Vehicle operation control method and device, vehicle and storage medium

Abstract

The invention relates to a vehicle operation control method and device, a vehicle and a storage medium, and is applied to a domain controller of the vehicle, the domain controller comprises a master control chip and a slave control chip, the master control chip is connected with a plurality of different master function buses, the slave control chip is connected with a plurality of different slave function buses, the master control chip is connected with the slave control chip, and the slave function buses are connected with the slave control chip. The method comprises the following steps: determining control states of a master control chip and a slave control chip, and determining operation states of a master function bus and a slave function bus; determining a target control chip from the master control chip and the slave control chip according to the control state; determining a target function bus from the master function bus and the slave function bus according to the running state; and the control instruction generated by the target control chip is sent to the target function bus, so that the vehicle runs according to the control instruction output by the target function bus. Therefore, the safety and the stability of the domain controller can be improved while the cost of the controller is reduced.

Description

Technical Field

[0001] The present application relates to the field of vehicle technology, and in particular to a method and device for controlling vehicle operation, a vehicle, and a storage medium. Background Art

[0002] With the popularization and development of vehicles, at present, the mainstream architecture of new energy vehicles is mainly distributed architecture, that is, the central gateway is responsible for the signal interaction between the power domain, chassis domain, body domain, entertainment domain, and autonomous driving domain. Under a single domain, the controllers under each domain transmit signals to each other to realize the corresponding functions. Therefore, the functions corresponding to each domain of the vehicle are coordinated and realized by multiple controllers under the domain.

[0003] Among them, the steering controller responsible for wire-controlled steering, the brake controller responsible for wire-controlled braking, and the suspension controller responsible for wire-controlled suspension are hung under the chassis domain of the vehicle. On this basis, the steering controller realizes the lateral function, the brake controller realizes the longitudinal function, and the suspension controller realizes the vertical function.

[0004] However, since the current chassis domain control is achieved by connecting multiple controllers, it is difficult to ensure system security, and the total cost of multiple controllers is high. In the context of increasing computing power required by controller software, the number of controllers is increasing, and the resulting cost is also higher. Summary of the invention

[0005] The present application provides a vehicle operation control method, device, vehicle and storage medium to solve the technical problems in the prior art that the current chassis domain control is obtained by connecting multiple controllers, which makes it difficult to ensure system security, and the total cost of multiple controllers is high. In the context of increasing computing power required for controller software, the number of controllers is increasing, and the resulting cost is also higher.

[0006] In a first aspect, the present application provides a method for controlling vehicle operation, which is applied to a domain controller of a vehicle, wherein the domain controller includes a master control chip and a slave control chip, wherein the master control chip is connected to a plurality of different master function buses, and the slave control chip is connected to a plurality of different slave function buses, wherein the master control chip and the slave control chip are connected, and the method includes:

[0007] In the case where both the master control chip and the slave control chip generate corresponding control instructions according to the received sensor signal, determining the control states of the master control chip and the slave control chip, and determining the operating states of the master function bus and the slave function bus;

[0008] Determining a target control chip from the master control chip and the slave control chip according to the control state;

[0009] Determining a target functional bus from the master functional bus and the slave functional bus according to the operating state;

[0010] The control instructions generated by the target control chip are sent to the target function bus, so that the vehicle operates according to the control instructions output by the target function bus.

[0011] As a possible implementation, the master control chip and the slave control chip are connected via a preset communication interface;

[0012] The determining the control states of the master control chip and the slave control chip includes:

[0013] Obtaining a verification result of verification performed between the master control chip and the slave control chip;

[0014] According to the verification result, the control states of the master control chip and the slave control chip are determined.

[0015] As a possible implementation manner, the method further includes:

[0016] When the verification result cannot be obtained, determining both the master control chip and the slave control chip as target control chips, and determining both the master function bus and the slave function bus as target function buses;

[0017] The step of sending the control instruction generated by the target control chip to the target function bus includes:

[0018] The control instructions generated by the master control chip are sent to the master function bus, and the control instructions generated by the slave control chip are sent to the slave function bus.

[0019] As a possible implementation manner, determining the target control chip from the master control chip and the slave control chip according to the control state includes:

[0020] When the control state indicates that the main control chip has not failed, determining the main control chip as a target control chip;

[0021] When the control state indicates that the master control chip fails and the slave control chip does not fail, the slave control chip is determined as the target control chip.

[0022] As a possible implementation manner, determining the target function bus from the main function bus and the slave function bus according to the running state includes:

[0023] In a case where the operating state indicates that the main functional bus has not failed, determining the main functional bus as a target functional bus;

[0024] When the operating state indicates that the master functional bus fails and the slave functional bus does not fail, the slave functional bus is determined as the target functional bus.

[0025] As a possible implementation manner, sending the control instruction generated by the target control chip to the target function bus includes:

[0026] When it is determined that the target control chip is a slave control chip, obtaining a slave control identifier of the slave control chip;

[0027] Sending the control instruction generated by the slave control chip and the slave control identifier to the target function bus, so that the target function bus sends the control instruction and the slave control identifier outwardly;

[0028] and / or,

[0029] In the case where it is determined that the target functional bus is a slave functional bus, obtaining a slave bus identifier of the slave functional bus;

[0030] The control instruction of the target control chip and the slave bus identifier are sent to the slave function bus, so that the slave function bus sends the control instruction and the slave bus identifier outwardly.

[0031] As a possible implementation manner, the method further includes:

[0032] If the verification result is not obtained, determining the fault time point when the communication interface fails;

[0033] If the fault time point is within the current operation cycle of the domain controller, then if the main control chip does not fail, the main control chip is determined as the target control chip, and if the main function bus does not fail, the main function bus is determined as the target function bus;

[0034] If the fault time point is before the current operation cycle of the domain controller, then when the slave control chip has not failed, the slave control chip is determined as the target control chip, and when the slave function bus has not failed, the slave function bus is determined as the target function bus.

[0035] As a possible implementation, the master control chip and the slave control chip both include a functional fault detection module and a hardware fault detection module, the master control chip is powered by a main power supply module, and the slave control chip is powered by a slave power supply module, the functional fault detection module is used to detect whether a functional module of the master control chip or the slave control chip has a fault, and the hardware fault detection module is used to detect whether hardware of the master control chip or the slave control chip has a fault, and the method further includes:

[0036] When the function fault detection module of the main control chip detects that the function of the main control chip is faulty, and the hardware fault detection module detects that the hardware of the main control chip is faulty, a preset fault signal is sent to the main power supply module, so that the main power supply module updates the operating state of the main control chip to a preset mode, wherein when the main control chip is in the preset mode, the main control chip no longer processes the received sensor signal;

[0037] When the functional fault detection module of the slave control chip detects that a functional module of the slave control chip has a fault, and the hardware fault detection module detects that the hardware of the slave control chip has a fault, a preset fault signal is sent to the slave power supply module so that the slave power supply module updates the operating state of the slave control chip to a preset mode, wherein when the slave control chip is in the preset mode, the slave control chip no longer processes the received sensor signal.

