Vehicle power loss safety control method, device, equipment and storage medium

Abstract

The application provides a vehicle power loss safety control method, device, equipment and storage medium, the method comprises the following steps: acquiring the state information of the vehicle in real time and storing; if it is detected that the first vehicle controller fails, the first vehicle controller is reset, and it is judged whether the first vehicle controller restarts within the first preset time; if it is not restarted within the first preset time, the first vehicle controller is determined as a fault point, and the second vehicle controller is triggered to switch, wherein the first and second vehicle controllers form redundant control; it is judged whether the second vehicle controller completes the switching within the second preset time, if yes, the second vehicle controller performs redundant control according to the state information; if not, a safety control strategy is executed and an alarm is given, the application adopts the above-mentioned mode to avoid the external power abnormality, improves the driving experience, avoids the safety hidden danger caused by the power loss, and greatly improves the driving safety of the vehicle.

Description

Technical Field

[0001] This invention relates to the field of automotive technology, and in particular to a method, device, equipment, and storage medium for vehicle power loss safety control. Background Technology

[0002] The booming development of new energy vehicles has allowed people to enjoy the green, economical, and convenient benefits they bring. At the same time, the safety of the entire vehicle has also received special attention. Among them, the vehicle control unit (VCU) is the core control component in new energy vehicles and serves as the control center for various subsystems.

[0003] However, in related technologies, the vehicle controller, as the brain of a new energy vehicle, will reset to eliminate the fault and enter a safe state if the vehicle experiences a serious random hardware failure or software malfunction during operation. It will be unable to return to the state before the fault, resulting in power interruption, which poses a safety hazard, violates the functional safety objectives of the power system, and is prone to causing unexpected power loss. Summary of the Invention

[0004] To provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. This summary is not intended as a general commentary, nor is it intended to identify key / important components or describe the scope of protection of these embodiments, but rather as a prelude to the detailed description that follows.

[0005] In view of the shortcomings of the prior art described above, the present invention discloses a vehicle power loss safety control method, device, equipment and storage medium, which is used to solve the problem of power interruption or loss caused by the restart of the vehicle controller due to a fault.

[0006] In a first aspect, this application provides a vehicle power loss safety control method, the method comprising: acquiring and storing the vehicle's status information in real time; if a fault is detected in a first vehicle controller, resetting the first vehicle controller and determining whether the first vehicle controller has restarted within a first preset time; if it has not restarted within the first preset time, determining the first vehicle controller as a fault point and triggering a second vehicle controller to switch, wherein the first and second vehicle controllers form redundant control; determining whether the second vehicle controller has switched within a second preset time, if it has, performing redundant control based on the status information; if it has not, determining that both the first and second vehicle controllers are faulty, executing a safety control strategy and issuing an alarm.

[0007] In some embodiments of the first aspect of the present invention, determining whether the first vehicle controller has completed a restart within a first preset time further includes: if the restart is completed within the first preset time, determining whether the battery and motor in the vehicle are faulty; if so, performing fault handling based on the fault information fed back by the battery and the motor; if not, controlling the first vehicle controller to restore the state before the fault based on the state information, wherein the first preset time is less than the second preset time.

[0008] In some embodiments of the first aspect of the present invention, controlling the first vehicle controller to restore the state before the fault based on the state information includes: reading the stored state information, the state information including the vehicle's driving state, gear state, high voltage state and motor state; determining the latest state information before the fault occurred as the recovery state; and controlling the vehicle's driving state, gear state, high voltage state and motor state to restore to the state before the fault occurred based on the recovery state.

[0009] In some embodiments of the first aspect of the present invention, the second vehicle controller performs redundant control based on the status information, including: the second vehicle controller reading the stored status information, the status information including the vehicle's driving status, gear status, high voltage status, and motor status; the second vehicle controller generating different control commands to the battery controller, motor controller, and gear position in the vehicle based on the latest status information before the fault occurred, so that the battery controller, the motor controller, and the gear position respond respectively, thereby restoring the vehicle to the state before the fault occurred.

[0010] In some embodiments of the first aspect of the present invention, determining that the first and second vehicle controllers are faulty, executing a safety control strategy and issuing an alarm includes: if it is determined that the first vehicle controller and the second vehicle controller are faulty at the same time, executing a safety control strategy on the vehicle, the safety control strategy including at least one of the following: performing a torque reduction operation on the motor controller, performing a high voltage reduction operation on the battery controller, controlling the gear to enter neutral, generating a diagnostic fault code; storing the diagnostic fault code, and displaying the diagnostic fault code based on a human-machine interface to provide a warning to the driver.

[0011] In some embodiments of the first aspect of the present invention, the first controller and the second controller respectively input different pedal signals, and the first controller and the second controller respectively configure CAN buses with different identifiers for output, forming a redundant control system. If the battery controller receives a CAN bus with a different identifier, it responds to the control command transmitted by the CAN bus corresponding to the identifier of the second controller through pre-arbitration logic; if the motor controller receives a CAN bus with a different identifier, it responds to the control command transmitted by the CAN bus corresponding to the identifier of the second controller through pre-arbitration logic.

[0012] In some embodiments of the first aspect of the present invention, the second vehicle controller generates different control commands for the vehicle's battery controller, motor controller, and gear position based on the latest state information prior to the fault, including: determining the vehicle's speed information, power pedal deformation, and environmental information; if the environmental information indicates a slippery road surface and the vehicle speed information does not exceed a preset speed, determining a first control command for the gear position based on the latest gear position status of the vehicle prior to the fault; if the environmental information indicates a slippery road surface and the vehicle speed information does not exceed a preset speed, determining a second control command for the battery controller based on the latest high-voltage status of the vehicle prior to the fault; if the environmental information indicates a slippery road surface and the vehicle speed information does not exceed a preset speed, adjusting the motor speed in response to the power pedal deformation based on the latest motor status of the vehicle prior to the fault, and determining a third control command for the motor controller.

[0013] In some embodiments of the first aspect of the present invention, before acquiring the vehicle's status information in real time, the method further includes: determining the vehicle's driving status; if the vehicle is in a driving state, then triggering the acquisition of the vehicle's status information; if the vehicle is not in a driving state, then no processing is performed.

[0014] In some embodiments of the first aspect of the present invention, after executing the safety control strategy and issuing an alarm, the method further includes: monitoring the torque in the vehicle's driving state, determining the torque range to which the torque difference between the torque and a preset torque belongs; determining the corresponding safety state based on the torque range to which the torque difference belongs; and executing the safety strategy corresponding to the safety state. The torque range includes: a first range, a second range, and a third range; wherein, each torque difference in the first range is greater than a first threshold and less than or equal to a second threshold; each torque difference in the second range is greater than the second threshold and less than or equal to a third threshold; each torque difference in the third range is greater than the third threshold; and the first threshold is less than the second threshold. The second threshold is less than the third threshold; the first interval corresponds to the first safety state, the second interval corresponds to the second safety state, and the third interval corresponds to the third safety state; the first safety strategy corresponding to the first safety state includes controlling the vehicle speed to be less than or equal to the current speed, issuing an alarm through the instrument panel, and limping at a speed less than or equal to the target preset speed after reset and restart; the second safety strategy corresponding to the second safety state includes controlling the vehicle speed to be less than or equal to the current speed, issuing an alarm through the instrument panel and voice, and losing power after reset and restart; the third safety strategy corresponding to the third safety state includes issuing an alarm through the instrument panel and voice, and losing power after a third preset time.

