Redundant controller primary-secondary redundant communication system and method

Abstract

The embodiments of the present invention relate to the technical field of communications, and disclose a redundant controller primary-secondary redundant communication system and method. The method comprises: a target arbitration mechanism receiving a private CAN message sent by a target private CAN transceiver, and determining whether the private CAN message has timed out; if the private CAN message has not timed out, the target arbitration mechanism sending to a target Autosar-COM the private CAN message sent by the target private CAN transceiver; if the private CAN message has timed out, the target arbitration mechanism sending to the target Autosar-COM UART data received by a target UART transceiver. According to the embodiments of the present invention, an arbitration mechanism monitors private CAN messages for timeouts, and initiates a UART-data-based simulation of a private CAN message when a private CAN message times out, thereby achieving stable and timely data communication between a primary MCU and a secondary MCU, and improving the safety performance of a vehicle while driving.

Description

Redundant controller master-slave redundancy communication system and method TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of communication, in particular to a redundant controller master-slave redundancy communication system and method. BACKGROUND

[0002] With the continuous development of automobiles, the chassis controller based on double MCUs is applied more and more widely, and the stability of data communication between the master-slave MCUs is required more and more highly. The data communication between the existing master-slave MCUs is generally realized through a CAN communication network (a cooperation structure of a CAN transceiver and a CAN bus). If the CAN message appears to be timeout, the data communication between the master-slave MCUs is unstable, which will affect the real-time performance of data transmission and further affect the safety performance of the automobile. SUMMARY

[0003] In order to overcome the shortcomings of the prior art, the purpose of embodiments of the present application is to provide a redundant controller master-slave redundancy communication system and method, which can realize the stability of data communication between the master-slave MCUs.

[0004] To solve the above problems, the first aspect of embodiments of the present application discloses a redundant controller master-slave redundancy communication system, which comprises a master controller and a slave controller. The master controller comprises a first Autosar-COM, a first arbitration mechanism and a first microcontroller. The slave controller comprises a second Autosar-COM, a second arbitration mechanism and a second microcontroller. The first microcontroller is provided with a first private CAN transceiver and a first UART transceiver. The second microcontroller is provided with a second private CAN transceiver and a second UART transceiver. The first private CAN transceiver and the second private CAN transceiver are connected through a CAN bus. The first private CAN transceiver is further connected to the first arbitration mechanism through a first protocol data unit route. The second private CAN transceiver is further connected to the second arbitration mechanism through a second protocol data unit route. The first UART transceiver and the second UART transceiver are connected through a UART bus. The first UART transceiver is further connected to the first Autosar-COM through the first arbitration mechanism. The second UART transceiver is further connected to the second Autosar-COM through the second arbitration mechanism.

[0005] As a preferred embodiment, in the first aspect of the embodiment of the present application, the first private CAN transceiver and the first protocol data unit route, the first protocol data unit route and the first arbitration mechanism, the second private CAN transceiver and the second protocol data unit route, the second protocol data unit route and the second arbitration mechanism, the first UART transceiver and the first arbitration mechanism, the first arbitration mechanism and the first Autosar-COM, the second UART transceiver and the second arbitration mechanism, and the second arbitration mechanism and the second Autosar-COM all communicate through I-PDU.

[0006] As a preferred embodiment, in the first aspect of the embodiment of the present application, a UART-to-CAN module is further arranged between the first UART transceiver and the first arbitration mechanism, and between the second UART transceiver and the second arbitration mechanism, for converting UART data into private CAN messages.

[0007] The second aspect of the embodiment of the present application discloses a redundancy controller master-slave redundancy communication method, which is implemented based on the redundancy controller master-slave redundancy communication system of the first aspect of the embodiment of the present application, and includes the following steps:

[0008] The target arbitration mechanism receives the private CAN message sent by the target private CAN transceiver, judges whether the private CAN message is timed out, if the private CAN message is not timed out, the target arbitration mechanism sends the private CAN message sent by the target private CAN transceiver to the target Autosar-COM;

[0009] If the private CAN message is timed out, the target arbitration mechanism sends the UART data received by the target UART transceiver to the target Autosar-COM;

[0010] When the target arbitration mechanism is the first arbitration mechanism, the target private CAN transceiver, the target UART transceiver and the target Autosar-COM correspond to the first private CAN transceiver, the first UART transceiver and the first Autosar-COM respectively.

