Ring network controller system, monitoring method and vehicle

Abstract

The invention relates to a ring network controller system, a monitoring method and a vehicle, the controller system comprises at least three controller units, and each controller unit serves as a superior unit of another controller unit and is used for sending a wake-up signal to the controller unit when the working state of the controller unit is an abnormal state. And each controller unit also serves as a subordinate unit of the other controller unit and is used for receiving the wake-up signal sent by the controller unit and quitting the abnormal state based on the wake-up signal. According to the invention, by carrying the annular closed-loop network, whether the working state of each controller unit is abnormal can be known in time, and the controller unit is awakened in time when entering the abnormal state. Moreover, the system provided by the invention can be in overall failure only when all the controller units enter the abnormal state at the same time, so that the robustness of the system is improved, and meanwhile, the user experience is also improved.

Description

Technical Field

[0001] The present disclosure relates to the field of vehicle technology, and in particular to a ring network controller system, a monitoring method and a vehicle. Background Art

[0002] As the safety level of controllers increases, many controllers have or integrate hardware solutions with fail-safe functions, which can actively shut down the controller's power supply system or functions with safety requirements when the controller fails, ensuring that no safety accidents are caused by controller failure. However, the controller may enter a fail-safe state due to false triggering in some scenarios, also known as a "pseudo-death" state, such as cold start of the controller, wake-up from sleep, low-voltage battery charging, electromagnetic interference, etc. Summary of the invention

[0003] In order to solve the above technical problems, the present disclosure provides a ring network controller system, a monitoring method and a vehicle.

[0004] The present disclosure provides a ring network controller system, which includes at least three controller units, wherein: each of the controller units serves as an upper-level unit of another controller unit and is used to send a wake-up signal to the controller unit when the working state of the controller unit is an abnormal state, each of the controller units also serves as a lower-level unit of another controller unit and is used to receive the wake-up signal sent by the controller unit and exit the abnormal state based on the wake-up signal, and the upper-level unit and the lower-level unit of each controller unit are not the same controller unit.

[0005] Optionally, each of the controller units is also used to: in response to its own working state being a normal state, send a safety signal of a preset state to the superior unit; and in response to its own working state being the abnormal state, send the safety signal that is not the preset state to the superior unit or stop sending the safety signal to the superior unit; each of the controller units is also used to receive the safety signal sent by the subordinate unit.

[0006] Optionally, each of the controller units is also used to: in response to receiving the safety signal sent by the subordinate unit that is not the preset state, or in response to not receiving the safety signal again after a first preset time after the last time the safety signal sent by the subordinate unit was received, determine that the working state of the subordinate unit is the abnormal state, and send the wake-up signal to the subordinate unit.

[0007] Optionally, each of the controller units is specifically configured to: initialize or restart based on the wake-up signal to exit the abnormal state.

[0008] Optionally, the safety signal is a pulse width modulation signal; the preset state of the safety signal includes: a period of the safety signal is a preset period, and a duty cycle is a preset duty cycle.

[0009] Optionally, the safety signal is a message sent through a controller local area network, a local area internet network, or an Ethernet network; the preset state of the safety signal includes: continuously sending messages at intervals of a second preset time, and the second preset time is less than the first preset time.

[0010] Optionally, the controller system is applied to a vehicle, and the controller system also includes a main controller unit, and each of the controller units is further used to: in response to the number of times the wake-up signal is sent to the subordinate unit within a third preset time being greater than or equal to a preset number of times, send a failure warning message to the main controller unit; the main controller is used to: in response to the failure warning message, generate a safety instruction to adjust the driving status of the vehicle.

[0011] Optionally, the safety instruction comprises an instruction to idle the vehicle or to emergency brake the vehicle.

[0012] The present disclosure also provides a ring network controller monitoring method, wherein the controller system includes at least three controller units, and the method includes: using each of the controller units as the upper unit of another controller unit and sending a wake-up signal to the controller unit when the working state of the controller unit is an abnormal state, and using each of the controller units as the lower unit of another controller unit and receiving the wake-up signal sent by the controller unit, and exiting the abnormal state based on the wake-up signal, wherein the upper unit and the lower unit of each of the controller units are not the same controller unit.

[0013] The present disclosure also provides a vehicle, characterized in that the vehicle includes any one of the controller systems described.