[0038] As a possible implementation, the functional fault detection module detects each function of the control chip in the following manner:

[0039] For each function of the control chip, determining the functional logic for generating a control instruction corresponding to the function, the control chip being a master control chip or a slave control chip;

[0040] Acquire a simulated sensor signal corresponding to the function generated by the simulator;

[0041] Processing the analog sensor signal according to the functional logic to obtain a control instruction range corresponding to the function;

[0042] Determining whether the control instruction actually generated by the control chip is within the control instruction range;

[0043] In the case where it is determined that the control instruction actually generated by the control chip is within the control instruction range, determining that there is no fault in the function;

[0044] When it is determined that the control instruction actually generated by the control chip is not within the control instruction range, it is determined that the function has a fault.

[0045] In a second aspect, the present application provides a vehicle operation control device, which is applied to a domain controller of a vehicle, wherein the domain controller includes a master control chip and a slave control chip, wherein the master control chip is connected to a plurality of different master function buses, and the slave control chip is connected to a plurality of different slave function buses, wherein the master control chip and the slave control chip are connected, and the device includes:

[0046] A first determination module is used to determine the control state of the master control chip and the slave control chip, and determine the operation state of the master function bus and the slave function bus when both the master control chip and the slave control chip generate corresponding control instructions according to the received sensor signal;

[0047] A second determining module, configured to determine a target control chip from the master control chip and the slave control chip according to the control state;

[0048] A third determining module, configured to determine a target function bus from the main function bus and the slave function bus according to the running state;

[0049] The sending module is used to send the control instructions generated by the target control chip to the target function bus, so that the vehicle runs according to the control instructions output by the target function bus.

[0050] In a third aspect, the present application provides a vehicle, comprising: a domain controller and a memory,

[0051] The domain controller comprises a master control chip and a slave control chip, the master control chip is connected to a plurality of different master function buses, the slave control chip is connected to a plurality of different slave function buses, and the master control chip and the slave control chip are connected;

[0052] The domain controller is used to execute the vehicle operation control program stored in the memory to implement the vehicle operation control method described in any one of the first aspects.

[0053] In a fourth aspect, the present application provides a storage medium storing one or more programs, which can be executed by one or more processors to implement the vehicle operation control method described in any one of the first aspects.

[0054] The technical solution provided by the embodiment of the present application is that the domain controller of the vehicle includes a master control chip and a slave control chip, the master control chip is connected to multiple different master function buses, and the slave control chip is connected to multiple different slave function buses. When the master control chip and the slave control chip are connected, when the master control chip and the slave control chip both generate corresponding control instructions according to the received sensor signals, the control states of the master control chip and the slave control chip are determined, and the running states of the master function bus and the slave function bus are determined. According to the control state, the target control chip is determined from the master control chip and the slave control chip, and according to the running state, the target function bus is determined from the main function bus and the slave function bus, and the control instructions generated by the target control chip are sent to the target function bus, so that the vehicle runs according to the control instructions output by the target function bus. This technical solution integrates multiple controllers included in the chassis domain of the vehicle into a domain controller. Furthermore, in order to improve the security of the domain controller, a dual control chip redundant control method of a master control chip and a slave control chip, as well as a dual control bus transmission method of a master control bus and a slave control bus are adopted for the domain controller. This ensures that when a control chip or a control bus fails, the domain controller can still operate safely and stably, thereby reducing the cost of the controller while improving the security and stability of the domain controller. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0056] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art texts are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0057] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0058] Figure 1 A schematic diagram of the structure of a domain controller provided in an embodiment of the present application;

[0059] Figure 2 A flow chart of an embodiment of a vehicle operation control method provided in an embodiment of the present application;

[0060] Figure 3A flowchart of another method for controlling vehicle operation provided in an embodiment of the present application;

[0061] Figure 4 A flow chart of another embodiment of a vehicle operation control method provided in an embodiment of the present application;

[0062] Figure 5 A flow chart of another embodiment of a vehicle operation control method provided in an embodiment of the present application;

[0063] Figure 6 A schematic diagram of the structure of another domain controller provided in an embodiment of the present application;

[0064] Figure 7 A block diagram of an embodiment of a vehicle operation control device provided in an embodiment of the present application;

[0065] Figure 8 A schematic diagram of the structure of a vehicle provided in an embodiment of the present application. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described in conjunction with the drawings in the embodiments of the present application. Obviously, the embodiments described in the text are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0067] The disclosure below provides many different embodiments or examples to implement different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0068] In order to solve the technical problems in the prior art that the current chassis domain control is obtained by connecting multiple controllers, it is difficult to ensure system security, and the total cost of multiple controllers is high. In the context of increasing computing power required for controller software, the number of controllers is increasing, and the resulting cost is also higher, the present application provides a vehicle operation control method, device, vehicle and storage medium, which can integrate multiple controllers included in the chassis domain of the vehicle into a domain controller. Furthermore, in order to improve the security of the domain controller, a dual control chip redundant control method of a master control chip and a slave control chip, as well as a dual control bus transmission method of a master control bus and a slave control bus are adopted for the domain controller, which can ensure that when the control chip or the control bus fails, the domain controller can still operate safely and stably, thereby reducing the cost of the controller while improving the security and stability of the domain controller.

[0069] To facilitate understanding of the vehicle operation control method provided in this application, the domain controller of the vehicle is first explained below.

[0070] See also Figure 1 , is a schematic diagram of the structure of a domain controller provided in an embodiment of the present application. Figure 1 As shown, the domain controller 10 may include a master control chip 11 and a slave control chip 12 . The master control chip 11 may be connected to a plurality of different master function buses 111 , and the slave control chip 12 may be connected to a plurality of different slave function buses 121 .

[0071] Among them, the present embodiment does not limit the models and types of the above-mentioned main control chip 11 and slave control chip 12, and the above-mentioned main function bus 111 and slave function bus 121.

[0072] Furthermore, in order to improve the security of the domain controller, the security level of the master control chip 11 and the slave control chip 12 may be ASILD level.

[0073] Furthermore, the master control chip 11 and the slave control chip 12 may be connected via a preset communication interface.

[0074] The above-mentioned main function bus 111 may be a function bus corresponding to the functions implemented in the daily operation of the vehicle, which may include but is not limited to: hand-feel simulation TV (three-phase) drive bridge bus, brake bus, steering bus, CN bus (serial communication protocol bus), drive bus, suspension bus, and EP bus, etc.

[0075] Correspondingly, the above-mentioned slave function bus 121 corresponds to the above-mentioned main function bus 111, which may include but is not limited to: hand-feel simulation TV (three-phase) drive bridge bus, brake bus, steering bus, CN bus (serial communication protocol bus), drive bus, suspension bus, and EP bus, etc.

