Interrupt handling methods for in-vehicle systems, vehicles, and computer-readable storage media

Abstract

This application provides an interrupt handling method for an in-vehicle system, a vehicle, and a computer-readable storage medium. The method involves obtaining the current interrupt frequency of the in-vehicle system; determining the risk level of the current interrupt frequency based on the current interrupt frequency and a preset interrupt frequency set; and controlling the in-vehicle system based on the risk level and the current interrupt frequency. Therefore, this application's in-vehicle system can accurately identify the risk level and execute flexible suppression and recovery strategies in advance before high-frequency interrupt triggering exhausts computing resources. This avoids vehicle function interruptions and remote diagnostic failures caused by traditional watchdog resets, ensuring the continuous, traceable, and zero-reset operation of the in-vehicle electronic control unit's safety-critical tasks.

Description

Technical Field

[0001] This application relates to the field of automotive electronic and electrical technology, and in particular to an interrupt handling method for an in-vehicle system, a vehicle, and a computer-readable storage medium. Background Technology

[0002] The new generation of automotive electronic and electrical architecture adopts a "functional domain centralization" design, which centrally deploys safety-critical applications such as power control, chassis braking, gateway communication, and advanced driver assistance systems on a single automotive-grade MCU (Microcontroller Unit) or heterogeneous SoC (System-on-Chips), and schedules them uniformly on the real-time operating system. Because interrupt priority is always higher than task priority, when external sensors, buses, or power devices malfunction, continuous high-frequency interrupt requests will monopolize the central processing unit's time, causing the operating system to be unable to obtain scheduling gaps, resulting in a "task starvation" type of apparent death.

[0003] Traditional interruption handling relies solely on watchdog timeout as a criterion and forces a complete system reset. If the root cause persists, repeated restarts occur, blocking cloud diagnostics and data feedback. Furthermore, in highly coupled vehicle topologies, this can induce chain-like safety check failures, causing temporary malfunctions across the entire domain. Additionally, reset records only retain the result status, lacking quantitative descriptions of the interruption source, frequency, and duration, which cannot support subsequent traceability and optimization, creating a dual gap in functional safety and after-sales maintenance. Summary of the Invention

[0004] This application provides an interrupt handling method for an in-vehicle system, a vehicle, and a computer-readable storage medium, aiming to improve the problems of vehicle function interruption and remote diagnostic failure caused by traditional watchdog resets. Before the in-vehicle system exhausts its computing resources due to high-frequency interruption triggers, it can accurately identify the risk level and execute flexible suppression and recovery strategies in advance, ensuring that the safety-critical tasks of the in-vehicle electronic control unit can be continuously scheduled, traceable, and operate with zero reset.

[0005] To achieve the above objectives, the first aspect of this application proposes an interruption handling method for an in-vehicle system, comprising: obtaining the current interruption frequency of the in-vehicle system; determining the risk level of the current interruption frequency based on the current interruption frequency and a preset interruption frequency set; and controlling the in-vehicle system based on the risk level and the current interruption frequency.

[0006] According to the interrupt handling method of the vehicle system in the embodiments of this application, the vehicle system can accurately identify the risk level and execute flexible suppression and recovery strategies in advance before the high-frequency triggering of interruption abnormalities has exhausted the computing resources, so as to ensure that the safety-critical tasks of the vehicle electronic control unit can be continuously scheduled, traceable and zero-reset operation.

[0007] A second aspect of this application provides a vehicle comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the aforementioned interrupt handling method for an in-vehicle system.

[0008] According to the vehicle embodiment of this application, when the processor executes the computer program, the above-mentioned interrupt handling method of the vehicle system can be implemented. Based on the above-mentioned interrupt handling method of the vehicle system, the vehicle system can accurately identify the risk level and execute flexible suppression and recovery strategies in advance before the high-frequency triggering of interruption abnormalities exhausts the computing resources, so as to ensure that the safety-critical tasks of the vehicle electronic control unit can be continuously scheduled, traceable and zero-reset operation.

[0009] A third aspect of this application provides a computer-readable storage medium having a computer program stored thereon, which is executed by a processor to implement the aforementioned interrupt handling method for an in-vehicle system.

[0010] According to the embodiments of this application, a computer-readable storage medium storing a computer program thereon implements the above-mentioned interrupt handling method for the vehicle system when executed by a processor. Based on the above-mentioned interrupt handling method for the vehicle system, the vehicle system can accurately identify the risk level and execute flexible suppression and recovery strategies in advance before the high-frequency triggering of interruption abnormalities exhausts computing resources, thereby ensuring that the safety-critical tasks of the vehicle electronic control unit can be continuously scheduled, traceable, and operate with zero reset. Attached Figure Description

[0011] Figure 1 This is a flowchart of an interrupt handling method for an in-vehicle system according to some embodiments of this application;

[0012] Figure 2 A flowchart illustrating an interrupt handling method for an in-vehicle system according to a specific embodiment of this application; Figure 3 This is a block diagram of a vehicle according to some embodiments of this application. Detailed Implementation

[0013] To make the technical problems, technical solutions, and beneficial effects solved by this application clearer, the following detailed description is provided in conjunction with embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0014] This application provides an embodiment of an interruption handling method for an in-vehicle system, including: S1, obtain the current interrupt frequency of the vehicle system.

