Steering system fault processing method and device and electronic equipment

Abstract

The invention provides a steering system fault processing method and device and electronic equipment, and the method comprises the steps: monitoring a sensor in a steering system based on a preset sensor safety mechanism, and determining that the sensor is in a fault state; monitoring a controller in the steering system based on a preset controller safety mechanism, and determining that the controller is in a fault state; an actuator in the steering system is monitored on the basis of a preset actuator safety mechanism, it is determined that the actuator is in a fault state, and the fault state is that the sensor or the controller or the actuator has a power-assisted steering fault; and controlling the target vehicle to enter a safe state based on a preset sensor safety mechanism and / or controller safety mechanism and / or actuator safety mechanism. According to the method, the fault is monitored, and a response mechanism after the fault occurs is designed, so that automatic fault processing is realized, and the driving safety is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of intelligent driving technology, and in particular to a steering system fault handling method, device and electronic equipment. Background Art

[0002] The steering system has gradually developed from mechanical steering and hydraulic steering to electric power steering and wire-controlled steering. With the increasing degree of electrification, the risks caused by the failure of electronic and electrical systems are also increasing. How to ensure the functional safety of electronic and electrical systems has become a hot topic of concern and research in the industry. By introducing the development of functional safety steering systems, systematic failures and random hardware failures can be reduced to a certain extent, thereby reducing the unacceptable risks caused by the failure of electronic and electrical systems. Therefore, there is an urgent need for safe control and fault management of the vehicle's steering system. Summary of the invention

[0003] Embodiments of the present application provide a steering system fault processing method, device, system, electronic device, and computer-readable storage medium.

[0004] In a first aspect, an embodiment of the present application provides a steering system fault processing method, the method comprising:

[0005] Monitoring the sensors in the steering system based on a preset sensor safety mechanism to determine whether the sensors are in a fault state; and / or,

[0006] Monitoring the controller in the steering system based on a preset controller safety mechanism to determine that the controller is in a fault state; and / or,

[0007] Monitoring the actuator in the steering system based on a preset actuator safety mechanism to determine that the actuator is in a fault state, wherein the fault state is that the sensor, the controller, or the actuator has a steering assist fault;

[0008] The target vehicle is controlled to enter a safe state based on a preset sensor safety mechanism and / or a controller safety mechanism and / or an actuator safety mechanism.

[0009] Optionally, the sensor includes a motor position sensor; and the monitoring of the sensor in the steering system based on a preset sensor safety mechanism to determine whether the sensor is in a fault state includes:

[0010] Acquiring a motor position signal corresponding to the motor position sensor, and performing vector length monitoring on the motor position signal, and performing common mode monitoring on the motor position sensor;

[0011] When it is detected that the vector length corresponding to the motor position signal is outside the first preset range, and / or the common mode monitoring is outside the second preset range, it is determined that the motor position sensor is in a fault state, and a rationality check is performed on the motor position signal;

[0012] When it is detected that the sum of the first half-bridge signal and the second half-bridge signal in the motor position signal is outside the third preset range, it is determined that the motor position sensor is in a fault state.

[0013] Optionally, the sensor includes a torque angle sensor; and the monitoring of the controller in the steering system based on a preset controller safety mechanism to determine that the controller is in a fault state includes:

[0014] Collecting a torque angle signal corresponding to the torque angle sensor, performing a protocol check on the torque angle signal, and performing a range check on the torque angle signal;

[0015] When it is detected that the torque angle signal fails the protocol check and / or the torque angle signal is outside the fourth preset range, determining that the torque angle sensor is in a fault state and performing a rationality check on the torque angle signal;

[0016] When it is detected that the ratio between the torque signal difference and the angle signal difference in the torque angle signal is outside the fifth preset range, it is determined that the torque angle sensor is in a fault state.

[0017] Optionally, the sensor includes a current sensor; and the monitoring of the actuator in the steering system based on a preset actuator safety mechanism to determine that the actuator is in a fault state includes:

[0018] Collecting a current signal corresponding to the current sensor, performing a validity check on the current signal, and performing an overcurrent detection on the current signal;

[0019] When it is detected that the current signal is outside the sixth preset range and / or the absolute value of the current signal is outside the seventh preset range, it is determined that the current sensor is in a fault state, and a rationality check is performed on the current signal;

[0020] When it is detected that the sum of the first current signal, the second current signal and the third current signal in the motor position signal is outside the eighth preset range, it is determined that the current sensor is in a fault state.

[0021] Optionally, monitoring the controller in the steering system based on a preset controller safety mechanism to determine whether the controller has a target fault includes:

[0022] When it is detected that the first output of the main processor and the second output of the check processor are different, and the number of failures of the controller is greater than a first preset value, it is determined that a target failure exists in the main control chip in the controller, and it is determined that the main control chip in the controller is in a failure state; wherein the main processor and the check processor are in a lock-step core, and the lock-step core is used to monitor the failure of the controller; or,

[0023] In the case where a storage fault is detected in the controller, determining that a main control chip in the controller is in a fault state; or,

[0024] When it is detected that the number of failures corresponding to the fault injection test of the main control chip in the controller in at least one key cycle is greater than the first preset value, it is determined that the main control chip in the controller is in a fault state.

