Vehicle control method and device, vehicle, equipment, medium and program product

Abstract

The embodiment of the invention provides a vehicle control method and device, a vehicle, equipment, a medium and a program product, and the method comprises the steps: calculating a second torque control related parameter according to an input signal in a safety function monitoring module, when it is detected that the obtained first torque control related parameters are inconsistent with the obtained second torque control related parameters, the vehicle is controlled to enter a safe state so as to stop torque output; and in the independent monitoring module, the safety function monitoring module is monitored, and when it is monitored that the safety function monitoring module is abnormal, the vehicle is controlled to enter a safety state so as to stop torque output. Through the embodiment of the invention, the abnormity or fault monitoring of the motor control unit in the vehicle is realized through a multi-layer monitoring mechanism, the potential risk during the driving control of the vehicle is avoided, and the driving safety is ensured.

Description

Technical Field

[0001] The present invention relates to the field of new energy vehicles, and in particular to a method, device, vehicle, equipment, medium and program product for vehicle control. Background Art

[0002] With the development of new energy vehicles, new energy vehicles are mainly hybrid vehicles and pure electric vehicles. Their power systems are complex, including power sources such as generators and drive motors, and power coupling is achieved between power sources through clutches.

[0003] In the prior art, a drive motor controller is generally used as a core control unit for vehicle power control, which controls torque output according to the driver's throttle to accelerate or decelerate and brake the vehicle.

[0004] However, when this approach is adopted, when an abnormality or fault occurs in the motor controller, the abnormality or fault cannot be monitored in time, thereby causing the risk of unexpected vehicle acceleration or deceleration. Summary of the invention

[0005] In view of the above problems, a method, device, vehicle, equipment, medium and program product for vehicle control are proposed to overcome the above problems or at least partially solve the above problems, including:

[0006] A vehicle control method, the vehicle having a motor control unit, the motor control unit having a safety function monitoring module and an independent monitoring module, the method comprising:

[0007] In the safety function monitoring module, a second torque control related parameter is calculated according to the input signal, and when it is detected that the acquired first torque control related parameter is inconsistent with the second torque control related parameter, the vehicle is controlled to enter a safe state to stop the torque output;

[0008] In the independent monitoring module, the safety function monitoring module is monitored, and when it is monitored that the safety function monitoring module is abnormal, the vehicle is controlled to enter a safe state to stop the torque output.

[0009] Optionally, the motor control unit further includes a basic function implementation module, and in the safety function monitoring module, before calculating the second torque control related parameter according to the input signal, and controlling the vehicle to enter a safe state to stop the torque output when detecting that the acquired first torque control related parameter is inconsistent with the second torque control related parameter, it also includes:

[0010] In the basic function implementation module, the first torque control related parameters are calculated according to the input signal.

[0011] Optionally, it also includes:

[0012] In the safety function monitoring module, when an abnormality is detected in the second torque control related parameters, the actual fault situation is determined based on the abnormal parameters in the second torque control related parameters, and the vehicle is safely controlled in different ways based on the actual fault situation.

[0013] Optionally, according to the actual situation of the fault, different methods are used to safely control the vehicle, including:

[0014] For multiple-point failures, controlling the vehicle to enter a safe state to stop torque output;

[0015] For a single point failure, the vehicle is subjected to safety degradation control to limit the torque output.

[0016] Optionally, the abnormal parameter includes a current value, and determining the actual fault condition according to the abnormal parameter in the second torque control related parameter includes:

[0017] Obtaining a first current value obtained by collecting three-phase currents through a sensor, and using the first current values ​​of any two phase currents of the three-phase currents to calculate a second current value of the third phase current;

[0018] The second current value of the third phase current and the first current value of the third phase current are verified, and whether a current fault exists is determined based on the verification result.

[0019] Optionally, the monitoring the safety function monitoring module includes:

[0020] The program flow in the safety function monitoring module is monitored.

[0021] Optionally, the motor control unit further comprises a basic function implementation module, and the basic function implementation module, the safety function monitoring module and the independent monitoring module are implemented by different cores in the same chip.

[0022] Optionally, the central control unit and the motor control unit of the vehicle perform signal exchange in at least two heterogeneous ways.

[0023] Optionally, the at least two heterogeneous modes include: a differential line signal interaction mode and a CAN bus signal interaction mode.