[0015] Among them, the vehicle-mounted system refers to the embedded real-time computing platform deployed within the automotive-grade electronic control unit, undertaking safety-related functions such as vehicle power, chassis, gateway, or domain control. The interruption frequency at the current moment can be defined as the ratio of the sum of the actual trigger counts of all enabled interrupt sources within the latest fixed sampling period to that period, characterizing the instantaneous interrupt load intensity and used to quantitatively evaluate the system's real-time response capability.

[0016] For example, the frequency of interruptions occurring in the vehicle system at any given time can be statistically determined within a fixed period.

[0017] S2, determine the risk level of the interruption frequency at the current moment based on the interruption frequency at the current moment and the preset interruption frequency set.

[0018] The preset interrupt frequency set refers to the set of interrupt frequency thresholds established before system delivery through bench stress testing, service limit analysis, and chip specification derivation. It serves as a quantitative benchmark for grading interrupt loads. The specific preset interrupt frequency set can be set by technical personnel according to actual conditions; no restrictions are imposed here.

[0019] Risk level refers to the system operation risk category classified by comparing the frequency of interruptions at the current moment with the preset set of interruption frequencies. It is used to trigger the corresponding interruption management strategy to ensure that basic tasks are continuously schedulable.

[0020] Specifically, the current interruption frequency is compared with a preset set of interruption frequencies to determine the risk level of the current interruption frequency.

[0021] S3 controls the vehicle system based on the risk level and the frequency of interruptions at the current moment.

[0022] Specifically, based on the obtained risk level and the frequency of interruption at the current moment, differentiated interruption management and remote information delivery are performed on the vehicle system to achieve graded suppression, orderly recovery and continuous overload protection without resetting.

[0023] First, the frequency of interruptions occurring in the vehicle system is precisely sampled at fixed intervals to obtain the current frequency. Then, it is compared with a preset set of interruption frequencies to determine the risk level. Finally, differentiated interruption suppression, remote reporting, and orderly recovery are implemented according to the risk level. In this way, the vehicle system can accurately identify the risk level and execute flexible suppression and recovery strategies in advance before the high-frequency triggering of interruptions exhausts computing resources. This avoids the vehicle function interruption and remote diagnostic failure caused by traditional watchdog resets, ensuring that the safety-critical tasks of the vehicle electronic control unit can be continuously scheduled, traceable, and operate with zero reset.

[0024] In some embodiments of this application, obtaining the current interruption frequency of the vehicle system includes: obtaining the current time of the vehicle system; in response to the current time being greater than a preset detection period, obtaining the timestamp of the last time the vehicle system obtained the interruption trigger frequency; calculating a first difference between the current time and the timestamp of the last time the interruption trigger frequency was obtained; and in response to the first difference being greater than a first preset interruption frequency acquisition period, obtaining the current interruption frequency based on the first difference.

[0025] Wherein, the current time refers to the latest absolute timestamp reached by the onboard system since it resumed operation after the last sampling (denoted as ). ).

[0026] The preset detection period refers to a fixed time interval set in advance, used to periodically trigger the interrupt frequency sampling logic. The interrupt trigger frequency calculation and recording are only allowed once when the system time accumulates to this period. It should be noted that the specific preset detection period can be set by technical personnel according to actual needs; no restrictions are imposed here.

[0027] The timestamp of the last interrupt trigger frequency acquisition refers to the system absolute time stamp (denoted as ) when the interrupt frequency sampling and recording were successfully completed last time. This is used as the starting point of the current sampling window to accurately calculate the time difference between two samples.

[0028] The first difference refers to the difference between the current time and the timestamp of the last time the interrupt trigger frequency was obtained, which is the actual duration of the current sampling window and is used to quantify the number of interrupt triggers per unit time.

[0029] The first preset interrupt frequency acquisition period refers to the minimum effective sampling window length preset by the system. The specific first preset interrupt frequency acquisition period can be set by technical personnel according to actual conditions, and there is no restriction here.

[0030] In response to the first difference being greater than the first preset interrupt frequency acquisition period, the interrupt occurrence frequency at the current moment is obtained based on the first difference.

[0031] As a specific embodiment of this example, firstly, the interrupt trigger count is executed in each interrupt handling callback function. The increment count is 1. Indicates the first k The interrupt count of each interrupt (of which) k =1, ..., n in n This indicates that the vehicle system is equipped with a total of n(One interrupt). Then, the count value of the on-board electronic controller hardware timer or the operating system kernel clock source at the sampling point is read, and the absolute timestamp in microseconds is obtained after clock frequency conversion, which is the current time. Then, the timestamp of the current time and the last time the interrupt trigger frequency was obtained are calculated. The difference is the first difference. If the current time is greater than the preset detection period, then the current time is recorded. , m Indicates the first m At any given time, if the first difference is greater than the first preset interrupt frequency acquisition period, then the interrupt occurrence frequency at the current time is calculated. The calculation method can be expressed as:

[0032]

[0033] in, Indicates the first m The total number of system interrupt triggers within a sampling period is equal to the trigger count of all interrupt channels in the current period. The sum after accumulation. Indicates the first m Total number of system interrupts triggered within each sampling window With window length The ratio of the two values, i.e., the average interrupt frequency of the window, is expressed in Hz.

