Vehicle function program migration operation method, device, equipment, medium and product

Abstract

The invention provides a vehicle function program migration operation method and device, equipment, a medium and a product, and can be applied to the technical field of vehicles. In the method, a master controller in a controller cluster does not receive a heartbeat message of a to-be-migrated slave controller in a first period, a fault of the to-be-migrated slave controller is determined, then a migration controller is determined according to the obtained computing resource remaining amount of each controller, and when the migration controller is the slave controller, the to-be-migrated slave controller does not receive the heartbeat message of the to-be-migrated slave controller. And sending the first migration message to a migration controller. And the migration controller runs a vehicle function program corresponding to the vehicle function program identifier according to the vehicle function program identifier in the first migration message to realize a vehicle function corresponding to the slave controller to be migrated. According to the scheme, when the master controller determines that the slave controller to be migrated fails, the vehicle function program corresponding to the vehicle function program identifier of the slave controller to be migrated is operated by using the migration controller, so that the vehicle function corresponding to the slave controller to be migrated is realized, and the vehicle safety is improved.

Description

Technical Field

[0001] The present application relates to the field of vehicle technology, and in particular to a vehicle function program migration operation method, device, equipment, medium and product. Background Art

[0002] With the development of technology, vehicles have more and more functions. In order to support the realization of vehicle functions, a large number of controllers and input / output (IO) devices are installed in the vehicle. IO devices can be sensors or actuators, such as motors, solenoid valves, etc.

[0003] In the prior art, although each IO device is connected to each controller in communication, different controllers run different vehicle function programs, so in fact, the controller only needs to obtain the data of the corresponding IO device, which is the data required by the vehicle function program. When a controller fails, the vehicle function program cannot continue to run, resulting in the inability to realize the vehicle function.

[0004] Therefore, there is an urgent need for a vehicle function program migration operation method that can realize the corresponding vehicle function when a controller fails. Summary of the invention

[0005] The embodiments of the present application provide a vehicle function program migration operation method, device, equipment, medium and product, which are used to solve the problem that a vehicle function program migration operation method is urgently needed to realize the corresponding vehicle function when a controller fails.

[0006] In a first aspect, an embodiment of the present application provides a vehicle function program migration operation method, which is applied to a main controller in a controller cluster, and the method includes:

[0007] For each slave controller in the controller cluster, monitoring whether a heartbeat message sent by the slave controller is received in each first cycle;

[0008] If a heartbeat message sent by the slave controller to be migrated is not received within the first cycle, obtaining the remaining amount of computing resources of each controller in the controller cluster and the vehicle function program identifier of the slave controller to be migrated;

[0009] Determining a migration controller according to the remaining amount of computing resources of each controller in the controller cluster;

[0010] If the migration controller is a slave controller, a first migration message is sent to the migration controller, where the first migration message includes the vehicle function program identifier.

[0011] In a specific embodiment, the method further comprises:

[0012] If the migration controller is the main controller, the vehicle function program corresponding to the vehicle function program identifier is run.

[0013] In a specific embodiment, the method further comprises:

[0014] The slave controller to be migrated is removed from the controller cluster.

[0015] In a specific embodiment, the method further comprises:

[0016] A migration correspondence relationship is established among the identification number of the slave controller to be migrated, the identification number of the migration controller, and the vehicle function program identification, and the vehicles are stored in a storage space corresponding to the first preset path.

[0017] In a specific embodiment, the method further comprises:

[0018] After determining that the failed controller is restored, acquiring a migration correspondence relationship from a storage space corresponding to the first preset path;

[0019] According to the migration correspondence, determining the migration controller identification number and the vehicle function program identification corresponding to the fault controller identification number;

[0020] If the fault controller is a main controller, the vehicle function program corresponding to the vehicle function program identifier is run, and a first stop operation message is sent to the migration controller according to the identification number of the migration controller, wherein the first stop operation message includes the vehicle function program identifier.

[0021] In a specific embodiment, the method further comprises:

[0022] If the faulty controller is a slave controller and the migration controller is a master controller, the vehicle function program corresponding to the vehicle function program identifier is stopped, and a second migration message is sent to the faulty controller, where the second migration message includes the vehicle function program identifier.

[0023] In a specific embodiment, the method further comprises:

[0024] If the faulty controller is a slave controller and the migration controller is a slave controller, the second migration message is sent to the faulty controller, and the first stop running message is sent to the migration controller.

[0025] In a specific embodiment, the method further comprises:

[0026] After determining that a new controller has been added to the controller cluster, obtaining a remaining amount of computing resources of each controller in the controller cluster;

[0027] Determining a target controller according to the remaining amount of computing resources of each controller in the controller cluster;

[0028] If the target controller is a slave controller, sending a second stop operation message to the target controller, and sending a third migration message to the newly added slave controller, wherein the third migration message and the second stop operation message include a part of the vehicle function program identifiers of the target controller;

[0029] If the target controller is a master controller, the vehicle function programs corresponding to the partial vehicle function program identifiers are stopped, and the third migration message is sent to the newly added slave controller.

[0030] In a specific embodiment, the method further comprises:

[0031] When receiving a heartbeat message sent by a recovery controller, determining whether the recovery controller belongs to the controller cluster according to the cluster identifier in the heartbeat message, wherein the heartbeat message also includes the priority of the recovery controller, or includes the priority of the recovery controller and the master controller mark;

[0032] If the recovery controller belongs to the controller cluster, determine whether the heartbeat message includes a master controller tag, and determine whether the priority of the recovery controller is higher than the priority of the master controller;

[0033] If the heartbeat message includes a master controller tag and the priority of the recovery controller is higher than that of the master controller, the master controller is updated to a slave controller and a role change message is sent to the recovery controller so that the recovery controller is updated to the master controller and the recovery controller determines that the faulty controller is recovered.

[0034] In a specific embodiment, the method further comprises:

[0035] If the heartbeat message does not include the master controller mark, or the priority of the recovery controller is lower than the priority of the master controller, it is determined that the faulty controller is recovered.

[0036] In a specific embodiment, the method further comprises:

[0037] Add the recovery controller to the controller cluster.

[0038] In a specific embodiment, the method further comprises:

[0039] After the master controller is powered on, a configuration file is obtained from the storage space corresponding to the second preset path, where the configuration file includes a cluster identifier, an identifier of the master controller, and an identifier of each slave controller;

[0040] Determining that the main controller is the main controller according to the identification number of the main controller;

[0041] Create a controller cluster, broadcast heartbeat messages according to the first cycle, and generate a master controller tag;

[0042] receiving a cluster joining request sent from a controller, wherein the cluster joining request includes a cluster identifier;

[0043] If the cluster identifier belongs to the configuration file, the slave controller is added to the controller cluster, and a feedback message is sent to the slave controller to determine that a new controller has been added to the controller cluster.

[0044] In a second aspect, an embodiment of the present application provides a vehicle function program migration operation method, which is applied to a slave controller in a controller cluster, and the method includes:

[0045] Receiving a first migration message sent by a master controller in the controller cluster, wherein the first migration message includes a vehicle function program identifier of a slave controller to be migrated, wherein the slave controller to be migrated is a slave controller in the controller cluster that has not sent a heartbeat message within a first cycle;

[0046] The vehicle function program corresponding to the vehicle function program identifier is run.

[0047] In a specific embodiment, the method further comprises:

[0048] receiving a first stop operation message sent by the main controller, wherein the first stop operation message includes a vehicle function program identifier;

[0049] Stop running the vehicle function program corresponding to the vehicle function program identifier.

[0050] In a specific embodiment, the method further comprises:

[0051] receiving a second migration message or a third migration message sent by the main controller, wherein the second migration message and the third migration message include a vehicle function program identifier;

[0052] The vehicle function program corresponding to the vehicle function program identifier is run.

[0053] In a specific embodiment, the method further comprises:

[0054] receiving a second stop operation message sent by the main controller, wherein the second stop operation message includes a part of the vehicle function program identifiers thereof;

[0055] Stop running the vehicle function program corresponding to the vehicle function program identifier.

[0056] In a specific embodiment, the method further comprises:

[0057] Monitoring whether a heartbeat message sent by the master controller and a slave controller with a higher priority than itself in the controller cluster is received in each second cycle;

[0058] If no heartbeat message is received from the master controller and a slave controller with a higher priority than itself in the controller cluster within the second cycle, the master controller updates itself to be the master controller.

[0059] In a specific embodiment, the method further comprises:

[0060] After the slave controller is powered on, a configuration file is obtained from the storage space corresponding to the second preset path, wherein the configuration file includes a cluster identifier, an identifier of the master controller, and an identifier of each slave controller;

[0061] According to the identification number of each controller, determine that it is a slave controller;

[0062] Broadcasting a cluster joining request, wherein the cluster joining request includes the cluster identifier;

[0063] If a feedback message sent by the main controller is received, a heartbeat message is broadcast according to the first cycle.

[0064] In one embodiment, the method further comprises

[0065] If no feedback message is received from the master controller, the controller updates itself to be the master controller, creates a controller cluster, broadcasts heartbeat messages according to the first cycle, and generates a master controller mark.

