Vehicle control method, controller, vehicle and computer program product

Abstract

The invention relates to a vehicle control method, a controller, a vehicle and a computer program product, and relates to the technical field of vehicle control, a control signal of a first controller of the vehicle to the vehicle is monitored, whether control of the first controller to the vehicle is abnormal or not is judged according to the control signal, and when it is judged that the control of the first controller to the vehicle is abnormal, the vehicle is controlled. And starting a redundancy control mode of the vehicle, and switching at least one function of the vehicle controlled by the first controller to be controlled by a second controller of the vehicle. According to the method and the device, the controller can still normally control the vehicle under the abnormal working condition, and the flexibility and the accuracy of vehicle control are improved.

Description

Technical Field

[0001] The present application relates to the field of vehicle control technology, and in particular to a vehicle control method, a controller, a vehicle, a computer-readable storage medium, and a computer program product. Background Art

[0002] Nowadays, most vehicles use a dual control unit controller architecture, where a controller contains a main control unit and a sub-control unit, and the two monitor each other's status. Under normal circumstances, the main control unit performs vehicle-related logical calculations and processing. When an abnormality occurs in the main control unit, the sub-control unit can take over the main control unit and control the most basic necessary functions of the vehicle to continue working.

[0003] However, the main control unit and the sub-control unit of the same controller often share many input and output ports. If these shared ports are abnormal, both the main and sub-control units will fail, and functional backup and control cannot be achieved. In addition, this control method performs redundant control within a single controller, making it difficult to use the computing resources of other controllers in the vehicle to perform a wider range of functional backup. Summary of the invention

[0004] An embodiment of the present application provides a vehicle control method, which enables the controller to maintain normal control of the vehicle under abnormal operating conditions and improves the flexibility and accuracy of vehicle control, so as to at least partially solve the above-mentioned technical problems.

[0005] In order to achieve the above object, according to a first aspect of the present application, a vehicle control method is provided, the method comprising:

[0006] Monitoring a control signal of a first controller of the vehicle to the vehicle;

[0007] determining, according to the control signal, whether the control of the vehicle by the first controller is abnormal;

[0008] When it is determined that the control of the vehicle by the first controller is abnormal, a redundant control mode of the vehicle is activated, and at least one function of the vehicle controlled by the first controller is switched to be controlled by the second controller of the vehicle.

[0009] Optionally, the control signal includes a bus signal sent by the first controller, and judging whether the control of the vehicle by the first controller is abnormal according to the control signal includes:

[0010] When a first receiving time length for receiving the bus signal is greater than a first preset time length, it is determined that the control of the vehicle by the first controller is abnormal.

[0011] Optionally, the control signal further includes a hard-line signal sent by the first controller, and the determining whether the control of the vehicle by the first controller is abnormal according to the control signal further includes:

[0012] When the first receiving duration is greater than a first preset duration, determining whether a second receiving duration for receiving the hard-line signal is greater than a second preset duration;

[0013] If the second receiving time is less than or equal to the second preset time, it is determined that the control of the vehicle by the first controller is in a first abnormal state;

[0014] If the second receiving time length is greater than the second preset time length, it is determined that the control of the vehicle by the first controller is in a second abnormal state.

[0015] Optionally, starting the redundant control mode of the vehicle to switch at least one function of the vehicle controlled by the first controller to be controlled by a second controller of the vehicle includes:

[0016] In response to the first abnormal state, activating a first redundant control mode of the vehicle to switch a first number of functions of the vehicle controlled by the first controller to be controlled by a second controller of the vehicle;

[0017] In response to the second abnormal state, starting a second redundant control mode of the vehicle to switch a second number of functions of the vehicle controlled by the first controller to be controlled by a second controller of the vehicle;

[0018] Wherein, the second number is greater than the first number.

[0019] Optionally, in the second redundant control mode of the vehicle, all functions of the vehicle controlled by the first controller are switched to be controlled by the second controller of the vehicle.

[0020] Optionally, the method further comprises:

[0021] configuring function priority parameters for functions of the vehicle;

[0022] In a first redundant control mode of the vehicle, at least one of the functions is selected to be switched to be controlled by a second controller of the vehicle according to priority parameters of the functions of the vehicle controlled by the first controller.

[0023] Optionally, the method further comprises:

[0024] receiving a first control signal output by the first controller when executing a preset control function on the vehicle;

[0025] Determine a second control signal predicted to be output by the second controller for the preset control function;

[0026] When the preset control function is switched to be controlled by the second controller, a third control signal output by the second controller for controlling the preset control function is determined according to a comparison result between the first control signal and the second control signal.

[0027] Optionally, the determining, according to a comparison result of the first control signal and the second control signal, a third control signal output by the second controller for controlling the preset control function includes:

[0028] When the difference between the first control signal and the second control signal is within a predetermined error range, outputting the second control signal as the third control signal;

[0029] When the difference between the first control signal and the second control signal is outside a predetermined error range, the second control signal and the first control signal last output before the first controller is switched are smoothed, and the smoothed control signal is output as the third control signal.

[0030] Optionally, after starting the redundant control mode of the vehicle, the method further includes:

[0031] Continuously detecting the state of the first controller;

[0032] When it is detected that the state of the first controller returns to normal, the redundant control mode is exited, and the function switched to be controlled by the second controller is restored to be controlled by the first controller.

[0033] According to a second aspect of the present application, a computer-readable storage medium is further provided, wherein program instructions are stored in the computer-readable storage medium, and when the program instructions are executed, the method described above is implemented.