[0076] In one embodiment, the master control chip 11 and the slave control chip 12 are respectively connected to other sensors of the vehicle, so the master control chip 11 and the slave control chip 12 can receive sensor signals sent by other sensors in the vehicle, and generate corresponding control instructions according to the received sensor signals. For example, when the domain controller 10 is a chassis domain controller of the vehicle, the control instructions generated by the master control chip 11 and the slave control chip 12 may include but are not limited to: control instructions for driving, steering, braking, suspension control, etc. of the vehicle. The other sensors may include but are not limited to: height sensor, acceleration sensor, accelerator pedal signal sensor, IMU (Inertial Measurement Unit) sensor, WSS (Windows SharePoint Services, an engine for creating Web sites that can realize information sharing and document collaboration) sensor, TAS (Tool-Assisted Speedrun, tool-assisted speedrun) sensor, and PTS (Predetermined time system, pre-booked time system) sensor, etc.

[0077] Furthermore, after generating the corresponding control instruction, the domain controller 10 may send the control instruction to the main function bus 111 or the slave function bus 121, so as to transmit the control instruction outward through the main function bus 111 or the slave function bus 121, so that the vehicle operates according to the control instruction.

[0078] In addition, the master control chip 11 and the slave control chip 12 can share an IGN power supply (wake-up power supply), thereby ensuring the synchronization of the two control chips.

[0079] Based on this, the present application provides a vehicle operation control method, which can be applied to the above Figure 1 The domain controller shown can ensure that when a control chip or a control bus fails, the domain controller can still operate safely and stably, thereby reducing the cost of the controller while improving the security and stability of the domain controller.

[0080] The vehicle operation control method provided by the present application is further explained below with reference to specific embodiments in conjunction with the accompanying drawings. The embodiments do not constitute a limitation on the embodiments of the present invention.

[0081] See also Figure 2, is a flow chart of an embodiment of a vehicle operation control method provided in an embodiment of the present application. As an embodiment, Figure 2 The process shown can be applied to a domain controller of a vehicle, which may include a master control chip and a slave control chip, wherein the master control chip is connected to a plurality of different master function buses, the slave control chip is connected to a plurality of different slave function buses, and the master control chip and the slave control chip are connected, for example Figure 1 The domain controller 10 is shown. Figure 2 As shown, the process may include the following steps:

[0082] Step 201, when both the master control chip and the slave control chip generate corresponding control instructions according to the received sensor signals, determine the control states of the master control chip and the slave control chip, and determine the operating states of the master function bus and the slave function bus.

[0083] The above-mentioned sensor signals refer to sensor signals sent by multiple sensors of the vehicle to the above-mentioned domain controller. The above-mentioned sensors may include but are not limited to: height sensor, acceleration sensor, accelerator pedal signal sensor, IMU sensor, WSS sensor, TAS sensor, and PTS sensor, etc.

[0084] The above-mentioned control instructions refer to the control instructions generated by the main controller chip in the domain controller or the slave control chip according to the received sensor signals. The control instructions may include but are not limited to: control instructions for driving, steering, braking, suspension control, etc. of the vehicle.

[0085] The above control status refers to the operating status of the master control chip and the slave control chip, which can indicate whether the master control chip and the slave control chip have failed, that is, whether the above master control chip and the slave control chip can transmit control instructions normally.

[0086] The above-mentioned operating status refers to the current operating status of the main function bus and the slave function bus, which can indicate whether there is a fault in the main function bus or the slave function bus, that is, whether the above-mentioned main function bus or the slave function bus can transmit control instructions normally.

[0087] In the present application embodiment, from Figure 1 As can be seen from the structure of the domain controller shown, both the master control chip and the slave control chip are connected to vehicle-related sensors and can receive sensor signals sent by the connected sensors.

[0088] Furthermore, the master control chip and the slave control chip included in the domain controller are master and slave chips, and the functions they implement are the same. Therefore, the master control chip and the slave control chip can both generate corresponding control instructions according to the received sensor signals.

[0089] Based on this, in order to ensure the normal operation of the domain controller, the execution subject of the embodiment of the present application can determine the control status of the main control chip and the slave control chip, and determine the operating status of the main function bus and the slave function bus.

[0090] As an optional implementation, the master control chip and the slave control chip can be connected via a preset communication interface, such as an SPI (Serial Peripheral interface) interface. Based on this, the master control chip and the slave control chip can perform fault verification via the communication interface and obtain verification results.

[0091] On this basis, the executing entity of the embodiment of the present application can obtain the verification result between the above-mentioned master control chip and the slave control chip, and determine the control status of the master control chip and the slave control chip based on the above-mentioned verification result.

[0092] Optionally, when the above verification result indicates that the main control chip has a fault and the slave control chip has no fault, it can be determined that the control state of the main control chip is a fault state and the control state of the slave control chip is a normal control state.

[0093] Optionally, when the above verification result indicates that the main control chip has no fault and the slave control chip has a fault, it can be determined that the control state of the main control chip is a normal control state and the control state of the slave control chip is a fault state.

[0094] Optionally, when the above verification result indicates that neither the master control chip nor the slave control chip has any fault, it can be determined that the control states of the master control chip and the slave control chip are both normal control states.

[0095] Optionally, when the above verification result indicates that both the master control chip and the slave control chip are faulty, it can be determined that the control states of the master control chip and the slave control chip are both in a faulty state.

[0096] Furthermore, when it is determined that the control states of the master control chip and the slave control chip are both in a fault state, both the master control chip and the slave control chip are unavailable. At this time, there is a fault in the domain controller, and therefore an alarm message indicating that there is a fault in the domain controller can be generated and outputted through the main function bus or the slave function bus.

[0097] Step 202: According to the above control state, determine the target control chip from the master control chip and the slave control chip.

[0098] Step 203: Determine the target function bus from the main function bus and the slave function bus according to the above-mentioned operating status.

[0099] Step 204: Send the control instruction generated by the target control chip to the target function bus, so that the vehicle runs according to the control instruction output by the target function bus.

[0100] The following is a unified description of steps 202 to 204:

[0101] The above-mentioned target control chip is a control chip in the domain controller used to transmit control instructions to the function bus, which can be a master control chip, a slave control chip, or both a master control chip and a slave control chip.

[0102] The above-mentioned target functional bus is a functional bus in the domain controller used to transmit control instructions to the outside, which can be a master functional bus, a slave functional bus, or both a master functional bus and a slave functional bus.

[0103] In an embodiment of the present application, before transmitting control instructions to the outside, the domain controller may first determine the target control chip from the main control chip and the slave control chip according to the control state obtained above, and determine the target function bus from the main function bus and the slave function bus according to the operation state. Afterwards, the control instructions generated by the target control chip may be sent to the target function bus, and the control instructions may be sent to the functional components corresponding to the vehicle through the target function bus, so that the vehicle operates according to the control instructions output by the target function bus. Among them, the functional components may include but are not limited to: motor, steering system, braking system, suspension system.