[0066] In a third aspect, an embodiment of the present application provides a vehicle function program migration operation device, comprising:

[0067] Processing modules for:

[0068] For each slave controller in the controller cluster, monitoring whether a heartbeat message sent by the slave controller is received in each first cycle;

[0069] If a heartbeat message sent by the slave controller to be migrated is not received within the first cycle, obtaining the remaining amount of computing resources of each controller in the controller cluster and the vehicle function program identifier of the slave controller to be migrated;

[0070] Determining a migration controller according to the remaining amount of computing resources of each controller in the controller cluster;

[0071] A sending module is used for sending a first migration message to the migration controller if the migration controller is a slave controller, wherein the first migration message includes the vehicle function program identifier.

[0072] In a fourth aspect, an embodiment of the present application provides a vehicle function program migration operation device, including:

[0073] A receiving module, configured to receive a first migration message sent by a master controller in a controller cluster, wherein the first migration message includes a vehicle function program identifier of a slave controller to be migrated, wherein the slave controller to be migrated is a slave controller in the controller cluster that has not sent a heartbeat message within a first cycle;

[0074] A processing module is used to run the vehicle function program corresponding to the vehicle function program identifier.

[0075] In a fifth aspect, an embodiment of the present application provides a controller, including:

[0076] Processor, memory, communication interface;

[0077] The memory is used to store executable instructions of the processor;

[0078] Wherein, the processor is configured to execute the vehicle function program migration operation method described in any one of the first aspect or the second aspect by executing the executable instructions.

[0079] In a sixth aspect, an embodiment of the present application provides a vehicle, comprising a master controller and a slave controller;

[0080] The main controller is used to execute any one of the vehicle function program migration operation methods described in the first aspect;

[0081] The slave controller is used to execute the vehicle function program migration operation method described in any one of the second aspects.

[0082] In the seventh aspect, an embodiment of the present application provides a readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the vehicle function program migration operation method described in any one of the first aspect or the second aspect is implemented.

[0083] In an eighth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, is used to implement the vehicle function program migration operation method described in any one of the first aspect or the second aspect.

[0084] The vehicle function program migration operation method, device, equipment, medium and product provided in the embodiments of the present application determine that the slave controller to be migrated is faulty when the master controller in the controller cluster does not receive the heartbeat message of the slave controller to be migrated within the first cycle, and then obtain the remaining computing resources of each controller in the controller cluster. The migration controller is then determined based on the remaining computing resources, and when the migration controller is a slave controller, a first migration message is sent to the migration controller. The migration controller runs the vehicle function program corresponding to the vehicle function program identifier according to the vehicle function program identifier in the first migration message, and realizes the vehicle function corresponding to the slave controller to be migrated. When the master controller determines that the slave controller to be migrated is faulty, this solution uses the migration controller to run the vehicle function program corresponding to the vehicle function program identifier of the slave controller to be migrated, thereby realizing the vehicle function corresponding to the slave controller to be migrated and improving vehicle safety. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0086] Figure 1a A schematic diagram of a vehicle architecture of the prior art provided for this application;

[0087] Figure 1b The vehicle architecture of the prior art provided for this application is shown in FIG. Figure 2 ;

[0088] Figure 2 A schematic diagram of an application scenario of the vehicle function program migration operation method provided in this application;

[0089] Figure 3a A flowchart of a first embodiment of a vehicle function program migration operation method provided by the present application;

[0090] Figure 3b A schematic diagram of vehicle function program migration provided for this application;

[0091] Figure 3c Schematic diagram 1 of the architecture of the controller provided for this application;

[0092] Figure 3d The architecture of the controller provided in this application is shown as follows Figure 2 ;

[0093] Figure 4 A flowchart of a second embodiment of the vehicle function program migration operation method provided by the present application;

[0094] Figure 5 A flowchart of a third embodiment of the vehicle function program migration operation method provided by the present application;

[0095] Figure 6 A flowchart of a fourth embodiment of the vehicle function program migration operation method provided by the present application;

[0096] Figure 7 A flowchart of a fifth embodiment of the vehicle function program migration operation method provided by the present application;

[0097] Figure 8a A flowchart of a sixth embodiment of the vehicle function program migration operation method provided by the present application;

[0098] Figure 8b Schematic diagram of vehicle function program migration provided for this application;

[0099] Fig. 9 A schematic diagram of the structure of a first embodiment of a vehicle function program migration and operation device provided by the present application;

[0100] Fig.10 A schematic diagram of the structure of a second embodiment of a vehicle function program migration and operation device provided by the present application;

[0101] Fig.11 A schematic diagram of the structure of a controller provided in this application. DETAILED DESCRIPTION

[0102] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments made by ordinary technicians in this field under the enlightenment of the embodiments belong to the scope of protection of the present application.

[0103] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0104] With the development of technology, vehicles have more and more functions. When the functions of a vehicle are relatively few, two control systems can be set up in the vehicle. The two control systems are the same. Each control system includes a controller and multiple input / output (IO) devices. The controller communicates with the IO devices. The IO devices can be sensors or actuators, such as motors, solenoid valves, etc.

[0105] For example, Figure 1a A schematic diagram of a vehicle architecture of the prior art provided in this application is shown in FIG. Figure 1a As shown, two identical control systems are set in the vehicle, each control system includes a controller and multiple IO devices, and the controller is connected to the IO devices for communication. The controller runs a vehicle function program, which uses the data of the IO devices to implement the vehicle function. To improve vehicle safety, when one controller fails, another control system is used to implement the vehicle function. Since only one controller is working at the same time, the utilization rate of the controller is low.

[0106] As vehicle functions become more and more numerous, a large number of controllers and IO devices are installed in the vehicle to realize vehicle functions and improve the utilization rate of controllers. Although each IO device is connected to each controller in communication, different controllers run different vehicle function programs, so in fact, the controller only needs to obtain the data of its corresponding IO device, which is the data required by the vehicle function program. When a controller fails, the vehicle function program cannot continue to run, resulting in the inability to realize the vehicle function.

[0107] For example, Figure 1b The vehicle architecture of the prior art provided for this application is shown in FIG. Figure 2 ,like Figure 1b As shown, the vehicle includes multiple controllers, namely controller 1, controller 2 and controller 3, and multiple IO devices, namely IO device 1, IO device 2, IO device 3 and IO device 4, and each IO device is communicatively connected with each controller. Different controllers run different vehicle function programs. Controller 1 runs vehicle function program 1 and vehicle function program 2, controller 2 runs vehicle function program 3 and vehicle function program 4, and controller 3 runs vehicle function program 5. Vehicle function program 1 and vehicle function 2 require data from IO device 1 and IO device 2, vehicle function program 3 and vehicle function 4 require data from IO device 3 and IO device 4, and vehicle function program 5 requires data from IO device 2. When a controller fails, the vehicle function program cannot be continued to run, resulting in the inability to realize the vehicle function. Therefore, a vehicle function program migration operation method is urgently needed to realize the corresponding vehicle function when a controller fails.

[0108] In view of the problems existing in the prior art, the inventor discovered during the research on the vehicle function program migration operation method that in order to realize the corresponding vehicle function when a controller fails, the controllers can be formed into a controller cluster, in which the master controller monitors whether the slave controller fails. When a failure occurs, the migration controller is determined according to the remaining amount of computing resources of each controller in the cluster, and then the migration controller is used to run the vehicle function program of the failed controller to realize the vehicle function. Based on the above inventive concept, the vehicle function program migration operation scheme in this application is designed.

[0109] In this application, the controller is a device with computing and storage functions, which can be a graphics card, a microcontroller unit (MCU), a vehicle control unit (VCU), a vehicle mainboard, etc. This application does not limit it and can be determined according to actual conditions.

[0110] For example, Figure 2 A schematic diagram of an application scenario of the vehicle function program migration operation method provided in this application, such as Figure 2 As shown, the application scenario may include multiple controllers (only controller 21, controller 22 and controller 23 are shown in the figure) and multiple IO devices (only IO device 24, IO device 25, IO device 26 and IO device 27 are shown in the figure).

[0111] exist Figure 2 In the application scenario shown, each IO device is connected to each controller for communication, and each controller is connected to each other for communication. Controller 21, controller 22 and controller 23 form a controller cluster, where controller 21 is a master controller, and controller 22 and controller 23 are slave controllers.

[0112] The controller 21 runs the vehicle function program 1 and the vehicle function program 2, the controller 22 runs the vehicle function program 3 and the vehicle function program 4, and the controller 23 runs the vehicle function program 5. The vehicle function program 1 and the vehicle function 2 require data from the IO device 24 and the IO device 25, the vehicle function program 3 and the vehicle function 4 require data from the IO device 26 and the IO device 27, and the vehicle function program 5 requires data from the IO device 26.

[0113] It should be noted that the communication connection method can be a wired communication connection or a wireless communication connection. Figure 2 In the embodiment, the IO device and the controller are connected by wired communication, and the controllers are connected by wireless communication. The embodiment of the present application does not limit the communication connection method, which can be determined according to actual conditions.

