Hot backup fault processing system and method for vehicle and vehicle using the same

Abstract

The present application provides a hot standby fault handling system for vehicles, comprising: a first detection layer, which is configured to detect and record faults of vehicle configurations with low safety levels; a second detection layer, which is configured to detect faults of vehicle configurations with critical safety levels and send fault information; a fault collection layer, which is configured to classify and record the received fault information, freeze the vehicle configuration corresponding to the fault information, and send the fault information to a higher processing layer; a first processing layer, which is configured to receive the fault information sent by the fault collection layer, process the fault corresponding to the fault information according to a preset strategy, and send the fault information of the fault that cannot be processed to the system safety component; a redundant part, which is configured to back up the first processing layer and take over the work of the first processing layer when the first processing layer fails; wherein the system safety component is configured to process the fault corresponding to the received fault information based on the information of the hot standby fault handling system for vehicles. A corresponding processing method is also provided.

Description

Technical Field

[0001] The present invention relates to a vehicle fault processing technology, and more specifically, to a vehicle hot backup fault processing technology. Background Art

[0002] When a car breaks down, the fault system needs to collect system information, detect fault problems, and make quick judgments and decisions to ensure the safety and stability of the entire vehicle system.

[0003] The Chinese patent application with application number 201510680937.2 discloses a fault diagnosis and management method for hybrid electric vehicles. According to this method, the vehicle controller of the hybrid electric vehicle obtains the status information and fault information of the hybrid electric vehicle and each component system, and the vehicle controller assigns fault identification and fault level to all faults in the fault list, and the vehicle controller analyzes and judges the vehicle fault; when a fault occurs, the vehicle controller manages the hybrid electric vehicle according to the fault level and complete fault code. Obviously, this method is very dependent on the vehicle controller. In this case, once the vehicle controller is abnormal, the vehicle's fault system will be paralyzed, thereby affecting driving safety.

[0004] The Chinese patent application with application number 201610389410.9 discloses a dual-chip redundant and fault-tolerant control system for automotive wire-controlled steering. Based on the hot backup method, the system makes one chip in the dual core responsible for data reception and processing, and the other chip is responsible for data reception and transmission. In addition, once one of the chips reports an error, the other chip immediately takes over control, allowing the system to quickly return to normal working state, greatly improving the stability and reliability of the system. However, this solution needs to support the normal operation of both chips at the same time, and on the one hand, for the overlapping functional parts of the two chips, when there is a disagreement, it is impossible to decide whose result to adopt. On the other hand, in order to complete the hot backup switching between the two chips, data needs to be synchronized at any time, which increases the calculation and load. Summary of the invention

[0005] In view of this, the present application provides an improved hot standby fault handling system for vehicles. According to one aspect of the present application, the provided hot standby fault handling system for vehicles includes: a first detection layer, which is configured to detect the operating state of a system with a low security level and record fault information when a fault is detected; a second detection layer, which is configured to detect the operating state of a system with a critical security level and send fault information when a fault is detected; a fault collection layer, which is configured to receive the fault information sent by the second detection layer and classify and record the received fault information, freeze the operating state of the system corresponding to the fault information, and send the fault information to a higher processing layer; a first processing layer, which is configured to receive the fault information sent by the fault collection layer, process the fault corresponding to the fault information according to a preset strategy, and send the fault information of the fault that cannot be processed to the system safety component; a redundant part, which is configured to back up each other with the first processing layer, and take over the work of the first processing layer when a fault occurs in the first processing layer; wherein the system safety component is configured to process the fault corresponding to the received fault information based on the information of the hot standby fault handling system for vehicles.

[0006] In some examples, in the hot backup fault handling system for a vehicle, the first processing layer is disposed in a first core of a processor, and the redundant portion is disposed in a second core of the same processor.

[0007] In some examples, in the hot standby fault handling system for a vehicle, the first processing layer and the redundant part operate based on symmetric multi-processing.

[0008] In some examples, in the hot backup fault handling system for the vehicle, the system safety component is a separate processor.

[0009] In some examples, in the vehicle hot backup fault handling system, the vehicle configuration with a low safety level is a vehicle configuration of the vehicle in which the fault does not affect the vehicle operation and safety; the vehicle configuration with a critical safety level is a vehicle configuration of the vehicle in which the fault affects the vehicle operation and / or safety.

