Multilayer redundancy interaction system and method

Abstract

The invention discloses a multi-layer redundancy interaction system and method, and relates to the technical field of automobiles, and the system comprises an actuator, a controller and a channel. The actuators comprise a main actuator and an auxiliary actuator, the controllers comprise a main controller and an auxiliary controller, and the channels comprise a main channel and an auxiliary channel; the controller is used for sending a control signal to the actuator through the main controller when the main controller is normal; when the main controller breaks down, a control signal is sent to the actuator through the auxiliary controller; the channel is used for sending a control signal of the controller to the actuator through the auxiliary channel when the main channel breaks down; when the auxiliary channel breaks down, a control signal of the controller is sent to the actuator through the main channel; the actuator is used for receiving a control signal through the main actuator when the main actuator is normal; when the main actuator breaks down, a control signal is received through the auxiliary actuator. And the reliability of the system is improved.

Description

Technical Field

[0001] The present application relates to the field of vehicle control technology, and in particular to a multi-layer redundant interaction system and method. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] With the development of automobile intelligence, the number of on-board domain controllers is gradually increasing, and the communication network topology in the domain controllers has become very complex. The intelligent driving level of vehicles includes multiple levels. For high-level intelligent driving, it is achieved through communication connections between domain controllers, where each domain controller is connected through communication lines.

[0004] Currently, in order to ensure the reliable operation of intelligent driving, it is mainly achieved by setting up a backup controller for a single domain controller.

[0005] However, the current method of ensuring the reliable operation of vehicle intelligent driving is only effective for the single-point failure mode of a single controller. Once multiple-point failures of the controller and communication lines occur, it cannot be taken into account, resulting in limited system reliability. Summary of the invention

[0006] In view of this, the present application proposes a multi-layer redundant interaction system and method, which can ensure that the system can still work normally in the event of multiple points of failure, thereby increasing the reliability of the system.

[0007] The embodiment of the present application provides a multi-layer redundant interactive system, including an actuator, a controller and a channel; the actuator includes a main actuator and a secondary actuator, the controller includes a main controller and a secondary controller, and the channel includes a main channel and a secondary channel;

[0008] A controller, used to send a control signal to the actuator through the main controller when the main controller is normal; and to send a control signal to the actuator through the sub-controller when the main controller fails;

[0009] Channel, used to send the control signal of the controller to the actuator through the secondary channel when the main channel fails; when the secondary channel fails, send the control signal of the controller to the actuator through the main channel;

[0010] The actuator is used to receive the control signal through the main actuator when the main actuator is normal; when the main actuator fails, the actuator receives the control signal through the auxiliary actuator.

[0011] In one implementation of the embodiment of the present application, the main actuator includes a first actuator and a second actuator;

[0012] A main actuator failure means that both the first actuator and the second actuator fail.

[0013] In one implementation of the embodiment of the present application, the main actuator is used to receive control signals from both the first actuator and the second actuator when both are normal; receive control signals through the second actuator when the first actuator fails; and receive control signals through the first actuator when the second actuator fails.

[0014] In one implementation of the embodiment of the present application, the second actuator is used to monitor the state of the first actuator; when the first actuator fails, a first actuator fault signal is sent to the controller;

[0015] The first actuator is used to monitor the state of the second actuator; when the second actuator fails, a second actuator failure signal is sent to the controller.

[0016] In one implementation of the embodiment of the present application, the controller is used to receive a fault signal through the main controller when the main controller is normal; when the main controller fails, the controller receives the fault signal through the sub-controller; after receiving the fault signal, it determines that the corresponding component is faulty.

[0017] In one implementation of the embodiment of the present application, the first actuator sends a fault signal to the controller through the main channel;

[0018] The second actuator sends a fault signal to the controller through the secondary channel.

[0019] In one implementation of the embodiment of the present application, the actuator is also used to send a fault signal to the controller through the first actuator when the main channel is normal; when the main channel fails, the fault signal is sent to the controller through the second actuator.

[0020] In one implementation of the embodiment of the present application, the channel is also used to send the control signal of the main controller to the first actuator and the second actuator through the main channel and the sub-channel respectively when the main channel, the sub-channel, the first actuator, the second actuator and the main controller are all normal.

