Vehicle control method and device based on functional safety mechanism and central computing architecture

Abstract

The present invention discloses a vehicle control method and device based on a functional safety mechanism and a central computing architecture, and relates to the field of vehicle control technology. The present invention determines the failure function module of the vehicle central integrated controller. If the function module is a common module, it means that the failure of the function module will affect the vehicle safety. The present invention will control the vehicle to lower the high pressure and stop outputting the torque to ensure the vehicle safety. If the function module is an independent module, it means that the failure of the function module will not affect the vehicle safety. The present invention will only interrupt the function of the function module, and the functions of other function modules are normal, which can improve the usability of the vehicle on the basis of ensuring the safety of the vehicle.

Description

Technical Field

[0001] The present invention relates to the field of vehicle control technology, and in particular to a vehicle control method and device based on a functional safety mechanism and a central computing architecture. Background Art

[0002] In vehicles that adopt a central integrated electrical architecture, only the central integrated controller controls the safety status of the entire vehicle. This requires that the central integrated controller can effectively detect the failure status of each functional module it carries, and enter the corresponding safe state when a functional module fails. At present, there are two main processing methods for the central integrated controller when detecting the failure of a functional module: one is to tend to safety, and the whole vehicle is controlled to enter a safe state when any functional module fails. This processing method can effectively ensure the safety of the vehicle, but it will cause other functional modules that have not failed to be unusable, reducing the usability of the vehicle; the other is to tend to usability. When any functional module fails, the whole vehicle is not controlled to enter a safe state, and only an alarm is displayed on the instrument. This processing method can effectively ensure the usability of the vehicle, but reduces the safety of the vehicle. Neither of the above two methods improves the usability of the vehicle on the basis of ensuring the safety of the vehicle. Therefore, how to improve the usability of the vehicle on the basis of ensuring the safety of the vehicle has become an urgent problem to be solved in this field. Summary of the invention

[0003] The present invention solves the technical problem of how to improve the usability of a vehicle while ensuring vehicle safety by providing a vehicle control method and device based on a functional safety mechanism and a central computing architecture.

[0004] On the one hand, the present invention provides the following technical solutions:

[0005] A vehicle control method based on a functional safety mechanism and a central computing architecture, comprising:

[0006] Determine the failed functional module of the vehicle central integrated controller;

[0007] In response to the functional module being a common module, controlling the vehicle to lower high pressure and stop outputting torque;

[0008] In response to the functional module being an independent module, the functional module is controlled to stop running.

[0009] Preferably, the shared module includes a power supply circuit, a communication circuit, a clock circuit, a domain control chip, a target operating system, an underlying driver and a configuration software module.

[0010] Preferably, the target operating system is an operating system for implementing vehicle safety-related operations.

[0011] Preferably, the target APP on the domain control chip directly calls the functions and services of the target operating system, and other APPs on the domain control chip call the functions and services of the target operating system through the target APP.

[0012] Preferably, the independent module includes any one or more of a peripheral driving circuit, a sampling circuit, an APP, a peripheral driving software module and a sampling software module.

[0013] Preferably, the independent module includes an operating system other than the target operating system.

[0014] Preferably, the step of controlling the vehicle to lower the high pressure and stop outputting the torque comprises:

[0015] Disrupt the vehicle's network communications;

[0016] The sub-controller and the execution unit under the central integrated controller cut off the vehicle high voltage and stop outputting torque after detecting that the network communication of the vehicle is interrupted.

[0017] On the other hand, the present invention also provides the following technical solutions:

[0018] A vehicle control device based on a functional safety mechanism and a central computing architecture, comprising:

[0019] A determination module, used to determine a failure function module of a vehicle central integrated controller;

[0020] A control module, for controlling the vehicle to lower the high pressure and stop outputting the torque in response to the functional module being a common module;

[0021] The control module is further used to control the function module to stop running in response to the function module being an independent module.

[0022] Preferably, the shared module includes a power supply circuit, a communication circuit, a clock circuit, a domain control chip, a target operating system, an underlying driver and a configuration software module.

[0023] Preferably, the target operating system is an operating system for implementing vehicle safety-related operations.

