Vehicle torque safety monitoring method, device, equipment and storage medium

Abstract

The present invention discloses a method, apparatus, device, and storage medium for monitoring vehicle torque safety, belonging to the field of electric vehicle technology. The method includes: if the torque value in a received torque command is non-zero, determining whether the vehicle's current state meets a preset validity condition; if the vehicle's current state meets the preset validity condition, determining that the torque command is valid; determining whether the effective torque command meets a preset trust condition; and if the effective torque command meets the preset trust condition, executing the effective torque command. This application can deeply monitor the torque safety of a vehicle.

Description

Technical Field

[0001] The present application relates to the technical field of electric vehicles, and in particular to a method, device, equipment and storage medium for safely monitoring torque of a vehicle. Background Art

[0002] At present, when electric vehicle motor controllers receive torque instructions, they do not consider the torque safety of the entire vehicle controller under network attacks or network hijacking, and do not judge the authenticity of the received torque instructions. If the torque instruction is issued by a third-party controller, or when the entire vehicle controller is attacked, the torque safety of the electric vehicle will be hidden dangers.

[0003] Therefore, there is a problem in the prior art that the torque safety monitoring of the vehicle is not in place. Summary of the Invention

[0004] The main purpose of this application is to provide a vehicle torque safety monitoring method, device, equipment and storage medium, aiming to solve the technical problem of inadequate vehicle torque safety monitoring.

[0005] To achieve the above objectives, the present application provides a method for safely monitoring torque of a vehicle, the method comprising the following steps:

[0006] If the torque value in the received torque command is non-zero, determining whether the current state of the vehicle meets the preset validity conditions;

[0007] If the current state of the vehicle meets the preset validity condition, determining that the torque command is valid;

[0008] Determining whether the effective torque command meets the preset credibility conditions;

[0009] If the effective torque command meets the preset credibility condition, the effective torque command is executed.

[0010] In a possible implementation manner of the present application, if the torque value in the received torque command is non-zero, in the step of determining whether the current state of the vehicle meets a preset validity condition, the preset validity condition includes:

[0011] The high-voltage circuit of the motor controller of the vehicle is closed;

[0012] The vehicle is in a non-parked state;

[0013] The accelerator pedal opening of the vehicle is greater than a preset value;

[0014] The vehicle is in a non-charging state and the charging plug is not connected;

[0015] The brake pedal opening of the vehicle is zero;

[0016] There is no level 3 or higher fault in any controller of the vehicle.

[0017] In a possible implementation manner of the present application, in the step of determining whether the effective torque command meets a preset credibility condition, the preset credibility condition includes:

[0018] The signal amplitude of the effective torque command has no jump;

[0019] The signal receiving period of the effective torque command is stable;

[0020] The signal of the effective torque command is related to the driving intention Figure 1 To.

[0021] In a possible implementation manner of the present application, which is applied to a vehicle having a brake energy recovery system, in the step of determining whether the effective torque command meets a preset trustworthy condition, the preset trustworthy condition further includes:

[0022] The braking torque amplitude of the vehicle is consistent with a preset energy recovery value.

[0023] In a possible implementation manner of the present application, before the step of executing the effective torque command if the effective torque command meets the preset credibility condition, the method further includes:

[0024] If the number of torque instructions that do not meet the preset validity conditions and the preset credibility conditions exceeds a preset threshold within a preset time period, the response to the torque instructions is stopped and a torque safety abnormality signal is issued.

[0025] In a possible implementation manner of the present application, before the step of determining whether the current state of the vehicle meets the preset validity condition if the torque value in the received torque command is non-zero, the method further includes:

[0026] Inputting the acquired vehicle driving environment image and driver status image into a preset emergency state recognition model, and determining whether the vehicle is in an emergency state based on the preset emergency state recognition model;

[0027] When the vehicle is in an emergency state, a torque output zero instruction is executed to allow the vehicle to quickly resolve the emergency state.

[0028] In a possible implementation manner of the present application, after the step of determining whether the effective torque command meets a preset credibility condition, the method further includes:

[0029] Acquiring a feedback torque output after executing the effective torque command;

[0030] A difference between the torque value of the feedback torque and the torque value in the effective torque command is calculated, and if the difference is greater than a preset torque difference threshold, a torque out-of-control signal is issued.