[0021] In one implementation of the embodiment of the present application, the actuator is further used to monitor the status of the main channel, the secondary channel, the main controller and the secondary controller; when the main channel fails, a main channel fault signal is sent to the controller; when the secondary channel fails, a secondary channel fault signal is sent to the controller; when the main controller fails, a main controller fault signal is sent to the controller; when the secondary controller fails, a main controller fault signal is sent to the controller;

[0022] The controller is used to determine that a component is faulty when a fault signal of the corresponding component is received.

[0023] The embodiment of the present application also provides a multi-layer redundant interaction method, including:

[0024] When the main controller is normal, the control signal is sent to the actuator through the main controller; when the main controller fails, the control signal is sent to the actuator through the sub-controller;

[0025] When the main channel fails, the control signal of the controller is sent to the actuator through the secondary channel; when the secondary channel fails, the control signal of the controller is sent to the actuator through the main channel;

[0026] When the main actuator is normal, the control signal is received through the main actuator; when the main actuator fails, the control signal is received through the auxiliary actuator.

[0027] The beneficial effects of the technical solution provided by the embodiments of the present application include at least:

[0028] An embodiment of the present application provides a multi-layer redundant interaction system and method, in which the actuators in the system include a main actuator and a sub-actuator, the controller includes a main controller and a sub-controller, and the channel includes a main channel and a sub-channel; when the main actuator fails, the control signal is received through the sub-actuator; when the main controller fails, the control signal is sent to the actuator through the sub-controller; when the main channel fails, the control signal is sent to the actuator through the sub-channel, thereby ensuring that the intelligent driving system can still work normally in the case of multiple point failures, thereby increasing the reliability of intelligent driving. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0030] Figure 1 The present invention is a schematic diagram of the structure of a multi-layer redundant interactive system disclosed in an embodiment. DETAILED DESCRIPTION

[0031] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application. In order to make the technical solutions and advantages of the present application clearer, the vehicle network communication system, system, system, etc. will be described in detail below in conjunction with the drawings.

[0032] The vehicle intelligent driving level is divided according to the different levels of vehicle intelligence and automation. At present, the main autonomous driving classification standard is issued by SAE International (Society of Automotive Engineers), which divides the intelligent driving level into six levels from L0 to L5, as follows:

[0033] (1) Level 0 (no automation)

[0034] Features: The vehicle is completely controlled by the driver. The accelerator, brake, steering wheel, etc. are all manually operated by the driver. The vehicle does not have any automated functions.

[0035] (2) Level 1 (driving support / partial driving assistance)

[0036] Features: The driver is still the main operator, but the system will provide assistance under appropriate circumstances, such as ESP electronic body stability system, ABS anti-lock braking system, adaptive cruise control or lane keeping assist, mainly to improve driving safety.

[0037] (3) Level 2 (partial autonomous driving / combined driving assistance)

[0038] Features: The vehicle is able to complete certain driving tasks, such as adaptive cruise control, lane keeping, automatic emergency braking (AEB), automatic parking (APS) and lane keeping assist (LKA), but the driver still needs to maintain control and attention of the vehicle so that he can take over the vehicle at any time.

[0039] (4) Level 3 (conditional automation)

[0040] Features: Under certain conditions, the vehicle can be fully autonomous, and the driver can divert his attention from driving at this time, but the system requires the driver to be able to take over the vehicle in an emergency. This level of autonomous driving requires the on-board computer to judge the road conditions through radar, cameras and other equipment.

[0041] (5) Level 4 (highly automated)

[0042] Features: After starting the automatic driving, the vehicle can drive autonomously in most cases without driver intervention. However, the start and end of the system may require certain conditions to be met, such as weather conditions, road conditions, etc. Users can enter a relaxed state.

[0043] (6) Level 5 (fully automated / unmanned driving)

[0044] Features: The vehicle is completely controlled by the onboard computer, without the need for driver involvement. This level of autonomous driving will not have steering wheels, accelerators, brakes or other driving mechanisms, and humans will become passengers.

[0045] In summary, the vehicle intelligent driving level from L0 to L5 represents different degrees of automation and technical levels. With the continuous development of technology and the improvement of regulations, higher levels of autonomous driving will gradually become popular, bringing people a more convenient and safer travel experience.