[0114] Each controller in the controller cluster sends heartbeat messages to other controllers in the controller cluster according to the first cycle. The master controller 21 monitors whether it receives heartbeat messages from the slave controllers 22 and 23 in each first cycle to determine whether the slave controllers are faulty.

[0115] It should be noted that the first period can be 0.1 seconds, 0.5 seconds, 1 second, 10 seconds, 30 seconds, etc. The embodiment of the present application does not limit the first period and can be determined according to actual conditions.

[0116] If the master controller 21 does not receive the heartbeat message sent by the slave controller 22 within the first cycle, it indicates that the slave controller 22 fails and the slave controller 22 is a slave controller to be migrated.

[0117] Then, the master controller 21 obtains the remaining amount of computing resources of each controller in the controller cluster and the vehicle function program identifier of the slave controller 22, and determines the migration controller according to the remaining amount of computing resources of each controller, and determines that the migration controller is the slave controller 23. The vehicle function program identifiers of the slave controller 22 are the identifiers of vehicle function program 3 and vehicle function program 4.

[0118] The master controller 21 sends a first migration message to the slave controller 23 , where the first migration message includes the vehicle function program identifier of the slave controller 22 .

[0119] The slave controller 23 runs the vehicle function program corresponding to the vehicle function program identifier of the slave controller 22 to implement the vehicle function corresponding to the slave controller 22, that is, to obtain the data of the IO device 26 and the IO device 27, run the vehicle function program 3 and the vehicle function program 4, and complete the vehicle function program migration operation.

[0120] It should be noted that Figure 2 This is only a schematic diagram of an application scenario provided by the embodiment of the present application. Figure 2 The actual form of the various devices included in the Figure 2 The interaction mode between devices is limited, and in the specific application of the solution, it can be set according to actual needs.

[0121] The technical solution of the present application is described in detail below through specific embodiments. It should be noted that the following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0122] Figure 3aThis is a flow chart of the first embodiment of the vehicle function program migration operation method provided by the present application. The present embodiment of the present application describes the situation that when the master controller determines that a slave controller in the controller cluster is faulty, a migration controller is determined, and the vehicle function program of the faulty controller is migrated to the migration controller for operation. The method in this embodiment can be implemented by software, hardware, or a combination of software and hardware.

[0123] like Figure 3a As shown, the vehicle function program migration operation method specifically includes the following steps:

[0124] S301: The master controller monitors, for each slave controller in the controller cluster, whether a heartbeat message sent by the slave controller is received in each first cycle.

[0125] The controllers in the vehicle form at least one controller cluster, each of which includes a master controller. The controllers other than the master controller in each controller cluster are slave controllers. The master controller maintains the controller cluster by maintaining a cluster table and synchronizing the cluster table to the slave controllers. The cluster table records the identification number of each controller in the controller cluster. Each controller in the controller cluster sends a heartbeat message according to the first cycle.

[0126] In this step, in order to determine whether a slave controller in the controller cluster fails, the master controller monitors whether a heartbeat message sent by each slave controller in the controller cluster is received in each first cycle.

[0127] The heartbeat message includes the cluster identifier and the controller identification number, so the master controller can determine whether the controller sending the heartbeat message is a slave controller in the controller cluster based on the received heartbeat message, and then record the identification number of the slave controller that sent the heartbeat message in the first cycle, and then combine it with the cluster table to determine which slave controllers have not sent heartbeat messages.

[0128] It should be noted that the first period can be 0.1 seconds, 0.5 seconds, 1 second, 10 seconds, 30 seconds, etc. The embodiment of the present application does not limit the first period and can be determined according to actual conditions.

[0129] S302: If the master controller does not receive a heartbeat message sent by the slave controller to be migrated within the first cycle, the master controller obtains the remaining amount of computing resources of each controller in the controller cluster and the vehicle function program identifier of the slave controller to be migrated.

[0130] In this step, if the main controller does not receive the heartbeat message sent by the slave controller to be migrated within the first cycle, in order to realize the migration of the vehicle function program, the remaining computing resources of each controller in the controller cluster and the vehicle function program identifier of the slave controller to be migrated are obtained.

[0131] Specifically, the master controller obtains its own remaining computing resources, sends a request to obtain the remaining computing resources to each slave controller corresponding to an identification number in the cluster table except the identification number of the master controller and the identification number of the controller to be migrated, and the slave controller sends its own remaining computing resources to the master controller. The remaining computing resources of the slave controller to be migrated are set to 0 at this time.

[0132] Each controller is set with a corresponding vehicle function program identifier to run the corresponding vehicle function program to implement the vehicle function. The corresponding relationship between the controller identification number and the vehicle function program identifier is stored in a public access space, so the master controller can obtain the corresponding vehicle function program identifier from the public access space according to the identification number of the slave controller to be migrated.

[0133] It should be noted that the remaining amount of computing resources may be the remaining utilization rate of the processor, the remaining utilization rate of the memory, the remaining network bandwidth, etc. The embodiment of the present application does not limit the remaining amount of computing resources and can be determined according to actual conditions.

[0134] S303: The main controller determines a migration controller according to the remaining amount of computing resources of each controller in the controller cluster.

[0135] In this step, after the main controller obtains the remaining amount of computing resources of each controller in the controller cluster, it determines the migration controller according to the remaining amount of computing resources.

[0136] It should be noted that the method for determining the migration control according to the remaining amount of computing resources can be: the controller with the largest remaining amount of computing resources in the controller cluster is used as the migration controller. It can also be: the controllers in the controller cluster are sorted in descending order of the remaining amount of computing resources to obtain a first controller sequence, and then the first preset number of controllers in the first controller sequence are selected, and then a controller is randomly selected from the preset number of controllers as the migration controller. It can also be: a controller is randomly selected from the controllers in the controller cluster whose remaining amount of computing resources is greater than 0 as the migration controller.

[0137] The preset number can be 3, 5, 7, etc. The embodiment of the present application does not limit the preset number and the method of determining the migration control according to the remaining amount of computing resources, and can be determined according to actual conditions.

[0138] Since the remaining computing resources of the selected migration controller are greater than 0 and the remaining computing resources of the slave controller to be migrated are 0, the slave controller to be migrated will not be selected as the migration controller.

[0139] S304: If the migration controller is a slave controller, the master controller sends a first migration message to the migration controller.

[0140] In this step, after the master controller determines the migration controller, in order to determine how to perform the migration, it is also necessary to determine whether the migration controller is a slave controller.

[0141] If the migration controller is a slave controller, the vehicle function program of the slave controller to be migrated needs to be migrated to the slave controller for operation, and the master controller sends a first migration message to the migration controller, where the first migration message includes the vehicle function program identifier of the slave controller to be migrated.

[0142] If the migration controller is the main controller, the vehicle function program of the slave controller to be migrated needs to be migrated to the main controller for execution, so the main controller runs the vehicle function program corresponding to the vehicle function program identifier.

[0143] It should be noted that in order to maintain the controller cluster, the master controller removes the slave controllers to be migrated in the controller cluster and completes the controller cluster update, that is, deletes the identification numbers of the slave controllers to be migrated from the cluster table, completes the update, and then sends the updated cluster table to each slave controller in the updated controller cluster.

[0144] It should be noted that, in order for the vehicle function program to be migrated back to the original controller for operation after the controller failure is recovered, it is necessary to establish a migration correspondence between the identification number of the slave controller to be migrated, the identification number of the migration controller, and the vehicle function program identification, and store them in the storage space corresponding to the first preset path. The storage space corresponding to the first preset path is a public access space that can be accessed by each controller.

[0145] S305: After receiving the first migration message sent by the main controller in the controller cluster, the slave controller runs the vehicle function program corresponding to the vehicle function program identifier.

[0146] In this step, after the main controller sends the first migration message to the migration controller, since the migration controller is a slave controller, the slave controller can receive the first migration message sent by the main controller in the controller cluster, and then run the vehicle function program corresponding to the vehicle function program identifier in the first migration message.

[0147] The first migration message includes a vehicle function program identifier of a slave controller to be migrated, and the slave controller to be migrated is a slave controller in the controller cluster that has not sent a heartbeat message within a first cycle.

[0148] Since the vehicle function program is stored in a public access space, each controller can obtain the corresponding vehicle function program from the public access space according to the vehicle function program identifier and then run it.

[0149] After the vehicle function program is migrated from the controller to be migrated to the migration controller, the data required to run the vehicle function program can be stored in the migration controller or in other controllers.

[0150] For example, Figure 3b The vehicle function program migration diagram provided for this application is as follows: Figure 3b As shown, controller 1 is the slave controller to be migrated, controller 2 is the migration controller, controller 1 runs vehicle function program 1 and vehicle function program 2, and controller 2 runs vehicle function program 3 and vehicle function program 4. After controller 1 fails, vehicle function program 1 and vehicle function program 2 are migrated to controller 2 for operation.

