiences dysfunction caused by various unknown reasons, a redundant controller is required to take over the control of the entire vehicle, alarm and brake the vehicle within a safe and reliable range;	ASIL C\D

4. System architecture definition

Since the autonomous driving system has realized the transition from human-controlled cars to system-controlled cars, that is, it has transformed from the original human-machine co-driving solution to a solution in which machine driving replaces humans. This change requires the system to have extremely high functions. The safety level, stability and reliability have very high requirements. Since the performance of the sensor is always subject to the constraints of its own hardware, it is impossible to truly and completely guarantee the accurate detection performance of the sensor without missing or false alarms. This may lead to erroneous control results due to erroneous input from the sensor during system control. . In addition, although controllers and actuators have higher functional safety than sensors, they cannot completely avoid system failure problems caused by their own failures. This requires that corresponding redundant control solutions be designed as much as possible in the architecture design of the autonomous driving system requirements. When a sensor or controller fails or its function is unavailable, the corresponding redundant control scheme is activated to implement the corresponding control logic to ensure the stable performance of truly autonomous driving.

5. System communication hardware design

从自动驾驶系统架构中不难看出，其中主要包含了几大部分：感知、决策、执行及显示控制中。其数据连接交互形式表示为如下几种形式：Hardwire、LVDS、Lin、CAN、CANFD、FLEXRAY、Ehternet几种，主要体现在通信方式及通信效率有所不同。对于自动驾驶系统而言，需要针对一些功能安全等级较高的控制器之间实现及时、高效且稳定可靠地通信链路，比如传感器与自动驾驶控制器之间，自动驾驶控制器与制动执行控制器之间均要求极高的功能安全策略，故必须采用性能最优的CAN通信策略，这里可以采用CANFD。

通信类型	通信效率	连接控制器	备注
HardWire	无	转化物理机械接触信号为电压或电流信号的部分：方向盘按键TJP/HWP Button；油门踏板Accel Pedal；制动踏板Brake Pedal；换挡器Gear Selection；震动座椅 Vibration seat（可选）；	自动驾驶功能设计中，诸如方向盘按键，座椅震动一类均采用的硬线连接技术，其原理是直接将与驾驶员接触的信号通过物理接触转化为电压或电流信息输入给系统控制器。
LVDS	155M	与视频接入有关的传感器控制器：影音娱乐系统HU；驾驶员监控系统DMS；抬头显示系统HUD；（可选）仪表显示系统IP；	低电压差分信号LVDS，是一种低功耗、低误码率、低串扰和低辐射的差分信号技术，其技术的核心是采用极低的电压摆幅高速差动传输数据，可以实现点对点或一点对多点的连接，其传输介质可以是铜质的PCB连线，也可以是平衡电缆。
Lin	20k	用于传输效率要求不高的控制器：车灯、雨刮、空调、方向盘等；	LIN总线是基于UART/SCI(通用异步收发器/串行接口)的低成本串行通讯协议。其目标定位于车身网络模块节点间的低端通信，主要用于智能传感器和执行器的串行通信，而这正是CAN总线的带宽和功能所不要求的部分。
CAN	5K-1M	功能安全需求较低的传感控制器：发动机管理系统EMS；变速器管理单元TCU；转角传感器SAS；安全气囊控制器SRS；座舱域控制器ICCU；车身控制单元BCM；车载通信基础终端TBOX；	CAN是目前主要的汽车局部网络通信协议，他具有实时性好、稳定性高、采取非破坏仲裁技术、信号位区分优先级等功能。与传统CAN通信协议相比，CAN FD主要的优势在于：• 更高的总线效率：5Mbps的最大数据传输速率，支持高达64字 节的有效负荷；• 兼容经典CAN：无需新的连接器或电缆，但需要更新的处理器，新处理器需要包含CAN FD控制器和相关的CAN FD收发器；• 受可用解决方案限制的转型：当前的多芯片解决方案需要更高的成本和板载空间。
CANFD	2M-5M	功能安全要求等级较高的传感控制器：自动驾驶主控制器TJP/HWP ECU；自动驾驶辅助控制器RedundantECU；雷达传感器Radar/Lidar；前视摄像头Camera；制动控制系统EPBi；转向控制系统EPS；
Ethernet	10M-100M	高精度地图HDMap；	车载以太网传输速率较高适用于诸如高精地图一类对传输实时性要求较高的场合。但其需要增加交换机，故成本也较高，在成本可接受的范s围内可以将以太网传输作为CAN线传输的备份