[0024] Preferably, the target APP on the domain control chip directly calls the functions and services of the target operating system, and other APPs on the domain control chip call the functions and services of the target operating system through the target APP.

[0025] Preferably, the independent module includes any one or more of a peripheral driving circuit, a sampling circuit, an APP, a peripheral driving software module and a sampling software module.

[0026] Preferably, the independent module includes an operating system other than the target operating system.

[0027] Preferably, the control module controls the vehicle to lower the high pressure and stop outputting the torque, including:

[0028] Disrupt the vehicle's network communications;

[0029] The sub-controller and the execution unit under the central integrated controller cut off the vehicle high voltage and stop outputting torque after detecting that the network communication of the vehicle is interrupted.

[0030] On the other hand, the present invention also provides the following technical solutions:

[0031] An electronic device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, any of the above-mentioned vehicle control methods based on the functional safety mechanism and the central computing architecture is implemented.

[0032] On the other hand, the present invention also provides the following technical solutions:

[0033] A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements any of the above-mentioned vehicle control methods based on a functional safety mechanism and a central computing architecture.

[0034] One or more technical solutions provided by the present invention have at least the following technical effects or advantages:

[0035] The present invention determines the failed functional module of the vehicle central integrated controller. If the functional module is a shared module, it means that the failure of the functional module will affect the vehicle safety. The present invention will control the vehicle to lower high pressure and stop outputting torque to ensure the vehicle safety. If the functional module is an independent module, it means that the failure of the functional module will not affect the vehicle safety. The present invention will only interrupt the function of the functional module, while the functions of other functional modules are normal, thereby improving the usability of the vehicle on the basis of ensuring the vehicle safety. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings in the following description are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0037] Figure 1 is a flow chart of a vehicle control method based on a functional safety mechanism and a central computing architecture in an embodiment of the present invention;

[0038] Figure 2Schematic diagram of a vehicle control device based on a functional safety mechanism and a central computing architecture in an embodiment of the present invention. DETAILED DESCRIPTION

[0039] The embodiments of the present invention solve the technical problem of how to improve the usability of a vehicle while ensuring the safety of the vehicle by providing a vehicle control method and device based on a functional safety mechanism and a central computing architecture.

[0040] In order to better understand the technical solution of the present invention, the technical solution of the present invention will be described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0041] The central integrated controller of this embodiment includes hardware circuits and software modules. The hardware circuits include domain control chips and peripheral circuits. The peripheral circuits include power circuits, communication circuits, clock circuits, peripheral drive circuits, sampling circuits, etc. The software modules include operating systems, underlying drive and configuration software modules, APPs, peripheral drive software modules, sampling software modules, etc. APPs can call the functions and services of the operating system to realize their own functions. It can be understood that all hardware circuits and software modules of the central integrated controller share power circuits, communication circuits, clock circuits, domain control chips, and underlying drive and configuration software modules. The failure of such modules shared by other modules will cause all modules to fail. For example, all modules lose power after the power circuit fails, which will definitely affect the safety of the vehicle; while the peripheral drive circuits, sampling circuits, APPs, peripheral drive software modules, and sampling software modules are independent modules. The failure of independent modules will not cause the failure of other modules and will not affect the safety of the vehicle. For the operating system, if the central integrated controller has only one operating system, all hardware circuits and software modules also share one operating system; if there are multiple operating systems and one of them is used to implement vehicle safety-related operations, the failure of the operating system used to implement vehicle safety-related operations will affect vehicle safety, while the failure of other operating systems will not affect vehicle safety. Vehicle safety-related operations include steering and braking.

[0042] Considering that the failure of the common module will affect the vehicle safety, the vehicle should be put into a safe state when the common module fails. The measures to enter the safe state are to lower the high voltage and stop the torque output, so as to ensure the safety of the vehicle. Considering that if the vehicle is put into a safe state when the independent module fails, it will reduce the usability of the vehicle, and not putting the vehicle into a safe state when the independent module fails will not affect the vehicle safety, then when the independent module fails, only the function of the independent module can be interrupted. Figure 1 As shown, this embodiment provides a vehicle control method based on a functional safety mechanism and a central computing architecture, including:

[0043] Step S1, determining a failed functional module of a vehicle central integrated controller;

[0044] Step S2, in response to the failed functional module being a common module, controlling the vehicle to lower the high pressure and stop outputting the torque;

[0045] Step S3, in response to the failed functional module being an independent module, controlling the failed functional module to stop running.