[0151] For example, Figure 3c The schematic diagram of the controller architecture provided in this application is as follows: Figure 3c As shown, the controller includes a vehicle function program layer, a virtual layer and a driver layer. A vehicle function program runs in the vehicle function program layer. When the vehicle function program needs to control the IO device 1, the vehicle function program sends a standard control message to the virtual layer. After the virtual layer converts the standard control message into a control message that can be recognized by the IO device 1, it sends the converted control message to the driver layer. The driver layer controls the IO device 1 according to the converted control message. When the IO device 1 sends its own data to the vehicle function program, the IO device 1 sends its own data to the driver layer, and the driver layer sends the data to the virtual layer. After the virtual layer standardizes the data, it sends the standardized data to the vehicle function program. Through the virtual layer, the vehicle function program can interact with different IO devices to realize vehicle functions.

[0152] For example, in Figure 3c On the basis of Figure 3d The architecture of the controller provided in this application is shown as follows Figure 2 ,like Figure 3d As shown, vehicle function programs are running in the vehicle function program layer, and different vehicle function programs are isolated through virtual machines or containers. Since different vehicle function programs are running in isolation, when one vehicle function program crashes, it will not affect the running of other vehicle function programs.

[0153] The vehicle function program migration operation method provided in this embodiment determines that the slave controller to be migrated is faulty when the master controller in the controller cluster does not receive the heartbeat message of the slave controller to be migrated within the first cycle, and then obtains the remaining computing resources of each controller in the controller cluster. The migration controller is then determined based on the remaining computing resources, and when the migration controller is a slave controller, the first migration message is sent to the migration controller. The migration controller runs the vehicle function program corresponding to the vehicle function program identifier according to the vehicle function program identifier in the first migration message, and realizes the vehicle function corresponding to the slave controller to be migrated. When the master controller determines that the slave controller to be migrated is faulty, this scheme uses the migration controller to run the vehicle function program corresponding to the vehicle function program identifier of the slave controller to be migrated, thereby realizing the vehicle function corresponding to the slave controller to be migrated and improving vehicle safety.

[0154] Figure 4 This is a flow chart of the second embodiment of the vehicle function program migration operation method provided by this application. Based on the above embodiment, this embodiment of the application describes the situation where the master controller creates a controller cluster and the slave controller joins the cluster. Figure 4 As shown, the vehicle function program migration operation method specifically includes the following steps:

[0155] S401: After the main controller is powered on, a configuration file is obtained from a storage space corresponding to a second preset path.

[0156] In this step, in order to be able to migrate the vehicle function program later, it is necessary to build a controller cluster. First, after the main controller is powered on, the configuration file is obtained from the storage space corresponding to the second preset path. The configuration file includes the cluster identifier, the identification number of the main controller, and the identification number of each slave controller.

[0157] It should be noted that the storage space corresponding to the second preset path is a public access space and is accessible to each controller.

[0158] S402: The main controller determines that it is the main controller according to the identification number of the main controller.

[0159] In this step, after the main controller obtains the configuration file, since the configuration file includes the identification number of the main controller, it can determine that its own identification number is the same as the identification number of the main controller, and thus determine that it is the main controller.

[0160] S403: The master controller creates a controller cluster, broadcasts a heartbeat message according to the first cycle, and generates a master controller mark.

[0161] In this step, after the master controller determines that it is the master controller, since the master controller maintains the controller cluster, the master controller creates a controller cluster and broadcasts a heartbeat message according to the first cycle to generate a master controller mark.

[0162] The master controller creates a controller cluster by creating a cluster table and then adding its own identification number to the cluster table.

[0163] In order for other controllers to determine that the main controller is not faulty, it is necessary to broadcast the heartbeat message according to the first cycle.

[0164] In order to ensure that the primary controller can become the primary controller again after the primary controller fails and recovers, a primary controller flag needs to be generated.

[0165] S404: After the slave controller is powered on, a configuration file is obtained from a storage space corresponding to the second preset path.

[0166] In this step, in order to be able to migrate the vehicle function program later, it is necessary to join the controller cluster from the controller. First, after the controller is powered on, obtain the configuration file from the storage space corresponding to the second preset path. The configuration file includes the cluster identifier, the identification number of the master controller, and the identification number of each slave controller.

[0167] S405: The slave controller determines that it is a slave controller according to the identification number of each controller.

[0168] In this step, after the slave controller obtains the configuration file, it determines that it is a slave controller according to the identification number of each slave controller in the configuration file.

[0169] In one implementation, if the identification number of the controller is different from the identification number of the master controller in the configuration file, it is determined that the controller is a slave controller.

[0170] In another implementation, if the identification number of the controller in the configuration file does not include the identification number of the controller, or the identification number of the slave controller in the configuration file includes the identification number of the controller, it is determined that the controller itself is a slave controller.

[0171] S406: Broadcast a request to join the cluster from the controller.

[0172] In this step, after the slave controller determines that it is a slave controller, it needs to join the controller cluster. Since the slave controller does not know which controller is the master controller at this time, the slave controller broadcasts a cluster joining request for the master controller to receive. The cluster joining request includes a cluster identifier.

[0173] S407: After receiving the cluster joining request sent by the slave controller, if the cluster identifier belongs to the configuration file, the master controller joins the slave controller to the controller cluster and sends a feedback message to the slave controller to confirm that the controller cluster has newly joined.

[0174] In this step, after the slave controller broadcasts the cluster joining request, the master controller can receive the cluster joining request sent by the slave controller. Then it determines whether the cluster identifier in the cluster joining request belongs to the configuration file obtained by the master controller; if the cluster identifier belongs to the configuration file, it means that the slave controller can join the controller cluster, then the slave controller will join the controller cluster, and send a feedback message to the slave controller to confirm that the controller cluster has newly joined.

[0175] The method of adding a slave controller to a controller cluster is as follows: if the identification number of the slave controller in the configuration file includes the identification number of the controller, the identification number of the slave controller is added to the cluster table to complete the controller cluster update, and then the cluster table is synchronized to each slave controller in the updated controller cluster; if the identification number of the controller in the configuration file does not include the identification number of the controller, the identification number of the controller is updated to the largest identification number in the cluster table + 1, and then added to the cluster table to complete the controller cluster update, and then the cluster table is synchronized to each slave controller in the updated controller cluster.

[0176] In order for the slave controller to acquire itself to join the controller cluster, the master controller is required to send a feedback message to the slave controller.

[0177] In order to subsequently allocate vehicle function programs to the newly added slave controller, it is necessary to determine the newly added controller to the controller cluster.

[0178] It should be noted that if the cluster identifier in the cluster joining request does not belong to the configuration file obtained by the master controller, the slave controller will not be added to the controller cluster, no feedback message will be sent to the slave controller, and it cannot be determined that a new controller has been added to the controller cluster.

[0179] S408: If the slave controller receives a feedback message sent by the master controller, it broadcasts a heartbeat message according to the first cycle.

[0180] In this step, after the master controller sends a feedback message to the slave controller, the slave controller can receive the feedback message sent by the master controller. In order for other controllers to determine that the slave controller has not failed, it is necessary to broadcast a heartbeat message according to the first cycle.

[0181] If no feedback message is received from the master controller, it means that there is no controller in the controller cluster corresponding to the cluster identifier in the configuration file, or all controllers in the controller cluster are faulty. In this case, the controller will be updated to be the master controller, a controller cluster will be created, and heartbeat messages will be broadcast according to the first cycle to generate a master controller tag.

[0182] The way to create a controller cluster is to create a cluster table, then update its own identification number to 0 and add it to the cluster table.

[0183] The vehicle function program migration operation method provided in this embodiment creates a controller cluster through the main controller, and the controller joins the controller cluster, thereby realizing the generation of the controller cluster, ensuring that a controller cluster has only one main controller, and a slave controller must be in a controller cluster.

[0184] Figure 5 The flowchart of the vehicle function program migration operation method embodiment 3 provided by the present application is a schematic diagram. Based on the above embodiment, the present application embodiment describes the situation in which the master controller allocates the vehicle function program to the slave controller after the slave controller joins the controller cluster, such as Figure 5 As shown, the vehicle function program migration operation method specifically includes the following steps:

[0185] S501: After determining that a new controller has been added to the controller cluster, the main controller obtains the remaining amount of computing resources of each controller in the controller cluster.

[0186] After the slave controller joins the controller cluster, the master controller can identify the new controller that has joined the controller cluster.

[0187] In this step, after the main controller determines that a new controller has been added to the controller cluster, in order to allocate vehicle function programs to the new controller, it is necessary to first obtain the remaining amount of computing resources of each controller in the controller cluster.

[0188] The main controller obtains its own remaining computing resources, and sends a computing resource remaining acquisition request to each slave controller corresponding to an identification number in the cluster table except the identification number of the main controller, and the slave controller sends its own computing resource remaining to the main controller.

[0189] It should be noted that after the master controller creates a cluster, it can run the vehicle function program corresponding to the vehicle function program identifier according to the vehicle function program identifier configured by the user for the master controller. Each slave controller can also run the vehicle function program corresponding to the vehicle function program identifier according to the vehicle function program identifier configured by the user.

[0190] S502: The main controller determines a target controller according to the remaining amount of computing resources of each controller in the controller cluster.