[0034] According to a third aspect of the present application, a computer program product is also provided, wherein the computer program product comprises program instructions, and when the program instructions are executed by a processor, the method as described above is implemented.

[0035] According to a fourth aspect of the present application, a controller is also provided for executing the method as described above.

[0036] According to a fifth aspect of the present application, a vehicle is also provided, comprising the controller as described above, or executing the method as described above.

[0037] In the vehicle control method of the embodiment of the present application, by setting a first controller and a second controller, the redundant control mechanism of the dual control units of a single controller is extended to different controllers, thereby realizing a distributed control system in which multiple controllers of the entire vehicle work in coordination. When a controller fails, other controllers can take over its functions, thereby avoiding the problem in the traditional controller architecture where the main and auxiliary control units fail simultaneously due to an abnormality of a single controller, causing the vehicle control function to collapse. Thus, the present application can enable the controller to maintain normal control of the vehicle under abnormal conditions, and improve the flexibility and accuracy of vehicle control.

[0038] Other features and advantages of the present application will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application, and those skilled in the art can obtain other drawings based on these drawings without creative work.

[0040] In order to more completely understand the present application and its beneficial effects, the following description will be given in conjunction with the accompanying drawings, wherein the same figure numbers represent the same parts in the following description.

[0041] Figure 1 is a schematic diagram of interaction between a first controller and a second controller provided in an exemplary embodiment of the present application;

[0042] Figure 2 is a flow chart of a vehicle control method provided in an exemplary embodiment of the present application;

[0043] Figure 3 is a schematic diagram of determining a redundant control mode provided in an exemplary embodiment of the present application;

[0044] Figure 4 is a schematic diagram of determining the type of the control signal output by the second controller provided in an exemplary embodiment of the present application;

[0045] Figure 5 is a schematic diagram of determining a switching timing between a first controller and a second controller provided in an exemplary embodiment of the present application;

[0046] Figure 6 is a block diagram of a controller provided in an exemplary embodiment of the present application;

[0047] Figure 7 is a block diagram of a vehicle provided in an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0048] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0049] In the vehicle controller architecture using dual control units, one controller contains a main control unit and a sub-control unit, and the two monitor each other's status through a certain communication mechanism. Under normal circumstances, the main control unit is responsible for the core logic calculation and processing related to the vehicle, such as power output control, steering control and braking control, while the sub-control unit is in a monitoring state. When an abnormality or failure is detected in the main control unit, the sub-control unit can automatically take over some functions of the main control unit to ensure that the most basic necessary functions of the vehicle can continue to operate, thereby improving the reliability and safety of the system. This architecture realizes redundant control within the vehicle to a certain extent, preventing the risks caused by single point failures. However, the redundant function of this control mode is limited to basic vehicle control functions, and its ability to respond to complex driving scenarios or emergencies is relatively limited.

[0050] Specifically, the main control unit and the sub-control unit of the same controller often share many input and output ports, including sensor interfaces, power interfaces, and control interfaces of actuators. If these shared ports are abnormal or fail, both the main control unit and the sub-control unit will fail at the same time, resulting in the inability to achieve functional backup between controllers, and the key control functions of the vehicle may be completely interrupted. In addition, the redundancy mechanism of this control method is limited to the internal structure of a single controller, and fails to fully utilize the resources of other controllers or computing units in the vehicle for a wider range of redundancy and functional backup. This means that in a multi-controller system, the controllers lack the necessary ability to collaborate and share computing resources, and cannot effectively respond to sudden failures and complex working conditions throughout the vehicle. The current control architecture fails to fully tap and utilize the potential of distributed control units in the vehicle, limits the overall redundancy and fault recovery capabilities of the system, and has poor control effects on vehicles in high-demand scenarios such as intelligent driving and autonomous driving.

[0051] Based on the above problems, the present application provides a vehicle control method, by setting a first controller and a second controller of a master-slave mechanism in the vehicle, such as Figure 1As shown, the first controller and the second controller can monitor each other's control signals, and can also switch to the other party to control the vehicle when one party is abnormal, thereby extending the redundant control mechanism of a single controller and dual control units to different controllers, and realizing a distributed control system in which multiple controllers of the entire vehicle work together. When a controller fails, other controllers can take over its functions, avoiding the problem in the traditional controller architecture that the main and secondary control units fail at the same time due to a single controller abnormality, causing the vehicle control function to collapse. Therefore, the present application can achieve that the controller still maintains normal control of the vehicle under abnormal conditions, and improves the flexibility and accuracy of vehicle control.

[0052] The present application is described below in conjunction with specific embodiments.

[0053] Figure 2 is a schematic diagram of a vehicle control method provided in an embodiment of the present application, such as Figure 2 As shown, the method may include the following steps S201-S203, which are specifically as follows:

[0054] Step S201: monitoring a control signal of a first controller of the vehicle to the vehicle.

[0055] As an example, the first controller can be understood as the main controller of the vehicle, which is responsible for the core control functions of the vehicle, including the control of key systems such as power output, steering, and braking of the vehicle. The first controller collects sensor data of the vehicle (such as vehicle speed, steering angle, acceleration, etc.) and performs logical calculations to execute the preset control strategy to achieve the normal operation of the vehicle. Correspondingly, the second controller can be used as a slave controller of the vehicle to monitor the working status and control signals of the first controller in real time, obtain the control signals, operating parameters and internal state information of the first controller through the communication network shared with the first controller, and determine whether the first controller is working normally. Although the second controller is in a monitoring state under normal circumstances, it has independent computing and control capabilities. When the first controller fails, the second controller can not only perform fault takeover, but also adjust some basic control strategies according to the current state of the vehicle to ensure the safe operation of the vehicle.