[0025] Optionally, the actuator includes a motor pre-driver chip, and the monitoring of the actuator in the steering system based on a preset actuator safety mechanism to determine that the actuator is in a fault state includes:

[0026] Collecting the chip power supply voltage and charge pump voltage corresponding to the motor pre-drive chip;

[0027] When it is detected that the chip power supply voltage is not in the ninth preset range, and / or the charge pump voltage is not in the tenth preset range, it is determined that the motor pre-drive chip is in a fault state; or,

[0028] In the case where it is detected that the digital phase feedback signal and the pulse width modulation input mode are in a mismatch state, it is determined that the motor pre-drive chip is in a fault state; or,

[0029] In the case where any of the synchronous serial communication frame number, synchronous serial communication timeout, synchronous serial communication cyclic redundancy check error and invalid address access monitoring is detected to be in a fault state, determining that the motor pre-drive chip is in a fault state; or,

[0030] When it is detected that the corresponding self-test state of the steering system during the power-on process is self-test failure, it is determined that the motor pre-drive chip is in a fault state.

[0031] Optionally, the actuator further includes a full-bridge module, and the motor pre-driver chip is used to convert the target motor torque command into a target motor current and a gate sequence signal command, and to diagnose a full-bridge fault corresponding to the full-bridge module.

[0032] Optionally, controlling the target vehicle to enter a safe state based on a preset sensor safety mechanism and / or controller safety mechanism and / or actuator safety mechanism includes:

[0033] The steering system of the target vehicle is controlled to switch to a redundant backup system.

[0034] In a second aspect, an embodiment of the present application provides a steering system fault processing device, the device comprising:

[0035] A first monitoring module is configured to monitor a sensor in the steering system based on a preset sensor safety mechanism to determine whether the sensor is in a fault state; and / or,

[0036] A second monitoring module is configured to monitor the controller in the steering system based on a preset controller safety mechanism to determine that the controller is in a fault state; and / or,

[0037] a third monitoring module, configured to monitor the actuator in the steering system based on a preset actuator safety mechanism, and determine that the actuator is in a fault state, wherein the fault state is that the sensor, the controller, or the actuator has a steering assist fault;

[0038] The fault processing module is used to control the target vehicle to enter a safe state based on a preset sensor safety mechanism and / or controller safety mechanism and / or actuator safety mechanism.

[0039] Optionally, the first monitoring module includes:

[0040] A first monitoring submodule, used for collecting a motor position signal corresponding to the motor position sensor, performing vector length monitoring on the motor position signal, and performing common mode monitoring on the motor position sensor;

[0041] A second monitoring submodule, for determining that the motor position sensor is in a fault state and performing a rationality check on the motor position signal when it is detected that the vector length corresponding to the motor position signal is outside the first preset range and / or the common mode monitoring is outside the second preset range;

[0042] The third monitoring submodule is used to determine that the motor position sensor is in a fault state when it is detected that the sum of the first half-bridge signal and the second half-bridge signal in the motor position signal is outside a third preset range.

[0043] Optionally, the first monitoring module includes:

[0044] a fourth monitoring submodule, configured to collect a torque angle signal corresponding to the torque angle sensor, perform a protocol check on the torque angle signal, and perform a range check on the torque angle signal;

[0045] a fifth monitoring submodule, for determining that the torque angle sensor is in a fault state and performing a rationality check on the torque angle signal when it is detected that the torque angle signal fails the protocol check and / or the torque angle signal is outside the fourth preset range;

[0046] The sixth monitoring submodule is used to determine that the torque angle sensor is in a fault state when it is detected that the ratio between the torque signal difference and the angle signal difference in the torque angle signal is outside the fifth preset range.

[0047] Optionally, the first monitoring module includes:

[0048] a seventh monitoring submodule, configured to collect a current signal corresponding to the current sensor, perform validity check on the current signal, and perform overcurrent detection on the current signal;

[0049] an eighth monitoring submodule, configured to determine that the current sensor is in a fault state and perform a rationality check on the current signal when it is detected that the current signal is outside the sixth preset range and / or the absolute value of the current signal is outside the seventh preset range;

[0050] The ninth monitoring submodule is used to determine that the current sensor is in a fault state when it is detected that the sum of the first current signal, the second current signal and the third current signal in the motor position signal is outside the eighth preset range.

[0051] Optionally, the second monitoring module includes:

[0052] a tenth monitoring submodule, configured to determine that a target fault exists in a main control chip in the controller and that the main control chip in the controller is in a fault state when it is detected that the first output of the main processor and the second output of the check processor are different and the number of faults of the controller is greater than a first preset value; wherein the main processor and the check processor are in a lock-step core, and the lock-step core is used to monitor the fault of the controller; or

[0053] an eleventh monitoring submodule, configured to determine that a main control chip in the controller is in a fault state when a storage fault is detected in the controller; or

[0054] A twelfth monitoring submodule is used to determine that the main control chip in the controller is in a fault state when it is detected that the number of failures corresponding to the fault injection test of the main control chip in the controller in at least one key cycle is greater than the first preset value.

