Double-ECU system based on AUTOSAR and network management method thereof

Abstract

The embodiment of the invention discloses a double-ECU (Electronic Control Unit) system based on an AUTOSAR (Autonomous Underwater Optical System Architecture) and a network management method thereof. The dual ECU system, as an independent node in an in-vehicle network, includes a first ECU and a second ECU connected to the same bus and sharing a first node identifier. The first ECU is responsible for a network management function and a first application function. The second ECU comprises a first software component and a second software component of the application layer, and a first basic software component, a second basic software component and a first network management component of the basic software layer. The second ECU enables the first software component and the first base software component to execute a second application function when the first ECU operates normally. And when the first ECU is abnormal, switching to enable the second software component, the second basic software component and the first network management component so as to execute the network management function, the first application function and the second application function. According to the embodiment of the invention, efficient and reliable network management is realized in the double-ECU system.

Description

Technical Field

[0001] The present invention relates to a vehicle-mounted network, and in particular to an AUTOSAR-based dual ECU system and a network management method thereof. Background Art

[0002] With the rapid development of automobile technology, the number and functions of automotive electronic control units (ECUs) are increasing. Especially in modern vehicles, in order to improve vehicle performance, safety and comfort, a variety of ECUs are widely used in engine control, body control, chassis control and other fields. Among these ECUs, dual ECU systems are gradually being used due to their redundancy and high reliability. However, there is no relevant solution for how to effectively manage the network in a dual ECU system. Summary of the invention

[0003] In view of this, the present invention provides an AUTOSAR-based dual ECU system and a network management method thereof, which can solve the problem of effective network management in the dual ECU system.

[0004] The AUTOSAR-based dual ECU system of an embodiment of the present invention, as an independent node in a vehicle network, includes: a first and a second ECU, which are connected to the same bus and share a first node identifier; the first ECU is used to execute a network management function and a first application function; the second ECU includes: a first software component and a second software component located at an application layer, and a first basic software component, a second basic software component and a first network management component located at a basic software layer; the second ECU is used to enable the first software component and the first basic software component to execute the second application function when the first ECU operates normally; and switch to enabling the second software component, the second basic software component and the first network management component to execute the network management function, the first application function and the second application function when the first ECU is abnormal.

[0005] In some embodiments, the first and second ECUs detect the operating abnormality using at least one synchronization method of hardwire synchronization, internal communication synchronization, and external communication synchronization.

[0006] In some implementations, when the second ECU detects that the first ECU resumes normal operation, the second ECU instructs the first ECU to prohibit execution of the network management function and the first application function.

[0007] In some implementations, when the first ECU is operating normally, the network status of the first ECU is sent to the second ECU, and the first software component in the second ECU manages the second ECU according to the received network status.

[0008] In some embodiments, the first ECU sends the network status to the second ECU using a network management frame sent to the bus.

[0009] In some implementations, the first ECU sends the network status to the second ECU using an application frame sent to the bus, wherein a second node identifier is used in the application frame, and the second node identifier is exclusively allocated to the second ECU.

[0010] In some embodiments, the first ECU sends the network status to the second ECU via an internal communication channel in the dual ECU system.

[0011] In some implementations, the network state includes: sleep mode, network mode or pre-sleep mode; and when the network state is network mode, the network state further includes: frame repetition state, normal operation state or ready-to-sleep state.

[0012] In some embodiments, the first ECU includes: a third software component and a fourth software component located at the application layer, and a third basic software component, a fourth basic software component and a second network management component located at the basic software layer; the first ECU is specifically used to: when the second ECU operates normally, enable the third software component, the third basic software component and the second network management component to execute the network management function and the first application function; and when the second ECU operates abnormally, switch to enabling the fourth software component, the fourth basic software component and the second network management component to execute the network management function, the first application function and the second application function.

[0013] The network management method of the dual ECU system based on AUTOSAR of the embodiment of the present invention comprises: the first and second ECUs in the dual ECU system communicate in the vehicle network according to the first node identifier; in the second ECU, the first software component and the second software component located in the application layer, and the first basic software component, the second basic software component and the network management component located in the basic software layer are set; when the first ECU is operating normally, the first ECU executes the network management function and the first application function, and the second ECU executes the second application function through the first software component and the first basic software component; when the first ECU is abnormal, the second ECU executes the network management function, the first application function and the second application function through the second software component, the second basic software and the network management component.