[0015] Secondly, this application provides a vehicle power loss safety control device, the device comprising: an information acquisition module for acquiring and storing the vehicle's status information in real time; a fault detection module for resetting the first vehicle controller if a fault is detected, and determining whether the first vehicle controller has completed a restart within a first preset time; a fault determination module for determining the first vehicle controller as a fault point if a restart is not completed within the first preset time, and triggering the second vehicle controller to switch, wherein the first and second vehicle controllers form redundant control; and a safety control module for determining whether the second vehicle controller has completed a switch within a second preset time. If it has, the second vehicle controller performs redundant control based on the status information; if it has not, it determines that the first and second vehicle controllers are faulty, executes a safety control strategy, and issues an alarm.

[0016] Thirdly, this application provides an electronic device, including: one or more processors; and a storage device for storing one or more programs, which, when executed by one or more processors, cause the electronic device to implement the vehicle power loss safety control method described in the first aspect.

[0017] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a computer's processor, causes the computer to perform the vehicle power loss safety control method described in the first aspect.

[0018] As described above, the vehicle power loss safety control method, device, equipment, and storage medium provided by the embodiments of the present invention have the following beneficial effects:

[0019] This invention monitors the vehicle's status information during operation. If a fault is detected in the first vehicle controller, a reset operation is performed on the first vehicle controller to eliminate the fault and enter a safe state. It then determines whether the first vehicle controller has completed the restart within a first preset time. If it has not completed the restart within the first preset time, the first vehicle controller is identified as the fault point, triggering the second vehicle controller to switch. It then determines whether the second vehicle controller has completed the switch within a second preset time. If it has, the second vehicle controller performs redundant control based on the status information. If it has not completed the switch, both the first and second vehicle controllers are identified as faulty, a safety control strategy is executed, and an alarm is triggered.

[0020] By forming a redundant control architecture using the first and second vehicle controllers, on the one hand, in the event of a failure in the first vehicle controller, the system can switch to the second vehicle controller for redundant control. Simultaneously, based on status information, the vehicle is restored to its pre-failure state. This rapid self-recovery mechanism avoids external power anomalies and improves the driving experience. On the other hand, by determining whether the first vehicle controller restarts within a preset time, a tiered safety handling method is established. If it restarts within the preset time, the first vehicle controller resumes operation after self-recovery. If it fails to restart within the preset time, the redundant second vehicle controller takes over control. This prevents the loss of powertrain capabilities and avoids safety hazards, significantly improving vehicle driving safety. If a failure is confirmed in both the first and second vehicle controllers, a safety control strategy is implemented and an alarm is triggered, thereby ensuring driver safety.

[0021] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0022] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings:

[0023] Figure 1 This is a schematic diagram of an application environment for a vehicle power loss safety control method according to one embodiment of this application;

[0024] Figure 2 This is a flowchart of a vehicle power loss safety control method according to one embodiment of this application;

[0025] Figure 3 This is another flowchart of a vehicle power loss safety control method in one embodiment of this application;

[0026] Figure 4 This is a schematic diagram of the vehicle power loss safety control method in one embodiment of this application;

[0027] Figure 5 This is a flowchart illustrating the implementation of a vehicle power loss safety control method in one embodiment of this application;

[0028] Figure 6 This is a complete flowchart of a vehicle power loss safety control method according to one embodiment of this application;

[0029] Figure 7 This is a block diagram of a vehicle power loss safety control device according to one embodiment of this application;

[0030] Figure 8 This is a schematic diagram of the structure of an electronic device in one embodiment of this application. Detailed Implementation

[0031] The embodiments of the present invention will be described below with reference to the accompanying drawings and preferred embodiments. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred embodiments are only for illustrating the present invention and not for limiting the scope of protection of the present invention.

[0032] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. Therefore, the drawings only show the components related to the present invention and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0033] In the following description, numerous details are explored to provide a more thorough explanation of embodiments of the invention. However, it will be apparent to those skilled in the art that embodiments of the invention may be practiced without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring embodiments of the invention.

[0034] This invention provides a vehicle power loss safety control method, which can be applied to a terminal, a server, or software running on either a terminal or a server. In some embodiments, the terminal can be an electronic device such as a vehicle terminal, smartphone, tablet, laptop, or desktop computer; if the terminal is an electronic device such as a smartphone, tablet, laptop, or desktop computer, it is embedded in the vehicle to form a central control system similar to a smart cockpit; additionally, the server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, and big data and artificial intelligence platforms, remotely controlling the vehicle via a wireless network (4 / 5 / 6G); the software can be an application for vehicle power loss safety control, but is not limited to the above forms.

[0035] For example, see Figure 1 Taking the vehicle power loss safety control method executed by the vehicle terminal as an example, when the vehicle terminal detects a fault in the first vehicle controller, it can perform a reset operation on the first vehicle controller and determine whether the first vehicle controller has completed a restart within a first preset time. If it has not completed a restart within the first preset time, the first vehicle controller is determined to be the fault point, and the second vehicle controller is triggered to switch, wherein the first and second vehicle controllers form redundant control. It is determined whether the second vehicle controller has completed a switch within a second preset time. If it has, the second vehicle controller performs redundant control according to the status information. If it has not completed, the first and second vehicle controllers are determined to be faulty, the safety control strategy is executed, and an alarm is triggered.

[0036] The present invention will now be described in detail through specific embodiments. Please refer to [link / reference]. Figure 2 As shown, Figure 2 A flowchart illustrating a vehicle power loss safety control method provided in an embodiment of the present invention includes the following steps:

[0037] Step S210: Acquire and store the vehicle's status information in real time;

[0038] Specifically, since the vehicle controller is generally located in new energy vehicles, while fuel vehicles often do not include a vehicle controller, the vehicles in this embodiment include, but are not limited to, hybrid electric vehicles (HEV), battery electric vehicles (BEV), fuel cell electric vehicles (FCEV), and other new energy vehicles (such as supercapacitors, flywheels, and other high-efficiency energy storage devices).

[0039] It should be understood that the vehicle's status information includes the vehicle's driving status, gear status, high voltage status, and motor status. This information is collected and stored in real time. Specifically, the information from the first or second vehicle controller is stored in an electrically erasable programmable read-only memory (EEPROM). The first or second vehicle controller can read the EEPROM data, and the data in the EEPROM will not be lost after power is off. On the one hand, this allows for real-time monitoring of the vehicle's status; on the other hand, it helps the vehicle to self-recover its status and functions based on the status information after a malfunction.