[0014] The technical solution provided by the present disclosure has the following advantages over the prior art: the present disclosure provides a ring network controller system, the controller system includes at least three controller units, wherein: each of the controller units serves as the upper unit of another controller unit and is used to send a wake-up signal to the controller unit when the working state of the controller unit is an abnormal state, each of the controller units also serves as the lower unit of another controller unit and is used to receive the wake-up signal sent by the controller unit, and exit the abnormal state based on the wake-up signal, and the upper unit and the lower unit of each controller unit are not the same controller unit. The present disclosure enables multiple controller units to monitor each other's working state by carrying a ring closed-loop network, and can timely know whether the working state of each controller unit is abnormal, and wake up the controller unit in time through another controller when the controller unit enters an abnormal state. In addition, the upper unit and the lower unit of each controller unit in the present disclosure are not the same controller unit, ensuring that multiple controller units can form a ring system, so that the system will fail as a whole only when all controller units enter an abnormal state at the same time, improving the robustness of the system, and also improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0016] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0017] Figure 1 A schematic diagram of the structure of a ring network controller system provided by an embodiment of the present disclosure;

[0018] Figure 2 A schematic diagram of the structure of another ring network controller system provided by an embodiment of the present disclosure;

[0019] Figure 3 A schematic diagram of a communication topology structure of a ring network controller system provided in an embodiment of the present disclosure;

[0020] Figure 4 A schematic diagram of a communication topology structure of another ring network controller system provided by an embodiment of the present disclosure;

[0021] Figure 5 A schematic diagram of a communication topology structure of another ring network controller system provided by an embodiment of the present disclosure;

[0022] Figure 6 A schematic diagram of the structure of a vehicle provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0023] In order to more clearly understand the above-mentioned purposes, features and advantages of the embodiments of the present disclosure, the scheme of the embodiments of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features therein can be combined with each other without conflict.

[0024] In the following description, many specific details are set forth to facilitate a full understanding of the embodiments of the present disclosure, but the embodiments of the present disclosure may also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0025] An embodiment of the present disclosure provides a ring network controller system, such as Figure 1 As shown, the controller system includes at least three controller units. Figure 1 ECU1, ECU2 and ECU3 (Electronic Control Unit, ECU) are shown respectively. Each controller unit is used to control the driving state of the car and realize its various functions. It mainly uses various sensors and bus data collection and exchange to judge the vehicle state and the user's intention and control the car through the actuator. For example, common controller units can be BMS (Battery Management System), ESP (Electronic Stability Program), etc. In the embodiment of the present disclosure, different controller units can perform different functions, or they can be hardware isolated but perform the same function in parallel.

[0026] In this embodiment, each controller unit serves as the upper level unit of another controller unit and is used to send a wake-up signal to the controller unit when the working state of the controller unit is abnormal. Each controller unit also serves as the lower level unit of another controller unit and is used to receive the wake-up signal sent by the controller unit and exit the abnormal state based on the wake-up signal. The upper level unit and the lower level unit of each controller unit are not the same controller unit, so that all controller units in the controller system form a ring network. Specifically, in order to ensure the formation of the ring network, each controller unit only serves as the lower level unit of another controller unit and the upper level unit of another controller unit, and cannot serve as the upper level unit or lower level unit of two or more other controller units at the same time.

[0027] The embodiment of the present disclosure uses a ring-shaped closed-loop network to enable multiple controller units to monitor each other's working status, so that it can timely know whether the working status of each controller unit is abnormal, and timely wake up the controller unit through another controller when it enters an abnormal state. If the abnormal state of the controller unit is caused by "pseudo-death", it can be restored to a normal working state after being awakened. In addition, if two controller units serve as the upper and lower units of each other, once the two controller units fall into the "pseudo-death" state at the same time, the controller system will fall into an unnecessary failure state; if a main controller unit and multiple controller units monitor each other, the communication burden of the main controller unit will be greatly increased, and the system thus constructed is also prone to collapse. Therefore, the ring network system provided by the present disclosure disperses the communication burden while ensuring that multiple controller units can form a ring system, so that the overall failure will only occur when all controllers are "pseudo-dead" at the same time, thereby improving the robustness of the system and also improving the user experience.

[0028] Specifically, in the embodiment of the present disclosure, even if two controller units are mistakenly triggered to fail state successively or simultaneously within a short period of time, the upper level unit of one controller unit can always wake up one of them, and the awakened controller unit continues to wake up its lower level unit. Figure 1 Taking the embodiment shown as an example, if ECU1 and ECU2 mistakenly trigger the failure state at the same time, ECU3 first detects that ECU1 is working in an abnormal state and can wake up ECU1 through a wake-up signal. After ECU1 is awakened, it will detect that ECU2 is working in an abnormal state. Then ECU1 wakes up ECU2 through a wake-up signal, so that the entire system resumes normal operation. Only when ECU1, ECU2, and ECU3 all enter the failure state will the entire system crash. However, compared with the probability of two ECUs entering the failure state at the same time, the probability of multiple ECUs entering the failure state at the same time is greatly reduced.

[0029] exist Figure 1 In the illustrated embodiment, ECU1 serves as the superior unit of ECU2 (i.e., ECU2 serves as the subordinate unit of ECU1), monitors the working state of ECU2, and sends a wake-up signal to ECU2 when the working state of ECU2 is abnormal; ECU2 serves as the superior unit of ECU3 (i.e., ECU3 serves as the subordinate unit of ECU2), monitors the working state of ECU3, and sends a wake-up signal to ECU3 when the working state of ECU3 is abnormal; ECU3 serves as the superior unit of ECU1 (i.e., ECU1 serves as the subordinate unit of ECU3), monitors the working state of ECU1, and sends a wake-up signal to ECU1 when the working state of ECU1 is abnormal.