[0014] Beneficial effects of the embodiments of the present invention:

[0015] Two sets of components are set in the second ECU, the first software component and the first basic software component are the first set of components, and the second software component, the second basic software component and the first network management component are the second set of components. The second ECU enables the first set of components when the first ECU operates normally, and enables the second set of components when the first ECU is abnormal. By controlling the switching of the two sets of components, when the first ECU is normal, the second ECU only executes the application functions it is responsible for, and the network management function is the responsibility of the first ECU. When the first ECU is abnormal, the second ECU executes the application functions it is responsible for, as well as the network management functions and application functions that the first ECU is responsible for, playing a role in redundancy and network management. Therefore, by integrating two sets of components in the second ECU and designing a switching mechanism for the two sets of components, efficient and reliable network management is achieved in the dual ECU system, providing a strong guarantee for the stable operation of complex systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Other details and advantages of the present invention will become apparent from the detailed description provided below. It should be understood that the following drawings are merely illustrative and thus cannot be considered as limiting the present invention, and the following will be described in detail with reference to the drawings, wherein:

[0017] Figure 1 is a schematic structural diagram of an embodiment of an in-vehicle network of the present invention;

[0018] Figure 2 is a schematic structural diagram of an embodiment of a dual ECU system of the present invention;

[0019] Figure 3A It is a structural schematic diagram of the ECU under the AUTOSAR architecture of the present invention;

[0020] Figure 3B is a schematic structural diagram of an embodiment of a first ECU of the present invention;

[0021] Figure 3C is a schematic structural diagram of an embodiment of a second ECU of the present invention;

[0022] Figure 3D is a schematic structural diagram of an embodiment of a first ECU of the present invention;

[0023] Figure 4 is a migration diagram of the network state of the present invention;

[0024] Figure 5 It is a flowchart of an embodiment of the network management method of the present invention. DETAILED DESCRIPTION

[0025] In order to make the technical problems, technical solutions and beneficial effects to be solved by the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only for explaining the present invention and are not intended to limit the present invention.

[0026] In the description of the present invention, it is to be understood that the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. Moreover, the terms "first", "second", etc. are applicable to distinguishing similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way are interchangeable where appropriate so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein.

[0027] A dual ECU (Electronic Control Unit) system generally refers to a system with two ECUs, which together complete one or some functions in the vehicle. Taking the brake system as an example, the two ECUs can control the left and right brake discs respectively to complete the braking function. Physically, the two ECUs can be two integrated chips or two partitions of a chip or different cores. In the vehicle network, the two ECUs are regarded as a whole and have the same node identifier.

[0028] like Figure 1 , which is a schematic diagram of the structure of an embodiment of an in-vehicle network. In the in-vehicle network, each node, such as nodes 1 to n, is connected to a common bus 101 to communicate with each other, thereby realizing relevant functions in the vehicle, such as a braking function. The common bus 101 may be a CAN bus, i.e. Figure 1 It can be a CAN-based vehicle network. Of course, this is not a limitation. In a vehicle, the network involved can also be an Ethernet network, a FlexRay network, etc.

[0029] like Figure 1 As shown, for the vehicle network, the dual ECU system 102 is an independent node therein, so the dual ECU system has only one node identifier. The node identifier can be used for the dual ECU system 102 to identify itself when communicating in the vehicle network. The first and second ECUs in the dual ECU system share the node identifier. Such a design helps to simplify the complexity of the network.

[0030] More specifically, taking the CAN network as an example, Figure 2, which is a schematic diagram of the structure of an embodiment of a dual ECU system 102. In the dual ECU system 102, the first and second ECUs are connected to an external common CAN bus, i.e., CAN_H and CAN_L, respectively, through the first and second CAN transceivers, so as to send data to the bus or receive data from the bus. In addition, the first and second ECUs can communicate with each other using the external CAN bus, because the data on the bus can be received by any device connected thereto.

[0031] Inside the dual ECU system 102, there is an internal channel between the first ECU and the second ECU that can be used to detect whether the other party exists (normal) or to perform internal communication. For example, the internal channel can be a hard-wired channel, an internal communication channel such as an internal bus or a shared memory. The hard-wired channel can be used to detect whether the other party is normal, and the internal communication channel can not only detect whether the other party is normal, but also exchange data.

[0032] exist Figure 2 In the structure, the first ECU and the second ECU can work in a master-slave mode, for example, the first ECU is set as the master ECU and the second ECU is set as the slave ECU. In addition, the first ECU and the second ECU can also work in a mode independent of each other.