[0040] Optionally, before acquiring the vehicle's status information in real time, the following steps are also included:

[0041] Determine the vehicle's driving status. If the vehicle is in a driving state, trigger the acquisition of the vehicle's status information and execute step S210; if the vehicle is not in a driving state, do not process it, that is, end the processing flow.

[0042] In this embodiment, the present invention is mainly aimed at the technical defect of power interruption or loss caused by the failure of the vehicle controller during vehicle operation.

[0043] Step S220: If a fault is detected in the first vehicle controller, a reset operation is performed on the first vehicle controller, and it is determined whether the first vehicle controller has completed the restart within a first preset time.

[0044] Specifically, by collecting data reflecting the normal or abnormal status of the first vehicle controller, a fault is determined based on the normal or abnormal status. After identifying the first vehicle controller, a reset operation is performed to restart it; and it is determined whether the first vehicle controller has restarted within a first preset time.

[0045] For example, if the fault occurs at time T0, and the time period during which the fault can be recovered is the first preset time T1, the recovery method of the first vehicle controller is determined by whether the restart is completed within the first preset time.

[0046] Step S230: If the restart is not completed within the first preset time, the first vehicle controller is identified as the fault point, and the second vehicle controller is triggered to switch. The first and second vehicle controllers form redundant control.

[0047] Specifically, by checking whether a restart is completed within the first preset time T1, it is determined whether the fault occurred in the first vehicle controller. At the same time, since the first and second vehicle controllers form a redundant control architecture, the second vehicle controller is triggered to switch over and use the second vehicle controller as the control scheme to receive and process relevant services.

[0048] By using the above methods, it is possible to determine whether the fault point is the first vehicle controller, which helps to troubleshoot the cause of the fault. At the same time, by responding with graded safety measures, the safety of vehicle control can be ensured.

[0049] Step S240: Determine whether the second vehicle controller has completed the switching within a second preset time. If it has, the second vehicle controller performs redundant control based on the status information. If it has not, determine that the first and second vehicle controllers are faulty, execute the safety control strategy, and issue an alarm.

[0050] Optionally, the second vehicle controller performs redundant control based on status information, including:

[0051] The second vehicle controller reads the stored status information, which includes the vehicle's driving status, gear status, high voltage status, and motor status.

[0052] The second vehicle controller generates different control commands to the battery controller, motor controller, and gear shifter based on the latest status information before the fault occurred, so that the battery controller, motor controller, and gear shifter respond respectively, and the vehicle returns to the state before the fault occurred.

[0053] By employing the above methods, even with redundant control using a second vehicle controller, vehicle driving safety can be ensured by switching control modes. Furthermore, the second vehicle controller can restore control using the latest status information, maintaining the services performed by the vehicle before the failure of the first vehicle controller, thus improving the driving experience.

[0054] In some embodiments, the second vehicle controller generates different control commands to the vehicle's battery controller, motor controller, and gear shift based on the latest status information prior to the fault, including:

[0055] Determine the vehicle's speed, accelerator pedal deformation, and environmental information;

[0056] If the environmental information indicates a slippery road surface and the vehicle speed information does not exceed the preset speed, the first control command for the gear is determined based on the vehicle's latest gear status before the fault occurred.

[0057] If the environmental information indicates a slippery road surface and the vehicle speed information does not exceed the preset vehicle speed, the second control command generated for the battery controller is determined based on the latest high voltage status of the vehicle before the fault occurs.

[0058] If the environmental information indicates a slippery road surface and the vehicle speed information does not exceed the preset speed, based on the latest motor status of the vehicle before the fault occurred, the motor speed is adjusted in response to the deformation of the power pedal, and a third control command is generated for the motor controller.

[0059] Specifically, the system detects the vehicle's current environmental information and speed information to determine whether the road surface is slippery and whether the vehicle speed exceeds the preset speed. If the road surface is slippery and the speed does not exceed the preset speed, a first control command is generated for the gear based on the vehicle's latest gear status before the fault occurred. For example, the first control command keeps the gear unchanged before and after the fault. If the road surface is slippery and the speed exceeds the preset speed, the gear is downshifted after the fault is resolved, for example, downshifting from 4th gear to 3rd gear. If the environmental information indicates a slippery road surface and the vehicle speed does not exceed the preset speed, a second control command is generated for the battery controller based on the vehicle's latest high-voltage status before the fault occurred. The second control command is still to maintain the battery high-voltage status. Conversely, if the preset speed is exceeded, the second control command is to discontinue maintaining the battery high-voltage status. Similarly, if the environmental information indicates a slippery road surface and the vehicle speed does not exceed the preset speed, the third control command can positively adjust (increase) the motor speed based on the deformation of the power pedal. If the preset speed is exceeded, the motor speed is directly reduced to decrease the output torque.

[0060] By using the above methods, we can prevent vehicles from failing to meet the current environmental and speed requirements after being restored based on the latest status information, both before and after a fault. In this way, we can make appropriate adjustments based on the latest status information to improve the safety performance of the vehicle after fault recovery.

[0061] Optionally, if it is determined that the first vehicle controller and the second vehicle controller fail simultaneously, a safety control strategy is implemented for the vehicle. The safety control strategy includes at least one of the following: performing a torque reduction operation on the motor controller (torque margin torque reduction to reduce the motor output torque), performing a high voltage reduction operation on the battery controller, controlling the gear to enter neutral, generating a diagnostic fault code; storing the diagnostic fault code, and displaying the diagnostic fault code based on the human-machine interface to provide a warning to the driver.

[0062] Specifically, since high-voltage batteries mean high energy density and a high discharge platform, under the same usage conditions, high-voltage batteries can release more capacity. By operating the battery under high voltage and switching the battery from high voltage to normal voltage, the risk of the battery being uncontrolled by the vehicle controller can be effectively reduced.

[0063] In response to the special situation where both the vehicle controller (first vehicle controller) and the safety backup system (second vehicle controller) malfunction simultaneously, the above method proposes to alert the driver via HMI (human-machine interface) to inform them that a serious malfunction has occurred in the vehicle and that the driver needs to brake and steer the vehicle to a safe location.

[0064] In some embodiments, the first controller and the second controller respectively input different pedal signals, and the first controller and the second controller respectively configure CAN buses with different identifiers for output, forming a redundant control system.

[0065] If the battery controller receives a CAN bus with a different identifier, it responds to the control command transmitted by the CAN bus corresponding to the second controller identifier through pre-arbitration logic.

[0066] If the motor controller receives a CAN bus with a different identifier, it responds to the control command transmitted by the CAN bus corresponding to the second controller identifier through pre-arbitration logic.