[0056] In some embodiments, the first controller may generate a control signal for the vehicle according to the real-time state of the vehicle and the input of the driver. The control signal may include adjusting the output power of the engine or motor, adjusting the steering angle, adjusting the brake pressure, etc., to ensure the stable driving of the vehicle under various road conditions.

[0057] Under normal circumstances, the first controller can serve as the core unit of vehicle control, responsible for all key control tasks, and transmits its own status and vehicle operating parameters to the second controller through the communication bus so that the second controller can perform real-time monitoring.

[0058] In some embodiments, the first controller and the second controller can communicate in real time via a high-speed communication bus (such as a CAN bus or Ethernet). The second controller can synchronously receive the control signal sent by the first controller, and determine whether the control behavior of the first controller meets expectations by comparing it with its own monitoring strategy.

[0059] It should be noted that the second controller of the present application may also be other control units independent of the second controller, such as a single-chip microcomputer, a DSP, an ARM processor, etc. And the first controller and the second controller of the present application adopt a mutual master-slave mechanism, that is, the first controller may be the master controller of the vehicle, and the second controller may be the slave controller of the vehicle. Correspondingly, the second controller may also be the master controller of the vehicle, and the first controller may also be the slave controller of the vehicle.

[0060] Step S202: Determine whether the control of the vehicle by the first controller is abnormal according to the control signal.

[0061] Among them, the control signal may include a bus signal sent by the first controller, that is, a bus heartbeat signal. Specifically, the bus heartbeat signal refers to a status signal regularly sent by the first controller through a communication bus (such as a CAN bus or Ethernet) so that the second controller can understand the operating status of the first controller in real time. If the bus heartbeat signal is not received normally within a preset time or its frequency is abnormal, it means that the first controller may have a fault or abnormality.

[0062] In some embodiments, when the first reception duration of receiving the bus signal is greater than the first preset duration, it is determined that the first controller controls the vehicle abnormally. The first reception duration refers to the actual time interval between two times when the second controller receives the bus heartbeat signal sent by the first controller. The first preset duration is a set maximum allowable reception time interval, which is the longest period during which the first controller should send the next heartbeat signal under normal circumstances. If the second controller does not receive a new bus signal within this preset time, it can be considered that the first controller may have an abnormality.

[0063] Specifically, when the first controller sends a bus heartbeat signal according to a set period, the second controller can continue to receive it within the period. If the received heartbeat signal interval, for example, the first receiving duration is less than or equal to the set first preset duration, it means that the first controller is working normally. Correspondingly, if the received time interval, for example, the first receiving duration exceeds the set first preset duration, it means that the first controller did not send a signal within the specified time, which may be caused by hardware failure, software jamming or communication interruption. At this time, the second controller can determine that the first controller is abnormal.

[0064] When an abnormality occurs in the first controller, the second controller can first send out an alarm signal to remind the vehicle system that there is an abnormality. If the abnormality persists, the second controller can take over part or all of the control tasks of the first controller to ensure the operation of basic vehicle functions, such as emergency braking or maintaining the vehicle's straight driving, to avoid accidents.

[0065] This application monitors the real-time status of the first controller by monitoring the bus signal of the first controller. The setting of the first receiving duration ensures that when the first controller fails or is abnormal, the second controller can detect and handle the failure in time, which improves the reliability and safety of the entire control system and helps reduce potential safety risks caused by the failure of the first controller.

[0066] The control signal also includes a hard-wire signal sent by the first controller. Its function is similar to that of the bus signal, but it is more independent and direct, and does not rely on the stability of the bus communication network. The hard-wire signal can be used as a backup mechanism to ensure that when the bus signal is abnormal, the system can still determine the status of the first controller through the hard-wire signal.

[0067] In some embodiments, step S202 may include the following steps:

[0068] First, when the first receiving duration is greater than the first preset duration, it is determined whether the second receiving duration of receiving the hard-line signal is greater than the second preset duration;

[0069] Next, if the second receiving time length is less than or equal to the second preset time length, it is determined that the control of the vehicle by the first controller is in a first abnormal state;

[0070] Finally, if the second receiving time length is greater than the second preset time length, it is determined that the control of the vehicle by the first controller is in a second abnormal state.

[0071] like Figure 3As shown, as an example, when the second controller detects that the first receiving duration of the bus heartbeat signal sent by the first controller is greater than the first preset duration, it indicates that the bus signal has become abnormal. At this time, the bus communication may be unstable, and the second controller cannot rely on the bus signal to determine the state of the first controller.

[0072] When the second controller detects that the first receiving duration of the bus heartbeat signal sent by the first controller is greater than the first preset duration, it indicates that the bus signal has become abnormal. At this time, the bus communication may be unstable and the second controller cannot rely on the bus signal to determine the state of the first controller.

[0073] Among them, the second receiving duration refers to the time interval between two hard-wire signals received by the second controller, and the second preset duration is the upper limit of the normal receiving interval of the hard-wire signal. Specifically, if the second receiving duration of the hard-wire signal is less than or equal to the second preset duration, that is, the second controller receives the hard-wire signal normally within the specified time, it means that although the bus signal is abnormal, the first controller is still working normally through the hard-wire heartbeat signal. In this case, the system can determine that the first controller is in the first abnormal state, that is, the bus communication is abnormal, but the first controller itself is still running, and the vehicle may still be able to maintain basic functions through other means.