[0024] Optionally, controlling the vehicle to enter a safe state includes: controlling a drive control panel in the vehicle to perform a specified operation to enter a safe state.

[0025] Optionally, the specified operation includes: short-circuiting the lower bridge of the three-phase motor, or opening the six-phase bridge of the motor.

[0026] Optionally, the vehicle has a motor control unit, and the motor control unit has a safety function monitoring module and an independent monitoring module for:

[0027] In the safety function monitoring module, a second torque control related parameter is calculated according to the input signal, and when it is detected that the acquired first torque control related parameter is inconsistent with the second torque control related parameter, the vehicle is controlled to enter a safe state to stop the torque output;

[0028] In the independent monitoring module, the safety function monitoring module is monitored, and when it is monitored that the safety function monitoring module is abnormal, the vehicle is controlled to enter a safe state to stop the torque output.

[0029] A vehicle comprises a processor, a memory and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements any of the above methods when executed by the processor.

[0030] An electronic device comprises a processor, a memory and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements any of the above methods when executed by the processor.

[0031] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in any one of the above items is implemented.

[0032] A computer program product, characterized in that it comprises a computer program, and when the computer program is executed by a processor, it implements any of the methods described above.

[0033] The embodiments of the present invention have the following advantages:

[0034] In an embodiment of the present invention, in a safety function monitoring module, a second torque control related parameter is calculated according to an input signal, and when it is detected that the acquired first torque control related parameter is inconsistent with the second torque control related parameter, the vehicle is controlled to enter a safe state to stop the torque output; in an independent monitoring module, the safety function monitoring module is monitored, and when it is monitored that the safety function monitoring module has an abnormality, the vehicle is controlled to enter a safe state to stop the torque output, thereby realizing abnormal or fault monitoring of the motor control unit in the vehicle through a multi-layer monitoring mechanism, avoiding potential risks in vehicle drive control, and ensuring driving safety. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solution of the present invention, the accompanying drawings required for use in the description of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0036] Figure 1 is a schematic diagram of a vehicle driving control method based on functional safety provided by some embodiments of the present invention;

[0037] Figure 2 is a flow chart of steps of a vehicle control method provided by some embodiments of the present invention;

[0038] Figure 3 is a schematic diagram of a heterogeneous redundant interaction solution provided by some embodiments of the present invention;

[0039] Figure 4 It is a schematic diagram of a function degradation scheduling process provided by some embodiments of the present invention;

[0040] Figure 5 is a schematic diagram of a current Hall sampling circuit provided by some embodiments of the present invention;

[0041] Figure 6 It is a schematic diagram of a third-layer monitoring mechanism solution provided by some embodiments of the present invention. DETAILED DESCRIPTION

[0042] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] With the development of automobile intelligence, the concept of functional safety has become more and more deeply integrated into vehicle design. As the core control unit of vehicle power control, the drive motor controller has a high functional safety level (ASIL, Automotive Safety Integrity Level) requirement, which is generally ASIL C or ASIL D.

[0044] In the related art, the torque safety control method of new energy vehicles is to calculate the actual torque of the motor at the battery discharge end based on the motor parameter information of the monitored new energy vehicle, and calculate the actual output torque at the clutch end based on the clutch parameter information of the monitored new energy vehicle; calculate the difference between the actual torque of the motor at the battery discharge end and the actual output torque at the clutch end, compare the difference with a pre-set threshold, and determine the target output torque of the motor based on the comparison result.

[0045] By comparing and judging the actual torque of the motor at the battery discharge end and the actual output torque at the clutch end, the target output torque of the motor output by the vehicle controller is reasonably arbitrated, and the target output torque of the motor is further compared with the driver's required torque and the monitoring layer's required torque. When acceleration or deceleration not intended by the driver is detected, fault handling measures are responded to in a timely manner to achieve judgment and coordination of vehicle torque.

[0046] However, in the above technologies, the control method of the drive motor controller is relatively simple, mainly relying on the drive motor controller's own circuit detection to control the drive torque, and heterogeneous redundant control has not yet been realized. There are potential faults, causing systemic failures, and there are safety hazards to the operation of the vehicle.