[0031] The present application also provides a vehicle torque safety monitoring device, the device comprising:

[0032] a first determining module, configured to determine whether a current state of the vehicle meets a preset validity condition if the torque value in the received torque command is non-zero;

[0033] a second determining module, configured to determine that the torque command is valid if the current state of the vehicle meets the preset validity condition;

[0034] a third determination module, configured to determine whether the effective torque command meets a preset credibility condition;

[0035] An execution module is configured to execute the effective torque instruction if the effective torque instruction meets the preset trust condition.

[0036] The present application also provides a vehicle torque safety monitoring device, which includes: a memory, a processor, and a vehicle torque safety monitoring program stored on the memory and executable on the processor, wherein the vehicle torque safety monitoring program is configured to implement the steps of the vehicle torque safety monitoring method as described in any one of the above items.

[0037] The present application also provides a storage medium, on which a vehicle torque safety monitoring program is stored. When the vehicle torque safety monitoring program is executed by a processor, the steps of the vehicle torque safety monitoring method as described in any one of the above items are implemented.

[0038] This application provides a method for monitoring torque safety in a vehicle. Compared to prior art methods in which electric vehicle controllers fail to consider torque safety in the event of cyberattacks or hijacking when receiving torque commands, and fail to determine the authenticity of received torque commands, i.e., insufficient torque safety monitoring, this method determines whether the vehicle's current state meets a preset validity condition if the torque value in the received torque command is non-zero; if the vehicle's current state meets the preset validity condition, the torque command is determined to be valid; determines whether the valid torque command meets a preset trust condition; and executes the valid torque command if the valid torque command meets the preset trust condition. It is understood that the validity of the torque command is determined by determining whether the vehicle's current state meets the preset validity condition; if the torque command is valid, it is necessary to determine whether the source of the torque command is secure. Therefore, the credibility of the valid torque command is determined by determining whether the signal of the valid torque command meets the preset trust condition. If so, its source is secure. Only after the torque command is determined to be valid and trustworthy can the valid torque command be executed, thus achieving in-depth torque safety monitoring. Therefore, the present application can deeply monitor the torque safety of the vehicle. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 This is a flow chart of a first embodiment of a method for torque safety monitoring of a vehicle according to the present application;

[0040] Figure 2 This is a logical architecture diagram of a vehicle torque safety monitoring method according to a first embodiment of the present application;

[0041] Figure 3 This is a schematic diagram of a first scenario of the vehicle torque safety monitoring method according to the first embodiment of the present application;

[0042] Figure 4 It is a structural diagram of a vehicle torque safety monitoring device in the hardware operating environment involved in the embodiment of the present application;

[0043] Figure 5 A schematic diagram of a vehicle torque safety monitoring device according to a first embodiment of the present application;

[0044] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0045] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0046] The embodiment of the present invention provides a method for monitoring torque safety of a vehicle, referring to Figure 1 , Figure 1 This is a flow chart of a first embodiment of a method for torque safety monitoring of a vehicle according to the present application.

[0047] In this embodiment, the vehicle torque safety monitoring method includes:

[0048] Step S10: If the torque value in the received torque command is non-zero, determining whether the current state of the vehicle meets the preset validity conditions;

[0049] Step S20: If the current state of the vehicle meets the preset validity condition, determining that the torque command is valid;

[0050] Step S30: Determine whether the effective torque command meets the preset credibility condition;

[0051] Step S40: If the effective torque command meets the preset credibility condition, the effective torque command is executed.

[0052] This embodiment aims to: deeply monitor the torque safety of the vehicle,

[0053] As an example, the torque safety monitoring method of a vehicle may be applied to a torque safety monitoring system of a vehicle, which is subordinate to a torque safety monitoring device of the vehicle.

[0054] As an example, the vehicle torque safety monitoring method is applied to electric vehicles, which may be pure electric vehicles and hybrid electric vehicles, etc., and the pure electric vehicles may be pure electric passenger vehicles and commercial vehicles, etc., without specific limitation.

[0055] For ease of description, the following specifically illustrates the application of the vehicle torque safety monitoring method to a pure electric vehicle.