[0034] By acquiring the current moment, the vehicle system captures all interrupt events within a window with high precision and calculates the interrupt frequency at the current moment using the window length. This allows for precise comparison with the real-time frequency during actual vehicle operation. Risk assessment and subsequent mitigation can be completed before the interrupt load triggers a watchdog reset, ensuring the vehicle's electronic controllers continuously maintain basic task scheduling, remote diagnostic links, and functional safety status, thus preventing infinite resets or functional loss.

[0035] In some embodiments of this application, the preset interrupt frequency set includes a first interrupt frequency, a second interrupt frequency, and a third interrupt frequency. The preset interrupt frequency set is generated in the following manner: stress testing the vehicle system based on a preset stress testing strategy, and using the maximum interrupt trigger frequency in the stress test as the first interrupt frequency; obtaining the service requirement information of the vehicle system, and performing theoretical analysis on the service requirement information based on the preset interrupt frequency analysis theory to obtain the theoretical interrupt frequency of the vehicle system's service analysis, and using the theoretical interrupt frequency of the service analysis as the second interrupt frequency; obtaining the hardware information of the vehicle system, and determining the theoretical interrupt frequency of the vehicle system's hardware analysis based on the hardware information, and using the theoretical interrupt frequency of the hardware analysis as the third interrupt frequency.

[0036] Specifically, the preset interrupt frequency set includes a first interrupt frequency, a second interrupt frequency, and a third interrupt frequency.

[0037] The vehicle system is subjected to stress testing based on a preset stress testing strategy, and the maximum value of the interrupt trigger frequency during the stress test is taken as the first interrupt frequency.

[0038] Among them, the vehicle system is subjected to stress test based on the preset stress test strategy, and the maximum value of the interrupt trigger frequency in the stress test is taken as the first interrupt frequency, that is, the stress test interrupt frequency.

[0039] A preset stress test strategy refers to a pre-defined stress test strategy used to define the limit of interruption load that the electronic control platform can withstand. It should be noted that the specific preset stress test strategy can be set by technical personnel according to actual conditions, and no restrictions are imposed here. For example, the unit under test can be continuously tested in a test bench simulating a complete vehicle environment. The interruption trigger frequency during the test is recorded according to the set interruption occurrence frequency detection cycle, and the maximum value of the interruption trigger frequency during the stress test is taken as the first interruption frequency, i.e., the stress test interruption frequency.

[0040] The system acquires the business requirement information of the vehicle system and performs theoretical analysis on the business requirement information based on the preset interruption frequency analysis theory to obtain the theoretical interruption frequency of the vehicle system's business analysis, and uses the theoretical interruption frequency of the business analysis as the second interruption frequency.

[0041] Specifically, in a real system, each interrupt has its corresponding service. Based on the preset interrupt frequency analysis theory, the theoretical frequency at which the interrupt is triggered is calculated based on the service requirement information of the vehicle system.

[0042] Among them, the business requirements information of the vehicle system refers to the communication matrix, functional timing and performance indicators defined for each electronic control unit at the vehicle level, including but not limited to bus type, message period, data length, load rate limit, functional safety level and end-to-end latency requirements, which are used to quantify the maximum data throughput and worst response time limit that each interruption source must bear.

[0043] The preset interruption frequency analysis theory refers to a systematic calculation method that, based on vehicle communication protocols, functional specifications, and safety standards, transforms business requirements into the number of interruptions caused by data transmission and reception or event triggering per unit time. It is typically derived by substituting parameters such as load rate, frame length, baud rate, and event probability into a standard formula. The specific settings of the preset interruption frequency analysis theory can be configured by technical personnel according to actual conditions; no restrictions are imposed here.

[0044] The service analysis theory interruption frequency of the vehicle system refers to the interruption trigger frequency that is allowed to occur in a certain interruption channel or the entire system under all functional and performance boundary conditions, calculated by the above-mentioned preset interruption frequency analysis theory. It is used as the second interruption frequency for risk classification.

[0045] For example, according to ISO (International Organization for Standardization) 11898-2 standard, the load rate of the vehicle Ethernet bus should be controlled below 40%, and not exceed 60% in extreme scenarios.

[0046] The calculation assumes a load factor of 60% and an Ethernet frame length of 1500 bytes. Therefore, the theoretical interruption frequency calculation method for a 1Gbps bandwidth Ethernet channel service analysis can be expressed as: .

[0047] Similar to Ethernet interrupts, the frequency of each interrupt is calculated based on the extreme scenario values ​​required by the standard design. .