[0104] As an optional implementation, when determining the target control chip, corresponding priorities may be set for the master control chip and the slave control chip. Further, the priority of the master control chip may be set higher than that of the slave control chip.

[0105] Based on this, when the control state indicates that the main control chip has not failed, the main control chip can be determined as the target control chip.

[0106] Optionally, when the control state indicates that the master control chip fails, and the slave control chip does not fail, the slave control chip is determined as the target control chip.

[0107] At the same time, as an optional implementation, priorities can also be determined for the above-mentioned master function bus and slave function bus, respectively. Further, the priority of the master function bus can be set to be greater than the priority of the slave function bus.

[0108] Based on this, when the above-mentioned operating status indicates that the main functional bus has not failed, the above-mentioned main functional bus can be determined as the target functional bus.

[0109] Optionally, when the above-mentioned operating state indicates that the main functional bus has failed and the slave functional bus has not failed, the above-mentioned slave functional bus is determined as the target functional bus.

[0110] In one embodiment, when a control instruction generated by a target control chip is sent to a target functional bus, in order to enable the functional component receiving the control instruction to distinguish between the control chip and the functional bus sending the control instruction, when the target control chip is a main control chip and the target functional bus is the main functional bus, the control instruction generated by the main control chip can be directly sent outward through the above-mentioned target functional bus.

[0111] As an optional implementation, when it is determined that the target control chip is a slave control chip, the slave control identifier of the slave control chip can be obtained. The slave control identifier is an identifier used to characterize the slave control chip, which can be a unique identification code of the slave control chip or any identifier used to characterize the slave control chip, such as a character, a number, or a symbol.

[0112] Based on this, the control instruction generated by the slave control chip and the above-mentioned slave control identifier can be sent to the above-mentioned target function bus, so that the target function bus sends the control instruction and the slave control identifier outward.

[0113] Furthermore, in the case where it is determined that the target function bus is a slave function bus, the slave bus identifier of the slave function bus can be obtained. The slave bus identifier is an identifier used to identify the slave function bus, which can be a unique identifier of the slave function bus, or other pre-set identifiers used to uniquely identify the slave function bus, such as characters, numbers, or letters.

[0114] Afterwards, the control instructions, slave control identifier, and slave bus identifier of the slave control chip can be sent to the slave functional bus, so that the slave functional bus sends the above control instructions, slave control identifier, and slave bus identifier outward.

[0115] As another optional implementation, when the target control chip is a master control chip and the target functional bus is a slave functional bus, the slave bus identifier of the slave functional bus can be obtained. Afterwards, the control instruction and the slave bus identifier of the target control chip can be sent to the slave functional bus, so that the slave functional bus sends the control instruction and the slave bus identifier outward.

[0116] In addition, when the control states of the master control chip and the slave control chip are determined by obtaining the verification results of the master control chip and the slave control chip, there may be a situation where the verification results cannot be obtained. Therefore, if the verification results are not obtained, it means that the control states of the master control chip and the slave control chip cannot be determined at this time. In order to determine the safe operation of the domain controller, the master control chip and the slave control chip can be determined as the target control chip, and the master function bus and the slave function bus can be determined as the target function bus.

[0117] Based on this, when the control instruction generated by the target control chip is sent to the target function bus, the control instruction of the main control chip can be sent to the main function bus, and the control instruction generated by the slave control chip can be sent to the slave function bus.

[0118] In addition, if the verification results of the master control chip and the slave control chip cannot be obtained, it means that the communication interface between the master control chip and the slave control chip has failed. At this time, in order to ensure the safe operation of the domain controller, the failure time point of the communication interface failure can be determined, and the target control chip and target function bus can be determined according to the failure time point.

[0119] Optionally, if the above-mentioned fault time point is within the current operation cycle of the domain controller (that is, the ignition cycle of the domain controller), then if the main control chip has not failed, the main control chip will be determined as the target control chip, and if the main function bus has not failed, the main function bus will be determined as the target function bus.

[0120] Optionally, if the failure time point is before the current operation cycle of the domain controller, the slave control chip will be determined as the target control chip if the slave control chip has not failed, and the slave functional bus will be determined as the target functional bus if the slave functional bus has not failed.

[0121] The technical solution provided by the embodiment of the present application is that the domain controller of the vehicle includes a master control chip and a slave control chip, the master control chip is connected to multiple different master function buses, and the slave control chip is connected to multiple different slave function buses. When the master control chip and the slave control chip are connected, when the master control chip and the slave control chip both generate corresponding control instructions according to the received sensor signals, the control states of the master control chip and the slave control chip are determined, and the running states of the master function bus and the slave function bus are determined. According to the control state, the target control chip is determined from the master control chip and the slave control chip, and according to the running state, the target function bus is determined from the main function bus and the slave function bus, and the control instructions generated by the target control chip are sent to the target function bus, so that the vehicle runs according to the control instructions output by the target function bus. This technical solution integrates multiple controllers included in the chassis domain of the vehicle into a domain controller. Furthermore, in order to improve the security of the domain controller, a dual control chip redundant control method of a master control chip and a slave control chip, as well as a dual control bus transmission method of a master control bus and a slave control bus are adopted for the domain controller. This ensures that when a control chip or a control bus fails, the domain controller can still operate safely and stably, thereby reducing the cost of the controller while improving the security and stability of the domain controller.

[0122] See also Figure 3 , which is a flow chart of an embodiment of another vehicle operation control method provided in an embodiment of the present application. Figure 3 The process shown in Figure 1 Based on the process shown in FIG. 1 , it describes how to perform fault detection and fault handling in detail when the main control chip includes a functional failure detection module and a hardware fault detection module, and the main control chip is powered by a main power supply module. Figure 3 As shown, the process may include the following steps:

[0123] Step 301: Detect whether there is a function failure of the main control chip by using a function failure detection module of the main control chip, and detect whether there is a hardware failure of the main control chip by using a hardware failure detection module of the main control chip.

[0124] The above-mentioned functional fault detection module refers to a functional fault detection layer in the main control chip, which is used to detect whether there is a fault in the functional module of the main control chip.

[0125] The above-mentioned hardware fault detection module refers to the hardware fault detection layer in the main control chip, which is used to detect whether there is a fault in the hardware of the main control chip.

[0126] In an embodiment of the present application, the main control chip may include a functional fault detection module and a hardware fault detection module. Based on this, in order to ensure that the main control chip can operate normally, the domain controller can detect the main control chip through the above-mentioned functional fault detection module and hardware fault detection module, so as to determine whether there are faults in the functional components of the main control chip and whether there are faults in the hardware of the main control chip.

[0127] As an optional implementation, the domain controller may periodically detect whether a functional module of the main control chip fails through the above-mentioned functional fault detection module, and detect whether a hardware of the main control chip fails through the hardware fault detection module.