[0011] When the target arbitration mechanism is the second arbitration mechanism, the target private CAN transceiver, the target UART transceiver and the target Autosar-COM correspond to the second private CAN transceiver, the second UART transceiver and the second Autosar-COM respectively.

[0012] As a preferred embodiment, in the second aspect of the embodiment of the present application, if the private CAN message is timed out, the target arbitration mechanism sends the UART data received by the target UART transceiver to the target Autosar-COM, and then further includes:

[0013] The target arbitration mechanism continues to determine whether the private CAN message is timed out, if the private CAN message is not timed out, the target arbitration mechanism sends the private CAN message sent by the target private CAN transceiver to the target Autosar-COM, and no longer sends the UART data received by the target UART transceiver to the target Autosar-COM.

[0014] As a preferred embodiment, in the second aspect of the embodiment of the application, the target arbitration mechanism sends the UART data received by the target UART transceiver to the target Autosar-COM, comprising:

[0015] The target arbitration mechanism directly sends the UART data received by the target UART transceiver to the target Autosar-COM, or the target arbitration mechanism converts the UART data received by the target UART transceiver into a private CAN message and then sends the private CAN message to the target Autosar-COM.

[0016] As a preferred embodiment, in the second aspect of the embodiment of the application, determining whether the private CAN message is timed out comprises:

[0017] Recording the receiving time of the message ID of each private CAN message, and periodically polling the message IDs of all private CAN messages, comparing the time difference between the receiving time and the current time, and when the time difference is greater than a preset time threshold, it is determined that the private CAN message is timed out.

[0018] The third aspect of the embodiment of the application discloses a computer readable storage medium storing a computer program, wherein the computer program causes a computer to execute the redundant controller master-slave redundant communication method disclosed in the second aspect of the embodiment of the application.

[0019] Compared with the prior art, the embodiment of the application has the beneficial effects that:

[0020] The embodiment of the application monitors whether the private CAN message is timed out through the arbitration mechanism, and starts the UART data simulation private CAN message when the private CAN message is timed out, and the Autosar-COM can directly process the data received by the UART, without needing to pay attention to which hardware is used to realize the communication, thereby realizing the stability and timeliness of the data communication between the master MCU and the slave MCU, and improving the safety performance of the automobile driving process. BRIEF DESCRIPTION OF DRAWINGS

[0021] Fig. 1 is a structural schematic diagram of a redundant controller master-slave redundant communication system provided by the embodiment of the application;

[0022] Fig. 2 is a flow schematic diagram of a redundant controller master-slave redundant communication method provided by the embodiment of the application. DETAILED DESCRIPTION

[0023] The specific embodiments are only intended to explain the embodiments of the present application, and are not intended to limit the embodiments of the present application. Those skilled in the art can make modifications to the embodiments of the present application without creative contribution after reading the present specification, and the modifications are protected by the patent law as long as they are within the scope of the claims of the embodiments of the present application.

[0024] To make the purpose, technical solutions and advantages of the embodiments of the present application more clear, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative contribution are within the scope of protection of the embodiments of the present application.

[0025] The term “comprising” and any variation thereof in the specification and claims of the present application is intended to cover not an exclusive inclusion, for example, a process, method, system, product or apparatus that includes a list of steps or units is not necessarily limited to those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to such processes, methods, products or apparatuses.

[0026] In the embodiments of the present application, the word “exemplary” or “for example” is used to mean serving as an example, instance or illustration. Any embodiment or design solution described as “exemplary” or “for example” in the embodiments of the present application should not be interpreted as being more preferred or having more advantages than other embodiments or design solutions. In fact, the word “exemplary” or “for example” is used in the sense of that the related concept is presented in a specific manner.