[0048] All n The theoretical interruption frequency (i.e., the second interruption frequency) can be obtained by summing the extreme theoretical values ​​of each channel. The calculation method is expressed as follows:

[0049] This refers to the maximum interruption trigger rate that an onboard system must be able to withstand under the extreme operating conditions allowed by the standard, and is used as a higher-order threshold for subsequent risk classification.

[0050] The hardware information of the vehicle system is obtained, and the hardware analysis theoretical interrupt frequency of the vehicle system is determined based on the hardware information, and the hardware analysis theoretical interrupt frequency is used as the third interrupt frequency.

[0051] For example, the S32G399 chip (a multi-core heterogeneous microprocessor) is used as an example (the chip's M-core clock speed is configured to 300MHz). According to the chip's datasheet, the maximum interrupt latency is 14 clock cycles. The context switch for an RTOS (Real-Time Operating System) to respond to an interrupt takes approximately 80 clock cycles. Therefore, obtaining an interrupt response consumes at least approximately 100 clock cycles. Thus, the theoretical interrupt frequency (i.e., the third interrupt frequency) for this hardware (chip) is 300 MHz ÷ 100 = 3 MHz.

[0052] This application generates a first interrupt frequency based on bench stress test peak values, a second interrupt frequency based on extreme business scenarios allowed by vehicle communication and functional standards, and a third interrupt frequency based on the chip's main frequency and minimum clock overhead to derive the hardware's maximum response rate. These three frequencies constitute a preset interrupt frequency set for comparison with real-time interrupt frequencies during operation. Thus, the vehicle system can compare instantaneous interrupt loads with three-dimensional frequency thresholds in multiple operating scenarios, proactively identifying potential storms exceeding the platform's capacity. Before triggering watchdog resets or functional failures, it initiates graded suppression and recovery strategies, ensuring the continuous schedulability of safety-critical tasks for the vehicle system's electronic controllers, transparent remote diagnostic links, and zero-interruption of vehicle functions.

[0053] In some embodiments of this application, the risk level is a first risk level, a second risk level, a third risk level, or a fourth risk level. Determining the risk level of the interruption frequency at the current moment based on the current interruption frequency and a preset interruption frequency set includes: if the current interruption frequency is less than a first interruption frequency, then the risk level of the current interruption frequency is determined to be a first risk level; if the current interruption frequency is greater than or equal to the first interruption frequency, and the current interruption frequency is less than a preset multiple of the first interruption frequency, then the risk level of the current interruption frequency is determined to be a second risk level; if the current interruption frequency is greater than or equal to a preset multiple of the first interruption frequency, and the current interruption frequency is less than the second interruption frequency, then the risk level of the current interruption frequency is determined to be a third risk level; if the current interruption frequency is greater than or equal to the second interruption frequency, and the current interruption frequency is less than the third interruption frequency, then the risk level of the current interruption frequency is determined to be a fourth risk level.

[0054] Specifically, the risk levels are classified as Level 1, Level 2, Level 3, or Level 4.

[0055] If the frequency of interruption at the current moment is less than the first interruption frequency, it is determined that the system interruption load has not yet reached the limit peak value of bench verification and is within the safety margin. Therefore, the risk level is set as the first risk level, i.e., no risk.

[0056] If the frequency of interruption at the current moment is within the first interruption frequency range that is greater than or equal to the first interruption frequency and less than a preset multiple, it is determined that the system interruption load is close to the peak value of bench verification but still lower than the upper limit of the design margin. Therefore, the risk level is set as the second risk level, i.e., low risk.

[0057] If the frequency of interruption at the current moment is within the first interruption frequency range that is greater than or equal to a preset multiple and less than the second interruption frequency range, it is determined that the interruption load has exceeded the load testing margin and is close to the theoretical limit of the business. Therefore, the risk level is set as the third risk level, i.e., medium risk.

[0058] If the current interruption frequency is greater than or equal to the second interruption frequency and less than the third interruption frequency, it is determined that the interruption load has exceeded the theoretical limit of the business and is approaching the physical response ceiling of the hardware. Therefore, the risk level is set as the fourth risk level, i.e., high risk.

[0059] The preset multiplier refers to the amplification factor assigned to the frequency threshold during vehicle system calibration. It is used to divide the risk range into finer-grained intervals between no risk and high risk. For example, the preset multiplier can be 1.2. The specific value can be set and fixed by technicians after bench or road testing, without any hard limit.

[0060] When the real-time interrupt frequency is lower than the first interrupt frequency, the system is in a risk-free zone, and all functions operate at their rated cycle time. Entering the range from the first to a preset multiple is classified as low-risk. Exceeding this multiple but not reaching the second interrupt frequency escalates to medium-risk. Once the second interrupt frequency is reached but still lower than the third interrupt frequency, it is classified as high-risk. Based on the risk level, corresponding controls are implemented. The onboard system can release computing resources without resetting, prioritizing safety functions such as braking and steering. Remote upgrade and diagnostic links remain continuously available, ensuring continuous functionality, data integrity, and after-sales traceability throughout the entire process.

[0061] In some embodiments of this application, when the risk level is the first risk level, the vehicle system is controlled according to the risk level and the frequency of interruption at the current time, including: in response to the existence of a disabled interrupt in the vehicle system, determining the target interrupt with the lowest interruption frequency, and performing an operation to enable the target interrupt.