[0128] As another optional implementation, the domain controller can detect in real time whether a functional module of the main control chip fails through the above-mentioned functional fault detection module, and detect whether a hardware of the main control chip fails through the hardware fault detection module.

[0129] As for how the above functional fault detection module specifically detects each function of the main control chip, it can be described below. Figure 5 The process shown is explained and will not be described in detail here.

[0130] Step 302: When the functional fault detection module of the main control chip detects that there is a fault in the function of the main control chip and the hardware fault detection module detects that there is a fault in the hardware of the main control chip, a preset fault signal is sent to the main power supply module so that the main power supply module updates the operating status of the main control chip to a preset mode, wherein when the main control chip is in the above-mentioned preset mode, the main control chip no longer processes the received sensor signal.

[0131] The above-mentioned main power module refers to a power module that supplies power to the main control chip, which can be an SBC (System Basis Chip) power chip or other power chips, and the present application embodiment does not limit this. In the embodiment of the present application, the main power module can not only supply power to the main control chip, but also serve as a monitoring module, so that when the main control chip sends a fault, it can promptly control the main control chip to enter a preset mode, wherein, when the above-mentioned main control chip is in the preset mode, the main control chip can no longer process the received sensor signal, that is, the main control chip no longer generates a control instruction.

[0132] In an embodiment of the present application, when the dysfunction detection module of the main control chip detects that there is a fault in the function of the main control chip, and the hardware fault detection module detects that there is a fault in the hardware of the main control chip, it means that the main control chip at this time can no longer execute safety-related logic normally. Therefore, in order to ensure the safety of the domain controller, a preset fault signal can be sent to the main power supply module of the main control chip, so that the main power supply module updates the operating status of the main control chip to a preset mode to ensure that the main control chip no longer processes the received sensor signal.

[0133] The technical solution provided by the embodiment of the present application is to detect whether there is a fault in the function of the main control chip through the function fault detection module of the main control chip, and to detect whether there is a fault in the hardware of the main control chip through the hardware fault detection module of the main control chip. When the function fault detection module of the main control chip detects that there is a fault in the function of the main control chip, and the hardware fault detection module detects that there is a fault in the hardware of the main control chip, a preset fault signal is sent to the main power supply module, so that the main power supply module updates the operating state of the main control chip to a preset mode, wherein when the main control chip is in the above-mentioned preset mode, the main control chip no longer processes the received sensor signal. This technical solution uses the main power supply module of the main control chip as a monitoring module, so that when the function fault detection module and the hardware fault detection module in the main control chip respectively detect that there are faults in both the functional components and the hardware of the main control chip, the main power supply module can update the operating state of the main control chip to a preset mode, so that the main control chip no longer processes the received sensor signal, thereby ensuring the security of the domain controller.

[0134] See also Figure 4 , which is a flow chart of an embodiment of another vehicle operation control method provided in an embodiment of the present application. Figure 4 The process shown in Figure 3 Based on the process shown in FIG. 1 , it is described how to perform fault detection and fault handling in the case where the slave control chip includes a functional failure detection module and a hardware fault detection module, and the slave control chip is powered by a slave power module. Figure 4 As shown, the process may include the following steps:

[0135] Step 401: Detect whether there is a fault in the function of the slave control chip by using a function fault detection module of the slave control chip, and detect whether there is a fault in the hardware of the slave control chip by using a hardware fault detection module of the slave control chip.

[0136] The above-mentioned functional fault detection module refers to a functional fault detection layer in the slave control chip, which is used to detect whether there is a fault in the functional module of the slave control chip.

[0137] The hardware fault detection module refers to a hardware fault detection layer in a slave control chip, which is used to detect whether there is a fault in the hardware of the slave control chip.

[0138] In an embodiment of the present application, the slave control chip may include a functional fault detection module and a hardware fault detection module. Based on this, in order to ensure that the slave control chip can operate normally, the domain controller can detect the slave control chip through the above-mentioned functional fault detection module and hardware fault detection module, so as to determine whether there is a fault in the functional component of the slave control chip and whether there is a fault in the hardware of the slave control chip.

[0139] As an optional implementation, the domain controller may periodically detect whether a functional module of the slave control chip fails through the above-mentioned functional fault detection module, and detect whether a hardware of the slave control chip fails through the hardware fault detection module.

[0140] As another optional implementation, the domain controller may detect in real time whether a functional module of the slave control chip fails through the above-mentioned functional fault detection module, and detect whether a hardware of the slave control chip fails through the hardware fault detection module.

[0141] As for how the above functional fault detection module specifically detects each function of the slave control chip, it can be described below. Figure 5 The process shown is explained and will not be described in detail here.

[0142] Step 402: When the functional fault detection module of the slave control chip detects that there is a fault in the function of the slave control chip, and the hardware fault detection module detects that there is a fault in the hardware of the slave control chip, a preset fault signal is sent to the slave power supply module, so that the slave power supply module updates the operating state of the slave control chip to a preset mode, wherein when the slave control chip is in the above-mentioned preset mode, the slave control chip no longer processes the received sensor signal.

[0143] The slave power module refers to a power module that supplies power to the slave control chip, which can be an SBC power chip or other power chips, and the embodiment of the present application does not limit this. In the embodiment of the present application, the slave power module can not only supply power to the slave control chip, but also serve as a monitoring module, so that when the slave control chip sends a fault, it can timely control the slave control chip to enter the preset mode, wherein, when the slave control chip is in the preset mode, the slave control chip can no longer process the received sensor signal, that is, the slave control chip no longer generates a control instruction.

[0144] In an embodiment of the present application, when the dysfunction detection module of the slave control chip detects that there is a fault in the function of the slave control chip, and the hardware fault detection module detects that there is a fault in the hardware of the slave control chip, it means that the slave control chip at this time can no longer execute the safety-related logic normally. Therefore, in order to ensure the safety of the domain controller, a preset fault signal can be sent to the slave power supply module of the slave control chip, so that the slave power supply module updates the operating state of the slave control chip to a preset mode to ensure that the slave control chip no longer processes the received sensor signal.

[0145] The technical solution provided by the embodiment of the present application is to detect whether there is a fault in the function of the slave control chip through the functional fault detection module of the slave control chip, and to detect whether there is a fault in the hardware of the slave control chip through the hardware fault detection module of the slave control chip. When the functional fault detection module of the slave control chip detects that there is a fault in the function of the slave control chip, and the hardware fault detection module detects that there is a fault in the hardware of the slave control chip, a preset fault signal is sent to the slave power module, so that the slave power module updates the operating state of the slave control chip to a preset mode, wherein when the slave control chip is in the above-mentioned preset mode, the slave control chip no longer processes the received sensor signal. This technical solution uses the slave power module of the slave control chip as a monitoring module, so that when the functional fault detection module and the hardware fault detection module in the slave control chip respectively detect that there are faults in both the functional components and the hardware of the slave control chip, the slave power module can update the operating state of the slave control chip to a preset mode, so that the slave control chip no longer processes the received sensor signal, thereby ensuring the security of the domain controller.