[0033] In some embodiments, the second ECU can be a redundant backup of the first ECU, that is, when the first ECU is abnormal, the second ECU can execute the functions in the first ECU. In addition, the first ECU can also serve as a backup of the second ECU, that is, the first ECU and the second ECU can back up each other.

[0034] In some implementations, in addition to being a backup for the first ECU, the second ECU can also be responsible for the implementation of some functions. For example, the first ECU can be responsible for the implementation of some functions of the node, and the second ECU can be responsible for the implementation of another part of the functions of the node. That is, in addition to being responsible for the implementation of some functions of the node, the second ECU can also serve as a redundant backup for the first ECU. In this way, on the basis of ensuring safety and reliability through a redundant backup mechanism, the utilization efficiency of the ECU can also be improved.

[0035] In the vehicle network, the network management solution in AUTOSAR (Automotive Open System Architecture) is generally used to dynamically adjust the working mode of the vehicle network according to the vehicle's operating status and network communication requirements, such as whether to enter sleep mode, and control the wake-up and sleep of each node in the vehicle network to achieve the purpose of optimizing power consumption.

[0036] exist Figure 1 and 2In the dual ECU system shown, since the dual ECU system is regarded as a network node, in the network management function, a node will only be assigned one network management frame, and this network management frame can conveniently monitor the sleep and wake-up of all network nodes in the vehicle. Under the condition that only one network management frame is assigned to the node, the first ECU and the second ECU cannot send the same frame, so the problem of how to perform network management needs to be solved within the dual ECU system.

[0037] Based on this, in the embodiment of the present invention, when the first ECU is normal, the first ECU performs network management, and the second ECU does not switch the network management state machine, but synchronizes the network state of the first ECU. When the first ECU is abnormal, the second ECU performs network management, and the second ECU also serves as a redundant backup of the first ECU to implement the application function of the first ECU. On this basis, this embodiment also designs the structure of the second ECU so that it can meet the above requirements.

[0038] Specifically, when the first ECU is normal, the first ECU is responsible for sending and receiving network management frames, the second ECU synchronizes the network status of the first ECU at the application layer, and performs network management based on the network status of the first ECU.

[0039] The network status can be, for example, Figure 4 As shown, in AUTOSAR, the network state includes: sleep mode, network mode or pre-sleep mode. When the network state is network mode, it further includes: frame repetition state, normal operation state or ready-to-sleep state. And the conversion between each mode or state can refer to Figure 4 As shown in the direction of the arrow in . In different modes or states, different sending and receiving control operations are involved to achieve the purpose of saving power. For example, when in the normal operating state in the network mode, the sending and receiving of NM (network management) frames are allowed, and the sending and receiving of application frames are allowed. When in sleep mode, only the reception of NM frames is allowed, and the sending of NM frames and the sending and receiving of application frames are prohibited. It should be noted that when the first ECU is operating normally, the sending and receiving of NM frames is not involved in the second ECU, because the second ECU does not have the NM management function, and only the sending and receiving control of application frames are performed in the second ECU. Among them, the description of each network state or mode, the state transition logic, and the detailed control operations can refer to the relevant specifications of AUTOSAR.

[0040] The first ECU may synchronize the network status to the second ECU in the following manner.

[0041] In some embodiments, the first ECU carries the network status in a network management (NM) frame sent to the public bus. The second ECU receives the network management frame from the public bus and extracts the network status information therein. It should be noted that the format of the network management frame defined by AUTOSAR is not sufficient to include all network status information, and the reserved bits in the network management frame can be used to carry the network status information.

[0042] In some embodiments, the first ECU may send an application frame carrying network status information to the public bus. The second ECU receives the application frame and parses the network status information therein. In this case, a dedicated second node identifier needs to be allocated to the second ECU separately, and the first ECU uses the second node identifier to generate and send the application frame. In other words, the second ECU has two node identifiers, the first node identifier is shared with the first ECU, and the second node identifier is dedicated to the second ECU.

[0043] In some embodiments, the first ECU may provide the network status information to the second ECU via an internal communication channel, wherein the internal communication channel may be, for example, a shared memory, an internal CAN bus, or an internal communication channel established based on other communication protocols (such as I2C).

[0044] Based on the above implementation, the second ECU can obtain the network status of the first ECU and perform corresponding operations according to the network status of the first ECU, such as controlling the sending and receiving of application frames. For example, if the network status information received by the second ECU shows that the first ECU has switched to the pre-sleep mode, the second ECU prohibits the sending and receiving of application frames to match the pre-sleep mode.