[0062] Among them, the target interrupt refers to the interrupt with the lowest frequency determined according to the historical trigger frequency sorting of the interrupt channels that have been closed. It is used to perform the enable operation first, so as to ensure that the system function gradually returns to the full state with the lowest load increment.

[0063] Specifically, when the risk level is Level 1, the vehicle system checks for any interrupts that have been disabled. If any exist, the system sorts them by their historical trigger frequency recorded when they were disabled, from lowest to highest, and selects the interrupt with the lowest frequency as the target interrupt each time, and then enables it. Only one interrupt is enabled per detection cycle, after which the next round of detection begins.

[0064] By using a progressive recovery mechanism that minimizes the target interrupt frequency, the vehicle system gradually re-enables interrupts within the risk-free domain with minimal additional load, avoiding instantaneous frequency rebound caused by enabling all interrupts at once, ensuring that the interrupt load is lower than the first interrupt frequency, maintaining continuous vehicle function and stable task cycles, and providing a reliable blank baseline for subsequent risk assessment.

[0065] In some embodiments of this application, when the risk level is the second risk level, the vehicle system is controlled according to the risk level and the interruption frequency at the current time, including: extracting the interruption frequencies that meet the preset interruption count condition from the interruption frequencies at the current time to obtain a target interruption frequency set; in response to an update of the basic task count, sending the target interruption frequency set to the corresponding server; in response to no update of the basic task count, disabling the interrupt with the highest interruption frequency at the current time, setting the recovery time corresponding to the interrupt with the highest interruption frequency as the first recovery time, and recording the relevant information of the interrupt with the highest interruption frequency; in response to the existence of a disabled interrupt in the vehicle system, determining the target interrupt with the lowest interruption frequency among the interrupts, and performing an operation to enable the target interrupt.

[0066] The preset interrupt count condition is a pre-defined condition used to filter abnormally high-load interrupts. For example, the preset interrupt count condition can be set to the interrupt count values ​​corresponding to the top three channels in terms of interrupt trigger count within the current sampling period, such as... , , It should be noted that the specific number of preset interruptions can be set by technical personnel according to the actual situation, and there are no restrictions here.

[0067] The target interrupt frequency set refers to a set of interrupts that meet the preset interruption count conditions, along with their corresponding trigger counts, channel numbers, and interrupt occurrence frequencies at the current time. This set is used to provide the server with detailed information on abnormally high-load interrupts, enabling remote diagnosis and subsequent root cause analysis.

[0068] Furthermore, in response to an update in the basic task count, the target interrupt frequency set is sent to the corresponding server.

[0069] The basic task count is used to characterize whether the system's basic scheduling is still running normally. When the basic task count changes compared to the last sample, it is determined that there has been an update, indicating that the main loop has not been starved due to the interrupt storm. Only then is there a safe window to send the target interrupt frequency set to the server.

[0070] In response to the fact that the basic task count has not been updated, the interrupt with the highest interrupt frequency at the current time is disabled, the recovery time corresponding to the interrupt with the highest interrupt frequency is set as the first recovery time, and the relevant information of the interrupt with the highest interrupt frequency is recorded.

[0071] The first recovery time refers to the initial silence duration set for the disabled interrupt within the second risk level. For example, the first recovery time is 100 ms. The vehicle system is only allowed to attempt to re-enable the corresponding channel after the first recovery time has expired.

[0072] It should be noted that if, in the next detection cycle, the interrupt with the highest frequency still meets the preset interrupt count condition, the first recovery time can be set to twice the original value, and then increased progressively in powers of 2. For example... ms, where To detect the number of cycles, in order to extend the quiet period and further suppress sustained high load.

[0073] It also records information such as the number of times the interrupt with the highest interrupt frequency is triggered, the channel number, and the interrupt frequency at the current moment.

[0074] If the vehicle system detects a disabled interrupt, it sorts the interrupts by their historical trigger frequencies from lowest to highest, based on the frequency recorded when they were disabled. Each time, the interrupt with the lowest frequency is selected as the target interrupt and enabled. Only one interrupt is enabled per detection cycle before proceeding to the next detection round.

[0075] In the second risk level range, the vehicle system first encapsulates high-load interrupt information that meets the preset interruption count conditions into a target interrupt frequency set. This set is sent to the server as soon as the basic task count is updated, ensuring the cloud receives the abnormal snapshot the instant the scheduling survives. If the count stagnates, the highest frequency interrupt channel is immediately shut down, and a first recovery time is set as the initial quiet period. If the channel remains high in the next round, its quiet period increases exponentially by a power of 2, continuously lengthening the suppression time, while its trigger count, channel number, and frequency are recorded in the log. Subsequently, each cycle only restores one historically lowest frequency interrupt that has been shut down, gradually releasing resources with the lowest load increment. Thus, high-load interrupts are suppressed in segments before reaching the theoretical business boundary, reducing the computational load and allowing the main loop to regain execution gaps. Abnormal snapshots are continuously sent to the backend during these gaps, preventing vehicle restarts. Critical services such as drive, braking, and networking remain online throughout, providing complete and traceable data records for subsequent diagnostics and remote upgrades.