[0146] See also Figure 5 , which is a flow chart of an embodiment of another vehicle operation control method provided in an embodiment of the present application. Figure 5 The process shown in Figure 3 and Figure 4 Based on the process shown, it describes how the function fault detection module of the main control chip specifically detects each function of the main control chip, and how the function fault detection module of the slave control chip specifically detects each function of the slave control chip. Figure 5 As shown, the process may include the following steps:

[0147] Step 501 : for each function of a control chip, determine the functional logic for generating a control instruction corresponding to the function, where the control chip is a master control chip or a slave control chip.

[0148] The above-mentioned control chip refers to the master control chip or slave control chip in the domain controller, and Figure 5The process shown can be applied to functional failure detection of the master control chip, and can also be applied to functional failure detection of the slave control chip.

[0149] The above-mentioned functional logic refers to the functional logic of the control chip for processing the sensor signal corresponding to the function when implementing the function, that is, by processing the sensor signal through the functional logic, the control instruction corresponding to the function can be generated.

[0150] The above-mentioned functions refer to the functions that can be realized by the control chip. The control chip may include a functional layer, and the functional layer may include multiple functions realized by the control chip, which may include but are not limited to: service braking function, EPB (Electrical Park Brake) left and right functions, SBW (Steering By Wire) electric adjustment function, SBW hand feel simulation motor (three-phase) function, SBW steering execution motor, air spring, CDC (Continuous Damping Control, automatic adjustment and uninterrupted shock absorption control system), and drive motor control instruction function, etc.

[0151] In the embodiment of the present application, when the control chip is running, there may be a corresponding functional logic for each function. Based on this, when the function of the control chip is detected by the functional fault detection module, the functional logic corresponding to each function can be determined.

[0152] As an optional implementation method, the main control chip can pre-store the correspondence between each function and the functional logic in a preset storage medium. Based on this, when determining the functional logic of each function, the functional logic of the function can be determined from the correspondence stored in the above storage medium according to the function.

[0153] Step 502: Acquire the simulated sensor signal corresponding to the above function generated by the simulator.

[0154] Step 503: Process the simulator sensor signal according to the above functional logic to obtain the control instruction range corresponding to the above function.

[0155] The following is a unified description of step 502 and step 503:

[0156] The above simulator is used to simulate various sensor signals in the vehicle.

[0157] The simulated sensor signal is a sensor signal generated by the simulator, rather than a sensor signal generated by an actual sensor. The simulated sensor signal may be one or more, and the embodiment of the present application does not limit this.

[0158] In an embodiment of the present application, for each function of the control chip, a simulator can be used to simulate the sensor signal required for the function (hereinafter referred to as "simulated sensor signal" for ease of distinction), so that the above-mentioned simulated sensor signal is processed according to the functional logic corresponding to the function to obtain the control instruction range corresponding to the function.

[0159] Furthermore, in order to ensure the accuracy of the determined control instruction range, the tree-up simulator may simulate all simulated sensor signals required for the function.

[0160] Step 504 , determine whether the control instruction actually generated by the control chip is within the above control instruction range, if so, execute step 505 ; if not, execute step 506 .

[0161] Step 505: Determine that the above functions have no faults.

[0162] Step 506: Determine whether the above function has a fault.

[0163] The following is a unified description of steps 504 to 506:

[0164] The above control instructions refer to the control instructions generated by the control chip according to the sensor signals actually received for the function.

[0165] In the embodiment of the present application, for each function of the control chip, it is determined whether the control instruction actually generated by the control chip corresponding to the function is within the above control instruction range.

[0166] Optionally, if the above control instruction is within the above control instruction range, it means that the control instruction generated by the control chip for the function is relatively accurate, so it can be determined that there is no fault in the above function.

[0167] On the contrary, if the above control instruction is not within the above control instruction range, it means that the control instruction generated by the control chip corresponding to the function is inaccurate, so it can be determined that there is a fault in the above function.

[0168] The technical solution provided by the embodiment of the present application determines the functional logic of generating control instructions corresponding to each function of the control chip. The control chip is a master control chip or a slave control chip. The analog sensor signal corresponding to the above function generated by the simulator is obtained. The simulator sensor signal is processed according to the above functional logic to obtain the control instruction range corresponding to the above function, and it is determined whether the control instruction actually generated by the control chip is within the above control instruction range. If so, it is determined that there is no fault in the above function; if not, it is determined that there is a fault in the above function. This technical solution uses the simulator to simulate the analog sensor signal required for each function of the control chip, and uses the analog sensor signal and the functional logic corresponding to the function to determine the control instruction range of each function, so that the control instruction actually generated by the control chip for the function can be compared with the control instruction range to determine whether there is a fault in each function of the control chip, thereby realizing efficient and accurate fault detection of the function of the control chip.

[0169] Furthermore, in order to facilitate understanding of the domain controller provided by this application, the detailed architecture of the domain controller is described below:

[0170] See also Figure 6 , is a schematic diagram of the structure of another domain controller provided in an embodiment of the present application. Figure 6 As shown, the domain controller may include: a master MCU (Microcontroller Unit) and a slave MCU, wherein both the master and slave chips and the power chip adopt the ASIL D level and share the IGN power supply (wake-up power supply) to ensure the synchronization of the two chips.

[0171] Among them, the communication between the two MCUs uses high-speed SPI to ensure real-time control. The power chip can be used as a monitoring module. When the control chip has functional failures and hardware failures, the control chip can be placed in a preset mode so that the control chip no longer processes the received sensor signals and generates control instructions.

[0172] Furthermore, in order to ensure that the entire controller system meets the functional safety requirements of ASILD, the control strategies of the master and slave chips adopt a three-layer architecture to achieve function monitoring, hardware monitoring, and program flow monitoring:

[0173] 1) The L1 layer is the function implementation layer, which completes the specific function implementation. For example, for the chassis domain controller, this layer implements the air suspension height adjustment function, shock absorber damping adjustment function, basic braking function, basic steering function, etc. It may include but is not limited to: service braking function, EPB left and right function, SBW electric adjustment function, SBW feel simulation motor (three-phase) function, SBW steering execution motor, air spring, CDC, and drive motor control instruction function, etc.

[0174] 2) The L2 layer is the function monitoring layer, which is used to monitor whether the L1 function is running normally. The L2 layer designs a set of functional logic to determine whether the L1 function is running normally. The functional logic for determining whether the L1 function is running normally is related to the monitored function. Different monitored functions have different functional logics, such as through software diversification redundancy or rationality verification.

[0175] For example, for the basic braking function, when L2 uses the rationality verification method to determine whether the L1 function is operating normally, it first calculates the reasonable range of the braking force output based on the signal input from the pedal displacement sensor on the brake pedal simulator, and then calculates the actual output feedback from the actuator. Finally, it determines whether the actual output braking force of L1 is within the allowable reasonable range. If it exceeds the reasonable range, the L1 function is determined to be abnormal and error handling is performed.