[0046] This embodiment presets a first attribute list and a second attribute list for the functional module. The existence of the attribute of the functional module in the first attribute list represents that the functional module is a shared module, and the existence of the attribute of the functional module in the second attribute list represents that the functional module is an independent module. Therefore, in step S1, the attribute of the functional module can be obtained after the functional module fails, and whether the failed functional module is a shared module or an independent module can be determined by whether the attribute of the functional module exists in the first attribute list or the second attribute list. For example, the attribute may be the number of each module, such as the attributes of the domain control chip, power circuit, communication circuit, clock circuit, peripheral drive circuit, sampling circuit, operating system, underlying drive and configuration software module, APP, peripheral drive software module, and sampling software module may be 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, and 11, respectively. Taking the first attribute list including the power circuit, communication circuit, clock circuit, domain control chip, target operating system (assuming that the central integrated controller has only one operating system, the target operating system is the only operating system), the attributes of the underlying drive and configuration software module, and the second attribute list including the attributes of the peripheral drive circuit, sampling circuit, APP, peripheral drive software module, and sampling software module as an example, the first attribute list includes numbers 1, 2, 3, 4, 7, and 8, and the second attribute list includes numbers 5, 6, 9, 10, and 11.

[0047] Assuming that the attribute of the failed functional module is 4, and 4 exists in the first attribute list, it means that the failure of the functional module will affect the safety of the vehicle, so step S2 will control the vehicle to lower the high pressure and stop outputting torque to ensure the safety of the vehicle. Assuming that the attribute of the failed functional module is 5, and 5 exists in the second attribute list, it means that the failure of the functional module will not affect the safety of the vehicle, so step S3 will only interrupt the function of the functional module, and the functions of other functional modules are normal, thereby improving the usability of the vehicle on the basis of ensuring the safety of the vehicle.

[0048] In this embodiment, the safety of the vehicle must be guaranteed. After any common module fails, the vehicle should be controlled to enter a safe state. Therefore, the scope covered by the common module should be as comprehensive as possible. The common module should include power circuit, communication circuit, clock circuit, domain control chip, target operating system (if the central integrated controller has only one operating system, the target operating system is the only operating system; if the central integrated controller has multiple operating systems, the target operating system is the operating system used to implement vehicle safety-related operations), bottom-level driver and configuration software modules. The scope covered by the independent module should also be as comprehensive as possible, but the usability of the vehicle is not necessarily guaranteed. After an independent module fails, only the function of the independent module can be interrupted. Of course, the vehicle can also be controlled to enter a safe state, although it will reduce the usability of the vehicle. Therefore, it is best for the independent module to include all independent modules, but it can also include only one or several of all independent modules, that is, the independent module can include any one or more of the peripheral drive circuit, sampling circuit, APP, peripheral drive software module and sampling software module. If the central integrated controller has multiple operating systems, the independent module can include any one or more of the operating system, peripheral drive circuit, sampling circuit, APP, peripheral drive software module and sampling software module other than the target operating system.

[0049] In step S2 of this embodiment, controlling the vehicle to lower the high voltage and stop outputting the torque may specifically include: interrupting the network communication of the vehicle; the sub-controller and the execution unit under the central integrated controller cut off the high voltage of the vehicle and stop outputting the torque after detecting that the network communication of the vehicle is interrupted. The network communication of the vehicle may include CAN and Ethernet communication, so that the sub-controller and the execution unit may be triggered to cut off the high voltage of the vehicle and stop outputting the torque by interrupting the communication.