[0076] In some embodiments of this application, when the risk level is the third risk level, the vehicle system is controlled according to the risk level and the interruption frequency at the current time, including: extracting the interruption frequencies that meet the preset interruption count condition from the interruption frequencies at the current time to obtain a target interruption frequency set; in response to an update of the basic task count, sending the target interruption frequency set to the corresponding server; in response to no update of the basic task count, disabling the interrupt with the highest interruption frequency at the current time, setting the recovery time corresponding to the interrupt with the highest interruption frequency as the second recovery time, and recording the relevant information of the interrupt with the highest interruption frequency; in response to the existence of a disabled interrupt in the vehicle system, determining the target interrupt with the lowest interruption frequency among the interrupts, and performing an operation to enable the target interrupt.

[0077] Specifically, when the basic task count changes relative to the last sample, it is determined that there has been an update, indicating that the main loop has not starved due to the interrupt storm. Only then is there a safe window to send the target interrupt frequency set to the server.

[0078] In response to the fact that the basic task count has not been updated, the interrupt with the highest interrupt frequency at the current time is disabled, the recovery time corresponding to the interrupt with the highest interrupt frequency is set as the second recovery time, and the relevant information of the interrupt with the highest interrupt frequency is recorded.

[0079] The second recovery time refers to the initial silence duration set for the disabled interrupt within the third risk level. For example, the second recovery time is 500 ms. The vehicle system is only allowed to attempt to re-enable the corresponding channel after the second recovery time has expired.

[0080] It should be noted that if, in the next detection cycle, the interrupt with the highest frequency still meets the preset interrupt count condition, the second recovery time can be set to twice the original value, and then increased progressively in powers of 2. For example... ms, where To detect the number of cycles, in order to extend the quiet period and further suppress sustained high load.

[0081] It also records information such as the number of times the interrupt with the highest interrupt frequency is triggered, the channel number, and the interrupt frequency at the current moment.

[0082] If the vehicle system detects a disabled interrupt, it sorts the interrupts by their historical trigger frequencies from lowest to highest, based on the frequency recorded when they were disabled. Each time, the interrupt with the lowest frequency is selected as the target interrupt and enabled. Only one interrupt is enabled per detection cycle before proceeding to the next detection round.

[0083] In the third risk level range, the vehicle system first encapsulates abnormal interrupts that meet the preset interruption count conditions into a target interrupt frequency set. Once the basic task count is updated, it is immediately uploaded to the cloud to ensure the background captures a critical snapshot before scheduling fails. If the count remains static, the highest-frequency interrupt channel is immediately shut down, and a second recovery time is given as an initial quiet period. If this channel remains among the top three most heavily loaded channels in the next cycle, the quiet period increases exponentially by double, continuously extending the suppression length, while the trigger count, channel number, and real-time frequency are written to the local log. Subsequently, the system only re-enables one historically lowest-frequency interrupt that has been shut down each cycle, ensuring minimal load recovery. Thus, interrupt surges are gradually weakened before approaching the theoretical limits of the hardware, processor utilization decreases accordingly, and the main loop resumes its rhythm. Abnormal data is continuously uploaded to the cloud during available gaps, allowing the vehicle to maintain online operation of power, braking, and gateway services without restarting, and providing a complete and traceable on-site record for subsequent root cause analysis and over-the-air upgrades.

[0084] In some embodiments of this application, when the risk level is the fourth risk level, the vehicle system is controlled according to the risk level and the interruption frequency at the current time, including: in response to the basic task count not being updated, disabling the interrupt with the highest interruption frequency at the current time; extracting the interruption frequencies that meet the preset interruption count condition at the current time to obtain a target interruption frequency set; in response to the basic task count being updated, sending the target interruption frequency set to the corresponding server; in response to the basic task count not being updated, disabling the interrupt with the highest interruption frequency at the current time, setting the recovery time corresponding to the interrupt with the highest interruption frequency as the third recovery time, and recording the relevant information of the interrupt with the highest interruption frequency; in response to the presence of a disabled interrupt in the vehicle system, determining the target interrupt with the lowest interruption frequency among the interrupts, and performing an operation to enable the target interrupt.

[0085] Specifically, if the basic task count has not changed relative to the last sample, it is determined that there has been no update, and the interrupt with the highest interrupt frequency at the current time is disabled.

[0086] When the basic task count changes relative to the last sample, it is determined that there has been an update, indicating that the main loop has not starved due to the interrupt storm. Only then is there a safe window to send the target interrupt frequency set to the server.

[0087] In response to the fact that the basic task count has not been updated, the interrupt with the highest interrupt frequency at the current time is disabled, the recovery time corresponding to the interrupt with the highest interrupt frequency is set as the third recovery time, and the relevant information of the interrupt with the highest interrupt frequency is recorded.