[0176] 3) The L3 controller monitoring layer mainly consists of three functions:

[0177] Hardware diagnosis of electronic and electrical systems: monitors hardware failures of electronic and electrical systems. To achieve this goal, safety islands (SaftyLand) are divided on both the master chip and the slave chip. When a functional safety failure occurs in the master chip, such as a CPU core failure, RAM failure, or ROM failure of the controller, the information is transmitted to the fault recovery module (FailBack) of the slave chip through the safety island, thereby enabling the backup control strategy of the slave chip to take over the braking, steering, and driving of the entire vehicle, and report the fault at the same time to remind the driver of the danger and to drive with caution. Failure of the master chip will not directly lead to a violation of the safety goal, and only the joint failure of the master and slave chips will directly violate the functional safety goal. When a functional safety failure occurs in the slave chip, the master chip maintains normal operation, and the fault recovery module (FailBack) reports the fault after receiving the fault information, reminding the driver of the danger and to drive with caution.

[0178] Independent monitoring: After a controller-related fault occurs, the controller can no longer reliably execute safety-related logic. To ensure safety, the power chip is used as a monitoring MCU to ensure that it can still enter a safe state even if a serious fault occurs in the MCU.

[0179] Application flow check: monitors whether the monitoring programs of L1 and L2 are running normally. This is achieved by binding the program flow check with the watchdog feeding. If the monitoring programs related to L1 and L2 are not run in the set order or are not executed within the specified time, the program flow check fails and the watchdog cannot be fed normally, thus entering the system safe state.

[0180] In one embodiment, based on the above domain controller, there may be a corresponding fail-safe mechanism to ensure the security of the domain controller:

[0181] Optionally, when there is no failure (that is, there is no fault in both the main MCU and the slave MCU), the main CAN on the main MCU (including private CANs of domain controller peripheral components such as control CAN1, steering CAN1, drive CAN1, suspension CAN1, and public CANs such as CHCAN and EP CAN1) sends drive, steering, braking, and suspension control instructions to the motor, steering system, braking system, and suspension system, and sends control instructions from the chassis domain controller to CH CAN and EP CAN1.

[0182] The slave CAN on the MCU (including private CANs of domain controller peripheral components such as control CAN2, steering CAN2, drive CAN2, suspension CAN2, and public CANs such as RNDT CAN and EP CAN2) sends drive, steering, braking, and suspension control instructions to the motor, steering system, braking system, and suspension system, and sends the control instructions of the chassis domain controller to RNDT CAN and EPCAN2.

[0183] The master MCU and slave MCU can perform fault verification through SPI, and then decide which controller will send control instructions to the outside. Generally, two controllers are not allowed to send control instructions to the outside at the same time. It is also not allowed for a controller to send control instructions to the master CAN and slave CAN at the same time. The master MCU and slave MCU are verified through two CANs, and the master-slave verification can still be completed when one CAN fails.

[0184] When the master MCU and slave MCU cannot determine each other's failure status due to some reasons, the master MCU and slave MCU need to send control instructions to the domain controller peripheral components through the master CAN and slave CAN respectively. The master MCU and slave MCU send requests through two CANs, which has a higher degree of redundancy.

[0185] When there is no failure, the main MCU sends control instructions to peripheral components through the main CAN. When the main CAN fails, the main MCU sends control instructions to peripheral components through the slave CAN.

[0186] The slave MCU is allowed to send a brake request only when the master MCU fails completely.

[0187] Among them, the master MCU sends control instructions from the slave CAN and sends the flag of the slave CAN takeover to the peripheral components at the same time. The slave MCU sends control instructions and should send the flag of the slave takeover to the peripheral components. After the slave MCU takes over, it needs to send a request on the slave CAN and should send the flag of the slave CAN takeover at the same time. The peripheral components only judge and respond to the control instructions of the master and slave MCUs through these flags, and no other arbitration is required.

[0188] Furthermore, two redundant SPI communications are used. If a fault occurs in the current ignition cycle, the master MCU is used for control and the SPI communication fault is recorded. If it occurs in the previous ignition cycle or ignition synchronization moment, the slave MCU is used as the master control and the slave MCU control instructions are executed.

[0189] The domain controller provided in the embodiment of the present application is based on the functional safety goals and the highest vehicle safety integrity level of the chassis domain controller, as well as the hardware resource deployment method of the chassis domain controller to implement the functions of the wire-controlled suspension system, wire-controlled braking system, and wire-controlled steering system, thereby jointly confirming the functional safety architecture of the chassis domain controller, thereby reducing the cost of the controller while improving the security and stability of the domain controller.

[0190] See also Figure 7 , is a block diagram of an embodiment of a vehicle operation control device provided in an embodiment of the present application. As an embodiment, Figure 7 The device shown can be applied to a domain controller of a vehicle, wherein the domain controller includes a master control chip and a slave control chip, wherein the master control chip is connected to a plurality of different master function buses, and the slave control chip is connected to a plurality of different slave function buses, and the master control chip and the slave control chip are connected. Figure 7 As shown, the device may include:

[0191] A first determination module 71 is used to determine the control state of the master control chip and the slave control chip, and determine the operation state of the master function bus and the slave function bus when both the master control chip and the slave control chip generate corresponding control instructions according to the received sensor signal;

[0192] A second determining module 72, configured to determine a target control chip from the master control chip and the slave control chip according to the control state;

[0193] A third determining module 73, configured to determine a target functional bus from the primary functional bus and the secondary functional bus according to the operating state;

[0194] The sending module 74 is used to send the control instructions generated by the target control chip to the target function bus, so that the vehicle runs according to the control instructions output by the target function bus.

[0195] like Figure 8 As shown, it is a schematic diagram of the structure of a vehicle provided in an embodiment of the present application, including a processor 81, a communication interface 82, a memory 83 and a communication bus 84, wherein the processor 81, the communication interface 82, and the memory 83 communicate with each other through the communication bus 84.

[0196] A memory 83, for storing computer programs;

[0197] In one embodiment of the present application, the processor 81 is used to execute the program stored in the memory 83 to implement the vehicle operation control method provided by any of the above method embodiments. The method can be applied to Figure 1 or Figure 6 The domain controller shown in the figure includes a master control chip and a slave control chip, the master control chip is connected to a plurality of different master function buses, the slave control chip is connected to a plurality of different slave function buses, and the master control chip and the slave control chip are connected, including:

[0198] In the case where both the master control chip and the slave control chip generate corresponding control instructions according to the received sensor signal, determining the control states of the master control chip and the slave control chip, and determining the operating states of the master function bus and the slave function bus;

[0199] Determining a target control chip from the master control chip and the slave control chip according to the control state;

[0200] Determining a target functional bus from the master functional bus and the slave functional bus according to the operating state;

[0201] The control instructions generated by the target control chip are sent to the target function bus, so that the vehicle operates according to the control instructions output by the target function bus.