[0055] Optionally, the third monitoring module includes:

[0056] A thirteenth monitoring submodule is used to collect the chip power supply voltage and charge pump voltage corresponding to the motor pre-drive chip;

[0057] A fourteenth monitoring submodule is configured to determine that the motor pre-drive chip is in a fault state when it is detected that the chip power supply voltage is not in the ninth preset range and / or the charge pump voltage is not in the tenth preset range; or

[0058] A fifteenth monitoring submodule is used to determine that the motor pre-drive chip is in a fault state when it is detected that the digital phase feedback signal and the pulse width modulation input mode are in a mismatch state; or

[0059] A sixteenth monitoring submodule is used to determine that the motor pre-drive chip is in a fault state when any of the synchronous serial communication frame number, synchronous serial communication timeout, synchronous serial communication cyclic redundancy check error and invalid address access monitoring is detected to be in a fault state; or,

[0060] The seventeenth monitoring submodule is used to determine that the motor pre-drive chip is in a fault state when it is detected that the corresponding self-test state of the steering system during the power-on process is a self-test failure.

[0061] Optionally, the fault processing module includes:

[0062] The fault processing submodule is used to control the steering system of the target vehicle to switch to a redundant backup system.

[0063] In a third aspect, an embodiment of the present application further provides an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor, wherein the processor is configured to execute the instructions to implement any of the steering system fault handling methods described above.

[0064] In a fourth aspect, an embodiment of the present application further provides a storage medium, which, when instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to execute any of the steering system fault handling methods described above.

[0065] In a fifth aspect, an embodiment of the present application further provides a vehicle, comprising the steering system fault handling device as described above.

[0066] In the embodiment of the present application, the sensor in the steering system is monitored based on a pre-set sensor safety mechanism to determine whether the sensor is in a fault state; and / or, the controller in the steering system is monitored based on a pre-set controller safety mechanism to determine whether the controller is in a fault state; and / or, the actuator in the steering system is monitored based on a pre-set actuator safety mechanism to determine whether the actuator is in a fault state, wherein the fault state is that the sensor or the controller or the actuator has a steering assist fault; and the target vehicle is controlled to enter a safe state based on the pre-set sensor safety mechanism and / or controller safety mechanism and / or actuator safety mechanism. That is, in the embodiment of the present application, by analyzing the steering system architecture, the hardware components that will violate the safety goals, namely, sensors, controllers and actuators, are found, and safety mechanisms are designed for them to monitor the steering system, that is, the present application realizes automatic fault handling and improves driving safety by monitoring faults and designing a response mechanism after the fault occurs.

[0067] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0069] Figure 1 is a flowchart of a method for handling a steering system fault provided by an embodiment of the present application;

[0070] Figure 2 is a device block diagram of a steering system fault processing device provided in an embodiment of the present application;

[0071] Figure 3 It is a structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0072] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0073] It should be noted that in the embodiment of the present application, the steering system is analyzed based on the safety goal of avoiding excessive steering assistance. It can be concluded that the sensors, controllers and actuators of the steering system may have failures that violate the safety goal of loss of steering assistance. Therefore, by real-time monitoring of these failures, when the steering system confirms a failure that violates the safety goal, it enters the corresponding safety state, switches from the safety state of excessive steering assistance to the redundant system to continue responding to steering assistance requests, and can light up the corresponding fault lights or fault prompts on the instrument panel.

[0074] Figure 1 is a flowchart of a method for handling a steering system fault provided by an embodiment of the present application. Figure 1 As shown, the method may include:

[0075] Step 101, monitoring a sensor in a steering system based on a preset sensor safety mechanism to determine whether the sensor is in a fault state; and / or,

[0076] It should be noted that the sensors of the steering system include: motor position sensor, torque angle sensor and current sensor. The motor position sensor is used to collect the real-time position of the motor to complete the motor rotation control; the torque angle sensor has two functions, one is to provide steering wheel angle information, and the other is to provide steering wheel torque information; the current sensor is used to collect the three-phase current flowing through the motor to complete the motor algorithm control.

[0077] Therefore, a sensor safety mechanism can be pre-set to monitor the sensors in the steering system.

[0078] Further, the sensor includes a motor position sensor; the monitoring of the sensor in the steering system based on a preset sensor safety mechanism to determine whether the sensor is in a fault state includes:

[0079] Acquiring a motor position signal corresponding to the motor position sensor, and performing vector length monitoring on the motor position signal, and performing common mode monitoring on the motor position sensor;

[0080] When it is detected that the vector length corresponding to the motor position signal is outside the first preset range, and / or the common mode monitoring is outside the second preset range, it is determined that the motor position sensor is in a fault state, and a rationality check is performed on the motor position signal;

[0081] When it is detected that the sum of the first half-bridge signal and the second half-bridge signal in the motor position signal is outside the third preset range, it is determined that the motor position sensor is in a fault state.

[0082] The failure modes of the motor position sensor include short circuit, open circuit and drift. After analysis, when the motor position sensor signal drifts too much, it will violate the safety goal of excessive steering assistance. It is necessary to perform functional safety design on the motor position sensor, select an ASIL D level sensor, and provide two motor position signals, the first half-bridge signal and the second half-bridge signal. The first half-bridge signal is an N-bridge signal, and the second half-bridge signal is a P-bridge signal. In order to meet the requirements of the ASIL D level, a redundant design is usually adopted. Therefore, two motor position signals are provided: the first half-bridge signal (N-bridge signal): uses an N-channel MOSFET as a switching element, and the second half-bridge signal (P-bridge signal): uses a P-channel MOSFET as a switching element.

[0083] Therefore, a corresponding safety mechanism can be designed for the motor position sensor.

[0084] Specifically, safety mechanism 1: vector length monitoring of the collected motor position signal.