[0050] For a central integrated controller with only one operating system, in the prior art, all APPs directly call the functions and services of the target operating system to realize their own functions. Since each APP is coupled with the target operating system, the possibility of causing the target operating system to fail when the APP fails is very high, that is, the failure of the independent module causes the vehicle to enter a safe state, which reduces the usability of the vehicle. Steps S1-S3 of this embodiment are processing measures after the failure of the functional module. This embodiment can also design the target operating system and APP to reduce the risk of failure of the target operating system, thereby improving the usability of the vehicle. That is, the target APP on the domain control chip is set to directly call the functions and services of the target operating system, and other APPs on the domain control chip call the functions and services of the target operating system through the target APP. The target APP is an APP trusted by the domain control chip, and the probability of the target APP itself failing is low, so the possibility of the target APP causing the target operating system to fail is low. Other APPs on the domain control chip call the functions and services of the target operating system through the target APP, which is equivalent to the decoupling of other APPs from the target operating system. When other APPs fail, only the target APP will fail, but not the target operating system. Only the failed other APPs and the target APP can be interrupted, thereby improving the usability of the vehicle.

[0051] In addition to controlling the vehicle to enter a safe state after the common module fails, this embodiment can also ensure the safety of the vehicle after the common module fails by setting hardware heterogeneous redundancy and safety islands. Specifically, heterogeneous redundancy is to add a low-computing power and high-reliability backup chip outside the domain control chip of the central integrated controller. The backup chip has a backup power supply and backup clock that are independent of the domain control chip power supply and clock. When the common hardware of the central integrated controller fails, the backup chip is immediately started to operate. The functions related to vehicle safety control are running on the backup chip, which can ensure the safe operation of the vehicle, while waiting for the reset and restart of the central integrated controller. If the reset and restart are successful, the vehicle control instructions are returned to the central integrated controller. The safety island is to open a safety core on the domain control chip of the central integrated controller. The safety core only runs functions related to vehicle safety control and monitors the operation of other cores on the domain control chip. Once other cores are found to be abnormal, they are restarted and initialized, and real-time driving instructions for vehicle safety are immediately output, waiting for other cores to work normally again.

[0052] like Figure 2 As shown, this embodiment also provides a vehicle control device based on a functional safety mechanism and a central computing architecture, including:

[0053] A determination module, used to determine a failure function module of a vehicle central integrated controller;

[0054] A control module, which is used to respond to the failure of the functional module as a common module, control the vehicle to lower the high pressure and stop outputting the torque;

[0055] The control module is further used to control the failed functional module to stop running in response to the failed functional module being an independent module.

[0056] This embodiment will preset the first attribute list and the second attribute list of the functional module. The existence of the attribute of the functional module in the first attribute list represents that the functional module is a shared module, and the existence of the attribute of the functional module in the second attribute list represents that the functional module is an independent module. Therefore, the determination module can obtain the attribute of the functional module after the functional module fails, and judge whether the failed functional module is a shared module or an independent module by whether the attribute of the functional module exists in the first attribute list or the second attribute list. For example, the attribute may be the number of each module, such as the attributes of the domain control chip, power circuit, communication circuit, clock circuit, peripheral drive circuit, sampling circuit, operating system, underlying drive and configuration software module, APP, peripheral drive software module, and sampling software module may be 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, and 11, respectively. Taking the first attribute list including the power circuit, communication circuit, clock circuit, domain control chip, target operating system (assuming that the central integrated controller has only one operating system, the target operating system is the only operating system), the attributes of the underlying drive and configuration software module, and the second attribute list including the attributes of the peripheral drive circuit, sampling circuit, APP, peripheral drive software module, and sampling software module as an example, the first attribute list includes numbers 1, 2, 3, 4, 7, and 8, and the second attribute list includes numbers 5, 6, 9, 10, and 11.

[0057] Assuming that the attribute of the failed functional module is 4, and 4 exists in the first attribute list, it means that the failure of the functional module will affect the safety of the vehicle, so the control module will control the vehicle to lower the high pressure and stop outputting torque to ensure the safety of the vehicle. Assuming that the attribute of the failed functional module is 5, and 5 exists in the second attribute list, it means that the failure of the functional module will not affect the safety of the vehicle, so the control module will only interrupt the function of the functional module, and the functions of other functional modules are normal, thereby improving the usability of the vehicle on the basis of ensuring the safety of the vehicle.