[0030] Figure 1 The embodiments shown are only exemplary. Figure 2 In a specific embodiment shown, the controller system includes four controller units ECU1, ECU2, ECU3 and ECU4. ECU1 serves as the upper level unit of ECU2 (i.e., ECU2 serves as the lower level unit of ECU1), and monitors the working state of ECU2, and sends a wake-up signal to ECU2 when the working state of ECU2 is abnormal; ECU2 serves as the upper level unit of ECU3 (i.e., ECU3 serves as the lower level unit of ECU2), and monitors the working state of ECU3, and sends a wake-up signal to ECU3 when the working state of ECU3 is abnormal; ECU3 serves as the upper level unit of ECU4 (i.e., ECU4 serves as the lower level unit of ECU3), and monitors the working state of ECU4, and sends a wake-up signal to ECU4 when the working state of ECU4 is abnormal; ECU4 serves as the upper level unit of ECU1 (i.e., ECU1 serves as the lower level unit of ECU4), and monitors the working state of ECU1, and sends a wake-up signal to ECU1 when the working state of ECU1 is abnormal. Those skilled in the art can Figure 1 and Figure 2 The implementation methods of 5 or more controller unit embodiments obtained on the basis of the embodiments do not require any creative work and are all within the protection scope of the present disclosure.

[0031] The present disclosure is not limited to connecting all controller units in a vehicle in series into a ring network system. Specifically, a vehicle can be equipped with multiple ring network controller systems. For example, if a vehicle has a total of six controller units, two ring network controller systems including three controller units can be installed to reduce network complexity. It is also possible to directly install a ring network controller system including six controller units to greatly improve the robustness of the vehicle body system, and all of these are within the scope of protection of the present disclosure.

[0032] In some embodiments, Figure 3 As shown, each controller unit is also used to:

[0033] In response to its own working state being a normal state, it sends a safety signal Signal1 of a preset state to the superior unit, and in response to its own working state being an abnormal state, it sends a safety signal Signal1 of a non-preset state to the superior unit or stops sending the safety signal to the superior unit.

[0034] Each controller unit is also used to receive a safety signal Signal1 sent by a lower-level unit.

[0035] exist Figure 3In the illustrated embodiment, ECU2 as a subordinate unit of ECU1 sends a safety signal Signal1 to ECU1 , ECU3 as a subordinate unit of ECU2 sends a safety signal Signal1 to ECU2 , and ECU1 as a subordinate unit of ECU3 sends a safety signal Signal1 to ECU3 .

[0036] The safety signal Signal1 is generated and sent by each controller unit based on its own working status, which can facilitate the superior unit of the controller unit to monitor its working status, so as to know whether the working status of each controller is normal in time.

[0037] Specifically, each controller unit will have a separate safety signal sending unit for sending safety signals. When the controller unit is working normally, the safety signal sending unit will use the working voltage to power itself and send the above safety signal. In a specific embodiment, the safety signal sending unit will also receive the output signals of each link of the controller unit. When the controller unit is working normally, the output signals of each link are also normal, and the safety signal sending unit will output a safety signal of a preset state based on the normal output signal. When the controller unit is working in an abnormal state, inevitably, the output signal of one or more links will be abnormal, and the abnormal output signal will cause the safety signal output by the safety signal sending unit to be disordered, so that it cannot be maintained in the preset state, or even stop outputting the safety signal.

[0038] In specific implementation, when a controller unit in the controller system triggers a failure for some reason, whether it is a true failure or a false failure (i.e., "false death"), it will cause it to work in an abnormal state and send a safety signal that is not in the preset state to the superior unit. In some embodiments, the preset state of the above safety signal is pre-set specifically for monitoring the working state of the controller unit, so each controller unit can identify whether the safety signal is in the preset state.

[0039] In some embodiments, Figure 4 As shown, each controller unit is also used to:

[0040] In response to receiving a safety signal sent by a lower-level unit that is not in a preset state, or in response to not receiving a safety signal again after a first preset time after the last time a safety signal sent by the lower-level unit was received, it is determined that the working state of the lower-level unit is an abnormal state, and a wake-up signal Signal2 is sent to the lower-level unit.

[0041] exist Figure 4In the embodiment shown, ECU1, as the superior unit of ECU2, sends a wake-up signal Signal2 to ECU2 in response to an abnormality in the safety signal Signal1 sent by ECU2 (i.e., a safety signal that is not in a preset state in the above embodiment, or in response to not receiving a safety signal again after a first preset time after the last receipt of a safety signal sent by a subordinate unit); ECU2, as the superior unit of ECU3, sends a wake-up signal Signal2 to ECU3 in response to an abnormality in the safety signal Signal1 sent by ECU3; ECU3, as the superior unit of ECU1, sends a wake-up signal Signal2 to ECU1 in response to an abnormality in the safety signal Signal1 sent by ECU1.