[0191] In this step, after the main controller obtains the remaining computing resources of each controller in the controller cluster, it first removes the newly added controller from the controller cluster to obtain the allocation cluster, and then determines the target controller based on the remaining computing resources of each controller in the allocation cluster.

[0192] It should be noted that the method for determining the target controller according to the remaining amount of computing resources of each controller in the allocation cluster can be: the controller with the smallest remaining amount of computing resources in the allocation cluster is used as the target controller. It can also be: the controllers in the allocation cluster are sorted in order from small to large in terms of remaining amount of computing resources to obtain a second controller sequence, and then the first preset number of controllers in the second controller sequence are selected, and then a controller is randomly selected from the preset number of controllers as the target controller. It can also be: a controller is randomly selected from the controllers in the allocation cluster whose remaining amount of computing resources is less than a preset threshold as the target controller.

[0193] The preset number can be 3, 5, 7, etc., and the preset threshold can be 30%, 40%, 50%, 40Mbps, 50Mbps, 60Mbps, etc. The embodiment of the present application does not limit the preset number, the preset threshold and the method of determining the target controller according to the remaining computing resources of each controller in the allocation cluster, and can be determined according to actual conditions.

[0194] S503: The master controller determines whether the target controller is a slave controller; if the target controller is a slave controller, execute steps S504 to S505; if the target controller is a master controller, execute step S506.

[0195] In this step, after the master controller determines the target controller, in order to determine how to allocate, it is necessary to determine whether the target controller is a slave controller.

[0196] S504: The main controller sends a second stop operation message to the target controller.

[0197] S505: The master controller sends a third migration message to the newly added slave controller.

[0198] In the above steps, if the master controller determines that the target controller is a slave controller, and the target controller is an existing slave controller in the cluster, the master controller sends a second stop operation message to the target controller and sends a third migration message to the newly added slave controller. The third migration message and the second stop operation message include some vehicle function program identifiers of the target controller.

[0199] The main controller may randomly select a preset allocation number of vehicle function program identifiers from all vehicle function program identifiers of the target controller as part of the vehicle function program identifiers. The main controller may also randomly select a preset proportion of vehicle function program identifiers from all vehicle function program identifiers of the target controller as part of the vehicle function program identifiers. The preset allocation number may be 1, 3, 5, etc., and the preset proportion may be 20%, 30%, 50%, etc. The embodiment of the present application does not limit the preset allocation number, preset proportion, and the method of determining the partial vehicle function program identifier, and may be determined according to actual conditions.

[0200] S506: The master controller stops running the vehicle function programs corresponding to some of the vehicle function program identifiers, and sends a third migration message to the newly added slave controller.

[0201] In this step, if the master controller determines that the target controller is the master controller, it stops running the vehicle function programs corresponding to some vehicle function program identifiers and sends a third migration message to the newly added slave controller.

[0202] S507: After receiving the second stop operation message sent by the main controller, the slave controller stops running the vehicle function program corresponding to the vehicle function program identifier.

[0203] In this step, after the main controller sends the second stop operation message to the target controller, the target controller is now an existing slave controller in the cluster. The slave controller can receive the second stop operation message sent by the main controller, and then stop running the vehicle function program corresponding to the vehicle function program identifier in the second stop operation message.

[0204] S508: After receiving the third migration message sent by the main controller, the slave controller runs the vehicle function program corresponding to the vehicle function program identifier.

[0205] In this step, after the main controller sends the third migration message to the newly added slave controller, the slave controller can receive the third migration message sent by the main controller, run the vehicle function program corresponding to the vehicle function program identifier in the third migration message, and realize vehicle function program allocation.

[0206] The vehicle function program migration operation method provided in this embodiment realizes vehicle function program allocation and improves controller utilization by determining a target controller from the controller cluster after the main controller determines a new controller has been added to the controller cluster, and then migrating part of the vehicle function program of the target controller to the newly added slave controller for operation.

[0207] Figure 6This is a flow chart of the fourth embodiment of the vehicle function program migration operation method provided by the present application. Based on the above embodiment, the present embodiment of the present application describes the situation in which the slave controller determines whether it becomes the master controller after the master controller in the controller cluster fails, such as Figure 6 As shown, the vehicle function program migration operation method specifically includes the following steps:

[0208] S601: The slave controller monitors whether it has received a heartbeat message sent by the master controller and a slave controller with a higher priority than itself in the controller cluster in each second cycle.

[0209] In order to ensure that there is always a master controller in the controller cluster, it is necessary to re-determine the master controller when the master controller fails. The principle of determining the master controller from the slave controllers in the controller cluster is: the slave controller with the highest priority in the controller cluster is used as the new master controller.

[0210] In this step, in order to determine whether the slave controller needs to become the master controller, the slave controller needs to monitor whether it receives heartbeat messages sent by the master controller and slave controllers with higher priority than itself in the controller cluster in each second cycle.

[0211] Since the heartbeat message includes the cluster identifier, the identification number and the priority of the controller that sends the heartbeat message, the slave controller can determine whether it is the same cluster as the controller that sends the heartbeat message based on the cluster identifier. When the two are the same cluster, it can be determined whether the controller that sends the heartbeat message is the master controller based on the identification number of the controller that sends the heartbeat message. When the controller that sends the heartbeat message is a slave controller, the priority of the slave controller and the controller that sends the heartbeat message can be determined based on the priority of the controller that sends the heartbeat message. Therefore, it can be monitored in each second cycle whether the heartbeat message sent by the master controller and the slave controller with a higher priority than itself in the controller cluster is received.

[0212] It should be noted that the second period is greater than or equal to the first period, and the second period can be 0.5 seconds, 1 second, 15 seconds, 40 seconds, etc. The embodiment of the present application does not limit the second period and can be determined according to actual conditions.

[0213] It should be noted that the priority can be represented by an identification number, and the smaller the identification number, the greater the priority.

[0214] S602: If the slave controller does not receive a heartbeat message sent by the master controller and a slave controller with a higher priority than itself in the controller cluster within the second cycle, the slave controller updates itself to the master controller.

[0215] In this step, if the slave controller does not receive a heartbeat message from the master controller and a slave controller with a higher priority than itself in the controller cluster within the second cycle, it indicates that the master controller is faulty, and the slave controller has the highest priority, and it updates itself to the master controller. The solution in the first embodiment can be executed later to realize the migration of vehicle function programs and ensure the realization of vehicle functions.

[0216] If the slave controller receives the heartbeat message sent by the master controller within the second cycle, it means that the master controller is not faulty, and the process ends.

[0217] If the slave controller receives a heartbeat message sent by a slave controller with a higher priority than itself in the controller cluster within the second cycle, it means that the slave controller should not become the master controller, and the process ends.

[0218] The vehicle function program migration operation method provided in this embodiment ensures that the controller cluster always has a master controller by having the slave controller with the highest priority become the new master controller when the master controller in the controller cluster fails.

[0219] Figure 7 This is a flow chart of the fifth embodiment of the vehicle function program migration operation method provided by the present application. Based on the above embodiments, the present embodiment of the present application describes the situation of rejoining the controller cluster after the controller failure is recovered. Figure 7 As shown, the vehicle function program migration operation method specifically includes the following steps:

[0220] S701: When the main controller receives a heartbeat message sent by the recovery controller, it determines whether the recovery controller belongs to the controller cluster according to the cluster identifier in the heartbeat message.

[0221] After the failed controller is restored, it can be called the restored controller. The restored controller will broadcast the heartbeat message again according to the first cycle. The heartbeat message includes the cluster identifier, identifier number and priority. If the restored controller was previously the master controller and the master controller tag has been generated, the heartbeat message sent also includes the master controller tag.

[0222] In this step, when the main controller receives the heartbeat message sent by the recovery controller, it determines whether the recovery controller belongs to the controller cluster according to the cluster identifier in the heartbeat message, so as to determine whether the recovery controller should join the controller cluster where the main controller is located.

[0223] S702: If the recovery controller belongs to a controller cluster, the main controller determines whether the heartbeat message includes the main controller mark, and determines whether the priority of the recovery controller is higher than the priority of the main controller; if the heartbeat message includes the main controller mark, and the priority of the recovery controller is higher than the priority of the main controller, execute steps S703-S704; if the heartbeat message does not include the main controller mark, or the priority of the recovery controller is lower than the priority of the main controller, execute step S705.

[0224] In this step, if the recovery controller belongs to the controller cluster, the master controller determines whether the heartbeat message includes the master controller tag and whether the priority of the recovery controller is higher than that of the master controller, so as to determine whether the master controller needs to be updated to a slave controller.

[0225] It should be noted that whether the master controller needs to be updated to a slave controller can also be determined only based on whether the heartbeat message includes the master controller mark. If the heartbeat message includes the master controller mark, it is determined that the master controller needs to be updated to a slave controller; if the heartbeat message does not include the master controller mark, it is determined that the master controller does not need to be updated to a slave controller.

[0226] It is also possible to determine whether the master controller needs to be updated to a slave controller only based on whether the priority of the recovery controller is higher than the priority of the master controller. If the priority of the recovery controller is higher than the priority of the master controller, it is determined that the master controller needs to be updated to a slave controller; if the priority of the recovery controller is lower than the priority of the master controller, it is determined that the master controller does not need to be updated to a slave controller.