[0067] See details Figure 4 The schematic diagram of the vehicle power loss safety control method in one embodiment of this application shows that the first vehicle controller and the second vehicle controller use the same CAN bus to obtain the gear position signal and the same CAN bus to obtain the vehicle speed signal, respectively, and use different hardwires to obtain the pedal signal. For example, the first vehicle controller uses one hardwire to obtain pedal signal 1, and the second vehicle controller uses another hardwire to obtain pedal signal 2. The first vehicle controller includes input signal processing 1 for receiving, and the second vehicle controller includes input signal processing 2 for receiving. At the same time, the first vehicle controller uses CAN bus ID1 (CAN ID) to transmit control commands, and the second vehicle controller uses CAN bus ID2 to transmit control commands.

[0068] In this embodiment, the vehicle control unit (VCU) and the safety backup system employ independent hard-wired pedal signal inputs and independent CAN ID outputs to avoid related failures. Interaction via different CAN IDs prevents abnormal network communication congestion. Furthermore, the ID arbitration function is deployed at the actuator end; considering that the actuator is already a high-function safety level controller, adding this function does not increase the overall system cost.

[0069] In summary, by monitoring the vehicle's status information during operation, if a fault is detected in the first vehicle controller, a reset operation is performed on the first vehicle controller to eliminate the fault and enter a safe state. It is then determined whether the first vehicle controller completes the restart within a first preset time. If it fails to restart within the first preset time, the first vehicle controller is identified as the fault point, triggering a switchover of the second vehicle controller. It is then determined whether the second vehicle controller completes the switchover within a second preset time. If it does, the second vehicle controller performs redundant control based on the status information. If it fails, both the first and second vehicle controllers are identified as faulty, a safety control strategy is executed, and an alarm is triggered.

[0070] By forming a redundant control architecture using the first and second vehicle controllers, on the one hand, in the event of a failure in the first vehicle controller, the system can switch to the second vehicle controller for redundant control. Simultaneously, based on status information, the vehicle is restored to its pre-failure state. This rapid self-recovery mechanism avoids external power anomalies and improves the driving experience. On the other hand, by determining whether the first vehicle controller restarts within a preset time, a tiered safety handling approach is established. If it restarts within the preset time, the first vehicle controller resumes operation after self-recovery. If it fails to restart within the preset time, the redundant second vehicle controller takes over control. This prevents the loss of powertrain capabilities and avoids safety hazards, significantly improving vehicle driving safety. If a failure is confirmed in both the first and second vehicle controllers, a safety control strategy is implemented and an alarm is triggered, thereby ensuring driver safety.

[0071] In some embodiments, please refer to Figure 3 Another flowchart of the vehicle power loss safety control method in one embodiment of this application is described in detail below:

[0072] With the above Figure 2 The difference in the Chinese embodiment is that determining whether the first vehicle controller has completed the restart within a first preset time also includes:

[0073] Step S250: If the restart is completed within the first preset time, determine whether the battery and motor in the vehicle are faulty; if so, perform fault handling based on the fault information fed back by the battery and motor; if not, control the first vehicle controller to restore the state before the fault based on the status information, and the first preset time is less than the second preset time.

[0074] Specifically, after the reset is completed within the first preset time T1, the vehicle controller receives the bus signals from each controller, performs logical judgment, and determines whether there is a fault in the battery, motor, etc. after the reset. If so, the fault handling module in the vehicle controller performs the corresponding fault handling; if not, the vehicle controller receives the fault information fed back by the motor and battery, performs fault handling, and no longer automatically restores to the state before the reset.

[0075] The vehicle controller performs system fault self-recovery by reading the vehicle's drivable state, gear state, high voltage state, and motor state stored in the EEPROM before the reset and restart, and using them as the target state to automatically restore the vehicle to a drivable state. The power supply automatically re-enters high voltage, and the gear re-enters D gear.

[0076] It should be noted that both the first preset time and the second preset time in this invention are in the millisecond range. By taking millisecond-level time values, it is ensured that the driver can complete the fault recovery and switching without noticing, thus ensuring that the driver's driving experience is not reduced.

[0077] In this embodiment, a safety backup system is added to the self-recovery design of the system fault function, enabling the entire powertrain system to meet the ASIL D functional safety level at its highest. Furthermore, this invention can support the "fail-operational operability" safety requirements of advanced intelligent driving systems for the powertrain system.

[0078] Please see Figure 4 This is a schematic diagram of the principle architecture of a vehicle power loss safety control method in one embodiment of this application; it includes an external input CAN signal, input signal processing 1 and input signal processing 2, a power management chip SBC, microcontroller units MCU1 and MCU2, an electrically erasable programmable read-only memory EEPROM, an output CAN signal, an HMI system, a motor controller and a battery controller.

[0079] Input signal processing is used to process received external inputs, including pedal signals, gear signals, vehicle speed signals, motor controller feedback signals, battery controller feedback signals, etc.

[0080] Pedal signal 1 and pedal signal 2 are treated as independent hard-wired signals and are input to input signal processing 1 and input signal processing 2 respectively for processing, so as to avoid the power control of MCU2 being affected by the failure of MCU1.

[0081] The microcontroller unit MCU1 is responsible for the overall vehicle control logic processing, including but not limited to functional modules such as motor coordination control, battery coordination control, and gear control management. This functional module performs logic jumps according to different conditions.

[0082] As a safety backup system, the microcontroller unit MCU2 monitors MCU1 in real time through methods including but not limited to GPIO, SPI, Ethernet, etc., to determine whether the self-recovery mechanism of the vehicle controller fault function has timed out, and provides the vehicle controller degradation function in the fault state, so that torque and power will be safely limited.

[0083] Microcontroller unit MCU1 and microcontroller unit MCU2 determine whether the vehicle is in motion by the input vehicle speed signal and valid vehicle speed signal, as well as their own power supply status.

[0084] The power management chip SBC acts as an external watchdog, responsible for monitoring the microcontroller unit MCU1. By feeding the watchdog to MCU1, it diagnoses in real time whether MCU1 is in normal working condition. When the watchdog feeding of MCU1 is abnormal or MCU1 has a hardware failure, the power management chip SBC will actively reset MCU1 by pulling down the power supply pin of MCU1.

[0085] The microcontroller unit MCU1 can record and provide the reset reason, and transmit the reason record through the interface MCU_Reset Type. By taking the value of this interface, it is possible to distinguish whether the MCU1 reset is a normal reset or an abnormal reset scenario.

[0086] The electrically erasable programmable read-only memory (EEPROM) has a data interaction relationship with the microcontroller unit (MCU1). MCU1 can store the required information in the EEPROM and can also read the data from the EEPROM. The data in the EEPROM will not be lost after power-off.

[0087] The motor controller interacts with the vehicle control unit (VCU) and the safety backup system through different CAN IDs, provides real-time feedback on the motor status, and arbitrates control commands received from the VCU and the safety backup system before performing actions such as driving the motor.