[0046] With the development of intelligent vehicles, the number of on-board domain controllers is gradually increasing, and the communication network topology in the domain controllers has become very complex. Autonomous driving vehicles are gradually being improved, and in order to verify the reliability of communication between domain controllers and fault analysis, communication tests on on-board devices are required. Physically cutting off the connection between domain controllers and connecting the control boards in series, and then collecting vehicle data and analyzing communication faults, makes communication tests between numerous electronic control units relatively cumbersome.

[0047] In the case of vehicle autonomous driving, the reliability of redundant parts becomes a top priority. In order to solve the problem that when the upper controller, lower actuator and transmission line of the vehicle fail at any multiple points, the remaining parts can still complete the response function well, the embodiment of the present application proposes a multi-layer redundant interaction system, such as Figure 1 As shown, Figure 1 Actuator 1 is the main actuator and actuator 2 is the slave actuator.

[0048] A multi-layer redundant interactive system proposed in this embodiment includes an actuator, a controller and a channel; the actuator includes a main actuator and a secondary actuator, the controller includes a main controller and a secondary controller, and the channel includes a main channel and a secondary channel;

[0049] A controller, used to send a control signal to the actuator through the main controller when the main controller is normal; and to send a control signal to the actuator through the sub-controller when the main controller fails;

[0050] Channel, used to send the control signal of the controller to the actuator through the secondary channel when the main channel fails; when the secondary channel fails, send the control signal of the controller to the actuator through the main channel;

[0051] The actuator is used to receive the control signal through the main actuator when the main actuator is normal; when the main actuator fails, the actuator receives the control signal through the auxiliary actuator.

[0052] The secondary actuator in the embodiment of the present application is used as a backup of the main actuator. The main channel is the communication channel under normal circumstances, and the secondary channel is used as a backup.

[0053] The main actuator includes a first actuator and a second actuator; both the first actuator and the second actuator can ensure that they can independently complete the actions required by the controller;

[0054] A main actuator failure means that both the first actuator and the second actuator fail.

[0055] In the embodiment of the present application, the channel is also used to send the control signal of the main controller to the first actuator and the second actuator through the main channel and the sub-channel respectively when the main channel, the sub-channel, the first actuator, the second actuator and the main controller are all normal.

[0056] In the embodiment of the present application, the main actuator is used for receiving control signals through the first actuator and the second actuator when both the first actuator and the second actuator are normal; receiving control signals through the second actuator when the first actuator fails; and receiving control signals through the first actuator when the second actuator fails.

[0057] In the embodiment of the present application, the second actuator is used to monitor the state of the first actuator; when the first actuator fails, a first actuator fault signal is sent to the controller;

[0058] The first actuator is used to monitor the state of the second actuator; when the second actuator fails, a second actuator failure signal is sent to the controller.

[0059] In an embodiment of the present application, the controller is used to receive a fault signal through the main controller when the main controller is normal; when the main controller fails, the controller receives the fault signal through the sub-controller; after receiving the fault signal, it determines that the corresponding component is faulty.

[0060] In the embodiment of the present application, the first actuator sends a fault signal to the controller through the main channel;

[0061] The second actuator sends a fault signal to the controller through the secondary channel.

[0062] In the embodiment of the present application, the actuator is also used to send a fault signal to the controller through the first actuator when the main channel is normal; when the main channel fails, the fault signal is sent to the controller through the second actuator.

[0063] In the embodiment of the present application, the actuator is also used to monitor the status of the main channel, the secondary channel, the main controller and the secondary controller; when the main channel fails, a main channel fault signal is sent to the controller; when the secondary channel fails, a secondary channel fault signal is sent to the controller; when the main controller fails, a main controller fault signal is sent to the controller; when the secondary controller fails, a main controller fault signal is sent to the controller;

[0064] The controller is used to determine that a component is faulty when a fault signal of the corresponding component is received.

[0065] The working process of a multi-layer redundant interactive system disclosed in an embodiment of the present application is described in detail.

[0066] The embodiment of the present application discloses a multi-layer redundant interactive system. Under normal circumstances, the main controller sends control signals to the main channel and the secondary channel at the same time; at the same time, the first actuator and the second actuator in the main actuator receive signals from the main channel and the secondary channel at the same time; and after arbitration, the corresponding models are sent to the main channel and the secondary channel. The main actuator will arbitrate the signals received by the first actuator and the second actuator and the content to be executed before execution. Among them, the first actuator only sends signals to the main channel, and the second actuator only sends signals to the secondary channel.