[0227] It should be noted that if the recovery controller does not belong to the controller cluster where the main controller is located, the process ends.

[0228] S703: The master controller is updated to the slave controller, and sends a role switching message to the recovery controller, so that the recovery controller is updated to the master controller and the recovery controller determines that the faulty controller is recovered.

[0229] In this step, if the heartbeat message includes a master controller mark and the priority of the recovery controller is higher than that of the master controller, it means that the master controller needs to be updated to a slave controller. The master controller is then updated to a slave controller and a role change message is sent to the recovery controller so that the recovery controller is updated to the master controller and the recovery controller determines that the faulty controller has been recovered.

[0230] The recovery controller determines that the faulty controller is recovered in order to subsequently migrate its original vehicle function program back for operation.

[0231] S704: The active controller adds the recovery controller to the controller cluster.

[0232] In this step, after the recovery controller is updated to become the master controller, the new master controller adds itself to the controller cluster.

[0233] The method of adding to the controller cluster is as follows: the new master controller determines whether its own identification number is repeated with the identification number in the current cluster table; if its own identification number is repeated with the identification number in the current cluster table, its own identification number is updated to the largest identification number in the cluster table + 1, and then added to the cluster table to complete the controller cluster update, and then the cluster table is synchronized to each slave controller in the updated controller cluster; if its own identification number is not repeated with the identification number in the current cluster table, its own identification number is added to the cluster table to complete the controller cluster update, and then the cluster table is synchronized to each slave controller in the updated controller cluster.

[0234] S705: The master controller determines that the failed controller is recovered, and adds the recovered controller to the controller cluster.

[0235] In this step, if the heartbeat message does not include the master controller tag, or the priority of the recovery controller is lower than that of the master controller, it means that the master controller does not need to be updated to a slave controller. The master controller determines that the failed controller is recovered and adds the recovery controller to the controller cluster.

[0236] The main controller determines that the faulty controller is restored in order to subsequently migrate the original vehicle function program of the restored controller back for operation.

[0237] The method of adding the recovery controller to the controller cluster is as follows: the master controller determines whether the identification number of the recovery controller is repeated with the identification number in the current cluster table; if the identification number of the recovery controller is repeated with the identification number in the current cluster table, the identification number of the recovery controller is updated to the largest identification number in the cluster table + 1, and then added to the cluster table to complete the controller cluster update, and then the cluster table is synchronized to each slave controller in the updated controller cluster; if the identification number of the recovery controller is not repeated with the identification number in the current cluster table, the identification number of the recovery controller is added to the cluster table to complete the controller cluster update, and then the cluster table is synchronized to each slave controller in the updated controller cluster.

[0238] The vehicle function program migration operation method provided in this embodiment enables the failed controller to rejoin the controller cluster by receiving a heartbeat message sent by the recovery controller and the recovery controller and the main controller belong to the same controller cluster, thereby ensuring the normal operation of the controller cluster.

[0239] Figure 8aThis is a flow chart of the sixth embodiment of the vehicle function program migration operation method provided by the present application. Based on the above embodiments, the present embodiment of the present application describes the situation where the main controller determines that the faulty controller has recovered and then migrates the original vehicle function program of the faulty controller back to run. Figure 8a As shown, the vehicle function program migration operation method specifically includes the following steps:

[0240] S801: After determining that the failed controller is restored, the main controller obtains a migration correspondence relationship from a storage space corresponding to a first preset path.

[0241] After the failed controller recovers and rejoins the controller cluster, the master controller in the controller cluster can determine that the failed controller has recovered. After a slave controller in the controller cluster fails, the master controller will establish a migration correspondence between the identification number of the slave controller to be migrated, the identification number of the migration controller, and the vehicle function program identification during the vehicle function program migration process, and store them in the storage space corresponding to the first preset path.

[0242] In this step, after determining that the faulty controller has been restored, the main controller first obtains the migration correspondence from the storage space corresponding to the first preset path in order to migrate the original vehicle function program of the faulty controller back for operation.

[0243] S802: The main controller determines the identification number of the migration controller and the vehicle function program identification corresponding to the identification number of the faulty controller according to the migration correspondence.

[0244] In this step, after the main controller obtains the migration correspondence, it can determine the identification number of the migration controller and the vehicle function program identification corresponding to the identification number of the faulty controller according to the migration correspondence.

[0245] S803: The master controller determines whether the faulty controller is the master controller; if the faulty controller is the master controller, execute step S804; if the faulty controller is the slave controller, execute step S805.

[0246] In this step, after the main controller determines the identification number of the migration controller and the vehicle function program identification corresponding to the identification number of the faulty controller, in order to determine how to migrate, it first determines whether the faulty controller is the main controller based on whether the identification number of the faulty controller is the same as the identification number of the main controller.

[0247] S804: The main controller runs the vehicle function program corresponding to the vehicle function program identifier, and sends a first stop operation message to the migration controller according to the identification number of the migration controller.

[0248] In this step, if the main controller determines that the faulty controller is the main controller, it means that the migration controller is the slave controller, and the main controller runs the vehicle function program corresponding to the vehicle function program identifier. At the same time, in order to make the migration controller no longer run the vehicle function program of the faulty controller, a first stop operation message is sent to the migration controller according to the identification number of the migration controller, and the first stop operation message includes the vehicle function program identifier corresponding to the identification number of the faulty controller.

[0249] S805: The master controller determines whether the migration controller is the master controller; if the migration controller is the master controller, execute step S806; if the migration controller is the slave controller, execute steps S807 to S808.

[0250] In this step, if the master controller determines that the faulty controller is a slave controller, it is also necessary to determine whether the migration controller is the master controller based on whether the identification number of the migration controller is the same as the identification number of the master controller.

[0251] S806: The main controller stops running the vehicle function program corresponding to the vehicle function program identifier, and sends a second migration message to the fault controller.

[0252] In this step, if the main controller determines that the migration controller is the main controller, the main controller stops running the vehicle function program corresponding to the vehicle function program identifier. At the same time, in order to allow the faulty controller to run the original vehicle function program, a second migration message is sent to the faulty controller, and the second migration message includes the vehicle function program identifier.

[0253] S807: The main controller sends a second migration message to the failed controller.

[0254] In this step, if the master controller determines that the migration controller is the slave controller, in order to allow the faulty controller to run the original vehicle function program, a second migration message is sent to the faulty controller, where the second migration message includes a vehicle function program identifier.

[0255] S808: The main controller sends a first stop operation message to the migration controller.

[0256] In this step, if the main controller determines that the migration controller is the slave controller, in order to prevent the migration controller from running the vehicle function program of the faulty controller, a first stop operation message is sent to the migration controller according to the identification number of the migration controller. The first stop operation message includes the vehicle function program identifier corresponding to the identification number of the faulty controller.

[0257] It should be noted that the execution order of step S807 and step S808 may be to execute step S807 first and then execute step S808; or to execute step S808 first and then execute step S807; or to execute step S807 and step S808 at the same time. The embodiment of the present application does not limit the execution order of step S807 and step S808, which can be determined according to actual conditions.

[0258] S809: After receiving the first stop operation message sent by the main controller, the slave controller stops running the vehicle function program corresponding to the vehicle function program identifier.

[0259] In this step, after the main controller sends the first stop operation message to the migration controller, the migration controller is now a slave controller, and the slave controller can receive the first stop operation message sent by the main controller, and then stop running the vehicle function program corresponding to the vehicle function program identifier in the first stop operation message.

[0260] S810: After receiving the second migration message sent by the main controller, the slave controller runs the vehicle function program corresponding to the vehicle function program identifier.

[0261] In this step, after the main controller sends the second migration message to the faulty controller, the faulty controller is now a slave controller. After the slave controller receives the second migration message sent by the main controller, it runs the vehicle function program corresponding to the vehicle function program identifier in the second migration message.

[0262] For example, in Figure 3b On the basis of Figure 8b The vehicle function program migration diagram provided for this application is as follows: Figure 8b As shown, after the controller 1 is restored, the original vehicle function program 1 and vehicle function program 2 of the controller 1 are migrated from the controller 2 to the controller 1.

[0263] The vehicle function program migration operation method provided in this embodiment improves the utilization rate of the controller by migrating the original vehicle function program back for operation after the faulty controller is restored.

[0264] The following is an embodiment of the device of the present application, which can be used to execute the embodiment of the method of the present application. For details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the method of the present application.

[0265] Fig. 9 This is a schematic diagram of the structure of the first embodiment of the vehicle function program migration operation device provided by the present application; the device can be integrated into the main controller in the above method embodiment, or can be implemented by the main controller in the above method embodiment. Fig. 9 As shown, the vehicle function program migration operation device 90 includes:

[0266] The processing module 91 is used for:

[0267] For each slave controller in the controller cluster, monitoring whether a heartbeat message sent by the slave controller is received in each first cycle;

[0268] If a heartbeat message sent by the slave controller to be migrated is not received within the first cycle, obtaining the remaining amount of computing resources of each controller in the controller cluster and the vehicle function program identifier of the slave controller to be migrated;

[0269] Determining a migration controller according to the remaining amount of computing resources of each controller in the controller cluster;

[0270] The sending module 92 is used for sending a first migration message to the migration controller if the migration controller is a slave controller, wherein the first migration message includes the vehicle function program identifier.