[0088] The battery controller interacts with the vehicle control unit (VCU) and the safety backup system via different CAN IDs. It provides feedback on battery status and high-voltage status, and after arbitrating control commands received from the VCU and safety backup system, it performs actions such as controlling the battery to enter or exit high voltage.

[0089] When the vehicle controller is running, the microcontroller MCU1 writes key information from inside the VCU in real time: the vehicle's drivable status, gear status, high voltage status, and motor status into the EEPROM.

[0090] Furthermore, during vehicle operation, if a hardware failure occurs in the VCU within the allowable fault time T1 ms, causing the MCU1 to reset and restart, the safety backup system will be switched within the allowable fault time T2-T1 ms. During this period, the VCU is in a state of communication loss: within the allowable fault time T1 ms and T2-T1 ms, the motor controller maintains the high voltage state before the communication loss, and the battery controller maintains the relay state before the communication loss.

[0091] After the MCU resets and restarts within the allowable fault time T1 ms, it determines whether it is an abnormal reset scenario and the current real-time vehicle status. When an abnormal reset scenario occurs, and there are no other faults reported by other controllers, it directly reads the vehicle drivable status, gear status management, high voltage status management, and motor status management stored in the EEPROM before the reset and uses them as the current functional status. The internal state logic automatically jumps to the functional status stored before the reset, and the system maintains normal driving status in response to driving requests without showing any loss of power to the outside world.

[0092] MCU2 monitors MCU1 in real time. If the reset and restart exceed the allowable fault time T1 ms, it determines that MCU1 has a serious fault and switches to the safety backup system within T2-T1 ms. It also sends control commands through CAN ID2. The motor controller and battery controller are designed with arbitration logic for CAN ID1 and CAN ID2. After receiving the control command of CAN ID2, they will no longer respond to the CAN ID1 command within the current driving cycle.

[0093] If the self-recovery of functions and the switching of the safety backup system are not completed within the allowable fault time T1 to T2 ms, the battery controller and motor controller will determine that the vehicle controller is missing or abnormal, perform local fault handling, reduce the high voltage, automatically shift the gear to N to ensure driver safety, control the vehicle to enter a safe state through braking and steering, and issue an alarm through the HMI system.

[0094] Please see Figure 5 The above is a flowchart illustrating the implementation of a vehicle power loss safety control method in one embodiment of this application. The method is applied during vehicle operation, and the vehicle's travel time is used as a horizontal timeline for detailed description of the specific implementation method, as detailed below:

[0095] S101, during driving, the vehicle control unit (VCU) stores the vehicle's drivable status, gear status, high voltage status, and motor status as information in the EEPROM. This stored information in the EEPROM can only be erased and rewritten; power failure or MCU reset will not cause information loss.

[0096] At time T0, the vehicle controller malfunctions. In step S102, the system is reset and restarted to eliminate the fault. Communication is lost during the period from T0 to T1 to T2. T1 is the first preset time and T2 is the second preset time.

[0097] S103, after the system completes the reset, it reads the MCU_Reset Type interface provided by the MCU underlying layer and determines whether the last reset scenario was an abnormal reset based on the interface value;

[0098] If it is an abnormal reset, the vehicle control system will perform two operations after the reset is successful, such as S104: ① Determine that there is no fault status feedback from the motor and battery at this time; ② Read the stored vehicle drivability status, gear status, high voltage status and motor status, without having to perform the power-on process, vehicle drivability judgment and gear switching process again.

[0099] If the above conditions are met, in step S105, the system will automatically restore to the state before the fault.

[0100] During this period, S201, the motor controller maintains the high-voltage state that existed before the communication loss;

[0101] S301, The battery controller maintains the relay control state prior to the communication loss;

[0102] S401, the gear position remains in D gear control state;

[0103] S106, the vehicle controller system completes fault recovery and status recovery within the allowable fault time T1, and the vehicle continues to drive normally. At the same time, the motor controller, battery controller, and gear function respond normally to the control commands of the VCU.

[0104] If the vehicle controller fails to complete the reset and restart function self-recovery within the allowable fault time T1, S107 switches to the safety backup system;

[0105] If the safety backup system is successfully switched on within the allowable failure time T2-T1, the vehicle will enter a safe driving state. In this state:

[0106] S203, the motor controller responds to the control command of the safety backup system after arbitration;

[0107] S303, the battery controller responds to the control commands of the safety backup system after arbitration;

[0108] S403, gear response safety backup system command;

[0109] If both the vehicle control system and the safety backup system malfunction simultaneously, and the self-recovery and safety backup system switching are not completed within the allowable fault time T2, the motor controller and battery controller will record the vehicle controller loss fault and perform fault handling after the loss. The high voltage will be applied, the gear will automatically shift to neutral (N) to achieve safety protection, and the HMI system will alert the driver to take necessary measures.

[0110] Please see Figure 6 Here is a complete flowchart of a vehicle power loss safety control method according to one embodiment of this application.

[0111] Step 1: The vehicle controller determines whether the vehicle is currently in motion. If not, the process ends, as this is not within the scope of this invention. If so, proceed to Step 2.

[0112] Step 2: The vehicle controller stores the vehicle's drivability status, gear status, high voltage status, and motor status into the EEPROM in real time.

[0113] Step 3: When the vehicle controller experiences a random hardware failure or software malfunction, a reset and restart are performed via an external SBC to recover from the fault. Determine whether the restart is successful and the fault is cleared within the tolerable fault time T1. If yes, proceed to step 4. If not, proceed to step 7.

[0114] Step 4: After the reset is completed, the vehicle controller will receive the bus signals from each controller and perform logical judgment to determine whether there is a fault in the battery, motor, etc. after the reset. If so, proceed to step 5, where the vehicle controller fault handling module performs the corresponding fault handling; otherwise, proceed to step 6.

[0115] Step 5: The vehicle controller receives fault information from the motor and battery, performs fault handling, and does not automatically restore to the state before the reset.

[0116] Step 6: The vehicle controller performs system fault self-recovery, reads the vehicle drivable status, gear status, high voltage status, and motor status stored in the EEPROM before the reset and restart, and uses them as the target status to automatically restore to the drivable status. The power supply automatically re-enters the high voltage position, and the gear re-enters the D gear position.

[0117] Step 7: If the function fails to recover within the tolerable fault time T1, the vehicle controller MCU1 is deemed to have a serious fault, and the system is switched to the safety backup system.

[0118] Step 8: Determine whether the switchover was successful within the allowable fault time T2. If yes, proceed to step 9; otherwise, proceed to step 10.

[0119] Step 9: Powertrain system switch successfully completed; control commands are sent via CAN ID2. The motor controller arbitrates and responds to the safety backup system's control commands; the battery controller arbitrates and responds to the safety backup system's control commands; the gear selector responds to the safety backup system's control commands. The system enters a safe driving state.

