Redundant controller main-auxiliary redundant communication system and method

Abstract

The embodiment of the present invention discloses a redundant controller master-slave redundant communication system and method, which relates to the field of communication technology. The method comprises: a target arbitration mechanism receives a private CAN message sent by a target private CAN transceiver, determines whether the private CAN message is timed out, and if the private CAN message is not timed out, the target arbitration mechanism sends the private CAN message sent by the target private CAN transceiver to the target Autosar‑COM; if the private CAN message is timed out, the target arbitration mechanism sends the UART data received by the target UART transceiver to the target Autosar‑COM. The embodiment of the present invention monitors whether the private CAN message is timed out through the arbitration mechanism, and starts UART data to simulate the private CAN message when the private CAN message is timed out, thereby achieving the stability and timeliness of data communication between the master and auxiliary MCUs, and improving the safety performance of the automobile driving process.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of communication technology, and in particular to a primary-secondary redundant communication system and method for a redundant controller. Background Art

[0002] With the continuous development of automobiles, chassis controllers based on dual MCUs are becoming more and more widely used, and the requirements for the stability of data communication between the main and auxiliary MCUs are becoming higher and higher. The existing data communication between the main and auxiliary MCUs is generally achieved through the CAN communication network (the cooperation structure of the CAN transceiver and the CAN bus). If the CAN message times out, the data communication between the main and auxiliary MCUs is likely to be unstable, which will affect the real-time performance of data transmission and further affect the safety performance of the vehicle. Summary of the invention

[0003] In order to overcome the deficiencies of the prior art, an object of an embodiment of the present invention is to provide a redundant controller primary-auxiliary redundant communication system and method, which can achieve stability of data communication between primary and auxiliary MCUs.

[0004] To solve the above problems, an embodiment of the present invention discloses a primary-secondary redundant communication system of a redundant controller, comprising a primary controller and a secondary controller, wherein the primary controller comprises a first Autosar-COM, a first arbitration mechanism and a first microcontroller, and the secondary controller comprises a second Autosar-COM, a second arbitration mechanism and a second microcontroller, wherein the first microcontroller is provided with a first private CAN transceiver and a first UART transceiver, and the second microcontroller is provided with a second private CAN transceiver and a second UART transceiver, wherein the first private CAN transceiver and the second private CAN transceiver are connected via a CAN bus, the first private CAN transceiver is also connected to the first arbitration mechanism via a first protocol data unit routing, the second private CAN transceiver is also connected to the second arbitration mechanism via a second protocol data unit routing, the first UART transceiver and the second UART transceiver are connected via a UART bus; the first UART transceiver is also connected to the first Autosar-COM via a first arbitration mechanism, and the second UART transceiver is also connected to the second Autosar-COM via a second arbitration mechanism.

[0005] As a preferred embodiment, in the first aspect of the embodiment of the present invention, communication is performed through I-PDU between the first private CAN transceiver and the first protocol data unit routing, between the first protocol data unit routing and the first arbitration mechanism, between the second private CAN transceiver and the second protocol data unit routing, between the second protocol data unit routing and the second arbitration mechanism, between the first UART transceiver and the first arbitration mechanism, between the first arbitration mechanism and the first Autosar-COM, between the second UART transceiver and the second arbitration mechanism, and between the second arbitration mechanism and the second Autosar-COM.

[0006] As a preferred embodiment, in the first aspect of the embodiment of the present invention, a UART to CAN module is further provided between the first UART transceiver and the first arbitration mechanism, and between the second UART transceiver and the second arbitration mechanism, for converting UART data into private CAN messages.

[0007] A second aspect of an embodiment of the present invention discloses a primary-secondary redundant communication method for a redundant controller, which is implemented based on the primary-secondary redundant communication system for a redundant controller described in the first aspect of the embodiment of the present invention, and includes the following steps:

[0008] The target arbitration mechanism receives the private CAN message sent by the target private CAN transceiver, determines whether the private CAN message is timed out, and if the private CAN message is not timed out, the target arbitration mechanism sends the private CAN message sent by the target private CAN transceiver to the target Autosar-COM;

[0009] If the private CAN message times out, the target arbitration mechanism sends the target UART transceiver receiving UART data to the target Autosar-COM;

[0010] When the target arbitration mechanism is the first arbitration mechanism, the target private CAN transceiver, the target UART transceiver and the target Autosar-COM correspond to the first private CAN transceiver, the first UART transceiver and the first Autosar-COM respectively;

[0011] When the target arbitration mechanism is the second arbitration mechanism, the target private CAN transceiver, the target UART transceiver and the target Autosar-COM correspond to the second private CAN transceiver, the second UART transceiver and the second Autosar-COM respectively.