[0056] As an example, Figure 3 As shown, the torque safety monitoring system applied to pure electric vehicles may include a motor controller, a vehicle controller, a power battery high-voltage distribution box, a three-phase AC motor, a vehicle instrument, a gateway controller, a remote communication module, a one-button torque clearing switch, and a one-button remote communication disable switch.

[0057] As an example, Figure 3As shown, the main function of the motor of a pure electric vehicle is to generate driving torque, which is the power source of the pure electric vehicle. The motor controller is an integrated circuit that controls the motor to work in the set direction, speed, angle, and response time through software; in a pure electric vehicle, the motor controller converts the electrical energy stored in the high-voltage distribution box of the power battery into the electrical energy required to drive the motor by receiving hard-wired signals of driving intentions such as the charging plug and the acceleration and brake pedal opening, including gear, throttle, brake, etc.; the motor controller adjusts the voltage and current based on the received torque command to control the starting operation, forward and backward speed, climbing strength and other driving conditions of the pure electric vehicle, or helps the pure electric vehicle brake and stores part of the braking energy in the power battery.

[0058] Specifically, if Figure 3 As shown in the figure, the vehicle controller calculates parameters such as the required torque of the motor based on the driver's operating intentions such as the position of the accelerator pedal, gear position, and brake pedal force, and sends the required instructions to the motor controller to coordinate the movement of various power components to ensure the normal operation of the electric vehicle; the vehicle controller connects various sub-control systems through the CAN communication network to coordinate and manage the entire communication network; the vehicle controller collects and processes the vehicle's status information, and sends important status and fault information to the vehicle instrument for display, such as vehicle speed, motor speed, remaining battery power, motor or battery fault information, etc.; the vehicle controller manages the entire vehicle according to actual working conditions, monitors the charging of the electric vehicle and the recovery of braking energy, and controls other electrical equipment on the vehicle; the vehicle controller monitors the operating status of each device in real time, diagnoses, prompts and actively repairs any abnormal conditions that occur, to ensure the safe operation of the electric vehicle.

[0059] For example, in physics, torque (also known as torque) is a specific moment of force, equal to the product of force and lever arm. Its SI unit is Newton-meter (N·m). The faster the motor speed, the lower the torque generated. Torque reflects a vehicle's load capacity within a certain range. For comparisons of cars with the same engine type, greater torque output means greater load capacity, better acceleration, greater gradeability, fewer gear shifts, and less wear and tear on the vehicle.

[0060] Specifically, the torque value in the torque command can be positive or negative. For example, for an accelerator pedal torque request command, when the driving intention is braking, the torque value in the torque command is negative; when the driving intention is acceleration, the torque value in the torque command is positive.

[0061] In this embodiment, the specific steps are as follows:

[0062] Step S10: If the torque value in the received torque command is non-zero, determining whether the current state of the vehicle meets the preset validity conditions;

[0063] In this embodiment, if Figure 2 As shown, when judging whether the absolute value of the torque value in the received torque command is greater than zero, if the absolute value is zero, the torque output is zero, that is, the motor controller does not respond to the received torque command at this time, and the vehicle maintains its original state; if the absolute value is greater than zero, that is, if the torque value in the received torque command is non-zero, it is necessary to respond to the torque command; before responding, it is necessary to monitor the safety of the torque command. Therefore, the first step of monitoring is to judge whether the torque command meets the preset validity conditions based on the current state of the vehicle.

[0064] As an example, the current state of the vehicle may be a door switch state, a motor operating state, etc., without specific limitation.

[0065] In this embodiment, the preset effective conditions are vehicle operating status conditions and vehicle component status conditions based on the vehicle type and vehicle structure, and are not specifically limited.

[0066] In this embodiment, if the torque value in the received torque command is non-zero, in the step of determining whether the current state of the vehicle meets the preset validity condition, the preset validity condition includes:

[0067] The high-voltage circuit of the motor controller of the vehicle is closed;

[0068] The vehicle is in a non-parked state;

[0069] The accelerator pedal opening of the vehicle is greater than a preset value;

[0070] The vehicle is in a non-charging state and the charging plug is not connected;

[0071] The brake pedal opening of the vehicle is zero;

[0072] There is no level 3 or higher fault in any controller of the vehicle.