[0042] In some embodiments, each controller unit is specifically configured to:

[0043] Initialize or restart based on the wake-up signal to exit the abnormal state.

[0044] After receiving the wake-up signal, each controller unit will initialize itself to the initial state or restart. If the controller unit is triggered to the failure state by mistake, it means that the controller unit can still work normally. After initialization or restart, it can return to the normal state and continue the functions in the above embodiment and other vehicle functions.

[0045] The above specific embodiments are all based on the example that the controller system includes three controller units. To facilitate understanding by those skilled in the art, Figure 5 An embodiment of four controller units is shown, and those skilled in the art can directly transfer the technical details in the above embodiment to the embodiment of four controller units, and no further description is given. In this embodiment, even if three controller units are mistakenly triggered to a failure state successively or simultaneously in a short period of time, the last controller unit can gradually restore the controller system to normal operation, further improving the robustness of the system. Those skilled in the art can select the number of controller units in the controller system according to actual needs, and no excessive restrictions are given here.

[0046] Those skilled in the art can Figures 3 to 5 The implementation methods of 5 or more controller unit embodiments obtained on the basis of the embodiments do not require any creative work and are all within the protection scope of the present disclosure.

[0047] Specifically, in order to realize the functions in the above embodiments, each controller unit includes:

[0048] A safety signal sending unit is used to send a safety signal to a superior unit based on its own working status; a safety signal receiving unit is used to receive a safety signal sent by a subordinate unit; a wake-up signal sending unit is used to send a wake-up signal to a subordinate unit in response to an abnormality in the safety signal sent by the subordinate unit; and a wake-up signal receiving module is used to receive a wake-up signal sent by an superior unit.

[0049] In a specific embodiment, each controller unit further includes:

[0050] The initialization module is used to exit the abnormal state based on the wake-up signal, specifically based on initializing or restarting for the second signal.

[0051] In the above embodiments, the controller units may use different communication methods to send and receive safety signals and wake-up signals, including but not limited to controller area network CAN (Controller Area Network), local interconnect network LIN (Local Interconnect Network), Ethernet, pulse width modulation PWM (Pulse Width Modulation), etc. Both wired and wireless connection methods are possible. To facilitate implementation by those skilled in the art, specific embodiments are provided below for different forms of communication methods.

[0052] In some embodiments, the safety signal is a pulse width modulation signal, specifically, a timing signal. Pulse width modulation is an analog control method that modulates the bias of the transistor base or the MOS tube gate according to the change of the corresponding load to achieve the change of the transistor or MOS tube conduction time, thereby achieving the change of the output of the switching regulated power supply. This method can keep the output voltage of the power supply constant when the working conditions change, and is a very effective technology for controlling analog circuits using digital signals of microprocessors.

[0053] In the embodiment where the safety signal is a pulse width modulation signal, the preset state of the safety signal includes:

[0054] The period of the safety signal is a preset period, and the duty cycle is a preset duty cycle.

[0055] In specific implementation, the cycle of the safety signal in the preset state is a constant preset cycle, and the duty cycle in each cycle is a constant preset duty cycle. When the controller unit works normally, it can normally send a stable safety signal to the superior unit; once the controller unit enters a failure state, the safety signal sent to the superior unit will become disordered, or even lose its timing and become a single high-level or low-level signal. At this time, the cycle and duty cycle of the safety signal must not be the preset cycle and the preset duty cycle, so that the superior unit is aware of the abnormality of the controller unit. Specifically, as long as one of the cycle and duty cycle of the safety signal does not meet the preset conditions, it is deemed that the safety signal is not in the preset state.

[0056] Specifically, if the controller unit stops sending the safety signal due to entering a failure state, it can be regarded that the period and duty cycle of the safety signal are both zero, and are also not the preset period and the preset duty cycle.

[0057] The preset period and preset duty cycle in the above embodiment are only used to limit the period and duty cycle of the normal safety signal to be constant. For the values ​​of the preset period and the preset duty cycle, technicians in this field can select corresponding values ​​according to site requirements, and no excessive restrictions are made here.

[0058] In some embodiments, the safety signal is a message sent via a controller area network (CAN), a local interconnect network (LIN), or an Ethernet.

[0059] Controller Area Network (CAN) is a fieldbus designed for microcontroller communication in the automotive environment. It exchanges information between various electronic control devices on board and forms an automotive electronic control network. In theory, a single network consisting of a CAN bus can connect countless nodes, but in practical applications, the number of nodes is limited by the electrical characteristics of the network hardware. The CAN bus can provide a data transmission rate of up to 1Mbit / s, which facilitates real-time data transmission. In addition, the CAN bus also has strong anti-electromagnetic interference capabilities.