[0012] As a preferred embodiment, in the second aspect of the embodiment of the present invention, if the private CAN message times out, the target arbitration mechanism sends the UART data received by the target UART transceiver to the target Autosar-COM, and then further includes:

[0013] The target arbitration mechanism continues to determine whether the private CAN message is timed out. If the private CAN message is not timed out, the target arbitration mechanism sends the private CAN message sent by the target private CAN transceiver to the target Autosar-COM, and no longer sends the UART data received by the target UART transceiver to the target Autosar-COM.

[0014] As a preferred embodiment, in the second aspect of the embodiment of the present invention, the target arbitration mechanism sends the UART data received by the target UART transceiver to the target Autosar-COM, including:

[0015] The target arbitration mechanism directly sends the UART data received by the target UART transceiver to the target Autosar-COM, or the target arbitration mechanism converts the UART data received by the target UART transceiver into a private CAN message and then sends it to the target Autosar-COM.

[0016] As a preferred embodiment, in the second aspect of the embodiment of the present invention, determining whether the private CAN message has timed out includes:

[0017] The receiving time of the message ID of each private CAN message is recorded, and the message IDs of all private CAN messages are polled periodically, and the time difference between the receiving time and the current time is compared. When the time difference is greater than the preset time threshold, it is determined that the private CAN message has timed out.

[0018] A third aspect of an embodiment of the present invention discloses a computer-readable storage medium storing a computer program, wherein the computer program enables a computer to execute a primary-secondary redundant communication method for a redundant controller disclosed in the second aspect of an embodiment of the present invention.

[0019] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0020] The embodiment of the present invention monitors whether the private CAN message times out through an arbitration mechanism, and starts UART data to simulate the private CAN message when the private CAN message times out. Autosar-COM can directly process the data received by UART without paying attention to which hardware the data is communicated through, thereby achieving stability and timeliness of data communication between the main and auxiliary MCUs and improving the safety performance of the vehicle driving process. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a structural diagram of a primary-secondary redundant communication system of a redundant controller provided by an embodiment of the present invention;

[0022] Figure 2It is a flow chart of a primary-secondary redundant communication method of a redundant controller provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0023] This specific implementation manner is merely an explanation of an embodiment of the present invention, and it is not a limitation of the embodiment of the present invention. After reading this specification, a person skilled in the art may make non-creative modifications to the embodiment as needed, but as long as it is within the scope of the claims of the embodiment of the present invention, it is protected by the patent law.

[0024] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of them. Based on the embodiments in the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the embodiments of the present invention.

[0025] The term "comprise" and any variations thereof in the specification and claims of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products or apparatuses.

[0026] In the embodiments of the present invention, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0027] The embodiment of the present invention monitors whether the private CAN message times out through an arbitration mechanism, and starts UART data to simulate the private CAN message when the private CAN message times out. Autosar-COM can directly process the data received by UART without paying attention to which hardware the data is communicated through, thereby achieving stability and timeliness of data communication between the main and auxiliary MCUs and improving the safety performance of the vehicle driving process. The following is a detailed description with reference to the accompanying drawings.

[0028] Embodiment 1

[0029] See also Figure 1 As shown, Figure 1A redundant controller master-slave redundant communication system disclosed in an embodiment of the present invention mainly includes a master controller (i.e., a master MCU) and a slave controller (i.e., a slave MCU). Data communication is achieved between the master controller and the slave controller through a data transmission component.

[0030] Both the main and auxiliary controllers adopt the Autosar architecture. Both can include Autosar-COM, microcontroller and arbitration mechanism. Among them, Autosar-COM provides basic communication services. It has a clear upper module RTE (Runtime Environment) and a lower module PDU Router (PDUR). The microcontroller is the core hardware of the main and auxiliary controllers.

[0031] The arbitration mechanism is implemented by software and is set in BswM, namely BSW Mode Manager (Basic Software Mode Management). BswM is a module that implements part of the vehicle mode management (VehicleModeManagement) and application mode management concepts (ApplicationModeManagement) located in BSW (Basic Software layer).