[0085] (V_L)2=(SINθ)2+(COSθ)2

[0086] (V_L)2 = [0.5564, 1.4009]

[0087] When the vector length (V_L)2 exceeds the range [0.5564,1.4009], the steering system switches to the redundant backup system and reports a motor position sensor failure.

[0088] Safety mechanism 2: Common-mode monitoring of the acquired motor position sensor.

[0089] VCM_S=SIN_P+SIN_N

[0090] VCM_C=COS_P+COS_N

[0091] VCM_S = [-0.08; +0.08]

[0092] VCM_C = [-0.08; +0.08]

[0093] When the common mode monitoring exceeds the range [-0.08; +0.08], the steering system switches to the redundant backup system and reports a motor position sensor failure.

[0094] Safety mechanism 3: Perform rationality check on the collected motor position signal.

[0095] AngleN+AngleP=0°

[0096] [-4.1°,4.1°]

[0097] When the rationality check is out of the range [-4.1°, 4.1°], the steering system switches to the redundant backup system and reports a motor position sensor failure.

[0098] Further, the sensor includes a torque angle sensor; the monitoring of the controller in the steering system based on a preset controller safety mechanism and determining that the controller is in a fault state includes:

[0099] Collecting a torque angle signal corresponding to the torque angle sensor, performing a protocol check on the torque angle signal, and performing a range check on the torque angle signal;

[0100] When it is detected that the torque angle signal fails the protocol check and / or the torque angle signal is outside the fourth preset range, determining that the torque angle sensor is in a fault state and performing a rationality check on the torque angle signal;

[0101] When it is detected that the ratio between the torque signal difference and the angle signal difference in the torque angle signal is outside the fifth preset range, it is determined that the torque angle sensor is in a fault state.

[0102] It should be noted that in the embodiment of the present application, the torque angle sensor has two functions, namely providing the driver's hand torque information and providing the steering wheel angle information. After analysis, when the signal drift of the torque angle sensor is too small, it will cause excessive steering assistance, violating the safety goal. Therefore, it is necessary to select an ASIL D-level torque angle sensor to provide two torque signals T1, T2 and two angle signals A1, A2.

[0103] Specifically, a corresponding safety mechanism is designed for the torque angle sensor. Safety mechanism 4: performing a protocol check on the collected torque angle signal.

[0104] When the protocol check fails, the steering system switches to the redundant backup system and reports a torque angle sensor failure.

[0105] Safety mechanism 5: Perform range check on the acquired torque angle signal.

[0106] T1 / T2, A1 / A2=[8,4087]

[0107] When the torque signal exceeds the range [8,4087], the steering system switches to the redundant backup system and reports a motor position sensor failure.

[0108] Safety mechanism 6: Perform rationality check on the collected torque angle signal.

[0109] |T1-T2 / A1-A2|=[0,8]

[0110] When the rationality check exceeds the range [0,8], the steering system switches to the redundant backup system and reports a motor position sensor failure.

[0111] Further, the sensor includes a current sensor; and the monitoring of the sensor in the steering system based on a preset sensor safety mechanism to determine whether the sensor is in a fault state includes:

[0112] Collecting a current signal corresponding to the current sensor, performing a validity check on the current signal, and performing an overcurrent detection on the current signal;

[0113] When it is detected that the current signal is outside the sixth preset range and / or the absolute value of the current signal is outside the seventh preset range, it is determined that the current sensor is in a fault state, and a rationality check is performed on the current signal;

[0114] When it is detected that the sum of the first current signal, the second current signal and the third current signal in the motor position signal is outside the eighth preset range, it is determined that the current sensor is in a fault state.

[0115] It should be noted that in the embodiment of the present application, the three-phase current of the three-phase motor is collected to control the motor operation in a closed loop. After analysis, when the current sensor signal drifts to a small value, it will cause excessive steering assistance, violating the safety goal. The first current signal, the second current signal and the third current signal are Shunt1, shunt2 and shunt3, that is, three-phase current signals.

[0116] Therefore, a corresponding safety mechanism is designed for the current sensor.

[0117] Specifically, safety mechanism 7: performing validity check on the shunt signal.

[0118] Shunt signal=[-207,204]A

[0119] When the shunt signal exceeds the range [-207,204], the steering system switches to the redundant backup system and reports a motor position sensor failure.

[0120] Safety mechanism 8: Perform over-current detection on the shunt signal.

[0121] |Shunt|<85A

[0122] When the absolute value of the current signal is greater than 85A, the steering system switches to the redundant backup system and reports a motor position sensor failure.

[0123] Safety mechanism 9: Perform rationality check on the shunt signal.

[0124] I1+I2+I3=0

[0125] If the three-phase current sum exceeds the range [-1,1]A, the steering system switches to the redundant backup system and reports a motor position sensor failure.

[0126] Step 102, monitoring the controller in the steering system based on a preset controller safety mechanism to determine that the controller is in a fault state; and / or,

[0127] As the center of the steering system, the controller calculates the size and direction of the steering assist. When the controller fails, it may cause excessive steering assist. As a class III device, the controller needs to use ASIL D grade chips. The reasons that may cause the controller to fail include: internal communication bus failure, storage failure, ROM failure, register failure and A / D sampling failure. Safety mechanisms need to be designed for these failure modes of the controller. Among them, storage failure is RAM failure, and RAM is a temporary storage device.