[0074] Correspondingly, if the second reception duration of the hard-wire signal is greater than the second preset duration, that is, the second controller fails to receive the hard-wire signal within the specified time, it means that the first controller may be completely inoperable or a serious hardware failure has occurred. In this case, the system determines that the first controller is in the second abnormal state. At this time, not only does the bus communication of the first controller fail, but the hard-wire signal cannot be transmitted normally, indicating that the first controller may completely lose the ability to control the vehicle, and emergency response measures must be taken immediately, such as switching to the second controller or performing safe parking operations.

[0075] It can be understood that in the first abnormal state, although the bus signal is abnormal, the hard-wire signal is normal, and the system can give certain prompts or alarms, while continuing to rely on the hard-wire signal of the first controller, or waiting for the second controller to take over part of the functions of the first controller to control the vehicle and maintain the basic operation of the vehicle. In the second abnormal state, all signals of the first controller are abnormal (including bus signals and hard-wire signals), and the second controller can take over the key functions of the control system to ensure the safe operation or emergency stop of the vehicle.

[0076] It should be noted that in addition to monitoring whether the bus signal and the hard-line signal have timed out, the present application can also synchronously monitor the frequency and voltage of the two signals. When the signal frequency or signal voltage of the first controller is abnormal, the controller switching mechanism of the above step S202 is also applicable.

[0077] The present application realizes more comprehensive status monitoring of the first controller through dual signal monitoring of bus heartbeat signal and hard-line heartbeat signal. By distinguishing the first abnormal state from the second abnormal state, the system can adopt corresponding response strategies according to different signal abnormalities, thereby further improving the safety and reliability of the vehicle control system. Under this dual-layer monitoring mechanism, even if one communication method fails, the system can still make accurate judgments based on another signal to avoid the risk of vehicle loss of control.

[0078] Step S203: When it is determined that the control of the vehicle by the first controller is abnormal, a redundant control mode of the vehicle is started, and at least one function of the vehicle controlled by the first controller is switched to be controlled by the second controller of the vehicle.

[0079] It can be understood that when a control abnormality occurs in the first controller, in order not to affect the normal driving of the vehicle, a redundant control mode can be started in which the second controller takes over at least one control function of the first controller to ensure the safety of vehicle driving.

[0080] In some embodiments, step S203 may include:

[0081] First, in response to a first abnormal state, a first redundant control mode of the vehicle is activated to switch a first number of functions of the vehicle controlled by the first controller to be controlled by a second controller of the vehicle;

[0082] Next, in response to a second abnormal state, a second redundant control mode of the vehicle is activated, and a second number of functions of the vehicle controlled by the first controller are switched to be controlled by the second controller of the vehicle.

[0083] Specifically, when the vehicle is in the first abnormal state, that is, the bus signal is abnormal but the hard-wire signal is normal, the system determines that although the first controller has a communication problem, it can still maintain certain functions. In this state, the system can start the first redundant control mode and switch the first number of vehicle functions controlled by the first controller to the second controller for control. The first number of functions usually refers to some core functions of the vehicle, such as control functions that affect the lateral and longitudinal driving of the vehicle, which can ensure that the vehicle continues to drive or maintain the most basic operation in the event of a failure.

[0084] In the first redundant control mode, the first controller still participates in the control of some functions, and the secondary functions continue to be handled by the first controller. Only the core or key functions are transferred to the second controller. This can ensure that the vehicle continues to operate normally when there is a partial failure in the first controller and avoid the complexity caused by the transfer of all functions.

[0085] Specifically, when the vehicle enters the second abnormal state, that is, the bus signal and hard-line signal of the first controller are both invalid, the system determines that the first controller may have completely lost control capability and needs to enter a more comprehensive redundant control. The second redundant control mode can be activated to switch all the second number of vehicle functions controlled by the first controller to the second controller for control.

[0086] Among them, the second number is greater than the first number, which means that the second controller will take over more functions, or even all functions of the vehicle, such as main functions including power system, steering system, braking system, and other minor functions such as ambient lights and windows.

[0087] In some embodiments, in the second redundant control mode of the vehicle, all functions of the vehicle controlled by the first controller are switched to the control of the second controller of the vehicle. The second controller completely replaces the work of the first controller and takes over all control tasks of the vehicle. The second redundant control mode ensures that even if the first controller fails completely, all functions of the vehicle can still be maintained by the second controller, especially in complex or emergency driving environments, which can ensure the safety and basic operating capabilities of the vehicle.

[0088] When the system detects that there is an abnormality in the communication of the first controller but it can still partially operate, the system will only switch a small number of the most critical control functions (such as power, direction, braking and other key functions) to the second controller to maintain the basic operation of the vehicle. In this case, the first controller still retains control of some secondary functions. When the system detects that the first controller has completely failed, the system can switch all functions controlled by the first controller to the second controller for control. Not only the core driving functions are included, but also all secondary ancillary functions may be covered to ensure that the vehicle can continue to operate safely in the worst case. In the second redundant control mode, the vehicle's function switching range is wider, and can even cover all functions of the vehicle, while in the first redundant control mode, only key functions are switched.

[0089] Just as an example, when the vehicle is driving normally, the communication of the first controller has a brief problem or a minor fault, resulting in an abnormal bus signal, but the first controller can still maintain some functions. At this time, secondary functions (such as functions that do not affect the lateral and longitudinal driving of the vehicle) are still controlled by the first controller, while key functions such as power and braking are transferred to the second controller to ensure that the vehicle continues to drive safely. Correspondingly, if the first controller of the vehicle fails completely and all signals are interrupted, the system can enable the second redundant control mode and transfer all functions of the vehicle to the second controller. In this case, the second controller will take over all control functions of the vehicle to ensure that the vehicle can stop in an emergency or drive off the road safely to avoid accidents.