[0047] Based on this, the present invention proposes to monitor the abnormality or fault of the motor control unit in the vehicle through a multi-layer monitoring mechanism, avoiding potential risks in vehicle drive control and ensuring driving safety, and through heterogeneous redundant backup control, the vehicle drive torque safety issue is solved to ensure that the vehicle can enter a safe state in a timely and accurate manner.

[0048] like Figure 1 As shown, the present invention adopts a three-layer architecture solution of EGAS, which is respectively composed of a basic function implementation module (L1), a safety function monitoring module (L2) of driving torque safety-related functions, and an independent monitoring module (L3) for safety functions, for control and arbitration; it can effectively reduce the risk of abnormal torque request and torque execution due to faults, thereby causing unexpected vehicle acceleration and deceleration, thereby ensuring that the entire driving power system can work safely and reliably.

[0049] However, because EGAS uses a layer-by-layer monitoring method to monitor faults in a timely manner and process them to switch to a safe state, the monitoring point is only the chip status of the upper layer. There are few monitoring points, and the vehicle has potential failures and there is no corresponding detection mechanism to discover and handle them in time, making it impossible to detect vehicle faults in time and trigger corresponding safety measures; and the monitoring chip in the third layer of EGAS is mainly used to monitor the fault status of the functional layer implementation chip in the second layer and take over the control of the entire vehicle in time. In the three-layer architecture, the control of the entire vehicle is taken over only for the failure of the functional implementation chip. The monitoring point is single, and other safety-related points cannot be monitored. If the power chip of the drive control unit fails, it cannot switch to a safe state in time, and the vehicle is at risk of delayed entry into a safe state.

[0050] Therefore, the present invention introduces a central control unit to perform calculations and arbitration of vehicle driving, steering, braking and other handling stability controls, cooperates with circuit design to achieve heterogeneous redundant control of the motor control unit, and adopts CAN and differential hard-line heterogeneous signal interaction methods between the central control unit and the motor control unit to achieve redundant control of the vehicle's driving torque; the third-layer control and monitoring layer (independent monitoring module, L3) of the three-layer architecture of the motor control unit introduces status monitoring points including but not limited to the second-layer function implementation chip, the power chip of the motor control unit, the central control unit enable command, etc., to enhance the identification of vehicle fault status, reduce the risk of potential vehicle failure, and ensure the safety of the vehicle.

[0051] In addition, the present invention also adds downgrade processing measures after basic function fault detection in the first-layer function implementation architecture layer (basic function implementation module, L1) of the motor control unit to reduce the vehicle breakdown rate, increase vehicle availability, and enhance user experience.

[0052] The following further describes the embodiments of the present invention:

[0053] Reference Figure 2 , showing a step flow chart of a vehicle control method provided by some embodiments of the present invention; the vehicle has a motor control unit, and the motor control unit has a safety function monitoring module and an independent monitoring module.

[0054] In actual applications, the safety function monitoring module can estimate the actual torque output of the vehicle from the three-phase current of the motor collected by the Hall sensor, the motor position signal collected by the resolver sensor, etc., and compare the driver's required torque estimated by the battery discharge state, the torque under rapid acceleration, rapid deceleration and other conditions, and reasonably arbitrate the controlled output torque to achieve safe monitoring and coordination of vehicle torque and ensure driving safety.

[0055] The safety function monitoring module may also monitor the signal collected by the sensor to ensure the accuracy of estimating the actual torque.

[0056] The independent monitoring module monitors the hardware failure or software failure of the motor torque control module chip.

[0057] In some embodiments of the present invention, the central control unit of the vehicle and the motor control unit use at least two heterogeneous methods to perform signal interaction, and the at least two heterogeneous methods include: a differential line signal interaction method and a CAN bus signal interaction method.

[0058] In practical applications, such as Figure 3 As shown, hard-wire and CAN signal transmission methods can be used to realize the communication of relevant command signals from the central control unit to the motor control unit. Two independent control paths are also used inside the motor control unit to respectively control and process the signals transmitted through software and hardware, thereby meeting the independence requirements of functional safety.

[0059] In some examples of the present invention, the central control unit can perform calculations and arbitration for vehicle driving, steering, braking and other handling stability controls, and cooperate with circuit design to achieve heterogeneous redundant control of the motor control unit. By adopting two different control signal interaction methods, differential hard line and CAN, between the central control unit and the motor control unit, it meets the current requirements of assisted driving vehicles and even self-driving vehicles for functional safety control command signal transmission methods, and reduces the potential failure risk of vehicle drive control; secondly, by using a heterogeneous method to input signals, it can avoid the vehicle from frequently entering a safe state due to common cause failures.