[0032] An arbitration mechanism is composed of a set of logical expressions and a mode request condition. In a preferred embodiment of the present invention, the arbitration mechanism has two main purposes: one is to determine whether a private CAN message has timed out, and the other is to switch the communication mode between the primary and secondary controllers. Of course, in other embodiments, other modules can also be used to determine whether a private CAN message has timed out. That is, the above arbitration mechanism can be divided into two parts, both of which can use an arbitration mechanism, or a microcontroller can be used to determine whether a private CAN message has timed out, and the arbitration mechanism determines which communication mode to use.

[0033] The data transmission component mainly includes a private CAN transceiver and a UART transceiver integrated in the microprocessor, wherein the private CAN transceivers between the main and auxiliary controllers are connected through a CAN bus, and the UART transceivers are connected through a UART serial port bus.

[0034] To distinguish, in an embodiment of the present invention, the Autosar-COM, arbitration mechanism, microcontroller, private CAN transceiver and UART transceiver in the main controller are respectively recorded as the first Autosar-COM, the first arbitration mechanism, the first microcontroller, the first private CAN transceiver and the first UART transceiver, and the Autosar-COM, arbitration mechanism, microcontroller, private CAN transceiver and UART transceiver in the auxiliary controller are respectively recorded as the second Autosar-COM, the second arbitration mechanism, the second microcontroller, the second private CAN transceiver and the second UART transceiver. In addition, the protocol data unit routing (PDUR) in the main and auxiliary controllers is respectively recorded as the first protocol data unit routing and the second protocol data unit routing.

[0035] Based on the above principle, the arbitration mechanism is connected between the microprocessor and Autosar-COM, which determines whether the private CAN message has timed out on the one hand, and determines the communication mode between Autosar-COM and the microprocessor on the other hand. Specifically, the first private CAN transceiver is also connected to the first arbitration mechanism through the first protocol data unit routing, the second private CAN transceiver is also connected to the second arbitration mechanism through the second protocol data unit routing, the first UART transceiver and the second UART transceiver are connected through the UART bus; the first UART transceiver is also connected to the first Autosar-COM through the first arbitration mechanism, and the second UART transceiver is also connected to the second Autosar-COM through the second arbitration mechanism.

[0036] In addition, except for the communication between the first microprocessor and the second microprocessor through the UART bus or the CAN bus, the communication between other associated modules is realized by multiplexing the protocol data unit (I-PDU). That is, the communication between the first private CAN transceiver and the first protocol data unit route, between the first protocol data unit route and the first arbitration mechanism, between the second private CAN transceiver and the second protocol data unit route, between the second protocol data unit route and the second arbitration mechanism, between the first UART transceiver and the first arbitration mechanism, between the first arbitration mechanism and the first Autosar-COM, between the second UART transceiver and the second arbitration mechanism, and between the second arbitration mechanism and the second Autosar-COM are all carried out through the I-PDU.

[0037] Generally, Autosar-COM can process UART data directly, but in some scenarios, if Autosar-COM cannot process UART data directly, a UART to CAN module can be added between the first UART transceiver and the first arbitration mechanism, and between the second UART transceiver and the second arbitration mechanism to convert UART data into private CAN messages, thereby ensuring the timeliness of data processing. Of course, in other embodiments, UART data can also be converted into data types of other formats that can be processed by Autosar-COM.

[0038] Its specific working principle can be described as:

[0039] The target arbitration mechanism receives the private CAN message sent by the target private CAN transceiver and determines whether the private CAN message is timed out. If the private CAN message is not timed out, the target arbitration mechanism sends the private CAN message sent by the target private CAN transceiver to the target Autosar-COM; if the private CAN message is timed out, the target arbitration mechanism sends the UART data received by the target UART transceiver to the target Autosar-COM.

[0040] Because it involves the interaction between the main and auxiliary controllers, the target arbitration mechanism may be the first arbitration mechanism or the second arbitration mechanism. If the target arbitration mechanism is the first arbitration mechanism, the target private CAN transceiver, the target UART transceiver, and the target Autosar-COM correspond to the first private CAN transceiver, the first UART transceiver, and the first Autosar-COM respectively; and if the target arbitration mechanism is the second arbitration mechanism, the target private CAN transceiver, the target UART transceiver, and the target Autosar-COM correspond to the second private CAN transceiver, the second UART transceiver, and the second Autosar-COM respectively.

[0041] In other embodiments, if the private CAN message is recovered (ie, the private CAN message is not timed out), the data sent to the target Autosar-COM is switched to the private CAN message.

[0042] Embodiment 2

[0043] See also Figure 2 , Figure 2 The invention discloses a flow chart of a primary-secondary redundant communication method for a redundant controller.