[0058] In this embodiment, the safety of the vehicle must be guaranteed. After any common module fails, the vehicle should be controlled to enter a safe state. Therefore, the scope covered by the common module should be as comprehensive as possible. The common module should include power circuit, communication circuit, clock circuit, domain control chip, target operating system (if the central integrated controller has only one operating system, the target operating system is the only operating system; if the central integrated controller has multiple operating systems, the target operating system is the operating system used to implement vehicle safety-related operations), bottom-level driver and configuration software modules. The scope covered by the independent module should also be as comprehensive as possible, but the usability of the vehicle is not necessarily guaranteed. After an independent module fails, only the function of the independent module can be interrupted. Of course, the vehicle can also be controlled to enter a safe state, although it will reduce the usability of the vehicle. Therefore, it is best for the independent module to include all independent modules, but it can also include only one or several of all independent modules, that is, the independent module can include any one or more of the peripheral drive circuit, sampling circuit, APP, peripheral drive software module and sampling software module. If the central integrated controller has multiple operating systems, the independent module can include any one or more of the operating system, peripheral drive circuit, sampling circuit, APP, peripheral drive software module and sampling software module other than the target operating system.

[0059] In this embodiment, the control module controls the vehicle to lower the high voltage and stop outputting the torque, which may specifically include: interrupting the network communication of the vehicle; the sub-controller and the execution unit under the central integrated controller cut off the high voltage of the vehicle and stop outputting the torque after detecting that the network communication of the vehicle is interrupted. The network communication of the vehicle may include CAN and Ethernet communication, so that the sub-controller and the execution unit can be triggered to cut off the high voltage of the vehicle and stop outputting the torque by interrupting the communication.

[0060] For a central integrated controller with only one operating system, in the prior art, all APPs directly call the functions and services of the target operating system to realize their own functions. Since each APP is coupled with the target operating system, the possibility of causing the target operating system to fail when the APP fails is very high, that is, the failure of the independent module causes the vehicle to enter a safe state, which reduces the usability of the vehicle. In this embodiment, the target operating system and APP can also be designed to reduce the risk of failure of the target operating system, thereby improving the usability of the vehicle. That is, the target APP on the domain control chip is set to directly call the functions and services of the target operating system, and other APPs on the domain control chip call the functions and services of the target operating system through the target APP. The target APP is an APP trusted by the domain control chip, and the probability of the target APP itself failing is low, so the possibility of the target APP causing the target operating system to fail is low. Other APPs on the domain control chip call the functions and services of the target operating system through the target APP, which is equivalent to the decoupling of other APPs from the target operating system. When other APPs fail, only the target APP will fail, but not the target operating system. Only the failed other APPs and the target APP can be interrupted, thereby improving the usability of the vehicle.

[0061] In addition to controlling the vehicle to enter a safe state after the common module fails, this embodiment can also ensure the safety of the vehicle after the common module fails by setting hardware heterogeneous redundancy and safety islands. Specifically, heterogeneous redundancy is to add a low-computing power and high-reliability backup chip outside the domain control chip of the central integrated controller. The backup chip has a backup power supply and backup clock that are independent of the domain control chip power supply and clock. When the common hardware of the central integrated controller fails, the backup chip is immediately started to operate. The functions related to vehicle safety control are running on the backup chip, which can ensure the safe operation of the vehicle, while waiting for the reset and restart of the central integrated controller. If the reset and restart are successful, the vehicle control instructions are returned to the central integrated controller. The safety island is to open a safety core on the domain control chip of the central integrated controller. The safety core only runs functions related to vehicle safety control and monitors the operation of other cores on the domain control chip. Once other cores are found to be abnormal, they are restarted and initialized, and real-time driving instructions for vehicle safety are immediately output, waiting for other cores to work normally again.