[0120] Step 10: If the vehicle controller and safety backup system both experience serious malfunctions, resulting in unsuccessful switching, the motor battery will be de-energized and the high voltage will be reduced. The vehicle will be shifted to neutral (N) and an HMI alarm will be triggered to indicate the current serious malfunction and inform the driver to take necessary measures.

[0121] By applying the above methods to in-vehicle vehicles powered by on-the-go energy, the present invention has the following beneficial effects:

[0122] 1) Based on the existing controller architecture, a self-recovery mechanism is designed for vehicle control system faults. Utilizing the characteristics of MCU and EEPROM storage, the system stores the vehicle's drivable state, gear position, high voltage state, and motor state in real time. After an abnormal reset, the system reads these states and uses them as the current state for rapid self-recovery, without externally displaying any power abnormalities, thus improving the driving experience.

[0123] 2) A tiered safety handling mechanism is established: self-recovery of functions, switching to the safety backup system, and vehicle fault exit, covering safety handling methods for almost all vehicle control system failures. Specifically, within the permissible fault time T1, the vehicle controller continues to respond to driving requests via self-recovery; after T1, it switches to the safety backup system to respond to driving requests. The application of these two mechanisms prevents the loss of powertrain capabilities and avoids safety hazards for drivers; this design is industry-leading. If both the vehicle controller and the safety backup system malfunction simultaneously, the system will automatically reduce high voltage and shift to neutral (N) after the permissible fault time T2, ensuring driver safety.

[0124] 3) In addition to the self-recovery design for system failure functions, a safety backup system is added, enabling the entire powertrain system to meet the ASIL D functional safety level at its highest. Furthermore, this invention can support the "fail-operational operability" safety requirements of advanced intelligent driving systems for the powertrain system.

[0125] 4) The vehicle control unit (VCU) and safety backup system employ independent hard-wired pedal signal inputs and independent CAN ID outputs, avoiding related failures. Interaction via different CAN IDs prevents abnormal network communication blockages. Furthermore, the ID arbitration function is deployed at the actuator end; considering that the actuator is already a high-functionality safety level controller, adding this function does not increase the overall system cost.

[0126] 5) The system safety design does not consider the scenario where the main control system and the safety backup system are abnormal at the same time. In view of the special situation where the vehicle controller and the safety backup system are abnormal at the same time, this invention proposes to alert the driver through HMI to inform the driver that the vehicle has a serious fault and that the driver needs to brake and steer the vehicle to a safe location.

[0127] In some embodiments, after executing the security control policy and triggering an alarm, the system further includes:

[0128] The system monitors the torque during vehicle operation and determines the torque range to which the torque difference between the measured torque and a preset torque belongs. Based on the torque range to which the torque difference belongs, it determines the corresponding safety state and executes the safety strategy corresponding to the safety state. The torque ranges include: a first range, a second range, and a third range. In the first range, each torque difference is greater than a first threshold and less than or equal to a second threshold; in the second range, each torque difference is greater than the second threshold and less than or equal to a third threshold; in the third range, each torque difference is greater than the third threshold. The first threshold is less than the second threshold, and the second threshold is less than the third threshold. The first range corresponds to a first safety state, the second range to a second safety state, and the third range to a third safety state. The first safety strategy corresponding to the first safety state includes controlling the vehicle speed to be less than or equal to the current speed, issuing a warning via the instrument panel, and limping at a speed less than or equal to a target preset speed after a reset and restart. The second safety strategy corresponding to the second safety state includes controlling the vehicle speed to be less than or equal to the current speed, issuing a warning via the instrument panel and voice prompts, and losing power after a reset and restart. The third safety strategy corresponding to the third safety state includes issuing a warning via the instrument panel and voice prompts, and losing power after a third preset time.

[0129] In dynamic situations, since the car is moving at a relatively high speed, losing power directly could be dangerous. Therefore, a warning is given first to allow the driver sufficient reaction time and time to take appropriate measures before power is lost.

[0130] In one feasible approach, the above-mentioned determination of the corresponding safety state based on the torque difference and the driving state, and the execution of the safety strategy corresponding to the safety state, includes: when the vehicle's driving state is dynamic, determining the torque range to which the torque difference belongs; determining the corresponding safety state based on the torque range to which the torque difference belongs; and executing the safety strategy corresponding to the safety state.

[0131] In this embodiment, when the torque control device determines the corresponding safety state based on the torque difference and the driving state, since the car is always in a driving state, it only needs to determine the torque range to which the torque difference belongs, and each torque range corresponds to a safety state.

[0132] In one feasible embodiment, the torque range includes: a first range, a second range, and a third range; wherein, the torque difference in the first range is greater than a first threshold and less than or equal to a second threshold; the torque difference in the second range is greater than the second threshold and less than or equal to a third threshold; the torque difference in the third range is greater than the third threshold; wherein, the first threshold is less than the second threshold and the second threshold is less than the third threshold; wherein, the first range corresponds to a first safety state, the second range corresponds to a second safety state, and the third range corresponds to a third safety state.

[0133] In this embodiment, the torque can be divided into three ranges: a first threshold, a second threshold, and a third threshold, which can be 230 Nm, 330 Nm, and 530 Nm, respectively. That is, the first range is 230-330 Nm, the second range is 330-530 Nm, and the third range is 530 Nm, ±∞. The first range corresponds to a first safety state, which in turn corresponds to a first safety strategy; the second range corresponds to a second safety state, which in turn corresponds to a second safety strategy; and the third range corresponds to a third safety state, which in turn corresponds to a third safety strategy.

[0134] It should be noted that the first, second, and third thresholds mentioned above are obtained based on statistics, calibration experience, and simulation. Specifically, assuming the distance between the vehicle and the vehicle in front is one speed, a preset fault-tolerant time interval (FTTI) is set. Kinematic analysis is used to calculate the acceleration at which the vehicle will collide with the vehicle in front or behind, and then the corresponding torque difference is calculated using acceleration, vehicle mass, and transmission ratio. Specifically, the mathematical expressions for the aforementioned kinematic analysis are (S + V1 × T) = V2 × T + 0.5 × a × T2 (Formula 1), F = m × a (Formula 2), and T = F × R / I (Formula 3), where S is the distance between the car and the vehicle in front or behind, V1 is the current speed of the vehicle in front or behind, V2 is the current speed of the vehicle, T is the FTTI, a is the acceleration, m is the vehicle mass, F is the torque difference, R is the tire radius, and I is the transmission ratio. The torque difference can be calculated using Formula 1, Formula 2, and Formula 3.

[0135] It can be seen that the first threshold, the second threshold, and the third threshold are used to measure the severity of the abnormal torque of the car, and also reflect the possibility that the car may collide with the car in front or behind at different FTTIs. The FTTI corresponding to the first threshold is greater than the FTTI corresponding to the second threshold, and the FTTI corresponding to the second threshold is greater than the FTTI corresponding to the third threshold.