[0045] The above is the operation when the first ECU is normal. When the first ECU is abnormal, the second ECU can perform network management, that is, control the switching of the network status.

[0046] Specifically, the second ECU may first detect whether the first ECU is abnormal. The detection method may be, for example, at least one of hard line synchronization, internal signal synchronization, and external signal synchronization. When any method detects that the first ECU is abnormal, the second ECU may enter network management.

[0047] The hard-wire synchronization method may be, for example, that a PWM (pulse width modulation) signal of a specific frequency is outputted on the first ECU, and the second ECU captures the PWM signal. When the PWM signal captured by the second ECU does not conform to the predetermined frequency, it can be determined that the first ECU is faulty.

[0048] The internal signal synchronization method refers to the communication between the first and second ECUs through the internal communication channel. This method can transmit additional information while maintaining synchronization. The ECU can determine whether the other party has a fault by detecting whether the internal communication is normal. For example, the first ECU periodically sends a synchronization message to the second ECU. When the second ECU does not receive the synchronization message from the first ECU for multiple consecutive cycles, it can be considered that the first ECU is abnormal.

[0049] The external signal synchronization method can be achieved by sending a specific application frame (such as a synchronization message) from the first ECU to the public bus, and the second ECU receives the application frame from the public bus. It should be noted that since a node has only one node identifier, the first ECU cannot use the shared node identifier to send the application frame, otherwise the network will be chaotic. Therefore, a node identifier for synchronization can be separately assigned to the second ECU, and the application frame can be sent based on the node identifier. At this time, the second ECU is equivalent to a separate node in the network.

[0050] Based on the above method, when the first ECU is detected to be abnormal, the second ECU can perform network management to ensure the continuity of network management. In addition, the second ECU can assume the application function of the first ECU to achieve the purpose of redundant backup. In addition, if the first ECU recovers from the abnormality, the second ECU can indicate that it is currently in redundant mode to prohibit the first ECU from implementing network management functions and application functions. The normal operation of the first ECU will be restored at the next system restart, because the recovery of the first ECU may be fluctuating, and immediate switching may cause system instability, and too fast switching is prone to frame leakage, unstable frame cycle and other problems.

[0051] It should be noted that, in the above, the first ECU may also serve as a backup of the second ECU, and when an abnormality of the second ECU is detected, the first ECU may implement the application functions of the second ECU.

[0052] The following combination Figure 3A and 3D , the structures of the first ECU and the second ECU are described to support the above-mentioned purpose.

[0053] like Figure 3AAs shown in the figure, it is a general structural diagram of an ECU that complies with the AUTOSAR standard. In AUTOSAR, an ECU can include: application layer, RTE (Runtime Environment) layer, basic software (Basic Software, BSW) layer and hardware layer. Among them, the application layer is the top layer of the AUTOSAR architecture, which contains various software components (SoftwareComponent, SWC). SWC can schedule the lower AUTOSAR standard modules to complete communication control and other special needs. For example, when the IGN (Ignition Switch) is powered on, communication needs to be turned on. When the SWC receives the IGN signal, the communication opening interface provided by the COMM module in the BSW layer is used to complete the function of turning on communication when the IGN is powered on. The RTE layer serves as an intermediary between the application layer and the basic software layer. The basic software layer provides underlying services such as hardware abstraction, communication protocol, and real-time task scheduling, so that the upper-layer application can be independent of the specific hardware platform. The hardware layer is composed of hardware such as PCBA (Printed Circuit Board Assembly) and multi-core microcontrollers designed by hardware engineers. For the functions and detailed descriptions of each layer, please refer to the relevant description of AUTOSAR.

[0054] like Figure 3B , which is a schematic diagram of the structure of an embodiment of a first ECU according to the AUTOSAR standard. Figure 3B In the embodiment, the first ECU includes: SWC3 in the application layer, and includes: basic software component 3 and network management component 5 in the BSW layer. Among them, the basic software component 3 may include: CANIF module, PDUR module, COM module, CANSM module, COMM module and CONTRCV module, etc. The network management component 5 may include: NM (network management) module and CanNM (Can network management) module. In this embodiment, the CAN network is taken as an example. For other networks, CanNM can be replaced by the network management module of other networks. Figure 3B As shown, the first ECU has a network management component 5 , so it has a network management function.