六、系统冗余设计

冗余设计包括如下几个部分：电源、定位、感知、控制器、执行器各个部分。

1）电源模块 — 每个关键的驱动系统都有两个独立的电源系统；

2）定位模块 — 两套独立的惯性测量系统；（可选）

3）感知模块— 激光雷达、毫米波雷达和视觉感知多传感器检测；（可选）

4）控制器模块 — 备用控制器一直后台运行，当主系统发生故障时，则备用控制器向车辆的执行系统发出控制指令，控制车辆安全停车；

5）执行器模块 — 制动系统和转向系统均采用冗余设计。

对于冗余设计而言，其功能安全要求较高的部分主要集中在中央控制及决策执行单元，故主要需要对中央控制单元及决策控制单元进行双冗余设计。

1、主控制器模块：

采用主控制器和辅助控制器两个进行双向控制，主控制器主要负责自动驾驶基础功能的计算与处理，包含对感知数据的后端处理，决策控制的模块处理，生成后端执行器能够执行的车辆数据（如纵向加减速度、转向角度等）。此外，主控制器还会接收来自各级传感器回传的车辆执行数据，分析其执行的程度，通过反馈回调将减小发送数据的误差。此外，由于自动驾驶系统功能需要考虑在系统失效时对系统当时的数据状态，以便在售后事故处理过程中进行原因分析，故主控制器还要实现数据记录相关工能。

2、辅助控制器模块：

当自动驾驶主控制器模块由于自身原因失效而无法继续控制整车时，需要启动辅助控制器模块接管进行车辆的安全控制，其设计逻辑是与主控制器实现直接的实时通信，在辅助控制器内部构建安全校验模块，当该模块校验的主控制器失效或通信中断时，启动辅助控制器开始进行安全控制，一般的安全控制策略包括如下：

1）继续接收高精地图及摄像头发出的道路环境信息，计算并发送一定的转角控制本车换道转向至车道最边缘；

2）继续接收前雷达和角雷达发出的障碍物信息，并控制车辆在最终道边以一定的减速度进行安全停车，停车后自动拉起电子手刹，打起双闪灯提示后车；

3）当检测到主控制器失效的同时，通过仪表发出相应的报警提示信息进行报警提示驾驶员立即接管车辆控制。

3、执行器模块：

对于执行器冗余控制来说主要是进行安全冗余控制，一般情况下加速控制对安全不产生积极控制影响，而安全控制主要集中在制动控制及转向控制逻辑中。故为了实现执行器的辅助安全控制，就需要进行制动及转向的双冗余控制。

1）制动控制单元制动控制的冗余控制包括通过主制动器对轮岗压力进行增压、保压、减压控制。该控制逻辑与传统辅助驾驶控制系统ADAS保持一致，差异表现在对该控制器的要求制动执行端的响应速度和性能比ADAS提升一个等级。对于辅助制动单元而言，当主制动控制单元失效时，启动辅助制动控制器进行强力制动，以博世的IBooster实现冗余制动控制为例，该控制器实现了与ESP结合，iBooster 和ESP均可通过机械推动力，帮助车辆在任何减速情况下停止行驶。通过电机工作，iBooster 能够实现主动建压，而无需驾驶员踩下制动踏板。

与典型的ESP系统相比，获得所需制动力的速度提高了三倍，并且可通过电子控制系统进行更加精确的调节。紧急情况下，iBooster 可在约120 毫秒内自动建立全制动压力。这不仅有助于缩短制动距离，还能在碰撞无法避免时降低撞击速度和对当事人的伤害风险。

2）转向控制单元一般的转向控制器EPS功能安全等级为ASILD级（诸多级别中故障最严重的级别），由此可看出其在失效率方面的严格要求。用于ADAS的基本思考针对目前的EPS，安全目标主要考虑两种故障模式被划分为ASIL-D级别，主要包括如下两种失效是自动驾驶无法接受的：

① 转向的失控：驾驶没有操控的情况下，车辆系统并没有给出自动转向等指示，可转向盘却会自动旋转；自动驾驶系统在发出转向角给执行器执行后，其执行器执行的转向角相对于发出的转向角出现严重超调而出现转向失控；

② 转向器的锁止：电机死锁可能由电气失效或机械失效导致。尤其在高速时，这种意外的扭矩会给司机，乘客和行人带来危险。这种危险可能源于电控单元ECU的故障，或电机及转向系统的机械故障。故转向冗余设计中，需要考虑确保电机不能锁死，保证司机能正常转向。由此，对转向系统设置双冗余是提升自动驾驶功能安全的保证因素，具体可参照如下图进行转向的双冗余设计。

4、双电源驱动系统

除了业内都在重点关注自动驾驶系统的自身硬件和软件算法是否满足相应的功能安全要求外，从车辆供电系统这个角度来分析，目前绝大多数传统车辆只有单主电源的供电系统，当这些车辆单路供电网络因故障无法提供电源时，整车电器负载包括自动驾驶系统就无法正常工作，而对此时正处于自动驾驶模式的车辆，就存在失去控制的风险。对比人工驾驶，自动驾驶在解放驾驶员手脚和眼睛的同时，也对车辆在自动驾驶下的安全性提出了更高的要求。比如在车辆驾驶安全和自动驾驶电器负载失去电源供电时，整个自动驾驶系统就无法正常运行，那车辆在自动驾驶模式下就存在安全隐患。为了提醒驾驶员立即接管驾驶并确保接管期间的驾驶安全，需要有备用电源对这些负载进行供电，确保车辆驾驶安全。典型的双冗余电源方案设计方案如下：