[0060] The Local Interconnect Network (LIN) is a low-cost serial communication network defined for automotive distributed electronic systems. It is a supplement to other automotive multi-channel networks such as the Controller Area Network (CAN). It is suitable for applications that do not have high requirements on network bandwidth, performance or fault tolerance.

[0061] Ethernet is a computer local area network technology and is currently the most commonly used local area network technology. The standard topology of Ethernet is a bus topology, but the current Fast Ethernet uses switches to connect and organize the network in order to reduce conflicts and maximize the network speed and efficiency.

[0062] Those skilled in the art can select a corresponding network to send a safety signal according to on-site requirements, and no further limitation is made here. In a specific embodiment, in order to facilitate network construction, the wake-up signal in this embodiment can adopt the same communication method as the safety signal.

[0063] In the above embodiment where the safety signal is a message sent through a network, the preset state of the safety signal includes:

[0064] The message is continuously sent at intervals of a second preset time, where the second preset time is shorter than the first preset time.

[0065] When the controller unit works normally, it can normally send stable messages to the superior unit, so that the superior unit knows that the controller unit is in a normal working state.

[0066] Once the controller unit enters the failure state, the interval time of the message sent to the superior unit will be prolonged, disordered, or even stop sending messages. As long as the superior unit does not receive the message within a period of time, it can be determined that the subordinate controller unit has an abnormality.

[0067] The first preset time and the second preset time in the above embodiment are only used to distinguish the state of the safety signal. For the values ​​of the first preset time and the second preset time, on the basis of making the second preset time less than the first preset time, those skilled in the art can select corresponding values ​​according to on-site requirements, and no excessive restrictions are made here. The content of the message in the above embodiment can also be set by those skilled in the art according to on-site requirements, and no excessive restrictions are made here.

[0068] In a specific embodiment, the above-mentioned safety signal receiving unit is also used to determine that the working state of the lower-level unit is the abnormal state in response to the period of the safety signal sent by the received lower-level unit being not a preset period, or the duty cycle of the safety signal being not a preset duty cycle, or in response to not receiving a message again after a first preset time after the last time a message sent by the lower-level unit is received.

[0069] In some embodiments, the controller system is applied to a vehicle, and the controller system further comprises a master controller unit. Specifically, the master controller unit is only used to receive, process, and distribute instructions, and does not participate in the control of the vehicle, so the working status thereof may not be monitored.

[0070] Each controller unit is also used to:

[0071] In response to the number of times that the wake-up signal is sent to the subordinate unit within the third preset time is greater than or equal to the preset number, failure warning information is sent to the main controller unit.

[0072] The master controller is used to:

[0073] In response to the failure warning information, a safety instruction for adjusting the driving state of the vehicle is generated. If a controller unit enters a failure state due to an incorrect trigger, it can resume normal operation after receiving a wake-up signal sent by the superior unit, and the superior unit will no longer send a wake-up signal to it. If a controller enters a failure state due to a real failure reason, since it cannot resume normal operation based on the wake-up signal, or it will enter a failure state again due to the same reason after resuming normal operation, its superior unit will send a wake-up signal to it multiple times within a period of time. Therefore, it can be judged from the number of times the superior unit sends a wake-up signal whether a controller unit is a real failure or a false trigger failure. If a controller unit is truly failed, its superior unit will send a failure warning message to the main controller for timely processing.

[0074] In specific implementation, the above preset number of times is determined according to the function performed by the controller unit. Specifically, each controller unit can know the function performed by the monitored lower-level unit. If the function performed by the lower-level unit is to control the in-vehicle entertainment device, the preset number of times the wake-up signal is sent to the lower-level unit is 3 to 5 times. If the function performed by the lower-level unit is directly related to driving, such as controlling the vehicle battery or the vehicle motor, the preset number of times the wake-up signal is sent to the lower-level unit is 2 times, and the failure warning is activated in time.

[0075] Specifically, the controller unit starts timing each time it sends a wake-up signal. If no wake-up signal is sent within the third preset time, the timing is reset. Otherwise, it is determined whether to send a failure warning message to the main controller unit according to the judgment conditions in the above embodiment. The above third preset time can be set to 10s to 60s, which is only to limit a short period of time to avoid judging a controller unit's pseudo-death for a long time (such as one day) as a real failure. Those skilled in the art can select the corresponding value according to the on-site requirements, and no excessive restrictions are made here.

[0076] In a specific embodiment, each controller unit is further configured to:

[0077] In response to the number of times that the wake-up signal is sent to the subordinate unit within the third preset time is greater than or equal to the preset number, the monitoring of the subordinate unit is stopped.

[0078] In some embodiments, the safety instructions include instructions to idle the vehicle or to emergency brake the vehicle.

[0079] If a controller unit enters a real failure state, continuing to drive may cause a safety accident. At this time, the vehicle needs to be idle or emergency braked to ensure driving safety. In specific implementation, the receiver of the above safety instructions can be selected according to the structure of the whole vehicle, and is usually received by a module that can directly control the vehicle speed.