[0073] As an example, after receiving the torque command, the motor controller of a pure electric vehicle detects the current state of the vehicle and determines whether the current state of the vehicle meets the following preset validity conditions:

[0074] The high-voltage circuit of the motor controller is closed, that is, the power battery high-voltage distribution box is powered on and can normally enter the motor-permitted operation state;

[0075] The parking brake or electronic parking system is ineffective, that is, the parking brake is not applied or the vehicle is not parked;

[0076] The accelerator pedal opening is greater than a preset value. For pure electric vehicles equipped with an automatic parking release function when the accelerator is pressed, the accelerator pedal opening signal needs to be set to a hard-wired signal, where the preset value can be 3% or 2.99%, without specific limitation.

[0077] The gear is valid, the vehicle is not in charging state and the charging plug is not connected;

[0078] The vehicle's brake pedal opening is 0%;

[0079] There are no serious faults (level 3 or above) in any controller of the vehicle, such as the power battery high-voltage distribution box, braking system, steering system, etc.

[0080] In this embodiment, which is applied to an electric bus, in the step of determining whether the current state of the vehicle meets the preset validity conditions, the preset validity conditions also include:

[0081] All doors of the vehicle are closed.

[0082] As an example, after receiving the torque command, the motor controller of a pure electric bus detects the current state of the vehicle. In addition to determining whether the current state of the vehicle meets the preset validity conditions described above, it should also determine whether the pure electric bus meets the condition that all doors are closed.

[0083] Step S20: If the current state of the vehicle meets the preset validity condition, determining that the torque command is valid;

[0084] In this embodiment, if Figure 2 As shown, if the current state of the vehicle meets the above-mentioned preset validity conditions, it is determined that the torque command is valid.

[0085] As an example, if the current vehicle is a pure electric passenger vehicle, and if its current state meets the above-mentioned preset validity conditions, it is determined that the torque command is valid.

[0086] As an example, if the current vehicle is a pure electric bus, when the motor controller of the pure electric bus receives a torque command and detects the current state of the vehicle, in addition to the above-mentioned preset validity conditions, it must also meet the condition that all doors are in a closed state to determine that the torque command is valid.

[0087] In this embodiment, if the torque value in the received torque command is non-zero, after the step of determining whether the current state of the vehicle meets the preset validity conditions, if the current state of the vehicle does not meet the preset validity conditions, the torque command is refused to be executed and a torque failure signal is issued.

[0088] In this embodiment, if Figure 2As shown, if the current state of the vehicle does not meet the above-mentioned preset validity conditions, the torque instruction will be refused to be executed. After the torque instruction is refused to be executed, the current torque output will be set to zero, and a torque failure signal will be issued to prompt the driver and the vehicle's torque safety monitoring background to handle the torque failure situation.

[0089] Step S30: Determine whether the effective torque command meets the preset credibility condition;

[0090] In this embodiment, if Figure 2 As shown, if it is determined that the torque command is valid, the second step of the vehicle torque safety monitoring is required: determining whether the signal of the valid torque command meets the preset trust conditions; in the step of determining whether the valid torque command meets the preset trust conditions, the preset trust conditions include:

[0091] The signal amplitude of the effective torque command has no jump;

[0092] The signal receiving period of the effective torque command is stable;

[0093] The signal of the effective torque command is related to the driving intention Figure 1 To.

[0094] In this embodiment, when applied to a vehicle with a braking energy recovery system, in the step of determining whether the effective torque command meets the preset credibility condition, the preset credibility condition also includes: the braking torque amplitude of the vehicle is consistent with the preset energy recovery value.

[0095] As an example, the condition for the signal amplitude of the above-mentioned effective torque command to have no jump may be that the torque rising gradient amplitude deviation is within 10%, and the torque falling gradient amplitude deviation is within 20%; it may also be that if the requested torque amplitude reaches the maximum allowable torque value of the motor but is lower than 110% of the maximum allowable torque of the motor, it shall be processed according to the maximum allowable torque of the motor, wherein the amplitude deviation and the maximum allowable torque value are values ​​that can be modified based on empirical data and are not specifically limited.

[0096] As an example, the torque command signal receiving cycle stability may be within 10% of the normal cycle, and the normal protocol cycle of the torque command is 20 milliseconds, where the normal cycle and the deviation value are values ​​that can be modified based on empirical data and are not specifically limited.