[0088] The third recovery time refers to the initial silence duration set for the disabled interrupt within the third risk level. For example, the third recovery time is 2000 ms. The vehicle system is only allowed to attempt to re-enable the corresponding channel after the third recovery time has expired.

[0089] It should be noted that if, in the next detection cycle, the interrupt with the highest frequency still meets the preset interrupt count condition, the third recovery time can be set to twice the original value, and then increased progressively in powers of 2. For example... ms, where To detect the number of cycles, in order to extend the quiet period and further suppress sustained high load.

[0090] It also records information such as the number of times the interrupt with the highest interrupt frequency is triggered, the channel number, and the interrupt frequency at the current moment.

[0091] If the vehicle system detects a disabled interrupt, it sorts the interrupts by their historical trigger frequencies from lowest to highest, based on the frequency recorded when they were disabled. Each time, the interrupt with the lowest frequency is selected as the target interrupt and enabled. Only one interrupt is enabled per detection cycle before proceeding to the next detection round.

[0092] In the fourth risk level range, once the system detects that the basic task count has stopped updating, it immediately and permanently shuts down the interrupt channel with the highest trigger frequency, and assigns the third recovery time as the initial silence period. If the channel remains high in subsequent cycles, the silence time increases exponentially by powers of 2 until the load drops, while the trigger count, channel number, and frequency are written to the log. Only one historically lowest-frequency disabled interrupt is restored each cycle, minimizing the load rebound. Thus, the interrupt storm is suppressed by the longest silence window before approaching the hardware limit, the processor immediately frees up resources, and the main loop regains execution intervals; abnormal snapshots are uploaded to the cloud in real time using available scheduling windows, allowing the vehicle to maintain online critical functions such as power, braking, and gateway without resetting, and providing a complete and traceable on-site record for subsequent diagnostics and over-the-air upgrades.

[0093] It should be noted that the durations of the first recovery time, the second recovery time, and the third recovery time increase sequentially. That is, the first recovery time is less than the second recovery time, which is less than the third recovery time.

[0094] As a specific embodiment of this application, refer to Figure 2 The interruption handling method of the vehicle system in this application may include: S201, determine whether the current time is greater than the preset detection period. If yes, proceed to S202; otherwise, proceed to S208.

[0095] S202, Obtain the interruption frequency at the current time, denoted as... F j .

[0096] S203, Determine the current interrupt frequency. F j Is it greater than the first interrupt frequency? F st If yes, then execute S209; otherwise, execute S204.

[0097] S204, Determine the current interrupt occurrence frequency. F j Is it greater than the first interrupt frequency? F st And less than 1.2 times the first interrupt frequency F st If yes, then execute S210; otherwise, execute S205.

[0098] S205, Determine the current interrupt occurrence frequency.F j Is it greater than 1.2 times the first interrupt frequency? F st And less than the second interrupt frequency F bt If yes, then execute S211; otherwise, execute S206.

[0099] S206, Determine the current interrupt occurrence frequency. F Is it greater than the second interrupt frequency? F bt And less than the second interrupt frequency. F ht If so, then execute S207.

[0100] S207, implement the fourth risk level control strategy.

[0101] S208, This detection and processing is complete. Set the interrupt trigger count to 0.

[0102] S209, Implement the first-level risk control strategy.

[0103] S210, implement the second risk level control strategy.

[0104] S211, implement the third-level risk control strategy.

[0105] This application also provides a vehicle, as shown in the embodiments. Figure 3 The vehicle 300 includes: a memory 310, a processor 320, and a computer program stored in the memory 310 and executable on the processor 320. The processor 320 executes the program to implement the aforementioned interrupt handling method of the vehicle system.

[0106] This application also proposes a computer-readable storage medium storing a computer program that is executed by a processor to implement the aforementioned interrupt handling method for an in-vehicle system.

[0107] In this application, "multiple" refers to two or more.

[0108] In this application, unless otherwise expressly defined, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection between two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0109] The terms “first,” “second,” “third,” “fourth,” etc., in this application (if present) are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0110] In this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, in this application, the character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0111] Unless otherwise specified, all steps in this application may be performed sequentially or randomly. For example, if the method includes steps A and B, it means that the method may include steps A and B performed sequentially, or it may include steps B and A performed sequentially. For example, if the method may also include step C, it means that step C may be added to the method in any order. For example, the method may include steps A, B, and C, or it may include steps A, C, and B, or it may include steps C, A, and B, etc.

[0112] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. An interrupt processing method of an in-vehicle system, characterized by, The method comprises: acquiring a current-time interruption occurrence frequency of the vehicle-mounted system; determining a risk level of the current-time interruption occurrence frequency according to the current-time interruption occurrence frequency and a preset interruption frequency set; controlling the vehicle-mounted system according to the risk level and the current-time interruption occurrence frequency.

2. The method of claim 1, wherein The acquiring of the current-time interruption occurrence frequency of the vehicle-mounted system comprises: acquiring a current time of the vehicle-mounted system; in response to the current time being greater than a preset detection period, acquiring a time stamp of a last-acquired interruption trigger frequency of the vehicle-mounted system; calculating a first difference between the current time and the time stamp of the last-acquired interruption trigger frequency; in response to the first difference being greater than a first preset interruption frequency collection period, acquiring the current-time interruption occurrence frequency according to the first difference.