[0080] In a specific implementation, the safety instruction for making the vehicle idle includes a safety instruction for reducing the rotation speed and torque of the vehicle-mounted motor.

[0081] In some embodiments, the master controller is further configured to:

[0082] In response to the failure warning information, a safety instruction is generated to prompt a user of the controller failure through an in-vehicle display device.

[0083] For ease of understanding, a complete specific embodiment is provided below to further illustrate the ring network controller system provided by the embodiment of the present disclosure.

[0084] When all controller units in the controller system are working normally, the system maintains a stable state of mutual monitoring. Since the safety signal does not need to carry a large amount of information, the mutual monitoring of the working status between the controller units does not occupy too many communication resources. When a controller unit in the system triggers a failure state for some reason, the safety signal of the controller unit will output abnormally or not output, and the upper unit that monitors the safety signal will not be able to receive the normal safety signal. The upper unit will determine that the controller unit has entered a failure state (including true failure and false failure), and output a wake-up signal to wake up the controller unit that has entered the failure state, triggering the controller unit to exit the failure state. After receiving the wake-up signal sent by the upper unit, the controller unit will actively exit the failure state by initialization or restarting.

[0085] If the upper-level unit detects that the lower-level controller unit has entered a failure state multiple times (determined by the number of times the wake-up signal is sent in the above embodiment), it will eventually determine that the controller unit has entered a true failure state due to some fault, and will no longer send wake-up signals. The main controller unit will be notified of the failure of the controller unit, and the main controller unit will then generate subsequent instructions.

[0086] It can be seen that the embodiment of the present disclosure, by carrying a ring-shaped closed-loop network, enables multiple controllers to monitor each other's working status, and can timely know whether the working status of each controller is normal, failed or "fake dead", and can timely wake up the controller unit in the "fake dead" state. In addition, the ring network system provided by the embodiment of the present disclosure disperses the communication burden, and only when all controllers are "fake dead" at the same time will the whole fail, which improves the robustness of the system and also improves the user experience.

[0087] Based on the same inventive concept, corresponding to the ring network controller system of any of the above embodiments, the present application also provides a ring network controller monitoring method.

[0088] In some embodiments, the controller system includes at least three controller units, the method comprising:

[0089] Each controller unit is used as the upper unit of another controller unit and sends a wake-up signal to the controller unit when the working state of the controller unit is an abnormal state, and each controller unit is used as the lower unit of another controller unit and receives the wake-up signal sent by the controller unit, and exits the abnormal state based on the wake-up signal, wherein the upper unit and the lower unit of each controller unit are not the same controller unit.

[0090] The embodiment of the present disclosure uses a ring-shaped closed-loop network to enable multiple controller units to monitor each other's working status, so that it can timely know whether the working status of each controller unit is abnormal, and timely wake up the controller unit through another controller when it enters an abnormal state. If the abnormal state of the controller unit is caused by "pseudo-death", it can be restored to a normal working state after being awakened. In addition, if two controller units serve as the upper and lower units of each other, once the two controller units fall into the "pseudo-death" state at the same time, the controller system will fall into an unnecessary failure state; if a main controller unit and multiple controller units monitor each other, the communication burden of the main controller unit will be greatly increased, and the system thus constructed is also prone to collapse. Therefore, the ring network system provided by the present disclosure disperses the communication burden while ensuring that multiple controller units can form a ring system, so that the overall failure will only occur when all controllers are "pseudo-dead" at the same time, thereby improving the robustness of the system and also improving the user experience.

[0091] In some embodiments, the above method further comprises:

[0092] The controller unit responds to its own working state being a normal state by sending a safety signal of a preset state to the superior unit, and responds to its own working state being an abnormal state by sending a safety signal of a non-preset state to the superior unit or stopping sending the safety signal to the superior unit.

[0093] In some embodiments, the above method further comprises:

[0094] Each controller unit receives the safety signal sent by the lower unit.

[0095] In some embodiments, the above-mentioned using each controller unit as a superior unit of another controller unit and sending a wake-up signal to the controller unit when the working state of the controller unit is abnormal specifically includes:

[0096] In response to receiving a safety signal sent by a lower-level unit that is not in a preset state, or in response to not receiving a safety signal again after a first preset time after the last time a safety signal sent by the lower-level unit was received, it is determined that the working state of the lower-level unit is an abnormal state, and a wake-up signal is sent to the lower-level unit.

[0097] In some embodiments, using a controller unit to exit an abnormal state based on a wake-up signal specifically includes:

[0098] Initialize or restart the controller unit based on the wake-up signal to exit the abnormal state.

[0099] In some embodiments, the safety signal is a pulse width modulated signal.

[0100] The preset states of safety signals include:

[0101] The period of the safety signal is a preset period, and the duty cycle is a preset duty cycle.