[0097] As an example, the above effective torque command is consistent with the driving intention. Figure 1The conditions may be that the torque command is in the driving direction when the accelerator pedal opening is greater than 3%, the torque command is in the braking direction or the torque request absolute value is zero when the brake pedal opening is greater than 3%, or when the accelerator pedal and brake pedal opening signals are valid at the same time, the braking signal shall prevail. In other cases, the torque command is 0 or meets the requirement that the electric braking torque amplitude is consistent with the recovery design value in the scenario where the coasting energy recovery function is valid. Among them, the accelerator pedal opening and the brake pedal opening are values ​​that can be modified based on empirical data, and there is no specific limitation.

[0098] In this embodiment, after the step of determining whether the effective torque command meets the preset credibility condition, if the effective torque command does not meet the preset credibility condition, the torque command is rejected and a torque interference signal is issued.

[0099] In this embodiment, if Figure 2 As shown, if the effective torque command does not meet the preset credibility condition, the torque command is rejected and a torque interference signal is issued. At the same time, the current torque output is reset to zero.

[0100] As an example, if the maximum rising gradient of the effective torque command is normally set to 20 Nm per 20 milliseconds, if the torque rising gradient is greater than 22 Nm, it is determined that the effective torque command is not credible.

[0101] As an example, if the requested torque amplitude continuously reaches 110% or more of the motor's maximum allowable torque value threshold for 10 consecutive cycles, it is determined that the effective torque command is not credible.

[0102] As an example, if the normal protocol period of the torque command exceeds 22 milliseconds or is less than 18 milliseconds, it is determined that the effective torque command is not credible.

[0103] As an example, if the electric braking torque amplitude is inconsistent with the energy recovery design value, it is determined that the effective torque command is not credible.

[0104] Step S40: If the effective torque command meets the preset credibility condition, the effective torque command is executed.

[0105] In this embodiment, if Figure 2 As shown, if the effective torque command meets the preset credibility condition, the effective torque command is executed.

[0106] In this embodiment, before the step of executing the effective torque command if the effective torque command meets the preset credibility condition, the method further includes:

[0107] Step A1: If the number of torque commands that do not meet the preset validity conditions and the preset credibility conditions exceeds a preset threshold within a preset time period, the response to the torque command is stopped and a torque safety abnormality signal is issued.

[0108] In this embodiment, before the step of determining whether the effective torque instruction meets the preset credibility conditions, the number of torque instructions that do not meet the preset validity conditions and do not meet the preset credibility conditions is counted, that is, the total number of the torque failure signals and torque interference signals issued is counted. If the number exceeds the preset number threshold, that is, if the total number exceeds the preset number threshold within the preset time period, the response to the torque instruction is stopped, and a torque safety abnormality signal is issued.

[0109] As an example, Figure 2 As shown, if the total number of the torque failure signal and the torque interference signal issued within 2 minutes exceeds 3 times, the response to the torque command is terminated, and a torque safety abnormality signal is issued, and the total number is recounted after 2 minutes.

[0110] As an example, Figure 3 As shown, the torque failure signal, torque interference signal and other related alarm signals are output by the motor controller and sent to the vehicle instrument and remote communication module as a signal source for driving prompts and background torque safety monitoring.

[0111] In this embodiment, after the step of determining whether the effective torque command meets the preset credibility condition, the method further includes:

[0112] Step B1: obtaining the feedback torque output after executing the effective torque command;

[0113] In this embodiment, after the effective torque command is executed, a feedback torque is output and fed back to the motor, so that the vehicle operates according to the feedback torque.

[0114] Step B2: Calculate the difference between the torque value of the feedback torque and the torque value in the effective torque command. If the difference is greater than a preset torque difference threshold, issue a torque out-of-control signal.

[0115] In this embodiment, the difference between the torque value of the feedback torque and the torque value in the effective torque command is calculated, and if the difference is greater than a preset torque difference threshold, a torque out-of-control signal is issued.

[0116] As an example, if the feedback torque is 350 Nm, and the torque value in the torque command is 347 Nm, which is greater than the preset torque difference threshold of 2 Nm, a torque out of control signal is issued to enable the motor controller to further monitor the safety of the torque command.