[0128] Further, monitoring the controller in the steering system based on a preset controller safety mechanism to determine whether the controller has a target fault includes:

[0129] When it is detected that the first output of the main processor and the second output of the check processor are different, and the number of failures of the controller is greater than a first preset value, it is determined that a target failure exists in the main control chip in the controller, and it is determined that the main control chip in the controller is in a failure state; wherein the main processor and the check processor are in a lock-step core, and the lock-step core is used to monitor the failure of the controller; or,

[0130] In the case where a storage fault is detected in the controller, determining that a main control chip in the controller is in a fault state; or,

[0131] When it is detected that the number of failures corresponding to the fault injection test of the main control chip in the controller in at least one key cycle is greater than the first preset value, it is determined that the main control chip in the controller is in a fault state.

[0132] Specifically, the LockStep Core is divided into the Master Core and the Checker Core, which use the same input data, perform the same operation, and use a hardware comparator to compare the output of the Master CPU and the Checker CPU cycle by cycle.

[0133] Therefore, safety mechanism 10: the core kernel module can monitor the permanent faults and transient faults of the kernel module through lock-step kernel acquisition. If the output results of the two cores are inconsistent and exceed the corresponding fault tolerance times 3, the steering system switches to the redundant backup system and reports the main control chip failure.

[0134] Safety Mechanism 11: Detect storage failures through the following detection measures, including but not limited to error correction code (ECC: Error Correcting Code), single error correction (SEC: Single Error Correct), double error detection (Double Error Detect), internal fault injection test (Programmable Bulit-in Self Test), Cyclic RAM test (Bus ECC RAM TEST). If a storage failure occurs, the steering system switches to the redundant backup system and reports a main control chip failure.

[0135] Safety mechanism 12: The main control MCU should perform a fault injection test on the corresponding logic calculation module at least once during a key cycle. If the logic fault injection test passes more than 3 fault tolerance times, the steering system will switch to the redundant backup system and report a main control chip fault.

[0136] Step 103, monitoring the actuator in the steering system based on a preset actuator safety mechanism, and determining that the actuator is in a fault state, wherein the fault state is that the sensor, the controller, or the actuator has a steering assist fault;

[0137] Furthermore, the actuator also includes a full-bridge module, and the motor pre-driver chip is used to convert the target motor torque command into a target motor current and a gate sequence signal command, and diagnose a full-bridge fault corresponding to the full-bridge module.

[0138] It should be noted that in the embodiment of the present application, the actuator of the steering system includes: a motor pre-driver chip and a full-bridge module. The function of the motor pre-driver chip is to convert the motor torque and direction signals of the main control chip into electrical signals to control the on-off of the full-bridge module. The full-bridge module is composed of 6 MOS tubes, each group of two controls the on-off of one of the three-phase motors.

[0139] Further, the actuator includes a motor pre-drive chip, and the actuator in the steering system is monitored based on a preset actuator safety mechanism to determine that the actuator is in a fault state, including:

[0140] Collecting the chip power supply voltage and charge pump voltage corresponding to the motor pre-drive chip;

[0141] When it is detected that the chip power supply voltage is not in the ninth preset range, and / or the charge pump voltage is not in the tenth preset range, it is determined that the motor pre-drive chip is in a fault state; or,

[0142] In the case where it is detected that the digital phase feedback signal and the pulse width modulation input mode are in a mismatch state, it is determined that the motor pre-drive chip is in a fault state; or,

[0143] In the case where any of the synchronous serial communication frame number, synchronous serial communication timeout, synchronous serial communication cyclic redundancy check error and invalid address access monitoring is detected to be in a fault state, determining that the motor pre-drive chip is in a fault state; or,

[0144] When it is detected that the corresponding self-test state of the steering system during the power-on process is self-test failure, it is determined that the motor pre-drive chip is in a fault state.

[0145] It should be noted that the function of the motor pre-driver chip is to convert the target motor torque command into the target motor current and gate sequence signal command, and diagnose the full-bridge module fault. This chip is classified as a Class III component, and the chip needs to meet the ASIL D level requirements. If the chip converts the target torque into a current and gate sequence signal command that is too large, it will lead to a violation of the safety goal.

[0146] Therefore, it is necessary to design a security mechanism for this chip, specifically, security goal 13: chip power supply voltage detection.

[0147] VS=[7.93,18]V

[0148] When the chip supply voltage exceeds the range [7.93,18]V, the steering system switches to the redundant backup system and reports a pre-drive chip failure.

[0149] Safety Goal 14: Charge pump voltage detection.

[0150] VDH=[0,48.18]V

[0151] When the chip charge pump voltage exceeds the range [0,48.18]V, the steering system switches to the redundant backup system and reports a pre-drive chip failure.

[0152] Safety mechanism 15: Input-output comparison.

[0153] The steering system should check whether the digital phase feedback signal matches the pulse width modulation input mode. If it does not match, the steering system switches to the redundant backup system and reports a pre-drive chip failure. The pulse width modulation input mode is the PWM input mode. Pulse Width Modulation (PWM), referred to as pulse width modulation, controls the analog circuit through the digital output of the microprocessor.

[0154] Safety mechanism 16: Synchronous serial communication protection

[0155] The steering system shall perform synchronous serial communication frame number, synchronous serial communication timeout, synchronous serial communication cyclic redundancy check error, and invalid address access monitoring.