[0027] The embodiments of the present application monitor whether the private CAN message is timed out through the arbitration mechanism, and start the UART data simulation private CAN message when the private CAN message is timed out. The Autosar-COM can directly process the data received by the UART without concerning which hardware is used to realize the communication, so that the stability and timeliness of the data communication between the main and auxiliary MCUs are realized, and the safety performance of the automobile driving process is improved. The following will be described in detail with reference to the drawings.

[0028] Embodiment one

[0029] Please refer to Fig. 1, which is a redundant controller main and auxiliary redundant communication system disclosed by the embodiments of the present application, which mainly includes a main controller (i.e. main MCU) and an auxiliary controller (i.e. auxiliary MCU), and the main controller and the auxiliary controller realize data communication through a data transmission component.

[0030] Both the main controller and the auxiliary controller adopt Autosar architecture, and both can include Autosar-COM, a microcontroller and an arbitration mechanism (Arbitration), wherein the Autosar-COM provides basic communication services, and has a clear upper module RTE (Runtime Environment) and a lower module PDU Router (i.e. PDUR protocol data unit router). The microcontroller is the core hardware of the main controller and the auxiliary controller.

[0031] The arbitration mechanism is implemented by software, and is arranged in BswM, i.e. BSW Mode Manager (basic software mode manager), which is a module that implements part of the concepts of vehicle mode management (Vehicle Mode Management) and application mode management (Application Mode Management) in the BSW (Basic Software) layer.

[0032] One arbitration mechanism is a set of a logical expression and a mode request condition, and in the preferred embodiment of the application, the arbitration mechanism has two main purposes, one is to determine whether the private CAN message is timed out, and the other is to switch the communication mode between the main controller and the auxiliary controller. Of course, in other embodiments, other modules can also be used to determine whether the private CAN message is timed out, i.e. the above arbitration mechanism can be divided into two parts, both of which can use one arbitration mechanism, or a microcontroller can be used to determine whether the private CAN message is timed out, and the arbitration mechanism determines which communication mode to use.

[0033] The data transmission assembly mainly includes private CAN transceivers and UART transceivers integrated in the microprocessor, wherein the private CAN transceivers between the main controller and the auxiliary controller are connected through a CAN bus, and the UART transceivers are connected through a UART serial bus.

[0034] For the sake of distinction, in the embodiment of the application, the Autosar-COM, the arbitration mechanism, the microcontroller, the private CAN transceiver and the UART transceiver in the main controller are respectively referred to as the first Autosar-COM, the first arbitration mechanism, the first microcontroller, the first private CAN transceiver and the first UART transceiver, and the Autosar-COM, the arbitration mechanism, the microcontroller, the private CAN transceiver and the UART transceiver in the auxiliary controller are respectively referred to as the second Autosar-COM, the second arbitration mechanism, the second microcontroller, the second private CAN transceiver and the second UART transceiver. In addition, the protocol data unit routers (PDURs) in the main controller and the auxiliary controller are respectively referred to as the first protocol data unit router and the second protocol data unit router.

[0035] Based on the above principle, the arbitration mechanism connects the microprocessor and Autosar-COM, on the one hand to determine whether the private CAN message is timeout, on the other hand to determine the communication mode between Autosar-COM and microprocessor. Specifically, the first private CAN transceiver is also connected to the first arbitration mechanism through the first protocol data unit route, the second private CAN transceiver is also connected to the second arbitration mechanism through the second protocol data unit route, and the first UART transceiver and the second UART transceiver are connected through the UART bus; the first UART transceiver is also connected to the first Autosar-COM through the first arbitration mechanism, and the second UART transceiver is also connected to the second Autosar-COM through the second arbitration mechanism.