[0090] This application provides vehicles with flexible response measures for different degrees of controller failure through two different redundant control modes. The first redundant control mode is used to deal with the situation when the first controller partially fails, and transfer key functions to ensure the continued operation of the vehicle. The second redundant control mode takes over all functions in the event of a complete failure of the first controller to ensure the safety of the vehicle. The redundancy and fault tolerance of the vehicle control system are significantly improved, especially in autonomous driving and intelligent driving systems, which can provide higher safety guarantees.

[0091] In some embodiments, the method of the present application may further include:

[0092] Configure function priority parameters for vehicle functions;

[0093] In a first redundant control mode of the vehicle, at least one of the functions is selected to be switched to be controlled by a second controller of the vehicle according to priority parameters of the functions of the vehicle controlled by the first controller.

[0094] Among them, the function priority parameter is a numerical value or label assigned to each vehicle function to identify the relative importance of the function in the event of a fault. Different functions have different importance, so the corresponding priority parameters are also different. High-priority functions generally refer to functions that are directly related to vehicle safety, stability, and basic driving operations. For example, functions such as power control, brake control, steering control, and air conditioning control can be assigned higher priority parameters because these functions are critical to the safe driving of the vehicle. Low-priority functions refer to those auxiliary functions that have less impact in emergency situations, such as window control, entertainment function control, lighting control, etc. Although these functions are important under normal circumstances, they have lower priority in emergency situations.

[0095] In some embodiments, when a control abnormality of the first controller is detected, the first redundant control mode may be entered. At this time, not all functions need to be switched to the second controller immediately, and the system may make a selection based on the priority parameters of the functions.

[0096] In some embodiments, the core functions of the vehicle (such as high-priority functions) can be selected for switching. Since the first controller can still control secondary functions, only high-priority functions that are closely related to vehicle safety and stability can be switched to the second controller for control. For example, functions such as power output, steering control, and braking systems may have higher priority parameters, so they can be taken over by the second controller at the first time to ensure the basic driving safety of the vehicle. Low-priority functions, such as in-car entertainment functions, headlight adjustment functions, etc., can continue to be controlled by the first controller, because such functions have relatively small impact even in the event of a failure. In this way, the consumption of system resources can be reduced and the complexity caused by excessive switching can be avoided.

[0097] Function priority parameters allow the system to dynamically decide which functions need to be switched first based on the current vehicle conditions. For example, when driving at high speeds, braking, steering, and power output have higher priority, while when parking, certain auxiliary functions such as the power steering system may have a relatively lower priority. Priority parameters can avoid unnecessary switching of functions of some controllers, and only switch key functions when necessary. This not only improves the efficiency of system response, but also reduces unnecessary complexity. Only when really important high-priority functions are affected, the system starts the second controller to take over, ensuring the accuracy and efficiency of redundant control.

[0098] Just as an example, if the vehicle is driving and power output control is a high priority function, the system can switch this function to the second controller for execution as a priority when the first controller is abnormal, to ensure that the vehicle can continue to maintain power and avoid sudden loss of driving ability. If the braking system has a higher priority, the system can immediately switch this function to the second controller for execution, to ensure that the vehicle can brake normally in an emergency and avoid accidents. Correspondingly, since functions such as window control and ambient light control have a lower priority, when the first controller is abnormal, the system may not immediately switch to the second controller to execute the above functions, but continue to be controlled by the first controller to maintain the stability of vehicle control.

[0099] As can be seen from the above, this application configures priority parameters for each vehicle function, reasonably selects high-priority functions for switching in the first redundant control mode, and ensures that when the first controller fails partially, the key functions of the vehicle can be protected and redundantly controlled first, while the secondary functions remain unchanged. This method not only optimizes the utilization of system resources, but also improves the response efficiency of the system in the event of a fault, ensuring the driving safety and stability of the vehicle.

[0100] In some embodiments, the method of the present application may further include:

[0101] receiving a first control signal output by the first controller when the first controller performs a preset control function on the vehicle;

[0102] Determine a second control signal predicted to be output by the second controller for a preset control function;

[0103] When the preset control function is switched to be controlled by the second controller, a third control signal output by the second controller for controlling the preset control function is determined according to a comparison result between the first control signal and the second control signal.

[0104] Among them, the first control signal refers to the control signal output by the first controller when it performs a preset control function on the vehicle. This signal may involve core vehicle functions such as power output, braking, and steering, and reflects the specific control operation of the vehicle by the first controller under normal working conditions. For example, when the vehicle needs to accelerate, the first control signal may be a power output signal issued by the first controller, instructing the engine or motor to increase power. When the first controller is working normally, the system can continuously receive and record these first control signals as a reference signal for the current control state of the vehicle.

[0105] The second control signal is a signal predicted and output by the second controller based on the same preset control function. When the system is working normally, the second controller does not directly participate in the control, but can predict a possible control signal based on the current state of the vehicle, sensor data and control logic. This prediction is to ensure that the second controller can quickly take over when the first controller fails to ensure a smooth transition of control.

[0106] The second controller can use the same sensor data and control algorithm as the first controller to calculate the second control signal for the preset function. This signal is only used for comparison when there is no actual control right, and does not directly affect the operation of the vehicle. It prepares for the subsequent switching of control rights, so that when the switch occurs, the second controller can quickly access and maintain a consistent control effect.

[0107] In some embodiments, when the system detects a failure or abnormality in the first controller, a preset control function (such as power output, braking control, etc.) can be switched from the first controller to the second controller for control, for example, when the redundant control mode is activated (such as the first redundant control mode or the second redundant control mode), depending on the severity of the fault.