[0271] Furthermore, the processing module 91 is further configured to run the vehicle function program corresponding to the vehicle function program identifier if the migration controller is the main controller.

[0272] Furthermore, the processing module 91 is further configured to remove the slave controller to be migrated from the controller cluster.

[0273] Furthermore, the processing module 91 is also used for:

[0274] After determining that the failed controller is restored, acquiring a migration correspondence relationship from a storage space corresponding to the first preset path;

[0275] According to the migration correspondence, determining the migration controller identification number and the vehicle function program identification corresponding to the fault controller identification number;

[0276] If the fault controller is a main controller, running the vehicle function program corresponding to the vehicle function program identifier;

[0277] Furthermore, the sending module 92 is further configured to send a first stop operation message to the migration controller according to the identification number of the migration controller, wherein the first stop operation message includes the vehicle function program identification.

[0278] Furthermore, the processing module 91 is further configured to stop running the vehicle function program corresponding to the vehicle function program identifier if the faulty controller is a slave controller and the migration controller is a master controller;

[0279] Furthermore, the sending module 92 is further configured to send a second migration message to the fault controller, wherein the second migration message includes the vehicle function program identifier.

[0280] Furthermore, the sending module 92 is further configured to send the second migration message to the faulty controller and send the first stop running message to the migration controller if the faulty controller is a slave controller and the migration controller is a slave controller.

[0281] Furthermore, the processing module 91 is also used for:

[0282] After determining that a new controller has been added to the controller cluster, obtaining a remaining amount of computing resources of each controller in the controller cluster;

[0283] Determining a target controller according to the remaining amount of computing resources of each controller in the controller cluster;

[0284] Furthermore, the sending module 92 is further configured to send a second stop operation message to the target controller if the target controller is a slave controller, and send a third migration message to the newly added slave controller, wherein the third migration message and the second stop operation message include a part of the vehicle function program identifiers of the target controller;

[0285] Furthermore, the processing module 91 is further configured to stop running the vehicle function programs corresponding to the part of vehicle function program identifiers if the target controller is the main controller;

[0286] Furthermore, the sending module 92 is further configured to send the third migration message to the newly added slave controller.

[0287] A receiving module 93, used for receiving a heartbeat message sent by the recovery controller;

[0288] Further, the processing module 91 is also used to determine whether the recovery controller belongs to the controller cluster according to the cluster identifier in the heartbeat message when receiving the heartbeat message sent by the recovery controller, and the heartbeat message also includes the priority of the recovery controller, or includes the priority of the recovery controller and the master controller mark;

[0289] If the recovery controller belongs to the controller cluster, determine whether the heartbeat message includes a master controller tag, and determine whether the priority of the recovery controller is higher than the priority of the master controller;

[0290] If the heartbeat message includes a master controller tag, and the priority of the recovery controller is higher than that of the master controller, the master controller is updated to a slave controller;

[0291] Furthermore, the sending module 92 is further configured to send a role switching message to the recovery controller, so that the recovery controller is updated to be the main controller and the recovery controller determines that the faulty controller is recovered.

[0292] Furthermore, the processing module 91 is further configured to determine that the faulty controller is recovered if the heartbeat message does not include a master controller mark, or the priority of the recovery controller is lower than the priority of the master controller.

[0293] Furthermore, the processing module 91 is further configured to add the recovery controller to the controller cluster.

[0294] Furthermore, the processing module 91 is also used for:

[0295] After the master controller is powered on, a configuration file is obtained from the storage space corresponding to the second preset path, where the configuration file includes a cluster identifier, an identifier of the master controller, and an identifier of each slave controller;

[0296] Determining that the main controller is the main controller according to the identification number of the main controller;

[0297] Create a controller cluster and generate the master controller tag;

[0298] Further, the sending module 92 is further used to broadcast the heartbeat message according to the first cycle;

[0299] Furthermore, the receiving module 93 is further configured to receive a cluster joining request sent from the controller, wherein the cluster joining request includes a cluster identifier;

[0300] Further, the processing module 91 is further configured to add the slave controller to the controller cluster if the cluster identifier belongs to the configuration file;

[0301] Furthermore, the sending module 92 is further configured to send a feedback message to the slave controller to determine that a new controller has been added to the controller cluster.

[0302] The vehicle function program migration operation device provided in this embodiment is used to execute the technical solution of the main controller in any of the aforementioned method embodiments. Its implementation principle and technical effects are similar and will not be repeated here.

[0303] Fig.10 This is a schematic diagram of the structure of the second embodiment of the vehicle function program migration operation device provided by the present application; the device can be integrated into the slave controller in the above method embodiment, or can be implemented by the slave controller in the above method embodiment. Fig.10 As shown, the vehicle function program migration operation device 100 includes:

[0304] A receiving module 101 is configured to receive a first migration message sent by a master controller in a controller cluster, wherein the first migration message includes a vehicle function program identifier of a slave controller to be migrated, and the slave controller to be migrated is a slave controller in the controller cluster that has not sent a heartbeat message within a first cycle;

[0305] The processing module 102 is used to run the vehicle function program corresponding to the vehicle function program identifier.

[0306] Furthermore, the receiving module 101 is further configured to receive a first stop operation message sent by the main controller, wherein the first stop operation message includes a vehicle function program identifier;

[0307] Furthermore, the processing module 102 is further configured to stop running the vehicle function program corresponding to the vehicle function program identifier.

[0308] Furthermore, the receiving module 101 is further configured to receive a second migration message or a third migration message sent by the main controller, wherein the second migration message and the third migration message include a vehicle function program identifier;

[0309] Furthermore, the processing module 102 is further configured to run the vehicle function program corresponding to the vehicle function program identifier.

[0310] Furthermore, the receiving module 101 is further used to receive a second stop operation message sent by the main controller, wherein the second stop operation message includes a part of the vehicle function program identifier thereof;

[0311] Furthermore, the processing module 102 is further configured to stop running the vehicle function program corresponding to the vehicle function program identifier.

[0312] Furthermore, the processing module 102 is further configured to:

[0313] Monitoring whether a heartbeat message sent by the master controller and a slave controller with a higher priority than itself in the controller cluster is received in each second cycle;

[0314] If no heartbeat message is received from the master controller and a slave controller with a higher priority than itself in the controller cluster within the second cycle, the master controller updates itself to be the master controller.

[0315] Furthermore, the processing module 102 is further configured to:

[0316] After the slave controller is powered on, a configuration file is obtained from the storage space corresponding to the second preset path, wherein the configuration file includes a cluster identifier, an identifier of the master controller, and an identifier of each slave controller;

[0317] According to the identification number of each controller, determine that it is a slave controller;

[0318] The sending module 103 is used for:

[0319] Broadcasting a cluster joining request, wherein the cluster joining request includes the cluster identifier;

[0320] If a feedback message sent by the main controller is received, a heartbeat message is broadcast according to the first cycle.

[0321] Furthermore, the processing module 102 is further configured to update itself to a master controller, create a controller cluster, and generate a master controller mark if no feedback message sent by the master controller is received.

[0322] Furthermore, the sending module 103 is further configured to broadcast a heartbeat message according to the first period.

[0323] The vehicle function program migration operation device provided in this embodiment is used to execute the technical solution of the slave controller in any of the aforementioned method embodiments. Its implementation principle and technical effects are similar and will not be repeated here.

[0324] Fig.11 This is a schematic diagram of the structure of a controller provided in this application. Fig.11 As shown, the controller 1100 includes:

[0325] Processor 1101, memory 1102, and communication interface 1103;

[0326] The memory 1102 is used to store executable instructions of the processor 1101;

[0327] The processor 1101 is configured to execute the technical solutions of the master controller and the slave controller in any of the aforementioned method embodiments by executing the executable instructions.

[0328] Optionally, the memory 1102 may be independent or integrated with the processor 1101 .

[0329] Optionally, when the memory 1102 is a device independent of the processor 1101, the controller 1100 may further include:

[0330] The bus 1104 , the memory 1102 and the communication interface 1103 are connected to the processor 1101 via the bus 1104 and communicate with each other. The communication interface 1103 is used to communicate with other devices.

[0331] Optionally, the communication interface 1103 may be implemented by a transceiver. The communication interface is used to implement communication between the database access device and other devices (such as a client, a read-write library, and a read-only library). The memory may include a random access memory (RAM) and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage.

[0332] The bus 1104 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0333] The above-mentioned processor can be a general-purpose processor, including a central processing unit CPU, a network processor (NP), etc.; it can also be a digital signal processor DSP, an application-specific integrated circuit ASIC, a field programmable gate array FPGA or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0334] The controller is used to execute the technical solutions of the master controller and the slave controller in any of the aforementioned method embodiments, and its implementation principles and technical effects are similar and will not be repeated here.