[0060] The specific steps may include:

[0061] Step 201, in the safety function monitoring module, calculate the second torque control related parameter according to the input signal, and when it is detected that the acquired first torque control related parameter is inconsistent with the second torque control related parameter, control the vehicle to enter a safe state to stop the torque output.

[0062] In actual applications, the safety function monitoring module can estimate the actual torque output of the vehicle based on signals such as the rotational speed and verify the input signal, which is used as the second torque control-related parameter, and detect the acquired first torque control-related parameter and the second torque control-related parameter. When inconsistent parameters are detected, there may be abnormal clutch end speed or motor speed. At this time, the vehicle can be controlled to enter a safe state to stop the motor from outputting torque.

[0063] As an example, a threshold range can also be set in advance. After the safety function monitoring module calculates the second torque control related parameter through the input signal, the second torque control related parameter can be compared with the first torque control related parameter. When the difference is greater than the preset threshold, it is determined that a fault exists and the vehicle can be controlled to enter a safe state to stop the output of torque.

[0064] In some embodiments of the present invention, the motor control unit further includes a basic function implementation module, and in the safety function monitoring module, the second torque control related parameter is calculated according to the input signal, and when it is detected that the acquired first torque control related parameter is inconsistent with the second torque control related parameter, the vehicle is controlled to enter a safe state to stop the torque output, and the basic function implementation module further includes:

[0065] In the basic function implementation module, the first torque control related parameters are calculated according to the input signal.

[0066] In actual applications, the basic function implementation module can start from the application layer strategy. After the motor control unit receives the input signal, the basic function implementation module can calculate the first torque control related parameters according to the input signal (target torque signal, braking signal, etc.) to control the torque of the motor.

[0067] As an example, the input signal may include motor speed, battery discharge current, vehicle speed, vehicle gear, target torque, brake signal, etc.

[0068] In actual applications, the central control unit can process the accelerator pedal signal and the brake pedal signal, and output the target torque and brake signal to the motor control module, which controls the motor to execute.

[0069] During the operation of the vehicle, the real-time situation of the vehicle can be monitored, and the sensor sends data to the motor control unit through the CAN bus. The basic function implementation module can perform calculations based on the input signals, such as the motor position signal calculated by the current vehicle speed, target torque, brake signal, and resolver sensor signal, and the three-phase current signal calculated by the Hall sensor, as the first torque control related parameters.

[0070] In some embodiments of the present invention, the motor control unit further comprises a basic function implementation module, and the basic function implementation module, the safety function monitoring module and the independent monitoring module are implemented by different cores in the same chip.

[0071] In some embodiments of the present invention, it also includes:

[0072] In the safety function monitoring module, when an abnormality is detected in the second torque control related parameters, the actual fault situation is determined based on the abnormal parameters in the second torque control related parameters, and the vehicle is safely controlled in different ways based on the actual fault situation.

[0073] As an example, the fault may be a fault related to motor driving, such as a current fault, a resolver fault, and faults of modules, equipment, sensors, circuits, devices, etc. that are closely related to motor driving.

[0074] In actual applications, the safety function monitoring module can detect whether there is an abnormality in the second torque control related parameters. If there is an abnormality, the actual fault situation is determined based on the abnormal parameters in the second torque control related parameters, and different methods are used to safely control the vehicle based on the actual fault situation; among which, the abnormal parameters can indicate the actual fault situation and the number of faults.

[0075] As an example, when the safety function monitoring module detects that the first torque control related parameter is consistent with the second torque control related parameter, the basic function implementation module may perform torque control according to the first torque control related parameter.

[0076] In actual applications, when the safety function monitoring module calculates the second torque control related parameters based on the input signal, it can be compared with the first torque control related parameters. When it is detected that the second torque control related parameters are consistent with the first torque control related parameters, there is no fault. At this time, torque control can be performed according to the first torque control related parameters through the drive control panel, such as adjusting the speed and power of the motor according to the first torque control related parameters to achieve torque control.

[0077] In some embodiments of the present invention, the vehicle is safely controlled in different ways according to the actual situation of the fault, including:

[0078] Sub-step 11, for multi-point faults, controlling the vehicle to enter a safe state to stop torque output.