[0010] According to another aspect of the present application, a method for handling hot backup faults for vehicles is provided. The method includes detecting the operating status of a system with a low safety level and recording fault information when a fault is detected; detecting the operating status of a system with a critical safety level and sending fault information when a fault is detected; the fault collection layer classifies and records the received fault information, freezes the operating status of the system corresponding to the fault information, and sends the fault information to a higher processing layer; the first processing layer receives the fault information sent by the fault collection layer, processes the fault corresponding to the fault information according to a preset strategy, and sends the fault information of the fault that cannot be processed to the system safety component; when a fault occurs in the first processing layer, the redundant part takes over the work of the first processing layer, wherein the redundant part is configured to be a backup for the first processing layer; and wherein the system safety component processes the fault corresponding to the received fault information based on the information of the hot backup fault handling system for vehicles.

[0011] The present application also provides another hot standby fault handling method for a vehicle, the method comprising: dividing the hot standby fault handling systems arranged in different systems of the vehicle into a first detection layer and a second detection layer, wherein the first detection layer is used to detect the operating status of a system with a low safety level and record fault information when a fault is detected, and the second detection layer is used to detect the operating status of a system with a critical safety level and send fault information when a fault is detected; a fault collection layer is set in each of the different systems, wherein the fault collection layer is used to receive the fault information sent by the second detection layer and classify and record the received fault information, and freeze the operation of the system corresponding to the fault information status, and sending the fault information to a higher processing layer; in each of the different systems, a first processing layer, a redundant part that backs up the first processing layer, and a system safety component are set, wherein the first processing layer is used to receive the fault information sent by the fault collection layer, process the fault corresponding to the fault information according to a preset strategy, and send the fault information of the fault that cannot be processed to the system safety component; the redundant part is used to back up the first processing layer, and take over the work of the first processing layer when a fault occurs in the first processing layer; and the system safety component is used to process the fault corresponding to the fault information received based on the information of the hot backup fault processing system for the vehicle.

[0012] The present application also provides a vehicle, which includes any type of hot backup fault handling system for a vehicle described herein, or the vehicle executes any type of hot backup fault handling method for a vehicle described herein. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1It is a structural diagram of a hot backup fault handling system for a vehicle according to an example of the present application.

[0014] Figure 2 A flowchart of a hot backup fault handling method for a vehicle according to another embodiment of the present application.

[0015] Figure 3 It is a flow chart of a hot standby fault handling method for a vehicle according to another embodiment of the present application. DETAILED DESCRIPTION

[0016] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and understandable, the specific embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention can be implemented in many other ways different from those described herein, and those skilled in the art can make similar improvements without violating the connotation of the present invention, so the present invention is not limited by the specific implementation disclosed below.

[0017] Figure 1 The hot standby fault handling system for a vehicle according to an example of the present application is a schematic diagram of the structure. As shown in the figure, the hot standby fault handling system includes a first detection layer 10, a second detection layer 12, a fault collection layer 14, a first processing layer 16, a redundancy unit 18 and a system safety component 20.

[0018] The first detection layer 10 is configured to detect the operating state of a system with a low security level and record fault information when a fault is detected. The second detection layer 12 is configured to detect the operating state of a system with a critical security level and send fault information when a fault is detected. The fault collection layer 14 is connected to the second detection layer 12 and receives the fault information sent by the second detection layer 12. The fault collection layer 14 classifies and records the received fault information, freezes the operating state of the corresponding system, and sends the fault information to a higher processing layer. Freezing the operating state of the corresponding system here refers to recording the data and related information when the fault occurs in an appropriate manner for subsequent analysis, for example, retaining a snapshot of the operating state of the system when the fault occurs. The first processing layer 16 receives the fault information sent by the fault collection layer 14, and processes the fault corresponding to the received fault information according to a preset strategy, and sends the fault information of the fault that cannot be processed to the system safety component 20. The redundancy unit 18 is configured to be parallel to the first processing layer 16 as a backup of the first processing layer 16, and take over the work of the first processing layer 16 when the first processing layer 16 fails. The system safety component 20 is configured to process the fault corresponding to the received fault information based on the information of the hot backup fault handling system for the vehicle (for example, hardware information in the system, etc.). In all examples of this application, an abnormality in the operating state of the system can be referred to as a fault. In all examples of this application, the system in the term "operating state of the system" refers to an application system based on software, hardware or a combination thereof set in the vehicle, such as a vehicle infotainment system, a vehicle's advanced driver assistance system ADAS, etc.

[0019] According to the present application, each application system based on software, hardware or a combination thereof provided in the vehicle is provided with a vehicle hot backup fault handling system for the system. Figure 1 The vehicle hot backup fault handling system shown is used as an example for explanation.