[0067] When the main controller fails, the actuator monitors the main controller fault, sends the main control fault signal to the sub-controller through the main channel, and at the same time gives the control authority to the sub-controller. After receiving the main controller fault signal, the sub-controller sends the control signal to the main actuator through the main channel.

[0068] When the sub-controller fails, the actuator monitors the sub-controller failure and sends the fault signal of the sub-controller to the main controller, and the main controller changes its control strategy according to the signal.

[0069] When the first actuator in the main actuator fails, the second actuator can monitor the failure of the first actuator and send the first actuator failure signal to the main controller through the secondary channel. At the same time, the main controller sends a control signal to the second actuator through the secondary channel, and the second actuator completes the command of the main controller alone.

[0070] When the second actuator in the main actuator fails, the first actuator can monitor the second actuator failure and send the second actuator failure signal to the main controller through the main channel. At the same time, the main controller sends a control signal to the first actuator through the main channel. At this time, the first actuator alone completes the command of the main controller.

[0071] When the main actuator fails completely, the main controller monitors the main actuator failure, sends the main actuator failure signal to the slave actuator, and completes the control through the slave actuator.

[0072] When the sub-actuator fails, the main controller monitors the sub-actuator failure, changes its own control strategy according to the sub-actuator failure, and controls the intelligent driving degradation.

[0073] When the main channel fails and cannot transmit signals, the actuator transmits the fault signal from the secondary channel to the main controller. The main controller controls the main actuator through the secondary channel. The first actuator and the second actuator receive the control signal of the main controller from the secondary channel, and after arbitration, the second actuator sends it to the secondary channel and transmits it to the main controller.

[0074] When a fault occurs in the secondary channel and the signal cannot be transmitted, the actuator transmits the fault signal from the main channel to the main controller. The main controller controls the main actuator through the main channel. The first actuator and the second actuator receive the control signal of the main controller from the main channel, and after arbitration, the first actuator sends it to the main channel and transmits it to the main controller.

[0075] When the main controller and the main actuator fail at the same time, the control signal is sent to the secondary actuator through the secondary controller, and the secondary actuator completes the command;

[0076] When both the main controller and the slave actuator fail at the same time, the slave controller sends a control signal to the main actuator, and the main actuator completes the command.

[0077] When the sub-controller and the main actuator fail at the same time, the main controller sends a control signal to the sub-actuator, and the main controller controls the sub-actuator to complete the command;

[0078] When the sub-controller and the sub-actuator fail at the same time, a control signal is sent to the main actuator through the main controller, and the main controller controls the main actuator to complete the command.

[0079] When the main controller and the secondary channel fail at the same time, the secondary controller sends a control signal to the main actuator through the main channel, and the secondary controller controls the main actuator to complete the command.

[0080] When the secondary controller and the main channel fail at the same time, the main controller sends a control signal to the main actuator through the secondary channel, and the main controller controls the main actuator to complete the command.

[0081] When the main channel and the main actuator fail at the same time, the main controller sends a control signal to the secondary actuator through the secondary channel, and the main controller controls the secondary actuator to complete the command;

[0082] When the main channel and the secondary actuator fail at the same time, the main controller sends a control signal to the main actuator through the secondary channel, and the main controller controls the actuator through the secondary channel to complete the command.

[0083] When the secondary channel and the main actuator fail at the same time, the main controller sends a control signal to the secondary actuator through the main channel, and the main controller controls the secondary actuator through the main channel to complete the command;

[0084] When the secondary channel and the secondary actuator fail at the same time, the main controller sends a control signal to the main actuator through the main channel, and the main controller controls the main actuator through the main channel to complete the command.

[0085] When the main controller, the secondary channel and the main actuator fail at the same time, the secondary controller sends a control signal to the secondary actuator through the main channel, and the secondary controller controls the secondary actuator through the secondary channel to complete the command;

[0086] When the main controller, the secondary channel and the secondary actuator fail at the same time, the secondary controller sends a control signal to the main actuator through the main channel, and the secondary controller controls the main actuator through the secondary channel to complete the command.