[0044] See also Figure 2 As shown, a redundant controller primary-slave redundant communication method may include the following steps:

[0045] S210, the target arbitration mechanism receives the private CAN message sent by the target private CAN transceiver, and determines whether the private CAN message is timed out. If the private CAN message is not timed out, the target arbitration mechanism sends the private CAN message sent by the target private CAN transceiver to the target Autosar-COM.

[0046] Because it involves the interaction between the main and auxiliary controllers, the target arbitration mechanism may be the first arbitration mechanism or the second arbitration mechanism. If the target arbitration mechanism is the first arbitration mechanism, the target private CAN transceiver, the target UART transceiver, and the target Autosar-COM correspond to the first private CAN transceiver, the first UART transceiver, and the first Autosar-COM respectively; and if the target arbitration mechanism is the second arbitration mechanism, the target private CAN transceiver, the target UART transceiver, and the target Autosar-COM correspond to the second private CAN transceiver, the second UART transceiver, and the second Autosar-COM respectively.

[0047] The method for calculating whether a private CAN message has timed out can be implemented using existing technology.

[0048] For example, a periodic polling method or a timer method can be used to determine whether a private CAN message has timed out. The periodic polling method records the receiving time of each private CAN message ID (Identity document) when receiving a message, and periodically polls all private CAN message IDs to obtain the receiving time of all messages, compares the time difference between the current time and the receiving time, and considers it a timeout when the time difference is greater than the set timeout value.

[0049] The timer method is to set a timer for each private CAN message ID, and update the trigger time of the corresponding timer every time a message is received. Therefore, if the private CAN message is received normally, the timer trigger time will be continuously updated backwards, but it will not actually be triggered. Once the timer is triggered, it means that the private CAN message corresponding to the private CAN message ID has timed out.

[0050] If the private CAN message does not time out, it means that the private CAN message data can ensure the stability and timeliness of data communication between the main and auxiliary controllers, thereby ensuring the safety of vehicle driving. Therefore, in this case, the target arbitration mechanism can directly send the private CAN message data to the target Autosar-COM.

[0051] S220 , if the private CAN message times out, the target arbitration mechanism sends the UART data received by the target UART transceiver to the target Autosar-COM.

[0052] If the private CAN message times out, it means that continuing to use private CAN message data for communication between the primary and secondary controllers may cause data delays or even loss, affecting the stability and timeliness of communication between the two. At this time, due to the existence of communication redundancy, the interaction between the two can be achieved through redundant data communication.

[0053] In a preferred embodiment of the present invention, the target arbitration mechanism can use the UART data received by the target UART transceiver as private CAN data to indicate to the target Autosar-COM. For the target Autosar-COM, the UART data simulates the private CAN message data. The target Autosar-COM layer can directly process the data received by the target UART transceiver without paying attention to which hardware the data is communicated through. Therefore, the stability and timeliness of data communication between the main and auxiliary controllers can be guaranteed.

[0054] S230: The target arbitration mechanism continues to determine whether the private CAN message is recovered.

[0055] In the process of realizing communication between the main and auxiliary controllers through UART, the target arbitration mechanism continues to monitor whether the private CAN message has timed out. The method for calculating whether the private CAN message has timed out is the same as the above step S210. In addition, in order to ensure the stability of the private CAN message data, a certain threshold value can also be set for the non-timeout time or / and the number of messages. For example, the private CAN message can be determined to be recovered only when the non-timeout time lasts for a first preset time threshold and the number of non-timeout private CAN messages is not less than a first preset number threshold.

[0056] S240: If recovered, execute step S210; otherwise, continue to execute step S220.

[0057] If the private CAN message is recovered (not timed out), the target arbitration mechanism sends the private CAN message sent by the target private CAN transceiver to the target Autosar-COM, and no longer sends the UART data received by the target UART transceiver to the target Autosar-COM.

[0058] If the private CAN message is not recovered (still times out), the target UART transceiver continues to send the received UART data to the target Autosar-COM.

[0059] The data received by the private CAN transceiver in the embodiment of the present invention will be routed to the arbitration mechanism through PDUR. The arbitration mechanism will determine whether the private CAN message has timed out. If it has not timed out, the arbitration mechanism will indicate the data to Autosar-COM. If it is determined that the private CAN message has timed out, the arbitration mechanism will indicate the data received by UART to Autosar-COM. If the private CAN message is restored, the arbitration mechanism will switch back to indicating the private CAN message data to Autosar-COM, thereby achieving redundancy of communication between redundant controllers (primary and auxiliary controllers), ensuring the stability and timeliness of data communication between the primary and auxiliary controllers, and improving the safety of the vehicle during driving.