[0020] The first detection layer 10 records fault information when a fault occurs in the operating state of a system with a low safety level. A system with a low safety level here refers to an application system based on software, hardware or a combination thereof that is set in the vehicle and has no effect on the operation and safety of the vehicle. For example, in this example, the camera bad pixels that appear during the camera shooting process in the ADAS system can be set as the operating state of a system with a low safety level. In each example of the present application, the classification of the safety level of the operating state of the system can refer to the classification of relevant safety standards, for example, the risk classification scheme defined by ISO 26262-Road Vehicle Functional Safety Standard. The recording of faults by the first detection layer 10 helps to quickly locate the abnormality of the operating state during subsequent maintenance. However, in some examples, the records made by the first detection layer 10 can also be transmitted to, for example, the second detection layer, or directly to the fault collection layer, etc.

[0021] The second detection layer 12 detects the operating status of the system with a critical safety level, and sends the fault information to the fault collection layer 14 when a fault is detected. The critical safety level here refers to an application system based on software, hardware or a combination thereof that is set in the vehicle and has no impact on the operation and / or safety of the vehicle. For example, the front radar in the ADAS system cannot collect external information. When the second detection layer 12 detects the fault, it sends the fault information of the radar to the fault collection layer 14. The second detection layer 12 also detects a delay in the data transmission of the ADAS system, and sends the information that the data transmission of the ADAS system has a fault to the fault collection layer 14.

[0022] In this example, the fault collection layer 14 classifies and records the received fault information. The fault collection layer 14 classifies the received fault information, for example, by grading the fault according to its importance. The fault collection layer 14 records the classified fault information for use during maintenance. At the same time, according to the example of the present application, the fault collection layer 14 also freezes the operating state of the system corresponding to the fault information and sends the fault information to a higher processing layer. The fault collection layer 14, for example, analyzes whether the fault is an occasional state fluctuation or a true fault based on the accumulation of the state flag bits of each fault, so as to avoid the fault handling mechanism being triggered by the state fluctuation of the vehicle configuration by mistake. After confirming that a fault has occurred, the fault collection layer 14 freezes the operating state of the corresponding system and sends the fault information to a higher processing layer. For example, the fault collection layer 14 receives fault information indicating that the front radar cannot collect external information, and receives fault information indicating that the data transmission of the ADAS system fails. The fault collection layer 14 lists the fault information indicating data transmission as the most important, for example, as the highest priority, and lists the fault information that cannot collect external information as the second most important, for example, as a high priority. In this way, the fault collection layer 14 collects fault information and classifies it, so that the second detection layer 12 can focus more on the operating status of the detection system without allocating processing capabilities to fault classification; for the first processing layer 16, it only needs to process according to the marked identification indicating the degree of importance without classification.

[0023] According to an example of the present application, the fault collection layer 14 also sends fault information to the backup of the first processing layer 16, that is, the redundant part 18. The redundant part 18 runs in parallel with the first processing layer 16 and monitors the operating status of the first processing layer 16 so as to seamlessly take over its work when the first processing layer 16 itself fails.

[0024] The first processing layer 16 in the present application is, for example, a decision processing layer, which processes faults according to a preset fault decision algorithm, such as realizing self-repair control, etc. In the example of the present application, once a fault that cannot be processed occurs in the first processing layer 16, it will report the fault information to the system safety component 20. The system safety component 20 will process the fault corresponding to the received fault information based on the relevant information of the vehicle hot backup fault processing system, such as the total hardware information, software information or a combination of the system, so as to protect the vehicle hot backup fault processing system.

[0025] According to the hot standby fault handling system for vehicles described above, a second detection module is set for the system application set in the vehicle with a critical security level, so that fault information can be actively reported, enriching the method of fault collection and avoiding missing any abnormal operation of critical configurations in the system. In addition, reporting faults is also beneficial to higher-level modules such as the fault collection module or the first processing module in the hot standby fault handling system, which can achieve full coverage monitoring of the system set in the vehicle through monitoring functions and systematic process status tracking. In addition, the system decision-making function, the fault processing function, and the control authority of the next level processing layer (such as the fault collection layer, the second detection layer, etc.) are only set in the first processing layer 16 and above. This helps to avoid the entire hot standby fault handling system from being illegally called and maliciously changed, thereby causing system control abnormalities.