[0136] In one feasible approach, the first safety strategy corresponding to the first safety state includes controlling the vehicle speed to be less than or equal to the current speed, issuing a warning through the instrument panel, and limping at a speed less than or equal to a preset speed after power failure and restart; the second safety strategy corresponding to the second safety state includes controlling the vehicle speed to be less than or equal to the current speed, issuing a warning through the instrument panel, and losing power after power failure and restart; the third safety strategy corresponding to the third safety state includes issuing a warning through the instrument panel and losing power after a preset time.

[0137] In this embodiment, when the vehicle is in a dynamic driving state, different safety states correspond to different safety strategies. Specifically: In the first safety state, the torque control device controls the vehicle speed to be less than or equal to the current speed by controlling the motor, etc., and issues a warning through the instrument panel to alert the driver of abnormal torque and to take countermeasures. After (another) restart, the vehicle limps home or to a repair shop at a target preset speed of less than or equal to 40 km / h. In the second safety state, the torque control device controls the vehicle speed to be less than or equal to the current speed, issues a warning through the instrument panel and voice, and loses power after (another) reset and restart. In the third safety state, the torque control device issues a warning through the instrument panel and voice, and loses power after (another) reset and restart. It can be seen that the larger the torque difference, the more stringent the safety measures taken. Therefore, by applying this embodiment, the safety of torque control can be further improved, preventing the driver from making mistakes due to lack of awareness during the power loss period, which could lead to more serious safety accidents.

[0138] Please see Figure 7 , Figure 7 This is a block diagram illustrating a vehicle power loss safety control device according to an exemplary embodiment of this application. It should be understood that this device can also be applied to other exemplary implementation environments, and this embodiment does not limit the implementation environment to which the device is applicable.

[0139] like Figure 7 As shown, in an exemplary embodiment, the vehicle power loss safety control device includes at least a fault detection module 701, a fault detection module 702, a fault determination module 703, and a safety control module 704, which are described in detail below:

[0140] The information acquisition module 701 is used to acquire and store the vehicle's status information in real time.

[0141] The fault detection module 702 is used to reset the first vehicle controller if a fault is detected, and to determine whether the first vehicle controller has completed the restart within a first preset time.

[0142] The fault determination module 703 is used to determine the first vehicle controller as the fault point if the restart is not completed within the first preset time, and trigger the second vehicle controller to switch, wherein the first and second vehicle controllers form redundant control.

[0143] Based on the above embodiments, it further includes: a fault recovery module, used to determine whether the battery and motor in the vehicle are faulty if a restart is completed within a first preset time; if so, to perform fault handling based on the fault information fed back by the battery and motor; if not, to control the first vehicle controller to restore the state before the fault based on the state information, wherein the first preset time is less than the second preset time.

[0144] The safety control module 704 is used to determine whether the second vehicle controller has completed the switching within a second preset time. If it has, the second vehicle controller performs redundant control based on the status information. If it has not completed the switching, the first and second vehicle controllers are determined to be faulty, and the safety control strategy is executed and an alarm is triggered.

[0145] In this embodiment, the vehicle power loss safety control device monitors the vehicle's status information during operation. If a fault is detected in the first vehicle controller, a reset operation is performed on the first vehicle controller to eliminate the fault and enter a safe state. It then determines whether the first vehicle controller has completed the restart within a first preset time. If it has not completed the restart within the first preset time, the first vehicle controller is identified as the fault point, triggering the second vehicle controller to switch. It then determines whether the second vehicle controller has completed the switch within a second preset time. If it has, the second vehicle controller performs redundant control based on the status information. If it has not, both the first and second vehicle controllers are identified as faulty, a safety control strategy is executed, and an alarm is triggered.

[0146] By forming a redundant control architecture using the first and second vehicle controllers, on the one hand, in the event of a failure in the first vehicle controller, the system can switch to the second vehicle controller for redundant control. Simultaneously, based on status information, the vehicle is restored to its pre-failure state. This rapid self-recovery mechanism avoids external power anomalies and improves the driving experience. On the other hand, by determining whether the first vehicle controller restarts within a preset time, a tiered safety handling approach is established. If it restarts within the preset time, the first vehicle controller resumes operation after self-recovery. If it fails to restart within the preset time, the redundant second vehicle controller takes over control. This prevents the loss of powertrain capabilities and avoids safety hazards, significantly improving vehicle driving safety. If a failure is confirmed in both the first and second vehicle controllers, a safety control strategy is implemented and an alarm is triggered, thereby ensuring driver safety.

[0147] It should be noted that the vehicle power loss safety control device provided in the above embodiments and the vehicle power loss safety control method provided in the above embodiments belong to the same concept. The content of the operation of each module has been described in detail in the method embodiments, and will not be repeated here.

[0148] Please see Figure 8 , Figure 8 This is a schematic diagram of the structure of an electronic device provided in one embodiment of this application. Figure 8 A schematic diagram of a computer system suitable for implementing the embodiments of this application is shown. It should be noted that... Figure 8 The computer system 800 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0149] like Figure 8 As shown, the computer system 800 includes a Central Processing Unit (CPU) 801, which can perform various appropriate actions and processes, such as executing the methods described in the above embodiments, based on programs stored in Read-Only Memory (ROM) 802 or programs loaded from storage portion 808 into Random Access Memory (RAM) 803. The RAM 803 also stores various programs and data required for system operation. The CPU 801, ROM 802, and RAM 803 are interconnected via a bus 804. An Input / Output (I / O) interface 805 is also connected to the bus 804.

[0150] The following components are connected to I / O interface 805: an input section 806 including a keyboard, mouse, etc.; an output section 807 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to I / O interface 805 as needed. A removable medium 811, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 810 as needed so that computer programs read from it can be installed into storage section 808 as needed.

[0151] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program including a computer program for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 809, and / or installed from removable medium 811. When the computer program is executed by central processing unit (CPU) 801, it performs various functions defined in the system of this application.

[0152] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying a computer-readable computer program. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0153] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0154] The units described in the embodiments of the present invention can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0155] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a computer's processor, causes the computer to perform the vehicle power loss safety control method described above. This computer-readable storage medium may be included in the electronic device described in the above embodiments, or it may exist independently and not incorporated into the electronic device.

[0156] The above embodiments are merely illustrative of the principles and effects of the present invention and are not intended to limit the invention. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in the present invention should still be covered by the claims of the present invention.