[0108] When switching functions, the system can compare the first control signal (i.e., the control signal originally sent by the first controller) with the second control signal (i.e., the control signal predicted by the second controller) to check whether there is a difference between the two. Through this comparison, the system can determine whether the prediction of the second controller is consistent with the actual output of the first controller.

[0109] The present application can realize the smooth switching of vehicle control functions by receiving the first control signal of the first controller, predicting the second control signal of the second controller, and comparing the two when switching to generate an adjusted third control signal. It ensures that when the first controller fails, the second controller can quickly and accurately take over the control task, maintain the stable operation of the vehicle, and avoid emergencies or safety hazards caused by differences in control signals.

[0110] In some embodiments, the third control signal may be output in the following manner:

[0111] When the difference between the first control signal and the second control signal is within a predetermined error range, outputting the second control signal as a third control signal;

[0112] When the difference between the first control signal and the second control signal is outside a predetermined error range, the second control signal and the first control signal last output before the first controller is switched are smoothed, and the smoothed control signal is output as a third control signal.

[0113] like Figure 4 As shown, an error range can be preset to measure the difference between the first control signal and the second control signal. If the difference between the two is within the error range, it indicates that the second control signal is close to the actual output of the first controller, which is sufficient to ensure the smoothness of vehicle control during switching; if the difference exceeds the preset error range, it indicates that there is a large deviation between the two, which may affect the smooth operation of the vehicle and requires special processing during switching.

[0114] In some embodiments, if the system detects that the difference between the first control signal and the second control signal is within a predetermined error range, it means that the signal predicted by the second controller is very close to the actual control output of the first controller, indicating that the second controller can well take over the control task of the first controller. When an abnormality occurs in the first controller, the system can directly output the second control signal as the third control signal, that is, the second controller can continue to control the preset function of the vehicle according to the predicted control signal. This processing method can ensure the smoothness of switching between controllers and avoid unnecessary complex signal processing.

[0115] Accordingly, if the system detects that the difference between the first control signal and the second control signal exceeds the predetermined error range, it indicates that there is a significant difference between the predicted signal of the second controller and the actual output of the first controller. If the second control signal is used directly, it may cause a sudden change in vehicle control, affecting stability and safety.

[0116] In order to avoid sudden changes caused by signal differences, the second control signal and the first control signal last output before the first controller is switched can be smoothed. For example, this can be achieved through interpolation algorithms, weighted average or other signal smoothing methods, with the purpose of gradually transitioning between the two to avoid vehicle state instability caused by sudden changes in the control signal.

[0117] After smoothing, a new control signal can be generated as the third control signal, which is output by the second controller and is between the final control signal of the first controller and the predicted signal of the second controller, ensuring that the vehicle can transition smoothly during switching and avoiding sudden changes caused by signal mutations, such as sudden acceleration, sudden braking and other unstable situations.

[0118] It can be understood that the main purpose of smoothing is to solve the control instability problem caused by the large difference between the first control signal and the second control signal. For example, if the acceleration signal finally sent by the first controller is 30%, and the acceleration signal predicted by the second controller is 50%, directly using the predicted signal of the second controller may cause the vehicle to accelerate suddenly, which poses a threat to the safety of the driver or passengers. Through smoothing, the two signals can be gradually transitioned to make the acceleration behavior of the vehicle more natural. A 40% transition signal can be generated first, gradually approaching the predicted signal of the second controller to ensure the stability of the whole process.

[0119] In a specific application, during high-speed driving, any sudden control changes will affect the stability of the vehicle. If the first controller fails and there is a large difference between the first control signal and the second control signal, smoothing can ensure the gradual adjustment of the vehicle's power output, avoid sudden acceleration or deceleration, and ensure driving safety. During emergency braking, sudden changes in the brake signal may lead to unstable braking effects. The smoothing mechanism can ensure the gradual transition of the brake signal, so that the vehicle can still maintain a stable braking effect when switching to the second controller.

[0120] The present application detects the difference between the first control signal and the second control signal, and determines the processing method of the control signal according to the size of the difference between the two. If the difference is within the predetermined error range, the system can directly use the second control signal; if the difference exceeds the error range, the second control signal and the first control signal last output by the first controller are smoothed to generate a transitional third control signal. This mechanism can ensure the smoothness and continuity of vehicle control when the control right is switched between the first controller and the second controller, effectively avoid emergencies caused by sudden changes in the control signal, and improve the safety of the vehicle and the reliability of the redundant control system.

[0121] In some embodiments, the following steps may be performed after step S203:

[0122] Continuously detecting the state of the first controller;

[0123] When it is detected that the state of the first controller returns to normal, the redundant control mode is exited, and the function switched to be controlled by the second controller is restored to be controlled by the first controller.

[0124] like Figure 5As shown, the working status of the first controller can be monitored in real time during the operation of the vehicle. For example, the output of the control signal, the stability of the system operation, whether the communication is normal, and whether there is a fault in the hardware status. Through continuous monitoring, the system can promptly detect any abnormality of the first controller and quickly take corresponding redundant control measures. When a problem occurs in the first controller (such as abnormal communication signal, hardware failure or abnormal control signal, etc.), the redundant control mode can be immediately started, and the second controller takes over part or all of the functions of the first controller. Ensure that the control of the vehicle is not interrupted when the first controller fails, thereby ensuring driving safety.