[0102] In some embodiments, the security signal is a message sent via a controller area network, a local area interconnect network, or an Ethernet network.

[0103] The preset states of safety signals include:

[0104] The message is continuously sent at intervals of a second preset time, where the second preset time is less than the first preset time. In some embodiments, the controller system is applied to a vehicle, the controller system further includes a master controller unit, and the method further includes:

[0105] In response to the controller unit sending the wake-up signal to the subordinate unit for a number of times greater than or equal to a preset number within a third preset time, the controller unit sends failure warning information to the main controller unit.

[0106] In some embodiments, the controller system is applied to a vehicle, and the method further includes:

[0107] The overall controller generates a safety instruction for adjusting the driving state of the vehicle in response to the failure warning information.

[0108] In some embodiments, the safety instructions include instructions to idle the vehicle or to emergency brake the vehicle.

[0109] The device of the above embodiment is used for the corresponding ring network controller system in any of the above embodiments, and has the beneficial effects of the corresponding embodiment, which will not be described in detail here.

[0110] It should be noted that the method of the embodiment of the present application can be executed by a single controller unit, or can be applied to the entire controller system and completed by multiple controller units cooperating with each other. In the case of such a distributed scenario, one of the multiple controller units can only execute one or more steps in the method of the embodiment of the present application, and the multiple controller units will interact with each other to complete the above method.

[0111] It should be noted that the above describes some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0112] In a specific implementation, the controller unit may include a processor and a memory storing computer program instructions.

[0113] Specifically, the above-mentioned processor may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0114] The memory may include a large capacity memory for information or instructions. By way of example and not limitation, the memory may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a tape, or a universal serial bus (USB) drive or a combination of two or more of these. Where appropriate, the memory may include a removable or non-removable (or fixed) medium. Where appropriate, the memory may be inside or outside the integrated gateway device. In a particular embodiment, the memory is a non-volatile solid-state memory. In a particular embodiment, the memory includes a read-only memory (ROM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (Electrically Erasable Programmable ROM, EEPROM), an electrically rewritable ROM (EAROM) or flash memory, or a combination of two or more of these.

[0115] The processor reads and executes computer program instructions stored in the memory to perform the steps of the ring network controller monitoring method provided in the embodiment of the present disclosure.

[0116] In one example, the controller unit may further include a transceiver, and the controller system may further include a bus, wherein the processor, the memory, and the transceiver are connected via the bus and communicate with each other.

[0117] The bus includes hardware, software or both. For example, but not limitation, the bus may include an accelerated graphics port (Accelerated Graphics Port, AGP) or other graphics bus, an enhanced industrial standard architecture (Extended Industry Standard Architecture, EISA) bus, a front side bus (Front Side BUS, FSB), a hypertransport (Hyper Transport, HT) interconnection, an industrial standard architecture (Industrial Standard Architecture, ISA) bus, an infinite bandwidth interconnection, a low pin count (Low Pin Count, LPC) bus, a memory bus, a microchannel architecture (MicroChannel Architecture, MCA) bus, a peripheral control interconnection (Peripheral Component Interconnect, PCI) bus, a PCI-Express (PCI-X) bus, a serial advanced technology attachment (Serial Advanced Technology Attachment, SATA) bus, a video electronics standards association local (Video Electronics Standards Association Local Bus, VLB) bus or other suitable buses or a combination of two or more of these. In appropriate cases, the bus may include one or more buses. Although the present application embodiment describes and shows a specific bus, the present application considers any suitable bus or interconnection.

[0118] The controller unit provided in the embodiment of the present disclosure also includes a storage medium containing computer executable instructions, and the computer executable instructions are used to execute a ring network controller monitoring method when executed by a computer processor.

[0119] Of course, the storage medium containing computer executable instructions provided by the embodiment of the present disclosure is not limited to the above method operations, and the computer executable instructions can also execute related operations in the ring network controller monitoring method provided by any embodiment of the present disclosure.

[0120] Through the above description of the implementation method, the technicians in the relevant field can clearly understand that the present disclosure can be implemented by means of software and necessary general hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present disclosure can be essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer program instructions and software products for performing the operations of the present disclosure can be written in one or more programming languages ​​or their combinations, and the above programming languages ​​include but are not limited to object-oriented programming languages-such as Java, Smalltalk, C++, and also include conventional procedural programming languages-such as "C" language or similar programming languages. The above computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (FLASH), a hard disk or an optical disk, etc., including a number of instructions to enable a computer cloud platform (which can be a personal computer, a server, or a network cloud platform, etc.) to perform the ring network controller monitoring method provided by each embodiment of the present disclosure.

[0121] Based on the same inventive concept, corresponding to the ring network controller system of any of the above embodiments, the present application also provides a vehicle, which includes the controller system in any of the above embodiments.