[0202] An embodiment of the present application also provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the vehicle operation control method provided in any of the aforementioned method embodiments are implemented.

[0203] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment.

[0204] Through the text of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiment.

[0205] It should be understood that the terms used in the text are only for the purpose of the specific example implementation of the text, and are not intended to be limited. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used in the text can also be represented to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of the stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or their combinations. The method steps, processes, and operations of the text in the text are not interpreted as necessarily requiring them to be performed in the specific order of the text or description, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps can be used.

[0206] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for controlling vehicle operation, characterized in that: A domain controller applied to a vehicle, the domain controller comprising a master control chip and a slave control chip, the master control chip being connected to a plurality of different master function buses, the slave control chip being connected to a plurality of different slave function buses, the master control chip and the slave control chip being connected, the method comprising: In the case where both the master control chip and the slave control chip generate corresponding control instructions according to the received sensor signal, determining the control states of the master control chip and the slave control chip, and determining the operating states of the master function bus and the slave function bus; Determining a target control chip from the master control chip and the slave control chip according to the control state; Determining a target functional bus from the master functional bus and the slave functional bus according to the operating state; The control instructions generated by the target control chip are sent to the target function bus, so that the vehicle operates according to the control instructions output by the target function bus.

2. The method according to claim 1, characterized in that The master control chip and the slave control chip are connected via a preset communication interface; The determining the control states of the master control chip and the slave control chip includes: Obtaining a verification result of verification performed between the master control chip and the slave control chip; According to the verification result, the control states of the master control chip and the slave control chip are determined.

3. The method according to claim 2, characterized in that The method further comprises: When the verification result cannot be obtained, determining both the master control chip and the slave control chip as target control chips, and determining both the master function bus and the slave function bus as target function buses; The step of sending the control instruction generated by the target control chip to the target function bus includes: The control instructions generated by the master control chip are sent to the master function bus, and the control instructions generated by the slave control chip are sent to the slave function bus.

4. The method according to claim 1, characterized in that The step of determining a target control chip from the master control chip and the slave control chip according to the control state includes: When the control state indicates that the main control chip has not failed, determining the main control chip as a target control chip; When the control state indicates that the master control chip fails and the slave control chip does not fail, the slave control chip is determined as the target control chip.

5. The method according to claim 1, characterized in that Determining a target function bus from the main function bus and the slave function bus according to the running state includes: In a case where the operating state indicates that the main functional bus has not failed, determining the main functional bus as a target functional bus; When the operating state indicates that the master functional bus fails and the slave functional bus does not fail, the slave functional bus is determined as the target functional bus.

6. The method according to claim 1, characterized in that The step of sending the control instruction generated by the target control chip to the target function bus includes: When it is determined that the target control chip is a slave control chip, obtaining a slave control identifier of the slave control chip; Sending the control instruction generated by the slave control chip and the slave control identifier to the target function bus, so that the target function bus sends the control instruction and the slave control identifier outwardly; and / or, In the case where it is determined that the target functional bus is a slave functional bus, obtaining a slave bus identifier of the slave functional bus; The control instruction of the target control chip and the slave bus identifier are sent to the slave function bus, so that the slave function bus sends the control instruction and the slave bus identifier outwardly.

7. The method according to claim 2, characterized in that The method further comprises: If the verification result is not obtained, determining the fault time point when the communication interface fails; If the fault time point is within the current operation cycle of the domain controller, then if the main control chip does not fail, the main control chip is determined as the target control chip, and if the main function bus does not fail, the main function bus is determined as the target function bus; If the fault time point is before the current operation cycle of the domain controller, then when the slave control chip has not failed, the slave control chip is determined as the target control chip, and when the slave function bus has not failed, the slave function bus is determined as the target function bus.

8. The method according to claim 1, characterized in that The master control chip and the slave control chip both include a functional fault detection module and a hardware fault detection module. The master control chip is powered by a master power module, and the slave control chip is powered by a slave power module. The functional fault detection module is used to detect whether a functional module of the master control chip or the slave control chip has a fault, and the hardware fault detection module is used to detect whether hardware of the master control chip or the slave control chip has a fault. The method further includes: When the function fault detection module of the main control chip detects that the function of the main control chip is faulty, and the hardware fault detection module detects that the hardware of the main control chip is faulty, a preset fault signal is sent to the main power supply module, so that the main power supply module updates the operating state of the main control chip to a preset mode, wherein when the main control chip is in the preset mode, the main control chip no longer processes the received sensor signal; When the functional fault detection module of the slave control chip detects that a functional module of the slave control chip has a fault, and the hardware fault detection module detects that the hardware of the slave control chip has a fault, a preset fault signal is sent to the slave power supply module so that the slave power supply module updates the operating state of the slave control chip to a preset mode, wherein when the slave control chip is in the preset mode, the slave control chip no longer processes the received sensor signal.

9. The method according to claim 8, characterized in that The functional fault detection module detects each function of the control chip in the following manner: For each function of the control chip, determining the functional logic for generating a control instruction corresponding to the function, the control chip being a master control chip or a slave control chip; Acquire a simulated sensor signal corresponding to the function generated by the simulator; Processing the analog sensor signal according to the functional logic to obtain a control instruction range corresponding to the function; Determining whether the control instruction actually generated by the control chip is within the control instruction range; In the case where it is determined that the control instruction actually generated by the control chip is within the control instruction range, determining that there is no fault in the function; When it is determined that the control instruction actually generated by the control chip is not within the control instruction range, it is determined that the function has a fault.

10. A vehicle operation control device, characterized in that: A domain controller applied to a vehicle, the domain controller comprising a master control chip and a slave control chip, the master control chip being connected to a plurality of different master function buses, the slave control chip being connected to a plurality of different slave function buses, the master control chip and the slave control chip being connected, the device comprising: A first determination module is used to determine the control state of the master control chip and the slave control chip, and determine the operation state of the master function bus and the slave function bus when both the master control chip and the slave control chip generate corresponding control instructions according to the received sensor signal; A second determining module, configured to determine a target control chip from the master control chip and the slave control chip according to the control state; A third determining module, configured to determine a target function bus from the main function bus and the slave function bus according to the running state; The sending module is used to send the control instructions generated by the target control chip to the target function bus, so that the vehicle runs according to the control instructions output by the target function bus.

11. A vehicle, characterized in that: include: Domain controllers and storage, The domain controller comprises a master control chip and a slave control chip, the master control chip is connected to a plurality of different master function buses, the slave control chip is connected to a plurality of different slave function buses, and the master control chip and the slave control chip are connected; The domain controller is used to execute the vehicle operation control program stored in the memory to implement the vehicle operation control method according to any one of claims 1 to 9.

12. A storage medium, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the vehicle operation control method according to any one of claims 1 to 9.

Images