[0036] In addition, in addition to the communication between the first microprocessor and the second microprocessor through the UART bus or the CAN bus, the communication between other associated modules is realized by using the multiplexed protocol data unit (I-PDU). That is, the communication between the first private CAN transceiver and the first protocol data unit route, the first protocol data unit route and the first arbitration mechanism, the second private CAN transceiver and the second protocol data unit route, the second protocol data unit route and the second arbitration mechanism, the first UART transceiver and the first arbitration mechanism, the first arbitration mechanism and the first Autosar-COM, the second UART transceiver and the second arbitration mechanism, and the second arbitration mechanism and the second Autosar-COM is realized by using the I-PDU.

[0037] Generally, Autosar-COM can directly process UART data, but in some scenarios, if Autosar-COM cannot directly process UART data, UART-to-CAN modules can also be added between the first UART transceiver and the first arbitration mechanism, and between the second UART transceiver and the second arbitration mechanism, for converting UART data into private CAN messages, thereby ensuring the timeliness of data processing. Of course, in other embodiments, UART data can also be converted into other formats of data types that Autosar-COM can process.

[0038] The specific working principle can be described as follows:

[0039] The target arbitration mechanism receives the private CAN message sent by the target private CAN transceiver, judges whether the private CAN message is timeout, if the private CAN message is not timeout, the target arbitration mechanism sends the private CAN message sent by the target private CAN transceiver to the target Autosar-COM; if the private CAN message is timeout, the target arbitration mechanism sends the UART data received by the target UART transceiver to the target Autosar-COM.

[0040] Because the interaction of the primary and secondary controllers is involved, the target arbitration mechanism can be the first arbitration mechanism or the second arbitration mechanism. If the target arbitration mechanism is the first arbitration mechanism, the target private CAN transceiver, the target UART transceiver and the target Autosar-COM correspond to the first private CAN transceiver, the first UART transceiver and the first Autosar-COM respectively; and if the target arbitration mechanism is the second arbitration mechanism, the target private CAN transceiver, the target UART transceiver and the target Autosar-COM correspond to the second private CAN transceiver, the second UART transceiver and the second Autosar-COM respectively.

[0041] In other embodiments, if the private CAN message is recovered (i.e. the private CAN message does not time out), the data sent to the target Autosar-COM is switched to the private CAN message again.

[0042] Embodiment two

[0043] Please refer to Fig. 2, which is a flowchart of a redundancy controller primary-secondary redundancy communication method according to an embodiment of the present application.

[0044] Please refer to Fig. 2, which is a flowchart of a redundancy controller primary-secondary redundancy communication method according to an embodiment of the present application.

[0045] S210, the target arbitration mechanism receives the private CAN message sent by the target private CAN transceiver, and judges whether the private CAN message times out. If the private CAN message does not time out, the target arbitration mechanism sends the private CAN message sent by the target private CAN transceiver to the target Autosar-COM.

[0046] Because the interaction of the primary and secondary controllers is involved, the target arbitration mechanism can be the first arbitration mechanism or the second arbitration mechanism. If the target arbitration mechanism is the first arbitration mechanism, the target private CAN transceiver, the target UART transceiver and the target Autosar-COM correspond to the first private CAN transceiver, the first UART transceiver and the first Autosar-COM respectively; and if the target arbitration mechanism is the second arbitration mechanism, the target private CAN transceiver, the target UART transceiver and the target Autosar-COM correspond to the second private CAN transceiver, the second UART transceiver and the second Autosar-COM respectively.

[0047] The calculation method of whether the private CAN message times out can be implemented by using the prior art.

[0048] Exemplarily, a period polling method or a timer method can be adopted to determine whether the private CAN message is timed out. In the period polling method, the receiving time of each private CAN message ID (Identity document) is recorded when the message is received, and all private CAN message IDs are periodically polled to obtain the receiving time of all messages, and the time difference between the current time and the receiving time is compared, and the message is considered to be timed out when the time difference is greater than the set timeout value.