[0335] An embodiment of the present application also provides a vehicle, which includes a master controller and a slave controller.

[0336] The main controller is used to execute the technical solution of the main controller in any of the aforementioned method embodiments, and its implementation principle and technical effect are similar and will not be repeated here.

[0337] The slave controller is used to execute the technical solution of the slave controller in any of the aforementioned method embodiments, and its implementation principle and technical effect are similar and will not be repeated here.

[0338] An embodiment of the present application also provides a readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the technical solution provided by any of the aforementioned method embodiments is implemented.

[0339] An embodiment of the present application also provides a computer program product, including a computer program, which is used to implement the technical solution provided by any of the aforementioned method embodiments when executed by a processor.

[0340] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0341] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A vehicle function program migration operation method, characterized in that: Applied to a main controller in a controller cluster, the method comprises: For each slave controller in the controller cluster, monitoring whether a heartbeat message sent by the slave controller is received in each first cycle; If a heartbeat message sent by the slave controller to be migrated is not received within the first cycle, obtaining the remaining amount of computing resources of each controller in the controller cluster and the vehicle function program identifier of the slave controller to be migrated; Determining a migration controller according to the remaining amount of computing resources of each controller in the controller cluster; If the migration controller is a slave controller, a first migration message is sent to the migration controller, where the first migration message includes the vehicle function program identifier.

2. The method according to claim 1, characterized in that The method further comprises: If the migration controller is the main controller, the vehicle function program corresponding to the vehicle function program identifier is run.

3. The method according to claim 1, characterized in that: The method further comprises: The slave controller to be migrated is removed from the controller cluster.

4. The method according to claim 1, characterized in that The method further comprises: A migration correspondence relationship is established among the identification number of the slave controller to be migrated, the identification number of the migration controller, and the vehicle function program identification, and the vehicles are stored in a storage space corresponding to the first preset path.

5. The method according to claim 4, characterized in that The method further comprises: After determining that the failed controller is restored, acquiring a migration correspondence relationship from a storage space corresponding to the first preset path; According to the migration correspondence, determining the migration controller identification number and the vehicle function program identification corresponding to the fault controller identification number; If the fault controller is a main controller, the vehicle function program corresponding to the vehicle function program identifier is run, and a first stop operation message is sent to the migration controller according to the identification number of the migration controller, wherein the first stop operation message includes the vehicle function program identifier.

6. The method according to claim 5, characterized in that The method further comprises: If the faulty controller is a slave controller and the migration controller is a master controller, the vehicle function program corresponding to the vehicle function program identifier is stopped, and a second migration message is sent to the faulty controller, where the second migration message includes the vehicle function program identifier.

7. The method according to claim 6, characterized in that The method further comprises: If the faulty controller is a slave controller and the migration controller is a slave controller, the second migration message is sent to the faulty controller, and the first stop running message is sent to the migration controller.

8. The method according to claim 1, characterized in that The method further comprises: After determining that a new controller has been added to the controller cluster, obtaining a remaining amount of computing resources of each controller in the controller cluster; Determining a target controller according to the remaining amount of computing resources of each controller in the controller cluster; If the target controller is a slave controller, sending a second stop operation message to the target controller, and sending a third migration message to the newly added slave controller, wherein the third migration message and the second stop operation message include a part of the vehicle function program identifiers of the target controller; If the target controller is a master controller, the vehicle function programs corresponding to the partial vehicle function program identifiers are stopped, and the third migration message is sent to the newly added slave controller.

9. The method according to claim 1, characterized in that: The method further comprises: When receiving a heartbeat message sent by a recovery controller, determining whether the recovery controller belongs to the controller cluster according to the cluster identifier in the heartbeat message, wherein the heartbeat message also includes the priority of the recovery controller, or includes the priority of the recovery controller and the master controller mark; If the recovery controller belongs to the controller cluster, determine whether the heartbeat message includes a master controller tag, and determine whether the priority of the recovery controller is higher than the priority of the master controller; If the heartbeat message includes a master controller tag and the priority of the recovery controller is higher than that of the master controller, the master controller is updated to a slave controller and a role change message is sent to the recovery controller so that the recovery controller is updated to the master controller and the recovery controller determines that the faulty controller is recovered.

10. The method according to claim 9, characterized in that The method further comprises: If the heartbeat message does not include the master controller mark, or the priority of the recovery controller is lower than the priority of the master controller, it is determined that the faulty controller is recovered.

11. The method according to claim 9 or 10, characterized in that: The method further comprises: Add the recovery controller to the controller cluster.

12. The method according to claim 1, characterized in that The method further comprises: After the master controller is powered on, a configuration file is obtained from the storage space corresponding to the second preset path, where the configuration file includes a cluster identifier, an identifier of the master controller, and an identifier of each slave controller; Determining that the main controller is the main controller according to the identification number of the main controller; Create a controller cluster, broadcast heartbeat messages according to the first cycle, and generate a master controller tag; receiving a cluster joining request sent from a controller, wherein the cluster joining request includes a cluster identifier; If the cluster identifier belongs to the configuration file, the slave controller is added to the controller cluster, and a feedback message is sent to the slave controller to determine that a new controller has been added to the controller cluster.

13. A vehicle function program migration operation method, characterized in that: Applied to a slave controller in a controller cluster, the method comprises: Receiving a first migration message sent by a master controller in the controller cluster, wherein the first migration message includes a vehicle function program identifier of a slave controller to be migrated, wherein the slave controller to be migrated is a slave controller in the controller cluster that has not sent a heartbeat message within a first cycle; The vehicle function program corresponding to the vehicle function program identifier is run.

14. The method according to claim 13, characterized in that The method further comprises: receiving a first stop operation message sent by the main controller, wherein the first stop operation message includes a vehicle function program identifier; Stop running the vehicle function program corresponding to the vehicle function program identifier.

15. The method according to claim 13, characterized in that The method further comprises: receiving a second migration message or a third migration message sent by the main controller, wherein the second migration message and the third migration message include a vehicle function program identifier; The vehicle function program corresponding to the vehicle function program identifier is run.

16. The method according to claim 13, characterized in that The method further comprises: receiving a second stop operation message sent by the main controller, wherein the second stop operation message includes a part of the vehicle function program identifiers thereof; Stop running the vehicle function program corresponding to the vehicle function program identifier.

17. The method according to claim 13, characterized in that The method further comprises: Monitoring whether a heartbeat message sent by the master controller and a slave controller with a higher priority than itself in the controller cluster is received in each second cycle; If no heartbeat message is received from the master controller and a slave controller with a higher priority than itself in the controller cluster within the second cycle, the master controller updates itself to be the master controller.

18. The method according to claim 13, characterized in that The method further comprises: After the slave controller is powered on, a configuration file is obtained from the storage space corresponding to the second preset path, wherein the configuration file includes a cluster identifier, an identifier of the master controller, and an identifier of each slave controller; According to the identification number of each controller, determine that it is a slave controller; Broadcasting a cluster joining request, wherein the cluster joining request includes the cluster identifier; If a feedback message sent by the main controller is received, a heartbeat message is broadcast according to the first cycle.

19. The method according to claim 18, characterized in that The method further comprises If no feedback message is received from the master controller, the controller updates itself to be the master controller, creates a controller cluster, broadcasts heartbeat messages according to the first cycle, and generates a master controller mark.

20. A vehicle function program migration operation device, characterized in that: include: Processing modules for: For each slave controller in the controller cluster, monitoring whether a heartbeat message sent by the slave controller is received in each first cycle; If a heartbeat message sent by the slave controller to be migrated is not received within the first cycle, obtaining the remaining amount of computing resources of each controller in the controller cluster and the vehicle function program identifier of the slave controller to be migrated; Determining a migration controller according to the remaining amount of computing resources of each controller in the controller cluster; A sending module is used for sending a first migration message to the migration controller if the migration controller is a slave controller, wherein the first migration message includes the vehicle function program identifier.

21. A vehicle function program migration operation device, characterized in that: include: A receiving module, configured to receive a first migration message sent by a master controller in a controller cluster, wherein the first migration message includes a vehicle function program identifier of a slave controller to be migrated, wherein the slave controller to be migrated is a slave controller in the controller cluster that has not sent a heartbeat message within a first cycle; A processing module is used to run the vehicle function program corresponding to the vehicle function program identifier.

22. A controller, characterized in that: include: Processor, memory, communication interface; The memory is used to store executable instructions of the processor; Wherein, the processor is configured to execute the vehicle function program migration operation method described in any one of claims 1 to 12 or any one of claims 13 to 19 by executing the executable instructions.

23. A vehicle, characterized in that: Includes a master controller and a slave controller; The main controller is used to execute the vehicle function program migration operation method described in any one of claims 1 to 12; The slave controller is used to execute the vehicle function program migration operation method described in any one of claims 13 to 19.

24. A readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the vehicle function program migration operation method described in any one of claims 1 to 12 or any one of claims 13 to 19 is implemented.

25. A computer program product, characterized in that It includes a computer program, which, when executed by a processor, is used to implement the vehicle function program migration operation method described in any one of claims 1 to 12, or any one of claims 13 to 19.

Images