[0060] The above is a detailed introduction to a redundant controller primary-auxiliary redundant communication system and method disclosed in the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A redundant controller master-slave redundant communication system, comprising a master controller and a slave controller, characterized in that: The main controller includes a first Autosar-COM, a first arbitration mechanism and a first microcontroller, and the auxiliary controller includes a second Autosar-COM, a second arbitration mechanism and a second microcontroller. The first microcontroller is provided with a first private CAN transceiver and a first UART transceiver, and the second microcontroller is provided with a second private CAN transceiver and a second UART transceiver. The first private CAN transceiver and the second private CAN transceiver are connected through a CAN bus. The first private CAN transceiver is also connected to the first arbitration mechanism through a first protocol data unit routing, and the second private CAN transceiver is also connected to the second arbitration mechanism through a second protocol data unit routing. The first UART transceiver and the second UART transceiver are connected through a UART bus; the first UART transceiver is also connected to the first Autosar-COM through a first arbitration mechanism, and the second UART transceiver is also connected to the second Autosar-COM through a second arbitration mechanism.

2. The redundant controller primary-secondary redundant communication system according to claim 1, characterized in that: The first private CAN transceiver and the first protocol data unit routing, the first protocol data unit routing and the first arbitration mechanism, the second private CAN transceiver and the second protocol data unit routing, the second protocol data unit routing and the second arbitration mechanism, the first UART transceiver and the first arbitration mechanism, the first arbitration mechanism and the first Autosar-COM, the second UART transceiver and the second arbitration mechanism, and the second arbitration mechanism and the second Autosar-COM all communicate through I-PDU.

3. The redundant controller primary-secondary redundant communication system according to claim 1, characterized in that: A UART-to-CAN module is also provided between the first UART transceiver and the first arbitration mechanism, and between the second UART transceiver and the second arbitration mechanism, for converting UART data into private CAN messages.

4. A redundant controller primary-secondary redundant communication method, which is implemented based on the redundant controller primary-secondary redundant communication system according to any one of claims 1 to 3, characterized in that: It includes the following steps: The target arbitration mechanism receives the private CAN message sent by the target private CAN transceiver, determines whether the private CAN message is timed out, and if the private CAN message is not timed out, the target arbitration mechanism sends the private CAN message sent by the target private CAN transceiver to the target Autosar-COM; If the private CAN message times out, the target arbitration mechanism sends the target UART transceiver receiving UART data to the target Autosar-COM; When the target arbitration mechanism is the first arbitration mechanism, the target private CAN transceiver, the target UART transceiver and the target Autosar-COM correspond to the first private CAN transceiver, the first UART transceiver and the first Autosar-COM respectively; When the target arbitration mechanism is the second arbitration mechanism, the target private CAN transceiver, the target UART transceiver and the target Autosar-COM correspond to the second private CAN transceiver, the second UART transceiver and the second Autosar-COM respectively.

5. The redundant controller master-slave redundant communication method according to claim 4, characterized in that: If the private CAN message times out, the target arbitration mechanism sends the target UART transceiver receiving UART data to the target Autosar-COM, and then also includes: The target arbitration mechanism continues to determine whether the private CAN message is timed out. If the private CAN message is not timed out, the target arbitration mechanism sends the private CAN message sent by the target private CAN transceiver to the target Autosar-COM, and no longer sends the UART data received by the target UART transceiver to the target Autosar-COM.

6. The redundant controller master-slave redundant communication method according to claim 4, characterized in that: The target arbitration mechanism sends the target UART transceiver receiving UART data to the target Autosar-COM, including: The target arbitration mechanism directly sends the UART data received by the target UART transceiver to the target Autosar-COM, or the target arbitration mechanism converts the UART data received by the target UART transceiver into a private CAN message and then sends it to the target Autosar-COM.

7. The redundant controller master-slave redundant communication method according to claim 4, characterized in that: Determine whether the private CAN message has timed out, including: The receiving time of the message ID of each private CAN message is recorded, and the message IDs of all private CAN messages are polled periodically, and the time difference between the receiving time and the current time is compared. When the time difference is greater than the preset time threshold, it is determined that the private CAN message has timed out.

8. A computer-readable storage medium, characterized in that: It stores a computer program, wherein the computer program enables a computer to execute the primary-secondary redundant communication method of a redundant controller as described in any one of claims 4-7.

Images