[0125] Once the first controller returns to normal from an abnormal state, the system can detect that its state has been restored to the point where it can assume normal control functions again. This judgment can be based on multiple factors such as the signal of the first controller returning to normal, communication reconstruction, and fault self-test passing. The continuous monitoring mechanism can ensure that the system can judge the state of the first controller at any time to ensure that once it has the conditions to continue control, it can smoothly restore control. After detecting that the first controller has returned to normal, the system does not switch control rights immediately, but instead observes for a period of time to ensure that the state of the first controller has stabilized, so as to avoid the impact of frequent control rights switching on vehicle operation.

[0126] In some embodiments, when the system confirms that the first controller has returned to normal, it can exit the redundant control mode. The exit process is not performed immediately, but is performed through a smooth transition to ensure the smoothness of the transfer of control rights. The functions previously switched to the second controller can be gradually restored to the first controller. This process is similar to the activation of the redundant control mode, but in the opposite direction. Specifically, the system can gradually restore the functions previously handed over to the second controller to the first controller according to the priority or importance of the control function. For example, core functions such as power output, steering control, and braking system can be restored to control by the first controller first.

[0127] In order to avoid sudden control switching that may cause instability in vehicle operation, the system can continue to monitor the status of the first controller to ensure that no abnormalities occur during the switching process. If the first controller is detected to have problems again during the switching process, the system can immediately stop and exit the redundant control mode, and let the second controller continue to control the corresponding functions.

[0128] The system can maintain control stability and continuity during the switch back to the first controller. For example, the power control function can be restored through gradual adjustments to avoid sudden acceleration or deceleration of the vehicle. Braking control, steering control and other functions can also be smoothly transferred back to the first controller to ensure the consistency of vehicle operation.

[0129] It is understandable that if the control switch is too rapid or not smoothly processed, it may cause the vehicle to accelerate, turn or brake suddenly during operation. To avoid this, the system can monitor and dynamically adjust the restoration of control in stages to ensure a smooth transition throughout the process.

[0130] The system can flexibly respond to changes in the state of the controller. If the first controller has problems again after exiting the redundant control mode, the system can immediately resume the redundant control mode and the second controller will take over the control function. This two-way switching mechanism ensures that under different conditions, the system can dynamically adjust the control rights to ensure the safety and stability of the vehicle.

[0131] Whether the first controller fails due to a brief communication interruption, signal anomaly, or a more serious hardware failure, the system can respond flexibly through this mechanism. When the first controller returns to normal, the system can quickly exit the redundant control mode and return the control function to normal.

[0132] During vehicle driving, if the first controller enters a fault state due to a temporary communication problem or hardware problem, the system can immediately start the redundant control mode and the second controller will take over control. However, if the fault of the first controller is repaired, such as re-establishing communication or passing the self-test, the system can exit the redundant control mode and resume vehicle control by the first controller. If the first controller returns to normal after being repaired after a long period of failure, the system can also gradually restore all control functions from the second controller to the first controller based on the detection situation.

[0133] This application ensures safe control of the vehicle by continuously detecting the status of the first controller and promptly entering the redundant control mode when the first controller fails. When it is detected that the status of the first controller has returned to normal, the system will exit the redundant control mode and gradually restore the functions switched to the second controller to the first controller for control. The entire process is monitored in real time and adjusted dynamically to ensure the smoothness and continuity of the control switch, avoid unstable operation of the vehicle during the switching process, and thus improve the safety and reliability of the vehicle control system.

[0134] Figure 6 FIG. 3 is a block diagram of a controller 300 according to an exemplary embodiment. Figure 6 As shown, the controller 300 may include: a processor 301 , a memory 302 . The controller 300 may also include one or more of a multimedia component 303 , an input / output (I / O) component 304 , and a communication component 305 .

[0135] The processor 301 is used to control the overall operation of the controller 300 to complete all or part of the steps in the above-mentioned vehicle control method. The memory 302 is used to store various types of data to support the operation of the controller 300, and these data may include, for example, instructions for any application or method operated on the controller 300, and application-related data, such as contact data, sent and received messages, pictures, audio, video, etc. The memory 302 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read-Only Memory, referred to as EPROM), programmable read-only memory (Programmable Read-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic memory, flash memory, magnetic disk or optical disk. The multimedia component 303 may include a screen and an audio component. The screen may be, for example, a touch screen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone for receiving external audio signals. The received audio signal may be further stored in the memory 302 or sent through the communication component 305. The audio component also includes at least one speaker for outputting audio signals. The I / O component 304 provides an interface between the processor 301 and other interface modules, and the above-mentioned other interface modules may be keyboards, mice, buttons, etc. These buttons may be virtual buttons or physical buttons. The communication component 305 is used for wired or wireless communication between the controller 300 and other devices. Wireless communication, such as WiFi, Bluetooth, Near Field Communication (NFC), 2G, 3G, 4G, NB-IOT, eMTC, or other 5G, etc., or a combination of one or more of them, is not limited here. Therefore, the corresponding communication component 305 may include: WiFi module, Bluetooth module, NFC module, etc.

[0136] In an exemplary embodiment, the controller 300 may be implemented by one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), controllers, microcontrollers, microprocessors or other electronic components to perform the above-mentioned vehicle control method. Adaptively, in order to implement the above-mentioned vehicle control method, the controller 300 may also include the aforementioned first controller and second controller, which are used to switch or control the corresponding control modes of the first controller and the second controller. Alternatively, the first controller and the second controller may also be controllers independent of the controller, and the controller is connected to the first controller and the second controller through a control signal line to communicate with the first controller and the second controller to control the first controller and the second controller.