[0026] According to the example of the present application, the first processing layer 16 is arranged in the first core of a processor, and the redundant part 18 is arranged on the second core of the same processor. The first core and the second core are here only to distinguish the two cores located on the same chip, and there are no other limitations. And according to the example of the present application, the operation of the first processing layer 16 and the redundant part 18 is based on symmetric multi-processing SMP technology. SMP enables multiple identical processing subsystems on a single chip to run the same instruction set, and enables multiple identical processing subsystems on a single chip to have equal access rights to memory, I / O and external interrupts. A single copy of the operating system can control all cores, so that any processor can run all threads without considering the distinction between cores, applications or interrupt services. According to the example of the present application, SMP can activate a specific core or multiple cores required to perform a task, so that the electronic controller ECU of the vehicle has highly scalable performance, fully meeting the most popular applications and potential applications in the industry today. In a multi-core processor structure, each core has its own L1 and L2 caches, and the L3 cache is shared. If a process switches back and forth between cores, the cache hit rate of each core will be affected. On the contrary, if the process can always be executed on one core regardless of how it is scheduled, the hit rate of the L1 and L2 caches of its data can be significantly improved. The dual-core process redundancy control (redundancy control between the first processor 16 and the redundant part 18 of the dual core) in the present invention emphasizes the division of labor control based on the redundancy control, improves the utilization rate of the processor, and ensures the performance of the system operation.

[0027] According to the example of the present application, the first processing layer 16 and the redundant part 18, which back up each other, are bound to run on different cores of the same processor, and are divided into a main process and a standby process with logical independence and the same processing results in a software heterogeneous manner. Among them, the main process runs on the first processing layer 16, and the standby process runs on the redundant part 18. The main process controls the overall decision-making plan and completes fault self-recovery control. The standby process monitors the main process, and once an error is found, the standby process takes over the work of the main process. When there is a result dispute between the main process and the standby process, the relevant data is collected and submitted to the system security component 20 for arbitration. In this way, the main process and the standby process of the first processing layer 16 and the redundant part 18 can be seamlessly switched, and when there is a dispute, the system security component 20 as a third party will arbitrate in combination with relevant information to ensure the correctness of the processing results.

[0028] According to the example of the present application, the first processing layer 16 and the redundant part 18 are arranged in two cores in the ARM R5 security chip. The system security component 20 is a cortex-r5 processor. In this example, after the redundant part 18 (which runs the standby process) detects that the first processing layer 16 (which runs the main process) is abnormal, it immediately takes over the control of the entire hot backup fault handling system, calls the data backup synchronization module to synchronize the system data to the standby process, and the standby process receives the fault information, takes over the system control and R5 communication related functions, and thus becomes the new main process of security control. After the original main process records the information data when it is abnormal, it restarts to become a standby process and calls the detection module to complete the detection of the new security control process. The two control processes that back up each other run on different cores, which can well guarantee the performance of the system and reduce the impact of system performance caused by context switching.

[0029] Figure 2 : is a flow chart of a vehicle hot standby fault handling method according to another embodiment of the present application. By way of example and not limitation, Figure 2 The method shown can be performed in Figure 1 The hot standby fault handling system for vehicles shown in FIG. Figure 1 describe Figure 2 The method shown.

[0030] like Figure 2 As shown, in step S200, the first detection layer 10 detects the operating state of the system with a low safety level and records the fault information when a fault is detected. It should be noted that the fault information recorded in step S200 will at least be used for subsequent improvement of the vehicle, that is, maintenance or repair, as shown in step S201.

[0031] In step S202, the second detection layer 12 detects the operating status of the system with a critical safety level and sends fault information when a fault is detected. Optionally, the data recorded in step S202 can also be used to improve the vehicle configuration later, as shown in step S300.

[0032] In step S204, the fault collection layer 14 classifies and records the received fault information, the corresponding system operating status, and sends the fault information to a higher processing layer. Optionally, the data recorded in step S204 can also be used to improve the vehicle configuration later, as shown in step S300.

[0033] It should be noted that, in step S205, the fault collection layer 14 also sends the fault information to the redundant part 18. In step S206, the first processing layer 16 receives the fault information sent by the fault collection layer, processes the fault corresponding to the fault information according to the preset strategy, and sends the fault information of the fault that cannot be processed to the system safety component. In step S208, the redundant part 18 is set to monitor the first processing layer 16, and takes over its work when the first processing layer 16 fails. In step S209, the system safety component 20 is set to process the fault corresponding to the received fault information based on the relevant information of the vehicle hot backup fault processing system. In some examples of the present application, it also includes that when a result dispute occurs between the process running in the redundant part 18 and the process running in the first processing layer 16, the relevant data is sent to the system safety component 20 for it to make a ruling.