[0079] As an example, the multi-point fault may be a current fault and a resolver fault occurring simultaneously, or two or three phases of the three-phase current are faulty, or more than two motor drive-related faults exist simultaneously.

[0080] In actual applications, when there are multiple point faults, in order to ensure the safety of the entire vehicle, the safety function monitoring module can control the vehicle to enter a safe state to stop torque output and no longer accelerate.

[0081] In some embodiments of the present invention, controlling the vehicle to enter a safe state includes: controlling a drive control panel in the vehicle to perform a specified operation to enter a safe state.

[0082] When there are multiple faults, the motor control unit and the driver board can enter a safe state through hard-line enabling.

[0083] In some embodiments of the present invention, the specified operation includes: short-circuiting the lower bridge of the three-phase motor, or opening the six-phase bridge of the motor.

[0084] Sub-step 12: for a single point failure, performing safety degradation control on the vehicle to limit the torque output.

[0085] In actual applications, when only a single point fault is detected, such as a fault in one phase of the three-phase current, the vehicle can be safely downgraded, such as limiting motor power or speed limit to limit torque output, thereby enhancing vehicle availability and improving user experience.

[0086] In practical applications, such as Figure 4 As shown, during vehicle operation, the three-phase current can be sampled by the Hall sensor to detect whether there is a current Hall fault. When there is no current Hall fault, the vehicle maintains the current operating state; when there is a single current Hall fault, the function is downgraded and the vehicle travels at limited power; when there are multiple currents or faults, the vehicle enters a safe state.

[0087] In some examples, since the basic function implementation module and the safety function monitoring module are implemented by different cores in the same chip, a fault degradation processing module can be added. In the fault judgment of the safety function monitoring module, if it is judged to be a single point fault, it sends a signal to the basic function implementation module, and the basic function implementation module performs fault degradation processing to limit the torque output.

[0088] In some embodiments of the present invention, the abnormal parameter includes a current value, and determining the actual fault condition according to the abnormal parameter in the second torque control related parameter includes:

[0089] Sub-step 22, obtaining a first current value collected by the sensor for the three-phase current, and using the first current values ​​of any two phase currents of the three-phase current to calculate a second current value of the third phase current.

[0090] In practical applications, the sensor may be a Hall sensor, which refers to a sensor that relies on the Hall effect to achieve physical quantity conversion. In new energy vehicles, Hall sensors play an irreplaceable role. They can sense vehicle speed, driving distance and other information by measuring the changes in the magnetic field of the rotating wheel rim. At the same time, they can also monitor key parameters such as the motor's speed, torque, phase, and monitor the battery's power level, charging and discharging status, etc. These information are key factors in ensuring the safe, efficient and stable operation of new energy vehicles.

[0091] Among them, the Hall sensor can also monitor the three-phase current of the motor to determine the operating status of the motor and effectively avoid motor stall, overload and other faults; with the help of the high precision, high speed and high reliability of the sensor, intelligent control can be achieved to improve the safety and reliability of new energy vehicles; for example, by real-time monitoring of the vehicle's operating status, the vehicle's driving mode can be adjusted according to different road conditions, vehicle speed and other parameters to improve driving efficiency and comfort.

[0092] In practical applications, when it is determined that there is a related fault in the motor drive, such as a current fault, the three-phase current of the motor can be detected and sampled by a Hall sensor, and the sampled value can be used to calculate the current value. The first current value obtained by collecting the three-phase current and the first current values ​​of any two phases of the three-phase current are used to calculate the second current value of the third phase current; if the first current value is obtained by collecting the three-phase current (U phase, V phase, W phase), the first current values ​​of the V phase and the W phase are taken to calculate the second current value of the U phase, and the first current values ​​of the U phase and the V phase are taken again to calculate the second current value of the W phase, and the first current values ​​of the U phase and the W phase are taken to calculate the second current value of the V phase, and the second current value of the third phase current is obtained.

[0093] In practical applications, the conversion can be performed in a way that the sum of the three-phase currents is 0, such as U+V+W=0. When the first current values ​​of any two phase currents of the three-phase current are used, the second current value of the third phase current can be calculated by conversion.

[0094] Sub-step 23: verifying the second current value of the third phase current and the first current value of the third phase current, and determining whether a current fault exists based on the verification result.