[0156] When the synchronous serial communication frame number, synchronous serial communication timeout, synchronous serial communication cyclic redundancy check error, and invalid address access monitoring report a fault, the steering system switches to the redundant backup system and reports a pre-drive chip fault.

[0157] It should be noted that SPI (Serial Peripheral Interface) is a synchronous serial communication interface, which is widely used in embedded systems and electronic devices for high-speed data transmission between microcontrollers, sensors, memories and other peripherals. In the embodiment of the present application, the synchronous serial communication protection is SPI communication protection.

[0158] In SPI (Serial Peripheral Interface) communication, a CRC (Cyclic Redundancy Check) error means that when the receiver receives a data frame, it detects an error in the data frame based on the CRC checksum. A CRC error usually indicates that the data has been damaged or lost during transmission.

[0159] Safety mechanism 17: chip self-test.

[0160] The steering system performs self-test during power-on. The self-test contents include: circuit breaker self-test, second cut-off circuit self-test, current amplifier voltage self-test and synchronous serial communication command invalid self-test.

[0161] When the self-test fails, the steering system switches to the redundant backup system and reports a pre-drive chip failure.

[0162] Step 104 : Control the target vehicle to enter a safe state based on a preset sensor safety mechanism and / or controller safety mechanism and / or actuator safety mechanism.

[0163] Further, controlling the target vehicle to enter a safe state based on a preset sensor safety mechanism and / or controller safety mechanism and / or actuator safety mechanism includes:

[0164] The steering system of the target vehicle is controlled to switch to a redundant backup system.

[0165] It should be noted that in the embodiment of the present application, when it is detected that any one of the controller, sensor and actuator in the steering system is in a fault state, the steering system switches to a redundant backup system. That is, when the steering system confirms a fault that violates the safety goal, it enters a corresponding safety state, from the safety state of excessive steering assistance to switching to a redundant system to continue responding to steering assistance requests, and the corresponding fault light or fault prompt can be lit on the instrument panel.

[0166] In the embodiment of the present application, the sensor in the steering system is monitored based on a preset sensor safety mechanism to determine whether the sensor is in a fault state; and / or, the controller in the steering system is monitored based on a preset controller safety mechanism to determine whether the controller is in a fault state; and / or, the actuator in the steering system is monitored based on a preset actuator safety mechanism to determine whether the actuator is in a fault state, wherein the fault state is that the sensor or the controller or the actuator has a steering assist fault; and the target vehicle is controlled to enter a safe state based on the preset sensor safety mechanism and / or controller safety mechanism and / or actuator safety mechanism. That is, in the embodiment of the present application, by analyzing the steering system architecture, the hardware components that will violate the safety goals, namely, sensors, controllers and actuators, are found, and safety mechanisms are designed for them to monitor the steering system, that is, the present application realizes automatic fault processing and improves driving safety by monitoring faults and designing a response mechanism after the fault occurs. .

[0167] Corresponding to the method provided in the above-mentioned steering system fault handling method embodiment of the present application, see Figure 2 The present application also provides a device block diagram of a steering system fault processing device. In this embodiment, the device includes:

[0168] The first monitoring module 201 is used to monitor the sensor in the steering system based on a preset sensor safety mechanism to determine whether the sensor is in a fault state; and / or,

[0169] A second monitoring module 202 is configured to monitor the controller in the steering system based on a preset controller safety mechanism to determine that the controller is in a fault state; and / or,

[0170] The third monitoring module 203 is used to monitor the actuator in the steering system based on a preset actuator safety mechanism to determine whether the actuator is in a fault state, wherein the fault state is that the sensor, the controller or the actuator has a steering assist fault;

[0171] The fault processing module 204 is used to control the target vehicle to enter a safe state based on a preset sensor safety mechanism and / or controller safety mechanism and / or actuator safety mechanism.

[0172] Optionally, the first monitoring module includes:

[0173] A first monitoring submodule, used for collecting a motor position signal corresponding to the motor position sensor, performing vector length monitoring on the motor position signal, and performing common mode monitoring on the motor position sensor;

[0174] A second monitoring submodule, for determining that the motor position sensor is in a fault state and performing a rationality check on the motor position signal when it is detected that the vector length corresponding to the motor position signal is outside the first preset range and / or the common mode monitoring is outside the second preset range;

[0175] The third monitoring submodule is used to determine that the motor position sensor is in a fault state when it is detected that the sum of the first half-bridge signal and the second half-bridge signal in the motor position signal is outside a third preset range.

[0176] Optionally, the first monitoring module includes:

[0177] a fourth monitoring submodule, configured to collect a torque angle signal corresponding to the torque angle sensor, perform a protocol check on the torque angle signal, and perform a range check on the torque angle signal;

[0178] a fifth monitoring submodule, for determining that the torque angle sensor is in a fault state and performing a rationality check on the torque angle signal when it is detected that the torque angle signal fails the protocol check and / or the torque angle signal is outside the fourth preset range;

[0179] The sixth monitoring submodule is used to determine that the torque angle sensor is in a fault state when it is detected that the ratio between the torque signal difference and the angle signal difference in the torque angle signal is outside the fifth preset range.