[0137] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided, and when the program instructions are executed by the domain controller, the steps of the vehicle control method described above are implemented. For example, the computer-readable storage medium may be the memory 302 including the program instructions described above, and the program instructions may be executed by the processor 301 of the controller 300 to complete the following steps:

[0138] Figure 7 is a block diagram of a vehicle provided in an embodiment of the present application, such as Figure 7 As shown, the vehicle 400 includes the controller 300 described above.

[0139] An embodiment of the present application also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for electronic data exchange, and the computer program enables a computer to execute part or all of the steps of any one of the charging control methods recorded in the above method embodiments.

[0140] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0141] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0142] In the several embodiments provided in the present application, it should be understood that the disclosed device can be implemented in other ways. For example, the device embodiments described above are only schematic, such as the division of the units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the device or unit can be electrical or other forms.

[0143] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0144] In addition, the functional units in the various embodiments of the application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware or in the form of software program modules.

[0145] If the integrated unit is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable storage unit. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage unit, including a number of instructions to enable a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage unit includes: U disk, read-only memory (ROM), random access memory (RAM), mobile hard disk, disk or optical disk and other media that can store program codes.

[0146] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage unit, which can include: a flash drive, a read-only storage unit, a random access memory, a magnetic disk or an optical disk, etc.

[0147] The preferred embodiments of the present application are described in detail above in conjunction with the accompanying drawings; however, the present application is not limited to the specific details in the above embodiments. Within the technical concept of the present application, a variety of simple modifications can be made to the technical solution of the present application, and these simple modifications all fall within the protection scope of the present application.

[0148] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, this application will not further describe various possible combinations.

[0149] In addition, the various implementation modes of the present application may be arbitrarily combined, and as long as they do not violate the concept of the present application, they should also be regarded as the contents disclosed in the present application.

Claims

1. A vehicle control method, characterized in that: The method comprises: Monitoring a control signal of a first controller of the vehicle to the vehicle; determining, according to the control signal, whether the control of the vehicle by the first controller is abnormal; When it is determined that the control of the vehicle by the first controller is abnormal, a redundant control mode of the vehicle is activated, and at least one function of the vehicle controlled by the first controller is switched to be controlled by the second controller of the vehicle.

2. The vehicle control method according to claim 1, characterized in that: The control signal includes a bus signal sent by the first controller, and judging whether the control of the vehicle by the first controller is abnormal according to the control signal includes: When a first receiving time length for receiving the bus signal is greater than a first preset time length, it is determined that the control of the vehicle by the first controller is abnormal.

3. The vehicle control method according to claim 2, characterized in that: The control signal further includes a hard-line signal sent by the first controller, and judging whether the control of the vehicle by the first controller is abnormal according to the control signal further includes: When the first receiving duration is greater than a first preset duration, determining whether a second receiving duration for receiving the hard-line signal is greater than a second preset duration; If the second receiving time is less than or equal to the second preset time, it is determined that the control of the vehicle by the first controller is in a first abnormal state; If the second receiving time length is greater than the second preset time length, it is determined that the control of the vehicle by the first controller is in a second abnormal state.

4. The vehicle control method according to claim 3, characterized in that: The starting of the redundant control mode of the vehicle, switching at least one function of the vehicle controlled by the first controller to be controlled by the second controller of the vehicle, comprises: In response to the first abnormal state, activating a first redundant control mode of the vehicle to switch a first number of functions of the vehicle controlled by the first controller to be controlled by a second controller of the vehicle; In response to the second abnormal state, starting a second redundant control mode of the vehicle to switch a second number of functions of the vehicle controlled by the first controller to be controlled by a second controller of the vehicle; Wherein, the second number is greater than the first number.

5. The vehicle control method according to claim 4, characterized in that: In the second redundant control mode of the vehicle, all functions of the vehicle controlled by the first controller are switched to be controlled by the second controller of the vehicle.

6. The vehicle control method according to claim 4, characterized in that: The method further comprises: configuring function priority parameters for functions of the vehicle; In a first redundant control mode of the vehicle, at least one of the functions is selected to be switched to be controlled by a second controller of the vehicle according to priority parameters of the functions of the vehicle controlled by the first controller.

7. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: receiving a first control signal output by the first controller when the first controller performs a preset control function on the vehicle; Determine a second control signal predicted to be output by the second controller for the preset control function; When the preset control function is switched to be controlled by the second controller, a third control signal output by the second controller for controlling the preset control function is determined according to a comparison result between the first control signal and the second control signal.

8. The method according to claim 7, characterized in that The determining, according to the comparison result between the first control signal and the second control signal, a third control signal output by the second controller for controlling the preset control function comprises: When the difference between the first control signal and the second control signal is within a predetermined error range, outputting the second control signal as the third control signal; When the difference between the first control signal and the second control signal is outside a predetermined error range, the second control signal and the first control signal last output before the first controller is switched are smoothed, and the smoothed control signal is output as the third control signal.

9. The method according to any one of claims 1 to 6, characterized in that: After starting the redundant control mode of the vehicle, the method further includes: Continuously detecting the state of the first controller; When it is detected that the state of the first controller returns to normal, the redundant control mode is exited, and the function switched to be controlled by the second controller is restored to be controlled by the first controller.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program instructions, which implement the method according to any one of claims 1 to 9 when executed.

11. A computer program product, characterized in that The computer program product comprises program instructions, and when the program instructions are executed by a processor, the method according to any one of claims 1 to 9 is implemented.

12. A controller, characterized in that: Used to perform the method according to any one of claims 1 to 9.

13. A vehicle, characterized in that: The controller comprises the controller described in claim 12 above, or is used to execute the method described in any one of claims 1 to 9.

Images