[0117] In this embodiment, the validity of the torque command is judged by determining whether the current state of the vehicle meets the preset validity conditions; if the torque command is valid, it is necessary to determine whether the source of the torque command is safe. Therefore, whether the effective torque command is credible is determined by determining whether the signal of the effective torque command meets the preset credibility conditions. If it is credible, its source is safe. Only after determining that the torque command is valid and credible can the effective torque command be executed; then, whether the feedback torque output after the execution of the effective torque command is accurate is determined to achieve in-depth monitoring of torque safety.

[0118] Furthermore, based on the first embodiment of the present application, another embodiment of the present application is provided. In this embodiment, in order to ensure the driving safety of the vehicle, a one-button torque clearing switch is added to the vehicle's torque safety monitoring system. When the vehicle is in any state, the torque output can be set to zero through the one-button torque clearing switch. Especially when the vehicle is in an emergency state, the torque output can be set to zero through the one-button torque clearing switch, so that the vehicle speed can be slowly reduced to zero to ensure driving safety.

[0119] As an example, when the vehicle is in any state, if the driver needs to set the output torque to zero, he can press the one-button torque clear switch to force the output torque to zero.

[0120] As an example, when it is automatically detected that the vehicle is in an emergency state, the one-button torque clearing switch can be forcibly opened.

[0121] In this embodiment, before the step of determining whether the current state of the vehicle meets the preset validity condition if the torque value in the received torque command is non-zero, the method further includes:

[0122] Step C1: inputting the acquired vehicle driving environment image and driver status image into a preset emergency state recognition model, and determining whether the vehicle is in an emergency state based on the preset emergency state recognition model;

[0123] In this embodiment, a vehicle driving environment image and a driver status image are acquired and input into a preset emergency state recognition model. The preset emergency state recognition model is obtained by iteratively training a preset to-be-trained model based on images with emergency state labels. The vehicle driving environment image and the driver status image are recognized based on the preset emergency state recognition model to determine whether the vehicle is in an emergency state.

[0124] As an example, whether the vehicle is in an emergency state can be determined by recognizing facial expressions and the vehicle's environment.

[0125] Step C2: When the vehicle is in an emergency state, executing a torque output zero instruction to allow the vehicle to quickly release the emergency state.

[0126] As an example, when the vehicle is in an emergency state, a torque output zero instruction is executed, where the emergency state can be a state determined by automatic detection of the vehicle, or a state determined when the driver triggers the emergency state button, without specific limitation.

[0127] As an example, when the torque output is set to zero, if the vehicle is in a brake failure state at the time, the torque output can be set to zero to slowly reduce the vehicle speed to zero to ensure driving safety.

[0128] In this embodiment, after the vehicle emergency state is released, the step of determining whether the current state of the vehicle meets the preset validity condition if the torque value in the received torque command is non-zero is performed.

[0129] In this embodiment, in any state of the vehicle, the remote wireless communication function of the vehicle can be forcibly turned off so that the vehicle can eliminate the interference of the network on the torque command signal.

[0130] As an example, the signals received by the vehicle include communication signals and hard-wired signals. Communication signals include CAN (Controller Area Network) signals and Ethernet signals. Communication signals have communication protocols during transmission. Many controllers are connected to the same wiring, and it is easy to attack the motor controller through other controllers. Hard-wired signals are switch signals, voltage signals, throttle signals, gear signals, etc. that are not controlled by the controller. They are relatively simple and have a narrow signal range, so they are not easily attacked by network attacks.

[0131] In this embodiment, in order to further ensure that the torque command signal is credible, that is, to avoid being attacked by the network, Figure 3 As shown, a one-button remote communication disable switch is added. The signal of the one-button remote communication disable switch is a hard-line signal. By using the one-button remote communication disable switch, the remote wireless communication function of the vehicle can be turned off at any time, and the hard-line signal of the vehicle is normal.

[0132] As an example, shutting down the remote wireless communication function of the vehicle can be done when the driver determines that it needs to be shut down and sends an instruction to the vehicle to shut down the network communication function, or when the vehicle's torque safety monitoring system detects that the network communication function needs to be shut down, without specific limitation.