[0034] Combination of the above Figure 1 The technical details described also apply to Figure 2 Examples of the method shown, such as: placing the first processing layer and the redundancy part on two cores of the same processor and configuring them to run based on symmetric multiprocessing; placing an independent processor as a system safety component; and the operating state of the system, and the life of the low safety level and the critical safety level. For the sake of brevity, the description is not repeated.

[0035] Figure 3 It is a flow chart of a hot standby fault handling method for a vehicle according to another embodiment of the present application. As shown in the figure, in step S300, the hot standby fault handling system set in different systems of the vehicle is divided into a first detection layer and a second detection layer. Among them, the first detection layer is used to detect the operating status of a system with a low security level and record fault information when a fault is detected, and the second detection layer is used to detect the operating status of a system with a critical security level and send fault information when a fault is detected. In step S302, a fault collection layer is set in each system of the different systems, wherein the fault collection layer is used to classify and record the received fault information after receiving the fault information sent by the second detection layer, freeze the operating status of the system corresponding to the fault information, and send the fault information to a higher processing layer. In step S304, a first processing layer, a redundant part that backs up the first processing layer, and a system safety component are set in each system of the different systems. Among them, the first processing layer is used to receive fault information sent by the fault collection layer, process the fault corresponding to the fault information according to a preset strategy, and send the fault information of the fault that cannot be processed to the system safety component; the redundant part is used to back up the first processing layer and take over the work of the first processing layer when a fault occurs in the first processing layer; and the system safety component is used to process the fault corresponding to the fault information received based on the information processing of the hot backup fault processing system for the vehicle.

[0036] The first processing layer and the redundancy part can be set on two cores of the same processor, and they are configured to run based on symmetric multi-processing. In addition, according to some examples, an independent processor can be set as a system safety component.

[0037] Simply put, such as Figure 3 The method shown can be configured in a vehicle such as an ADAS system, an infotainment system, etc. Figure 1 A hot standby fault handling system for a vehicle is described. Figure 3 In the example shown, the first detection layer, the second detection layer, the fault collection layer, the first processing layer, the redundancy part, and the system safety component are combined with the above Figure 1 Describes the same or similar.

[0038] According to an example of the present application, a vehicle is also provided. The vehicle includes the vehicle hot standby fault processing system described in the present application, or the vehicle can execute the vehicle hot standby fault processing method described in the present application.

[0039] In addition, it should be noted that the first detection layer, the second detection layer, the fault collection layer, the first processing layer, the redundant part and the system safety component in the hot backup fault handling system for vehicles described in this application can be set in the electronic control unit ECU of the corresponding system in the form of software, hardware or a combination of software and hardware. For example, the hot backup fault handling system for the ADAS system is set in the ECU of the ADAS, and the hot backup fault handling system for the infotainment system is set in the ECU of the infotainment system. However, this is not limited to this, and the hot backup fault handling system for vehicles described herein must be implemented in the ECU.

[0040] The above-mentioned embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A hot backup fault handling system for a vehicle, characterized in that: The fault handling system is configured to include: A first detection layer, which is configured to detect the operating status of the system with a low security level and record fault information when a fault is detected; A second detection layer, which is configured to detect the operating status of the system with a critical safety level and send a fault message when a fault is detected; a fault collection layer, configured to receive the fault information sent by the second detection layer, classify and record the received fault information, freeze the operating state of the system corresponding to the fault information, and send the fault information to a higher processing layer; A first processing layer, which is configured to receive the fault information sent by the fault collection layer, process the fault corresponding to the fault information according to a preset strategy, and send the fault information of the fault that cannot be processed to the system security component; a redundancy unit configured to back up the first processing layer and take over the work of the first processing layer when the first processing layer fails; Among them, the system safety component is configured to detect the fault corresponding to the fault information received based on the information processing of the hot backup fault handling system for the vehicle; the first processing layer is set on the first core of the processor, and the redundant part is set on the second core of the same processor; the main process runs on the first processing layer, and the standby process runs on the redundant part; the main process controls the overall decision-making plan; the standby process monitors the main process, and after the standby process detects that the main process is abnormal, it takes over the control of the hot backup fault handling system for the vehicle and becomes the new main process; after the original main process records the information data when it is abnormal, it completes the fault self-recovery control, restarts to become a new standby process and detects the new main process; when there is a dispute over the results between the main process and the standby process, the system safety component shall make a ruling.