[0049] In the timer method, a timer is set for each private CAN message ID, and the trigger time of the corresponding timer is updated each time a message is received. Therefore, if the private CAN message is normally received, the timer trigger time is continuously updated backward, but the actual trigger will not occur. Once the timer triggers, it means that the private CAN message corresponding to the private CAN message ID is timed out.

[0050] If the private CAN message is not timed out, it means that the private CAN message data can ensure the stability and timeliness of the data communication between the main controller and the auxiliary controller, thereby ensuring the safety of the vehicle driving. Therefore, in this case, the target arbitration mechanism can directly send the private CAN message data to the target Autosar-COM.

[0051] S220, if the private CAN message is timed out, the target arbitration mechanism sends the UART data received by the target UART transceiver to the target Autosar-COM.

[0052] If the private CAN message is timed out, it means that the private CAN message data is still used for communication between the main controller and the auxiliary controller, which may cause delay or even loss of data, affecting the stability and timeliness of the communication between the two. At this time, due to the existence of communication redundancy, the interaction between the two can be realized through the redundant data communication mode.

[0053] In the preferred embodiment of the present application, the target arbitration mechanism can use the UART data received by the target UART transceiver as private CAN data to indicate the target Autosar-COM. For the target Autosar-COM, the UART data simulates the private CAN message data, and the target Autosar-COM layer can directly process the data received by the target UART transceiver without worrying about which hardware is used for communication. Therefore, the stability and timeliness of the data communication between the main controller and the auxiliary controller can be ensured.

[0054] S230, the target arbitration mechanism continues to determine whether the private CAN message is recovered.

[0055] In the process of realizing the communication between the master controller and the auxiliary controller through the UART, the target arbitration mechanism continues to monitor whether the private CAN message is timed out. The method for calculating whether the private CAN message is timed out is the same as that in the step S210. In addition, in order to ensure the stability of the private CAN message data, a certain threshold value can also be set for the time and / or the number of messages that are not timed out. For example, when the time that is not timed out lasts for a first preset time threshold value and the number of private CAN messages that are not timed out is not less than a first preset number threshold value, it is determined that the private CAN message is recovered.

[0056] S240, if recovered, the step S210 is executed, otherwise, the step S220 is continued to be executed.

[0057] If the private CAN message is recovered (not timed out), the target arbitration mechanism sends the private CAN message sent by the target private CAN transceiver to the target Autosar-COM, and no longer sends the UART data received by the target UART transceiver to the target Autosar-COM.

[0058] If the private CAN message is not recovered (still timed out), the sending of the UART data received by the target UART transceiver to the target Autosar-COM is continued.

[0059] The data received by the private CAN transceiver in the embodiment of the application is routed to the arbitration mechanism through the PDUR. The arbitration mechanism judges whether the private CAN message is timed out. If not, the arbitration mechanism indicates the data to the Autosar-COM. If it is judged that the private CAN message is timed out, the arbitration mechanism indicates the data received by the UART to the Autosar-COM. If the private CAN message is recovered, the arbitration mechanism switches back to indicating the private CAN message data to the Autosar-COM, thereby realizing the redundancy of the communication between the redundant controllers (the master controller and the auxiliary controller), ensuring the stability and timeliness of the data communication between the master controller and the auxiliary controller, and improving the safety during the driving of the automobile.

[0060] The redundant controller master-auxiliary redundant communication system and method disclosed in the application are described in detail above. The principles and implementation modes of the application are described by applying specific examples in this paper. The above description of the embodiments is only used to help understand the method of the application and its core idea. Meanwhile, for those skilled in the art, according to the idea of the application, the specific implementation modes and application ranges will be changed. In view of the above, the content of the specification should not be understood as a limitation of the application.