[0062] Based on the same inventive concept as the vehicle control method based on the functional safety mechanism and the central computing architecture described above, this embodiment also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any of the vehicle control methods based on the functional safety mechanism and the central computing architecture described above when executing the program. The electronic device of this embodiment obtains the attributes of the functional module after the functional module of the vehicle central integrated controller fails. If the attributes of the functional module exist in the first attribute list, it means that the failure of the functional module will affect the safety of the vehicle. The present invention will control the vehicle to lower the high pressure and stop the output torque to ensure the safety of the vehicle; if the attributes of the functional module exist in the second attribute list, it means that the failure of the functional module will not affect the safety of the vehicle. The present invention will only interrupt the function of the functional module, and the functions of other functional modules are normal, which can improve the usability of the vehicle on the basis of ensuring the safety of the vehicle.

[0063] Among them, the bus architecture (represented by the bus), the bus can include any number of interconnected buses and bridges, and the bus links various circuits including one or more processors represented by the processor and memory represented by the memory. The bus can also link various other circuits such as peripherals, voltage regulators, and power management circuits together, which are all well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the receiver and transmitter. The receiver and transmitter can be the same element, namely a transceiver, which provides a unit for communicating with various other devices on a transmission medium. The processor is responsible for managing the bus and general processing, while the memory can be used to store data used by the processor when performing operations.

[0064] Since the electronic device introduced in this embodiment is an electronic device used to implement the vehicle control method based on the functional safety mechanism and the central computing architecture in the embodiment of the present invention, based on the vehicle control method based on the functional safety mechanism and the central computing architecture introduced in the embodiment of the present invention, the technical personnel of the field can understand the specific implementation of the electronic device of the present embodiment and its various variations, so how the electronic device implements the method in the embodiment of the present invention is not described in detail here. As long as the technical personnel of the field implement the electronic device used in the vehicle control method based on the functional safety mechanism and the central computing architecture in the embodiment of the present invention, it belongs to the scope of protection of the present invention.

[0065] Based on the same inventive concept as the above-mentioned vehicle control method based on functional safety mechanism and central computing architecture, the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements any of the above-mentioned vehicle control methods based on functional safety mechanism and central computing architecture.

[0066] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0067] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0068] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0069] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0070] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0071] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A vehicle control method based on functional safety mechanism and central computing architecture, characterized in that: include: Determine the failed functional module of the vehicle central integrated controller; In response to the functional module being a common module, controlling the vehicle to lower high pressure and stop outputting torque; In response to the functional module being an independent module, controlling the functional module to stop running; The shared modules include power supply circuit, communication circuit, clock circuit, domain control chip, target operating system, bottom-level driver and configuration software module; The target operating system is an operating system used to implement vehicle safety-related operations; The target APP on the domain control chip directly calls the functions and services of the target operating system, and other APPs on the domain control chip call the functions and services of the target operating system through the target APP.

2. The vehicle control method based on functional safety mechanism and central computing architecture as claimed in claim 1, characterized in that: The independent module includes any one or more of a peripheral driving circuit, a sampling circuit, an APP, a peripheral driving software module and a sampling software module.

3. The vehicle control method based on functional safety mechanism and central computing architecture as claimed in claim 1 or 2, characterized in that: The independent module includes an operating system other than the target operating system.

4. The vehicle control method based on functional safety mechanism and central computing architecture as claimed in claim 1, characterized in that: The controlling the vehicle to lower the high pressure and stop outputting the torque comprises: Disrupt the vehicle's network communications; The sub-controller and the execution unit under the central integrated controller cut off the vehicle high voltage and stop outputting torque after detecting that the network communication of the vehicle is interrupted.

5. A vehicle control device based on a functional safety mechanism and a central computing architecture, the device being used to implement a vehicle control method based on a functional safety mechanism and a central computing architecture as claimed in any one of claims 1 to 4, characterized in that: include: A determination module, used to determine a failure function module of a vehicle central integrated controller; A control module, for controlling the vehicle to lower the high pressure and stop outputting the torque in response to the functional module being a common module; The control module is further used to control the function module to stop running in response to the function module being an independent module.

6. An electronic device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the vehicle control method based on the functional safety mechanism and the central computing architecture as described in any one of claims 1 to 4 is implemented.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the vehicle control method based on a functional safety mechanism and a central computing architecture as described in any one of claims 1 to 4.

Images