3. The method of claim 1, wherein The preset interruption frequency set comprises a first interruption frequency, a second interruption frequency and a third interruption frequency, wherein the preset interruption frequency set is generated in the following manner: performing a stress test on the vehicle-mounted system based on a preset stress test strategy, and taking a maximum interruption trigger frequency in the stress test as the first interruption frequency; acquiring business requirement information of the vehicle-mounted system, and performing theoretical analysis on the business requirement information based on a preset interruption frequency analysis theory to obtain a business analysis theoretical interruption frequency of the vehicle-mounted system, and taking the business analysis theoretical interruption frequency as the second interruption frequency; acquiring hardware information of the vehicle-mounted system, and determining a hardware analysis theoretical interruption frequency of the vehicle-mounted system based on the hardware information, and taking the hardware analysis theoretical interruption frequency as the third interruption frequency.

4. The method of claim 3, wherein The risk level is a first risk level, a second risk level, a third risk level or a fourth risk level, wherein the determining of the risk level of the current-time interruption occurrence frequency according to the current-time interruption occurrence frequency and the preset interruption frequency set comprises: if the current-time interruption occurrence frequency is less than the first interruption frequency, determining the risk level of the current-time interruption occurrence frequency as the first risk level; if the current-time interruption occurrence frequency is greater than or equal to the first interruption frequency and less than a preset multiple of the first interruption frequency, determining the risk level of the current-time interruption occurrence frequency as the second risk level; if the current-time interruption occurrence frequency is greater than or equal to the preset multiple of the first interruption frequency and less than the second interruption frequency, determining the risk level of the current-time interruption occurrence frequency as the third risk level; if the current-time interruption occurrence frequency is greater than or equal to the second interruption frequency and less than the third interruption frequency, determining the risk level of the current-time interruption occurrence frequency as the fourth risk level.

5. The method of claim 4, wherein When the risk level is the first risk level, the controlling of the vehicle-mounted system according to the risk level and the current-time interruption occurrence frequency comprises: In response to the existence of the interrupted interrupts in the vehicle-mounted system, a target interrupt with the minimum interrupt frequency among the interrupts is determined, and an open target interrupt operation is performed.

6. The method of claim 4, wherein When the risk level is the second risk level, the control of the vehicle-mounted system according to the risk level and the current interrupt frequency includes: The interrupt frequencies in the current interrupt frequency that meet the preset interrupt frequency condition are taken out to obtain a target interrupt frequency set; In response to the update of the basic task count, the target interrupt frequency set is sent to the corresponding server; In response to the non-update of the basic task count, the interrupt with the highest interrupt frequency in the current interrupt frequency is closed, the recovery time corresponding to the interrupt with the highest interrupt frequency is set as the first recovery time, and the related information of the interrupt with the highest interrupt frequency is recorded; In response to the existence of the interrupted interrupts in the vehicle-mounted system, a target interrupt with the minimum interrupt frequency among the interrupts is determined, and an open target interrupt operation is performed.

7. The method of claim 4, wherein When the risk level is the third risk level, the control of the vehicle-mounted system according to the risk level and the current interrupt frequency includes: The interrupt frequencies in the current interrupt frequency that meet the preset interrupt frequency condition are taken out to obtain a target interrupt frequency set; In response to the update of the basic task count, the target interrupt frequency set is sent to the corresponding server; In response to the non-update of the basic task count, the interrupt with the highest interrupt frequency in the current interrupt frequency is closed, the recovery time corresponding to the interrupt with the highest interrupt frequency is set as the second recovery time, and the related information of the interrupt with the highest interrupt frequency is recorded; In response to the existence of the interrupted interrupts in the vehicle-mounted system, a target interrupt with the minimum interrupt frequency among the interrupts is determined, and an open target interrupt operation is performed.

8. The method of claim 4, wherein When the risk level is the fourth risk level, the control of the vehicle-mounted system according to the risk level and the current interrupt frequency includes: In response to the non-update of the basic task count, the interrupt with the highest interrupt frequency in the current interrupt frequency is closed; The interrupt frequencies in the current interrupt frequency that meet the preset interrupt frequency condition are taken out to obtain a target interrupt frequency set; In response to the update of the basic task count, the target interrupt frequency set is sent to the corresponding server; In response to the non-update of the basic task count, the interrupt with the highest interrupt frequency in the current interrupt frequency is closed, the recovery time corresponding to the interrupt with the highest interrupt frequency is set as the third recovery time, and the related information of the interrupt with the highest interrupt frequency is recorded; In response to the existence of the interrupted interrupts in the vehicle-mounted system, a target interrupt with the minimum interrupt frequency among the interrupts is determined, and an open target interrupt operation is performed.

9. A vehicle characterized by comprising: It includes: A memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing the program to implement the interrupt handling method of the vehicle system as described in any one of claims 1-8.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the interrupt handling method of the vehicle system as described in any one of claims 1-8.

Images