Claims

1. A redundant controller master-slave redundancy communication system comprising a master controller and a slave controller, characterized in that, The main controller comprises a first Autosar-COM, a first arbitration mechanism and a first microcontroller, the auxiliary controller comprises a second Autosar-COM, a second arbitration mechanism and a second microcontroller, the first microcontroller is provided with a first private CAN transceiver and a first UART transceiver, the second microcontroller is provided with a second private CAN transceiver and a second UART transceiver, the first private CAN transceiver and the second private CAN transceiver are connected through a CAN bus, the first private CAN transceiver is further connected to the first arbitration mechanism through a first protocol data unit route, the second private CAN transceiver is further connected to the second arbitration mechanism through a second protocol data unit route, and the first UART transceiver and the second UART transceiver are connected through a UART bus; the first UART transceiver is further connected to the first Autosar-COM through the first arbitration mechanism, and the second UART transceiver is further connected to the second Autosar-COM through the second arbitration mechanism.

2. The redundant controller primary / secondary redundant communication system of claim 1, wherein, Communication is carried out between the first private CAN transceiver and the first protocol data unit route, between the first protocol data unit route and the first arbitration mechanism, between the second private CAN transceiver and the second protocol data unit route, between the second protocol data unit route and the second arbitration mechanism, between the first UART transceiver and the first arbitration mechanism, between the first arbitration mechanism and the first Autosar-COM, between the second UART transceiver and the second arbitration mechanism, and between the second arbitration mechanism and the second Autosar-COM through I-PDU.

3. The redundant controller primary / secondary redundant communication system of claim 1, wherein, A UART-to-CAN module is further arranged between the first UART transceiver and the first arbitration mechanism and between the second UART transceiver and the second arbitration mechanism, for converting UART data into private CAN messages.

4. A method for redundant communication between a primary controller and a secondary controller, implemented based on the redundant communication system between a primary controller and a secondary controller according to any one of claims 1-3, characterized in that, It comprises the following steps: The target arbitration mechanism receives the private CAN message sent by the target private CAN transceiver, judges whether the private CAN message is overdue, if the private CAN message is not overdue, the target arbitration mechanism sends the private CAN message sent by the target private CAN transceiver to the target Autosar-COM; If the private CAN message is overdue, the target arbitration mechanism sends the UART data received by the target UART transceiver to the target Autosar-COM; When the target arbitration mechanism is the first arbitration mechanism, the target private CAN transceiver, the target UART transceiver and the target Autosar-COM correspond to the first private CAN transceiver, the first UART transceiver and the first Autosar-COM respectively; When the target arbitration mechanism is the second arbitration mechanism, the target private CAN transceiver, the target UART transceiver and the target Autosar-COM correspond to the second private CAN transceiver, the second UART transceiver and the second Autosar-COM respectively.

5. The redundant controller primary / secondary redundancy communication method of claim 4, wherein, If the private CAN message is timed out, the target arbitration mechanism sends the UART data received by the target UART transceiver to the target Autosar-COM, and then further includes: If the private CAN message is not timed out, the target arbitration mechanism sends the private CAN message sent by the target private CAN transceiver to the target Autosar-COM, and no longer sends the UART data received by the target UART transceiver to the target Autosar-COM.

6. The redundant controller primary / secondary redundancy communication method of claim 4, wherein, The target arbitration mechanism sends the UART data received by the target UART transceiver to the target Autosar-COM, including: The target arbitration mechanism sends the UART data received by the target UART transceiver to the target Autosar-COM directly, or the target arbitration mechanism converts the UART data received by the target UART transceiver into a private CAN message and then sends it to the target Autosar-COM.

7. The redundant controller primary / secondary redundant communication method of claim 4, wherein, Judging whether the private CAN message is timed out, including: Recording the receiving time of the message ID of each private CAN message, and periodically polling the message ID of all private CAN messages, comparing the time difference between the receiving time and the current time, and when the time difference is greater than a preset time threshold, it is judged that the private CAN message is timed out.

8. A computer-readable storage medium, characterized in that, The computer program is stored in the computer, wherein the computer program enables the computer to execute the redundant controller master-slave redundant communication method of any one of claims 4-7

Images