2. The vehicle hot standby fault processing system according to claim 1, wherein: The first processing layer and the redundant part operate based on symmetric multi-processing.

3. The vehicle hot standby fault processing system according to claim 1, wherein: The system safety component is a separate processor.

4. The vehicle hot standby fault processing system according to claim 1, wherein: The operating status of the system with a low safety level is a vehicle system whose failure does not affect the vehicle operation and safety; the operating status of the system with a critical safety level is a vehicle system of the vehicle that affects the vehicle operation and / or safety.

5. A vehicle hot backup fault handling method, characterized in that: The method comprises: Detect the operating status of systems with low security levels and record fault information when a fault is detected; Detect the operating status of safety-critical systems and send fault information when a fault is detected; The fault collection layer classifies and records the received fault information, freezes the operating state of the system corresponding to the fault information, and sends the fault information to a higher processing layer; The first processing layer receives the fault information sent by the fault collection layer, processes the fault corresponding to the fault information according to a preset strategy, and sends the fault information of the fault that cannot be processed to the system security component; When the first processing layer fails, the redundancy unit takes over the work of the first processing layer, wherein the redundancy unit is configured to back up the first processing layer; and Among them, the system safety component processes the fault corresponding to the received fault information based on the information of the vehicle hot backup fault handling system; the first processing layer is set on the first core of the processor, and the redundant part is set on the second core of the same processor; the main process runs on the first processing layer, and the standby process runs on the redundant part; the main process controls the overall decision-making plan, and the standby process monitors the main process. After the standby process detects that the main process is abnormal, it takes over the control of the vehicle hot backup fault handling system and becomes the new main process; after the original main process records the information data when it is abnormal, it completes the fault self-recovery control, restarts to become a new standby process and detects the new main process; when there is a dispute over the results between the main process and the standby process, the system safety component will make a ruling.

6. The vehicle hot backup fault processing method according to claim 5, characterized in that: The first processing layer and the redundant part are configured to operate based on symmetric multi-processing.

7. The vehicle hot backup fault processing method according to claim 5 or 6, characterized in that: An independent processor is configured as the system safety component.

8. The vehicle hot standby fault handling method according to claim 5, wherein: The operating status of the system with a low safety level is a vehicle system whose failure does not affect the vehicle operation and safety; the operating status of the system with a critical safety level is a vehicle system of the vehicle that affects the vehicle operation and / or safety.

9. A vehicle hot backup fault handling method, characterized in that: The method comprises: The hot standby fault handling system arranged in different systems of the vehicle is divided into a first detection layer and a second detection layer, wherein the first detection layer is used to detect the operating state of the system with a low safety level and record the fault information when a fault is detected, and the second detection layer is used to detect the operating state of the system with a critical safety level and send the fault information when a fault is detected; A fault collection layer is set in each of the different systems, wherein the fault collection layer is used to receive the fault information sent by the second detection layer, classify and record the received fault information, freeze the operating state of the system corresponding to the fault information, and send the fault information to a higher processing layer; In each of the different systems, a first processing layer, a redundant part serving as a backup for the first processing layer, and a system safety component are provided; Among them, the first processing layer is used to receive the fault information sent by the fault collection layer, process the fault corresponding to the fault information according to the preset strategy, and send the fault information of the fault that cannot be processed to the system safety component; the redundant part is used to back up the first processing layer and take over the work of the first processing layer when the first processing layer fails; and the system safety component is used to process the fault corresponding to the fault information received based on the information processing of the vehicle hot backup fault processing system; the first processing layer is set on the first core of the processor, and the redundant part is set on the second core of the same processor; the main process runs on the first processing layer, and the standby process runs on the redundant part; the main process controls the overall decision-making plan, the standby process monitors the main process, and after the standby process detects that the main process is abnormal, it takes over the control of the vehicle hot backup fault processing system and becomes the new main process; after the original main process records the information data when it is abnormal, it completes the fault self-recovery control, restarts to become a new standby process and detects the new main process; when there is a result dispute between the main process and the standby process, the system safety component makes a ruling.

10. The vehicle hot standby fault processing method according to claim 9, characterized in that: The first processing layer and the redundant part are configured to operate based on symmetric multi-processing.

11. The vehicle hot standby fault processing method according to claim 9 or 10, characterized in that: An independent processor is configured as the system safety component.

12. A vehicle, characterized in that: The vehicle includes the hot standby fault processing system for a vehicle as described in any one of claims 1 to 4, or the vehicle executes the hot standby fault processing method for a vehicle as described in any one of claims 5 to 11.

Images