[0180] Optionally, the first monitoring module includes:

[0181] a seventh monitoring submodule, configured to collect a current signal corresponding to the current sensor, perform validity check on the current signal, and perform overcurrent detection on the current signal;

[0182] an eighth monitoring submodule, configured to determine that the current sensor is in a fault state and perform a rationality check on the current signal when it is detected that the current signal is outside the sixth preset range and / or the absolute value of the current signal is outside the seventh preset range;

[0183] The ninth monitoring submodule is used to determine that the current sensor is in a fault state when it is detected that the sum of the first current signal, the second current signal and the third current signal in the motor position signal is outside the eighth preset range.

[0184] Optionally, the second monitoring module includes:

[0185] a tenth monitoring submodule, configured to determine that a target fault exists in a main control chip in the controller and that the main control chip in the controller is in a fault state when it is detected that the first output of the main processor and the second output of the check processor are different and the number of faults of the controller is greater than a first preset value; wherein the main processor and the check processor are in a lock-step core, and the lock-step core is used to monitor the fault of the controller; or

[0186] an eleventh monitoring submodule, configured to determine that a main control chip in the controller is in a fault state when a storage fault is detected in the controller; or

[0187] A twelfth monitoring submodule is used to determine that the main control chip in the controller is in a fault state when it is detected that the number of failures corresponding to the fault injection test of the main control chip in the controller in at least one key cycle is greater than the first preset value.

[0188] Optionally, the third monitoring module includes:

[0189] A thirteenth monitoring submodule is used to collect the chip power supply voltage and charge pump voltage corresponding to the motor pre-drive chip;

[0190] A fourteenth monitoring submodule is configured to determine that the motor pre-drive chip is in a fault state when it is detected that the chip power supply voltage is not in the ninth preset range and / or the charge pump voltage is not in the tenth preset range; or

[0191] A fifteenth monitoring submodule is used to determine that the motor pre-drive chip is in a fault state when it is detected that the digital phase feedback signal and the pulse width modulation input mode are in a mismatch state; or

[0192] A sixteenth monitoring submodule is used to determine that the motor pre-drive chip is in a fault state when any of the synchronous serial communication frame number, synchronous serial communication timeout, synchronous serial communication cyclic redundancy check error and invalid address access monitoring is detected to be in a fault state; or,

[0193] The seventeenth monitoring submodule is used to determine that the motor pre-drive chip is in a fault state when it is detected that the corresponding self-test state of the steering system during the power-on process is a self-test failure.

[0194] Optionally, the fault processing module includes:

[0195] The fault processing submodule is used to control the steering system of the target vehicle to switch to a redundant backup system.

[0196] In summary, the embodiment of the present application provides a steering system fault handling device, which monitors the sensor in the steering system based on a preset sensor safety mechanism to determine whether the sensor is in a fault state; and / or, monitors the controller in the steering system based on a preset controller safety mechanism to determine whether the controller is in a fault state; and / or, monitors the actuator in the steering system based on a preset actuator safety mechanism to determine whether the actuator is in a fault state, wherein the fault state is that the sensor or the controller or the actuator has a steering assist fault; and controls the target vehicle to enter a safe state based on the preset sensor safety mechanism and / or controller safety mechanism and / or actuator safety mechanism. That is, in the embodiment of the present application, by analyzing the steering system architecture, the hardware components that will violate the safety goals, namely, sensors, controllers and actuators, are found, and safety mechanisms are designed for them to monitor the steering system, that is, the present application realizes automatic fault handling and improves driving safety by monitoring faults and designing a response mechanism after the fault occurs.

[0197] Figure 3 This is a structural diagram of an electronic device M00 provided in an embodiment of the present application. In the figure, the electronic device M00 includes a processor M01 and a memory M02. The electronic device includes: a processor; a memory for storing instructions executable by the processor, wherein the processor is configured to execute the instructions to implement any of the steering system fault handling methods described above, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0198] In an embodiment of the present application, the memory M02 can be used to store software programs and various data. The memory M02 may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory M02 may include a volatile memory or a non-volatile memory, or the memory x09 may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), a synchronous dynamic random access memory (SDRAM), a double data rate synchronous dynamic random access memory (DDRSDRAM), an enhanced synchronous dynamic random access memory (ESDRAM), a synchronous link dynamic random access memory (SLDRAM) and a direct memory bus random access memory (DRRAM). The memory M02 in the embodiment of the present application includes but is not limited to these and any other suitable types of memories.

[0199] The processor M01 may include one or more processing units; optionally, the processor M01 integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor M01.

[0200] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, each process of the above-mentioned steering system fault handling method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0201] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0202] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned steering system fault handling method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0203] It should be understood that the chip involved in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0204] An embodiment of the present application further provides a storage medium. When instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute any of the steering system fault handling methods described above.

[0205] An embodiment of the present application provides a computer program product, which is stored in a storage medium. The program product is executed by at least one processor to implement the various processes of the steering system fault handling method embodiment as described above, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0206] An embodiment of the present application also provides a vehicle, which includes the steering system fault handling device as described above.

[0207] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0208] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the relevant technology, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0209] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A method for handling steering system faults, characterized in that: The method comprises: Monitoring the sensors in the steering system based on a pre-set sensor safety mechanism to determine whether the sensors are in a fault state; and / or, Monitoring the controller in the steering system based on a preset controller safety mechanism to determine that the controller is in a fault state; and / or, Monitoring the actuator in the steering system based on a preset actuator safety mechanism to determine that the actuator is in a fault state, wherein the fault state is that the sensor, the controller, or the actuator has a steering assist fault; The target vehicle is controlled to enter a safe state based on a preset sensor safety mechanism and / or a controller safety mechanism and / or an actuator safety mechanism.