[0095] In practical applications, after obtaining the second current value of the three-phase current (U phase, V phase, W phase), the three phases can be checked separately for example, and verified with the first current value. When the second current value of the three-phase current is not equal to its corresponding first current value, a fault exists.

[0096] In some examples, such as Figure 5As shown, taking the current collected by the U-phase current Hall as an example for verification, after the V-phase and W-phase currents are sampled by the current Hall, they are respectively passed through the calculation circuit and then through the DSP for calculation to obtain the phase current, and independent over-current protection is performed on each phase current. At the same time, a horizontal comparison analysis method is adopted to convert the current values ​​calculated by the V-phase and W-phase into the current value of the U-phase, and then verify it with the current value collected by the U-phase current Hall to determine whether the current three-phase current sampling of the vehicle is faulty.

[0097] Step 202: In an independent monitoring module, the safety function monitoring module is monitored, and when an abnormality is detected in the safety function monitoring module, the vehicle is controlled to enter a safe state to stop torque output.

[0098] In actual applications, the independent monitoring module can monitor the safety function monitoring module, such as monitoring whether the safety function monitoring module correctly calculates the second torque control related parameters to perform torque control. For example, when it is monitored that the safety function monitoring module fails and the input signal is not effectively judged to perform torque control; at this time, the independent monitoring module can control the vehicle to enter a safe state to stop torque output.

[0099] In some embodiments of the present invention, the monitoring of the safety function monitoring module includes: monitoring the program flow in the safety function monitoring module.

[0100] In actual applications, the independent monitoring module can monitor the program flow in the safety function monitoring module, such as monitoring whether the safety function monitoring module is executed according to the preset program flow. When there is no feedback from a corresponding node, an exception occurs.

[0101] As an example, when the independent monitoring module detects that the program flow in the safety function monitoring module is abnormal, the independent monitoring module can control the safety function monitoring module to restart through a command, so that the safety function module re-executes the program flow.

[0102] like Figure 6 As shown, the independent monitoring module (L3) can perform a program flow check on the safety function monitoring module (L2). The safety function monitoring module can calculate the input signal and perform torque control or degradation operation according to the preset program node, and store the relevant data flow.

[0103] In actual applications, when an abnormality or fault occurs in the motor controller, the inability to monitor the abnormality or fault in time may lead to the risk of unexpected acceleration or deceleration of the vehicle. Through some embodiments of the present invention, the torque output of the braking system is independently controlled by independent safety control modules, and the monitoring module monitors the two independent safety control modules. The redundant and independently established braking system monitoring is conducive to timely detection and response to abnormal faults, thereby improving safety.

[0104] In an embodiment of the present invention, in a safety function monitoring module, a second torque control related parameter is calculated according to an input signal, and when it is detected that the acquired first torque control related parameter is inconsistent with the second torque control related parameter, the vehicle is controlled to enter a safe state to stop the torque output; in an independent monitoring module, the safety function monitoring module is monitored, and when it is monitored that the safety function monitoring module has an abnormality, the vehicle is controlled to enter a safe state to stop the torque output, thereby realizing abnormal or fault monitoring of the motor control unit in the vehicle through a multi-layer monitoring mechanism, avoiding potential risks in vehicle drive control, and ensuring driving safety.

[0105] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0106] Some embodiments of the present invention also provide a vehicle control device, wherein the vehicle has a motor control unit, and the motor control unit has a safety function monitoring module and an independent monitoring module, which are used to:

[0107] In the safety function monitoring module, a second torque control related parameter is calculated according to the input signal, and when it is detected that the acquired first torque control related parameter is inconsistent with the second torque control related parameter, the vehicle is controlled to enter a safe state to stop the torque output;

[0108] In the independent monitoring module, the safety function monitoring module is monitored, and when it is monitored that the safety function monitoring module is abnormal, the vehicle is controlled to enter a safe state to stop the torque output.

[0109] In some embodiments of the present invention, the motor control unit further includes a basic function implementation module, in which the safety function monitoring module calculates the second torque control related parameter according to the input signal, and when it is detected that the acquired first torque control related parameter is inconsistent with the second torque control related parameter, controls the vehicle to enter a safe state to stop the torque output, and is also used to:

[0110] In the basic function implementation module, the first torque control related parameters are calculated according to the input signal.