[0133] In this embodiment, by turning off the remote wireless communication function of the vehicle and executing the torque output zero instruction when the vehicle is in an emergency state, safety accidents that the vehicle may encounter during the driving process due to torque interference and torque failure can be avoided, which plays a key role in the driving process.

[0134] The present application also provides a vehicle torque safety monitoring device, such as Figure 5 As shown, the device includes:

[0135] A first determination module 10 is configured to determine whether the current state of the vehicle meets a preset validity condition if the torque value in the received torque command is non-zero;

[0136] A second determining module 20 is configured to determine whether the torque command is valid if the current state of the vehicle meets the preset validity condition;

[0137] The third determination module 30 is used to determine whether the effective torque command meets the preset credibility condition;

[0138] The execution module 40 is configured to execute the effective torque instruction if the effective torque instruction meets the preset credibility condition.

[0139] Optionally, in a possible implementation manner of the present application, before the step of executing the effective torque command if the effective torque command meets the preset credibility condition, the device further includes:

[0140] The stop response module is used to stop responding to the torque command and issue a torque safety abnormality signal if the torque command that does not meet the preset validity condition and does not meet the preset credibility condition exceeds a preset number threshold within a preset time period.

[0141] Optionally, in a possible implementation manner of the present application, before the step of determining whether the current state of the vehicle meets a preset validity condition if the torque value in the received torque command is non-zero, the apparatus further includes:

[0142] a fourth determination module, configured to input the acquired vehicle driving environment image and driver status image into a preset emergency state recognition model, and determine whether the vehicle is in an emergency state based on the preset emergency state recognition model;

[0143] The execution module is used to execute a torque output zero instruction when the vehicle is in an emergency state, so that the vehicle can quickly release the emergency state.

[0144] Optionally, in a possible implementation manner of the present application, after the step of determining whether the effective torque command meets a preset credibility condition, the device further includes:

[0145] an acquisition module, configured to acquire a feedback torque output after executing the effective torque command;

[0146] The calculation module is used to calculate the difference between the torque value of the feedback torque and the torque value in the effective torque command, and to issue a torque out-of-control signal if the difference is greater than a preset torque difference threshold.

[0147] The specific implementation of the torque safety monitoring method for a vehicle of the present application is basically the same as the various embodiments of the torque safety monitoring method for a vehicle described above, and will not be repeated here.

[0148] The present application also provides a storage medium, on which a vehicle torque safety monitoring program is stored. When the vehicle torque safety monitoring program is executed by a processor, the steps of the vehicle torque safety monitoring method as described in any one of the above items are implemented.

[0149] The specific implementation of the storage medium of the present application is basically the same as the various embodiments of the torque safety monitoring method for the vehicle described above, and will not be repeated here.

[0150] Reference Figure 4 , Figure 4 It is a schematic diagram of the device structure of the hardware operating environment involved in the embodiment of the present application.

[0151] like Figure 4 As shown, the torque safety monitoring device for a vehicle may include: a processor 1001 , a memory 1005 , and a communication bus 1002 . The communication bus 1002 is used to implement connection and communication between the processor 1001 and the memory 1005 .

[0152] Optionally, the vehicle torque safety monitoring device may further include a user interface, a network interface, a camera, an RF (Radio Frequency) circuit, a sensor, a WiFi module, and the like. The user interface may include a display and an input submodule such as a keyboard. The optional user interface may also include a standard wired interface or a wireless interface. The network interface may include a standard wired interface or a wireless interface (such as a WiFi interface).

[0153] Those skilled in the art will understand that Figure 4 The structure of the vehicle torque safety monitoring device shown in the figure does not constitute a limitation to the vehicle torque safety monitoring device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0154] like Figure 4As shown, memory 1005, a storage medium, may include an operating system, a network communication module, and the vehicle's torque safety monitoring program. The operating system manages and controls the hardware and software resources of the vehicle's torque safety monitoring device, supporting the operation of the vehicle's torque safety monitoring program and other software and / or programs. The network communication module facilitates communication between components within memory 1005, as well as with other hardware and software in the vehicle's torque safety monitoring system.

[0155] exist Figure 4 In the vehicle torque safety monitoring device shown, the processor 1001 is used to execute the vehicle torque safety monitoring program stored in the memory 1005 to implement the steps of any of the above-mentioned vehicle torque safety monitoring methods.