[0055] like Figure 3CAs shown, it is a structural schematic diagram of an embodiment of the second ECU according to the AUTOSAR standard. As shown in the figure, in the second ECU, there are two sets of components, the first set of components includes: SWC1 and basic software component 1, and the second set of components includes: SWC2, basic software component 2 and network management component 5. When the first ECU is normal, the second ECU runs the first set of components. Since the first set of components does not have a network management component, the second ECU does not have a network management function at this time. It synchronizes the network status of the first ECU and then uses SWC1 to perform network management, such as controlling the sending and receiving of application frames. When the first ECU is abnormal, the first set of components is disabled and the second set of components is enabled. Because the second set of components has a network management component 5, the second ECU has a network management function and can send and receive NM frames to the network. In addition, in addition to all the functions of the basic software component 1, the basic software component 2 also has all the functions of the basic software component 3, so the second ECU can serve as a redundant backup for the first ECU.

[0056] That is to say, the second ECU has two SWCs and their supporting lower-layer components for communication control. Under normal circumstances, SWC1 and its supporting lower-layer components are running, and SW2 is not running. Under abnormal circumstances, SWC1 is no longer running, and SWC2 and its supporting lower-layer components are running. At this time, SWC2 completes the sending and receiving functions of all frames of the first ECU and the second ECU, and completes the network management function in the first ECU.

[0057] Among them, in order to implement network management in SWC2, two modules, CANNM and NM, are added in the call of the AUTOSAR module in the lower layer of SWC2. These two modules are added to complete the network management function. In addition, related network management functions will also be added in SWC2. After adding these modules and functions, the second ECU can send network management frames to switch the network management state, so that other ECU nodes in the vehicle network can still receive the network management frames sent by this node.

[0058] In addition, all the sending and receiving frames of the first ECU are added to the lower-level AUTOSAR modules COM, PDUR, CANIF, CAN and other modules called by SWC2 to support the implementation of application functions on the first ECU. In other words, the frames received and sent by these modules are equal to the sum of all the frames of the first ECU and the original frames of the second ECU. This ensures that other nodes in the CAN network can still receive the application frames of this node, which can reduce the spread of this abnormality, because other nodes on the CAN bus also need the signals sent by this node to complete some of their functions. In the event of an abnormality, the communication redundancy design of this node will prevent other nodes from sensing the abnormality and continue to operate normally.

[0059] As shown in 3D, it is a structural diagram of an embodiment of the first ECU based on the AUTOSAR specification. As shown in the figure, in the first ECU, there are two sets of components, the first set of components includes: SWC3, basic software component 3 and network management component 5, and the second set of components includes: SWC2, basic software component 2 and network management component 5. When the second ECU is normal, the first set of components is run, and when the second ECU is abnormal, the second set of components is run, wherein the basic software component 4 can receive and send the frames of the second ECU, so SWC4 and the basic software component 4 can cooperate as a backup of the second ECU.

[0060] In this embodiment, by setting up multiple sets of components in the ECU and designing their switching mechanism, efficient and reliable network management is achieved in the dual ECU system, providing a strong guarantee for the stable operation of the complex system.

[0061] like Figure 5 FIG. 1 is a flow chart of an embodiment of a network management method for a dual ECU system based on AUTOSAR of the present invention. The method can be used in the above-mentioned dual ECU system, and many details of the method have been described above and will not be repeated here. Specifically, the method includes:

[0062] Step S50: The first and second ECUs communicate in the vehicle network according to the first node identifier.

[0063] Step S52: In the second ECU, two sets of components are set, wherein the first set of components includes: a first software component located at the application layer and a first basic software component located at the basic software layer, and the second set of components includes: a second software component located at the application layer and a second basic software component located at the basic software layer and a network management component.

[0064] Step S54: When the first ECU operates normally, the first ECU executes the network management function and the first application function, and the second ECU executes the second application function through the first software component and the first basic software component.

[0065] Step S56: When the first ECU is abnormal, the second ECU executes the network management function, the first application function and the second application function through the second software component, the second basic software and the network management component.

[0066] In this embodiment, multiple sets of components are set in the second ECU, and different components are enabled based on whether the first ECU is normal, so that efficient and reliable network management can be achieved in the dual ECU system, and the second ECU can serve as a backup for the first ECU, thereby improving the reliability and redundancy of the system.

[0067] In addition, an embodiment of the present invention further provides an electronic device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method described in the embodiment of the present invention.

[0068] In addition, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the steps of the method of the present invention are implemented.

[0069] In addition, an embodiment of the present invention further provides a computer program product, including a computer program / instruction, which implements the steps of the method of the present invention when executed by a processor.

[0070] The description of the above device, storage medium and program product embodiments is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the device, storage medium and program product embodiments of this application, please refer to the description of the method embodiment of this application for understanding.