[0087] In addition, when the sub-actuator or sub-controller fails, the vehicle's intelligent driving is degraded.

[0088] Among them, the main controller may be an ADAS domain controller, and the actuator may be a chassis domain controller; the ADAS domain controller communicates with the chassis domain controller via a channel.

[0089] The ADAS domain controller is used to obtain the spatial environment, road conditions, and traffic information of the vehicle, and make decisions based on the perception and positioning information to obtain the vehicle's expected running trajectory, driving process, and dynamic state, and transmit the vehicle's acceleration request, front wheel angle request, engine / motor output torque request, and active / semi-active suspension control request to the chassis domain controller;

[0090] The chassis domain controller is used to receive acceleration requests, front wheel angle requests, engine / motor output torque requests, and active / semi-active suspension control requests sent by the ADAS domain controller via the channel. According to the current driving condition of the vehicle and the current availability of each chassis actuator, the chassis domain controller transmits control instructions to the drive, brake, steering and suspension actuator systems to achieve coordinated actuation of each chassis subsystem. At the same time, after centrally acquiring the real-time dynamic state of the vehicle and the time-varying limitation characteristics of the chassis actuator, the real-time dynamic state of the vehicle and the time-varying limitation characteristics of the chassis actuator are sent to the ADAS domain controller via the channel to enable the ADAS domain controller to reasonably perceive and make decisions.

[0091] Taking the main controller as an ADAS domain controller and the actuator as a chassis domain controller as an example, a multi-layer redundant interactive system provided in an embodiment of the present application is described in detail.

[0092] The embodiment of the present application sets up two ADAS domain controllers, two communication channels and three chassis domain controllers, wherein one ADAS domain controller serves as a main controller and the other ADAS domain controller serves as a sub-controller, wherein one chassis domain controller serves as a first actuator, one chassis domain controller serves as a second actuator and one chassis domain controller serves as a sub-actuator; the first actuator and the second actuator serve as main actuators; one communication channel serves as a main channel and the other communication channel serves as a sub-channel.

[0093] When the ADAS domain controller is unable to perceive the spatial environment, road conditions or traffic information of the vehicle, or is unable to obtain the vehicle's expected running trajectory, driving process or dynamic state, or is unable to issue various requests, it determines that an ADAS fault exists and sends a fault signal to the first actuator and the second actuator.

[0094] When the chassis domain controller is unable to transmit control instructions to the drive, braking, steering and suspension execution systems based on the current driving conditions of the vehicle and the current availability of each chassis actuator, or is unable to send the vehicle's real-time dynamic status and the time-varying limitation characteristics of the chassis actuator to the ADAS domain controller, the chassis domain controller is determined to be faulty.

[0095] When the ADAS domain controller serving as the main controller fails, a request is sent to the chassis domain controller through the ADAS domain controller serving as the secondary controller; when the chassis domain controller serving as the first actuator fails, the request sent by the ADAS domain controller is executed through the chassis domain controller serving as the second actuator; when the chassis domain controller serving as the second actuator fails, the request sent by the ADAS domain controller is executed through the chassis domain controller serving as the first actuator; when both the first actuator and the second actuator fail, the request sent by the ADAS domain controller is executed through the chassis domain controller serving as the secondary actuator; and when the ADAS domain controller serving as the secondary controller fails or the chassis domain controller serving as the secondary actuator fails, the vehicle's intelligent driving is controlled to be downgraded, such as from intelligent driving level L3 to level L2 or L1.

[0096] An embodiment of the present application provides a multi-layer redundant interactive system, wherein the actuators include a main actuator and a sub-actuator, the controllers include a main controller and a sub-controller, and the channels include a main channel and a sub-channel; when the main actuator fails, the control signal is received through the sub-actuator; when the main controller fails, the control signal is sent to the actuator through the sub-controller; when the main channel fails, the control signal is sent to the actuator through the sub-channel, thereby ensuring that the system can still work normally in the case of multiple point failures, increasing the reliability of the system, and solving the redundancy problem of multiple point failures in the system.