[0122] The embodiment of the present disclosure enables multiple controller units to monitor each other's working status by installing a ring-shaped closed-loop network on the vehicle, so that it can timely know whether the working status of each controller unit is abnormal, and timely wake up the controller unit through another controller when the controller unit enters an abnormal state. If the abnormal state of the controller unit is caused by "pseudo-death", it can be restored to a normal working state after being awakened. In addition, if the two controller units serve as the upper and lower units of each other, once the two controller units fall into the "pseudo-death" state at the same time, the controller system will fall into an unnecessary failure state; if a main controller unit and multiple controller units monitor each other, the communication burden of the main controller unit will be greatly increased, and the system thus constructed is also prone to collapse. Therefore, the ring network system provided by the present disclosure disperses the communication burden while ensuring that multiple controller units can form a ring system, so that the overall failure will only occur when all controllers are "pseudo-dead" at the same time, thereby improving the robustness of the system and also improving the user experience.

[0123] like Figure 6 As shown, the multiple controller units in the controller system in the above embodiment can be mounted at different positions of the vehicle body. Figure 6 The communication connection relationship between the multiple controller units is not shown yet.

[0124] In specific implementation, each controller unit is used to control the driving state of the car and realize its various functions, mainly by using various sensors, data collection and exchange of buses to determine the vehicle state and the user's intention and control the car through actuators. For example, common controller units can be BMS (Battery Management System), ESP (Electronic Stability Program), etc.

[0125] Specifically, a vehicle can be equipped with multiple ring network controller systems. For example, if a vehicle has a total of six controller units, two ring network controller systems consisting of three controller units can be installed to reduce network complexity. Alternatively, a ring network controller system consisting of six controller units can be directly installed to greatly improve the robustness of the vehicle body system.

[0126] The vehicle of the above-mentioned embodiment is used to implement the corresponding ring network controller system in any of the aforementioned embodiments, and has the beneficial effects of the corresponding embodiments, which will not be repeated here.

[0127] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "including a..." do not exclude the existence of other identical elements in the process, method, article or device including the above elements.

[0128] The above are only specific embodiments of the present disclosure, which enable those skilled in the art to understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described above, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A ring network controller system, characterized in that: The controller system comprises at least three controller units, wherein: Each of the controller units serves as an upper-level unit of another controller unit and is used to send a wake-up signal to the controller unit when the working state of the controller unit is an abnormal state. Each of the controller units also serves as a lower-level unit of another controller unit and is used to receive the wake-up signal sent by the controller unit and exit the abnormal state based on the wake-up signal. The upper-level unit and the lower-level unit of each controller unit are not the same controller unit.

2. The system according to claim 1, characterized in that Each of the controller units is further configured to: In response to its own working state being a normal state, sending a safety signal of a preset state to a superior unit, and in response to its own working state being the abnormal state, sending the safety signal of a state other than the preset state to the superior unit or stopping sending the safety signal to the superior unit; Each of the controller units is also used to receive the safety signal sent by the lower level unit.

3. The system according to claim 2, characterized in that Each of the controller units is further configured to: In response to receiving the safety signal sent by the subordinate unit that is not the preset state, or in response to not receiving the safety signal again after a first preset time after the last time the safety signal sent by the subordinate unit was received, it is determined that the working state of the subordinate unit is the abnormal state, and the wake-up signal is sent to the subordinate unit.

4. The system according to claim 1, characterized in that Each of the controller units is specifically used for: Initialize or restart based on the wake-up signal to exit the abnormal state.

5. The system according to claim 2, characterized in that The safety signal is a pulse width modulation signal; The preset states of the safety signal include: The period of the safety signal is a preset period, and the duty cycle is a preset duty cycle.

6. The system according to claim 3, characterized in that The safety signal is a message sent via a controller area network, a local area internet network, or an Ethernet network; The preset states of the safety signal include: Messages are continuously sent at intervals of a second preset time, where the second preset time is shorter than the first preset time.

7. The system according to claim 1, characterized in that The controller system is applied to a vehicle, and the controller system further comprises a master controller unit, and each of the controller units is further used for: In response to the number of times the wake-up signal is sent to the subordinate unit within a third preset time being greater than or equal to a preset number, sending failure warning information to the main controller unit; The master controller is used for: In response to the failure warning information, a safety instruction for adjusting a driving state of the vehicle is generated.

8. The system according to claim 7, characterized in that The safety instruction includes an instruction to idle the vehicle or to perform emergency braking of the vehicle.

9. A ring network controller monitoring method, characterized in that: The controller system comprises at least three controller units, and the method comprises: Each of the controller units is used as the upper unit of another controller unit and sends a wake-up signal to the controller unit when the working state of the controller unit is an abnormal state, and each of the controller units is used as the lower unit of another controller unit and receives the wake-up signal sent by the controller unit, and exits the abnormal state based on the wake-up signal, wherein the upper unit and the lower unit of each controller unit are not the same controller unit.

10. A vehicle, characterized in that: The vehicle comprises a controller system as claimed in any one of claims 1 to 8.

Images