2. The method according to claim 1, characterized in that The sensor includes a motor position sensor; the monitoring of the sensor in the steering system based on a preset sensor safety mechanism to determine whether the sensor is in a fault state includes: Acquiring a motor position signal corresponding to the motor position sensor, and performing vector length monitoring on the motor position signal, and performing common mode monitoring on the motor position sensor; When it is detected that the vector length corresponding to the motor position signal is outside the first preset range, and / or the common mode monitoring is outside the second preset range, it is determined that the motor position sensor is in a fault state, and a rationality check is performed on the motor position signal; When it is detected that the sum of the first half-bridge signal and the second half-bridge signal in the motor position signal is outside the third preset range, it is determined that the motor position sensor is in a fault state.

3. The method according to claim 1, characterized in that The sensor includes a torque angle sensor; the monitoring of the controller in the steering system based on a preset controller safety mechanism and determining that the controller is in a fault state includes: Collecting a torque angle signal corresponding to the torque angle sensor, performing a protocol check on the torque angle signal, and performing a range check on the torque angle signal; When it is detected that the torque angle signal fails the protocol check and / or the torque angle signal is outside the fourth preset range, determining that the torque angle sensor is in a fault state and performing a rationality check on the torque angle signal; When it is detected that the ratio between the torque signal difference and the angle signal difference in the torque angle signal is outside the fifth preset range, it is determined that the torque angle sensor is in a fault state.

4. The method according to claim 1, characterized in that: The sensor includes a current sensor; and the monitoring of the sensor in the steering system based on a preset sensor safety mechanism to determine whether the sensor is in a fault state includes: Collecting a current signal corresponding to the current sensor, performing a validity check on the current signal, and performing an overcurrent detection on the current signal; When it is detected that the current signal is outside the sixth preset range and / or the absolute value of the current signal is outside the seventh preset range, it is determined that the current sensor is in a fault state, and a rationality check is performed on the current signal; When it is detected that the sum of the first current signal, the second current signal and the third current signal in the motor position signal is outside the eighth preset range, it is determined that the current sensor is in a fault state.

5. The method according to claim 1, characterized in that The monitoring of the controller in the steering system based on a preset controller safety mechanism to determine whether the controller has a target fault includes: When it is detected that the first output of the main processor and the second output of the check processor are different, and the number of failures of the controller is greater than a first preset value, it is determined that a target failure exists in the main control chip in the controller, and it is determined that the main control chip in the controller is in a failure state; wherein the main processor and the check processor are in a lock-step core, and the lock-step core is used to monitor the failure of the controller; or, In the case where a storage fault is detected in the controller, determining that a main control chip in the controller is in a fault state; or, When it is detected that the number of failures corresponding to the fault injection test of the main control chip in the controller in at least one key cycle is greater than the first preset value, it is determined that the main control chip in the controller is in a fault state.

6. The method according to claim 1, characterized in that The actuator includes a motor pre-drive chip, and the actuator in the steering system is monitored based on a preset actuator safety mechanism to determine that the actuator is in a fault state, including: Collecting the chip power supply voltage and charge pump voltage corresponding to the motor pre-drive chip; When it is detected that the chip power supply voltage is not in the ninth preset range, and / or the charge pump voltage is not in the tenth preset range, it is determined that the motor pre-drive chip is in a fault state; or, In the case where it is detected that the digital phase feedback signal and the pulse width modulation input mode are in a mismatch state, it is determined that the motor pre-drive chip is in a fault state; or, In the case where any of the synchronous serial communication frame number, synchronous serial communication timeout, synchronous serial communication cyclic redundancy check error and invalid address access monitoring is detected to be in a fault state, determining that the motor pre-drive chip is in a fault state; or, When it is detected that the corresponding self-test state of the steering system during the power-on process is self-test failure, it is determined that the motor pre-drive chip is in a fault state.

7. The method according to claim 6, characterized in that The actuator also includes a full-bridge module, and the motor pre-driver chip is used to convert the target motor torque command into a target motor current and a gate sequence signal command, and diagnose a full-bridge fault corresponding to the full-bridge module.

8. The method according to claim 1, characterized in that The controlling the target vehicle to enter a safe state based on a preset sensor safety mechanism and / or controller safety mechanism and / or actuator safety mechanism comprises: The steering system of the target vehicle is controlled to switch to a redundant backup system.

9. A steering system fault handling device, characterized in that: The device comprises: A first monitoring module is configured to monitor a sensor in the steering system based on a preset sensor safety mechanism to determine whether the sensor is in a fault state; and / or, A second monitoring module is configured to monitor the controller in the steering system based on a preset controller safety mechanism to determine that the controller is in a fault state; and / or, a third monitoring module, configured to monitor the actuator in the steering system based on a preset actuator safety mechanism, and determine that the actuator is in a fault state, wherein the fault state is that the sensor, the controller, or the actuator has a steering assist fault; The fault processing module is used to control the target vehicle to enter a safe state based on a preset sensor safety mechanism and / or controller safety mechanism and / or actuator safety mechanism.

10. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; Wherein, the processor is configured to execute the instructions to implement the steering system fault processing method as described in any one of claims 1 to 8.

Images