[0071] The processor may be at least one of an application specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a central processing unit (CPU), a controller, a microcontroller, a microprocessor, etc. It is understandable that the electronic device that implements the function of the processor may also be other, and the embodiments of the present application are not specifically limited.

[0072] The above-mentioned computer storage medium / memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory (Flash Memory), a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM) and the like; it can also be various terminals including one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0073] It should be noted that the above description is only for example and not for limitation of the present invention. In other embodiments of the present invention, the method may have more, fewer or different steps, and the order, inclusion and function of each step may be different from that described and illustrated. For example, generally multiple steps can be combined into a single step, and a single step can also be divided into multiple steps. For those of ordinary skill in the art, without paying creative work, the sequential changes of each step are also within the scope of protection of the present invention.

[0074] The technical solution of the present invention, in essence or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor or a microcontroller to perform all or part of the steps of the method described in each embodiment of the present invention.

[0075] Those skilled in the art will appreciate that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware associated with program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed.

[0076] Although the present invention has been disclosed as above with preferred embodiments, the present invention is not limited thereto. Any changes and modifications made by any person skilled in the art without departing from the spirit and scope of the present invention should be included in the protection scope of the present invention, and therefore the protection scope of the present invention should be subject to the scope defined by the claims.

Claims

1. A dual ECU system based on AUTOSAR, as an independent node in the vehicle network, characterized in that: include: first and second ECUs connected to the same bus and sharing a first node identifier; A first ECU, configured to execute a network management function and a first application function; The second ECU includes: a first software component and a second software component located at the application layer, and a first basic software component, a second basic software component and a first network management component located at the basic software layer; The second ECU is used to enable the first software component and the first basic software component to execute the second application function when the first ECU operates normally; and to switch to enabling the second software component, the second basic software component and the first network management component to execute the network management function, the first application function and the second application function when the first ECU is abnormal.

2. The AUTOSAR-based dual ECU system according to claim 1, characterized in that: The first and second ECUs detect operational abnormality using at least one synchronization method of hard-wire synchronization, internal communication synchronization, and external communication synchronization.

3. The AUTOSAR-based dual ECU system according to claim 2, characterized in that: When the second ECU detects that the first ECU resumes normal operation, it instructs the first ECU to prohibit execution of the network management function and the first application function.

4. The AUTOSAR-based dual ECU system according to claim 1, characterized in that: When the first ECU is operating normally, the network status of the first ECU is sent to the second ECU, and the first software component in the second ECU manages the second ECU according to the received network status.

5. The AUTOSAR-based dual ECU system as claimed in claim 4, characterized in that: The first ECU sends the network status to the second ECU using a network management frame sent to the bus.

6. The AUTOSAR-based dual ECU system as claimed in claim 4, characterized in that: The first ECU sends the network status to the second ECU by using an application frame sent to the bus. The application frame uses a second node identifier, and the second node identifier is exclusively allocated to the second ECU.

7. The AUTOSAR-based dual ECU system as claimed in claim 4, characterized in that: The first ECU sends the network status to the second ECU through the internal communication channel in the dual ECU system.

8. The AUTOSAR-based dual ECU system as claimed in claim 4, characterized in that: The network state includes: sleep mode, network mode or pre-sleep mode; and when the network state is the network mode, the network state further includes: frame repetition state, normal operation state or ready-to-sleep state.

9. The AUTOSAR dual ECU system according to claim 2, characterized in that: A first ECU includes: a third software component and a fourth software component located at an application layer, and a third basic software component, a fourth basic software component and a second network management component located at a basic software layer; The first ECU is specifically used to: enable the third software component, the third basic software component and the second network management component to execute the network management function and the first application function when the second ECU is operating normally; and switch to enabling the fourth software component, the fourth basic software component and the second network management component to execute the network management function, the first application function and the second application function when the second ECU is operating abnormally.

10. A network management method for a dual ECU system based on AUTOSAR, characterized in that: include: The first and second ECUs in the dual ECU system both communicate in the vehicle network according to the first node identifier; In the second ECU, a first software component and a second software component located at the application layer, and a first basic software component, a second basic software component and a network management component located at the basic software layer are provided; When the first ECU is operating normally, the first ECU executes the network management function and the first application function, and the second ECU executes the second application function through the first software component and the first basic software component; as well as When the first ECU is abnormal, the second ECU executes the network management function, the first application function and the second application function through the second software component, the second basic software and the network management component.

Images