Claims

1. A vehicle power loss safety control method, characterized in that, The method includes: The vehicle's status information is acquired and stored in real time; If a fault is detected in the first vehicle controller, a reset operation is performed on the first vehicle controller, and it is determined whether the first vehicle controller has completed the restart within a first preset time. If the restart is not completed within the first preset time, the first vehicle controller is determined to be the fault point, and the second vehicle controller is triggered to switch. The first and second vehicle controllers form redundant control. The system determines whether the second vehicle controller has completed the switching within a second preset time. If it has, the second vehicle controller performs redundant control based on the status information. The second vehicle controller reads the stored status information, which includes the vehicle's driving status, gear status, high-voltage status, and motor status. Based on the latest status information before the fault occurred, the second vehicle controller generates different control commands for the vehicle's battery controller, motor controller, and gear position. Among them, the vehicle speed information, power pedal deformation, and environmental information are determined; If the environmental information indicates that the road surface is slippery and the vehicle speed information does not exceed the preset vehicle speed, a first control command for the gear is determined based on the latest gear status of the vehicle before the fault occurred. If the environmental information indicates a slippery road surface and the vehicle speed information does not exceed the preset vehicle speed, a second control command is determined for the battery controller based on the latest high voltage status of the vehicle before the fault occurred. If the environmental information indicates a slippery road surface and the vehicle speed information does not exceed the preset vehicle speed, based on the latest motor status of the vehicle before the fault occurred, the motor speed is adjusted in response to the deformation of the power pedal, and a third control command is determined for the motor controller. This causes the battery controller, the motor controller, and the gear position to respond respectively, restoring the vehicle to its state before the malfunction occurred; If the operation is not completed, the first and second vehicle controllers will be identified as faulty, and a safety control strategy will be implemented and an alarm will be triggered.

2. The vehicle power loss safety control method according to claim 1, characterized in that, The step of determining whether the first vehicle controller has completed the restart within a first preset time also includes: If the restart is completed within the first preset time, determine whether the battery and motor in the vehicle are faulty. If so, troubleshooting is performed based on the fault information fed back by the battery and the motor; If not, the first vehicle controller is controlled to restore the state before the fault based on the state information, and the first preset time is less than the second preset time.

3. The vehicle power loss safety control method according to claim 2, characterized in that, The step of controlling the first vehicle controller to restore its state before the fault based on the state information includes: Read the stored status information, which includes the vehicle's driving status, gear status, high voltage status, and motor status; The latest status information before the fault occurred is determined as the recovery status. Based on the recovery status, the vehicle's driving status, gear status, high voltage status, and motor status are controlled to return to the state before the fault occurred.

4. The vehicle power loss safety control method according to claim 1, characterized in that, The process of determining the faults in the first and second vehicle controllers, executing safety control strategies, and issuing alarms includes: If it is determined that the first vehicle controller and the second vehicle controller both fail simultaneously, a safety control strategy is executed on the vehicle. The safety control strategy includes at least one of the following: performing a torque reduction operation on the motor controller, performing a high voltage reduction operation on the battery controller, controlling the gear to enter neutral, and generating a diagnostic fault code. The diagnostic fault codes are stored and displayed on a human-machine interface to provide warnings to the driver.

5. The vehicle power loss safety control method according to claim 1, characterized in that, The first vehicle controller and the second vehicle controller each input different pedal signals, and the first vehicle controller and the second vehicle controller each output CAN buses with different identifiers, forming a redundant control system; If the battery controller receives CAN buses with different identifiers, it responds to the control commands transmitted by the CAN bus corresponding to the identifier of the second vehicle controller through pre-arbitration logic; If the motor controller receives a CAN bus with a different identifier, it responds to the control command transmitted by the CAN bus corresponding to the identifier of the second vehicle controller through pre-arbitration logic.

6. The vehicle power loss safety control method according to any one of claims 1 to 5, characterized in that, Before acquiring the vehicle's status information in real time, the method further includes: The system determines the vehicle's driving status. If the vehicle is in motion, it triggers the acquisition of the vehicle's status information; otherwise, it does not process the request.

7. The vehicle power loss safety control method according to claim 1, characterized in that, After executing the security control policy and triggering the alarm, the following is also included: The system monitors the torque during vehicle operation and determines the torque range to which the torque difference between the measured torque and a preset torque belongs. Based on the torque range to which the torque difference belongs, a corresponding safety state is determined. A safety strategy corresponding to the safety state is then executed. The torque range includes a first range, a second range, and a third range. Specifically, each torque difference in the first range is greater than a first threshold and less than or equal to a second threshold; each torque difference in the second range is greater than the second threshold and less than or equal to a third threshold; each torque difference in the third range is greater than the third threshold; the first threshold is less than the second threshold, and the second threshold is less than the third threshold; the first range corresponds to a first safety state, the second range corresponds to a second safety state, and the third range corresponds to a third safety state. The first safety strategy corresponding to the first safety state includes controlling the vehicle speed to be less than or equal to the current speed, issuing a warning through the instrument panel, and limping at a speed less than or equal to the target preset speed after a reset and restart; the second safety strategy corresponding to the second safety state includes controlling the vehicle speed to be less than or equal to the current speed, issuing a warning through the instrument panel and voice, and losing power after a reset and restart; the third safety strategy corresponding to the third safety state includes issuing a warning through the instrument panel and voice, and losing power after a third preset time.

8. A vehicle power loss safety control device, characterized in that, The device includes: The information acquisition module is used to acquire and store the vehicle's status information in real time. The fault detection module is used to reset the first vehicle controller if a fault is detected, and to determine whether the first vehicle controller has completed the restart within a first preset time. The fault determination module is used to determine the first vehicle controller as a fault point if the restart is not completed within a first preset time, and to trigger the second vehicle controller to switch, wherein the first and second vehicle controllers form redundant control. The safety control module is used to determine whether the second vehicle controller has completed the switching within a second preset time. If it has, the second vehicle controller performs redundant control based on the status information. The second vehicle controller reads the stored status information, which includes the vehicle's driving status, gear status, high-voltage status, and motor status. Based on the latest status information before the fault occurred, the second vehicle controller generates different control commands for the vehicle's battery controller, motor controller, and gear position. The process involves determining the vehicle's speed, accelerator pedal deformation, and environmental information. If the environmental information indicates a slippery road surface and the vehicle speed does not exceed a preset speed, a first control command is generated for the gear based on the vehicle's latest gear status before the fault occurred. If the environmental information indicates a slippery road surface and the vehicle speed does not exceed a preset speed, a second control command is generated for the battery controller based on the vehicle's latest high-voltage status before the fault occurred. If the environmental information indicates a slippery road surface and the vehicle speed does not exceed a preset speed, a third control command is generated for the motor controller based on the vehicle's latest motor status before the fault occurred, adjusting the motor speed in response to the accelerator pedal deformation. This causes the battery controller, motor controller, and gear to respond, restoring the vehicle to its state before the fault occurred. If this is not achieved, a fault is determined in the first and second vehicle controllers, a safety control strategy is executed, and an alarm is triggered.

9. An electronic device, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, cause the electronic device to implement the vehicle power loss safety control method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, It stores computer-readable instructions, which, when executed by the processor of a computer, cause the computer to perform the vehicle power loss safety control method according to any one of claims 1 to 7.

Images