[0156] The specific implementation of the torque safety monitoring device of the vehicle of the present application is basically the same as the various embodiments of the torque safety monitoring method of the vehicle mentioned above, and will not be repeated here.

[0157] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or system comprising the element.

[0158] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0159] Through the description of the above embodiments, those skilled in the art can clearly understand that the above embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better embodiment. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0160] The above are only preferred embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for monitoring vehicle torque safety, characterized in that: The torque safety monitoring of the vehicle includes the following steps: If the torque value in the received torque command is non-zero, determining whether the current state of the vehicle meets the preset validity conditions; If the current state of the vehicle meets the preset validity condition, determining that the torque command is valid; Determining whether the effective torque command meets the preset credibility conditions; If the effective torque command meets the preset trust condition, executing the effective torque command; Acquiring a feedback torque output after executing the effective torque command; A difference between the torque value of the feedback torque and the torque value in the effective torque command is calculated, and if the difference is greater than a preset torque difference threshold, a torque out-of-control signal is issued.

2. The vehicle torque safety monitoring method according to claim 1, characterized in that: In the step of determining whether the current state of the vehicle meets a preset validity condition if the torque value in the received torque command is non-zero, the preset validity condition includes: The high-voltage circuit of the motor controller of the vehicle is closed; The vehicle is in a non-parked state; The accelerator pedal opening of the vehicle is greater than a preset value; The vehicle is in a non-charging state and the charging plug is not connected; The brake pedal opening of the vehicle is zero; There is no level 3 or higher fault in any controller of the vehicle.

3. The vehicle torque safety monitoring method according to claim 1, characterized in that: In the step of determining whether the effective torque command meets the preset credibility conditions, the preset credibility conditions include: The signal amplitude of the effective torque command has no jump; The signal receiving period of the effective torque command is stable; The signal of the effective torque command is consistent with the driving intention.

4. The vehicle torque safety monitoring method according to claim 3, applied to a vehicle with a braking energy recovery system, characterized in that: In the step of determining whether the effective torque command meets the preset credibility condition, the preset credibility condition further includes: The braking torque amplitude of the vehicle is consistent with a preset energy recovery value.

5. The vehicle torque safety monitoring method according to claim 1, wherein: Before the step of executing the effective torque command if the effective torque command meets the preset trustworthy condition, the method further includes: If the number of torque instructions that do not meet the preset validity conditions and the preset credibility conditions exceeds a preset threshold within a preset time period, the response to the torque instructions is stopped and a torque safety abnormality signal is issued.

6. The method for monitoring torque safety of a vehicle according to claim 1, wherein: Before the step of determining whether the current state of the vehicle meets the preset validity condition if the torque value in the received torque command is non-zero, the method further includes: Inputting the acquired vehicle driving environment image and driver status image into a preset emergency state recognition model, and determining whether the vehicle is in an emergency state based on the preset emergency state recognition model; When the vehicle is in an emergency state, a torque output zero instruction is executed to allow the vehicle to quickly resolve the emergency state.

7. A torque safety monitoring device for a vehicle, characterized in that: The device comprises: a first determining module, configured to determine whether a current state of the vehicle meets a preset validity condition if the torque value in the received torque command is non-zero; a second determining module, configured to determine that the torque command is valid if the current state of the vehicle meets the preset validity condition; a third determination module, configured to determine whether the effective torque command meets a preset credibility condition; an execution module, configured to execute the effective torque instruction if the effective torque instruction meets the preset trustworthy condition; an acquisition module, configured to acquire a feedback torque output after executing the effective torque command; The calculation module is used to calculate the difference between the torque value of the feedback torque and the torque value in the effective torque command, and to issue a torque out-of-control signal if the difference is greater than a preset torque difference threshold.

8. A vehicle torque safety monitoring device, characterized in that: The device includes: a memory, a processor, and a vehicle torque safety monitoring program stored in the memory and executable on the processor, wherein the vehicle torque safety monitoring program is configured to implement the steps of the vehicle torque safety monitoring method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium stores a vehicle torque safety monitoring program, which, when executed by a processor, implements the steps of the vehicle torque safety monitoring method according to any one of claims 1 to 6.

Images