[0097] The embodiment of the present application also provides a multi-layer redundant interaction method, including:

[0098] When the main controller is normal, the control signal is sent to the actuator through the main controller; when the main controller fails, the control signal is sent to the actuator through the sub-controller;

[0099] When the main channel fails, the control signal of the controller is sent to the actuator through the secondary channel; when the secondary channel fails, the control signal of the controller is sent to the actuator through the main channel;

[0100] When the main actuator is normal, the control signal is received through the main actuator; when the main actuator fails, the control signal is received through the auxiliary actuator.

[0101] Regarding the method in the above embodiment, the specific manner in which each device performs the operation has been described in detail in the embodiment of the system, and will not be elaborated here.

[0102] It should be noted that the multi-layer redundant interaction method and the multi-layer redundant interaction system embodiment provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0103] In the present application, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance. The term "plurality" refers to two or more than two, unless otherwise clearly defined.

[0104] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with this embodiment can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0105] Although the above describes the specific implementation mode of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without creative work are still within the scope of protection of the present invention.

Claims

1. A multi-layer redundant interactive system, characterized in that: It includes an actuator, a controller and a channel; the actuator includes a main actuator and a sub-actuator, the controller includes a main controller and a sub-controller, and the channel includes a main channel and a sub-channel; A controller, used to send a control signal to the actuator through the main controller when the main controller is normal; and to send a control signal to the actuator through the sub-controller when the main controller fails; Channel, used to send the control signal of the controller to the actuator through the secondary channel when the main channel fails; when the secondary channel fails, send the control signal of the controller to the actuator through the main channel; The actuator is used to receive the control signal through the main actuator when the main actuator is normal; when the main actuator fails, the actuator receives the control signal through the auxiliary actuator.

2. A multi-layer redundant interactive system as claimed in claim 1, characterized in that: The main actuator includes a first actuator and a second actuator; A main actuator failure means that both the first actuator and the second actuator fail.

3. A multi-layer redundant interactive system as claimed in claim 2, characterized in that: The main actuator is used for receiving control signals through the first actuator and the second actuator when both the first actuator and the second actuator are normal; receiving control signals through the second actuator when the first actuator fails; and receiving control signals through the first actuator when the second actuator fails.

4. A multi-layer redundant interactive system as claimed in claim 2, characterized in that: The second actuator is used to monitor the state of the first actuator; when the first actuator fails, a first actuator failure signal is sent to the controller; The first actuator is used to monitor the state of the second actuator; when the second actuator fails, a second actuator failure signal is sent to the controller.

5. A multi-layer redundant interactive system as claimed in claim 2, characterized in that: The first actuator sends a fault signal to the controller through the main channel; The second actuator sends a fault signal to the controller through the secondary channel.

6. A multi-layer redundant interactive system as claimed in claim 2, characterized in that: The actuator is also used to send a fault signal to the controller through the first actuator when the main channel is normal; and send a fault signal to the controller through the second actuator when the main channel fails.

7. A multi-layer redundant interactive system as claimed in claim 2, characterized in that: The channel is also used to send the control signal of the main controller to the first actuator and the second actuator through the main channel and the sub-channel respectively when the main channel, the sub-channel, the first actuator, the second actuator and the main controller are all normal.

8. A multi-layer redundant interactive system as claimed in claim 1, characterized in that: The actuator is also used to monitor the status of the main channel, the sub-channel, the main controller and the sub-controller; when the main channel fails, a main channel fault signal is sent to the controller; when the sub-channel fails, a sub-channel fault signal is sent to the controller; when the main controller fails, a main controller fault signal is sent to the controller; when the sub-controller fails, a main controller fault signal is sent to the controller; The controller is used to determine that a component is faulty when a fault signal of the corresponding component is received.

9. A multi-layer redundant interactive system as claimed in claim 1, characterized in that: The controller is used to receive a fault signal through the main controller when the main controller is normal; receive a fault signal through the sub-controller when the main controller fails; and determine that the corresponding component is faulty after receiving the fault signal.

10. A multi-layer redundant interaction method, characterized in that: include: When the main controller is normal, a control signal is sent to the actuator through the main controller; When the main controller fails, the control signal is sent to the actuator through the sub-controller; When the main channel fails, the control signal of the controller is sent to the actuator through the secondary channel; when the secondary channel fails, the control signal of the controller is sent to the actuator through the main channel; When the main actuator is normal, the control signal is received through the main actuator; when the main actuator fails, the control signal is received through the auxiliary actuator.

Images