[0111] In some embodiments of the present invention, it is also used for:

[0112] In the safety function monitoring module, when an abnormality is detected in the second torque control related parameters, the actual fault situation is determined based on the abnormal parameters in the second torque control related parameters, and the vehicle is safely controlled in different ways based on the actual fault situation.

[0113] In some embodiments of the present invention, the vehicle is safely controlled in different ways according to the actual situation of the fault, including:

[0114] For multiple-point failures, controlling the vehicle to enter a safe state to stop torque output;

[0115] For a single point failure, the vehicle is subjected to safety degradation control to limit the torque output.

[0116] In some embodiments of the present invention, the abnormal parameter includes a current value, and determining the actual fault condition according to the abnormal parameter in the second torque control related parameter includes:

[0117] Obtaining a first current value obtained by collecting three-phase currents through a sensor, and using the first current values ​​of any two phase currents of the three-phase currents to calculate a second current value of the third phase current;

[0118] The second current value of the third phase current and the first current value of the third phase current are verified, and whether a current fault exists is determined based on the verification result.

[0119] In some embodiments of the present invention, monitoring the safety function monitoring module includes:

[0120] The program flow in the safety function monitoring module is monitored.

[0121] In some embodiments of the present invention, the motor control unit further comprises a basic function implementation module, and the basic function implementation module, the safety function monitoring module and the independent monitoring module are implemented by different cores in the same chip.

[0122] In some embodiments of the present invention, the central control unit and the motor control unit of the vehicle perform signal exchange in at least two heterogeneous ways.

[0123] In some embodiments of the present invention, the at least two heterogeneous modes include: a differential line signal interaction mode and a CAN bus signal interaction mode.

[0124] In some embodiments of the present invention, controlling the vehicle to enter a safe state further includes: controlling a drive control panel in the vehicle to perform a specified operation to enter a safe state.

[0125] In some embodiments of the present invention, the designated operation includes: short-circuiting the lower bridge of the three-phase motor, or opening the six-phase bridge of the motor.

[0126] In an embodiment of the present invention, in a safety function monitoring module, a second torque control related parameter is calculated according to an input signal, and when it is detected that the acquired first torque control related parameter is inconsistent with the second torque control related parameter, the vehicle is controlled to enter a safe state to stop the torque output; in an independent monitoring module, the safety function monitoring module is monitored, and when it is monitored that the safety function monitoring module has an abnormality, the vehicle is controlled to enter a safe state to stop the torque output, thereby realizing abnormal or fault monitoring of the motor control unit in the vehicle through a multi-layer monitoring mechanism, avoiding potential risks in vehicle drive control, and ensuring driving safety.

[0127] Some embodiments of the present invention further provide a vehicle, comprising a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the method described above when executed by the processor.

[0128] Some embodiments of the present invention further provide an electronic device, comprising a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the above method is implemented when the computer program is executed by the processor.

[0129] Some embodiments of the present invention further provide a computer-readable storage medium, on which a computer program is stored, and the computer program implements the above method when executed by a processor.

[0130] Some embodiments of the present invention further provide a computer program product, including a computer program, which implements the above method when executed by a processor.

[0131] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0132] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0133] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0134] Those skilled in the art will appreciate that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0135] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0136] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0137] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable terminal device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0138] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0139] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the above elements.

[0140] The above describes in detail the provided vehicle control method, device, vehicle, equipment, medium and program product. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A vehicle control method, characterized in that: The vehicle has a motor control unit, the motor control unit has a safety function monitoring module and an independent monitoring module, and the method includes: In the safety function monitoring module, a second torque control related parameter is calculated according to the input signal, and when it is detected that the acquired first torque control related parameter is inconsistent with the second torque control related parameter, the vehicle is controlled to enter a safe state to stop the torque output; In the independent monitoring module, the safety function monitoring module is monitored, and when it is monitored that the safety function monitoring module is abnormal, the vehicle is controlled to enter a safe state to stop the torque output.

2. The method according to claim 1, characterized in that: The motor control unit also has a basic function implementation module, and in the safety function monitoring module, before calculating the second torque control related parameter according to the input signal, and controlling the vehicle to enter a safe state to stop the torque output when detecting that the acquired first torque control related parameter is inconsistent with the second torque control related parameter, it also includes: In the basic function implementation module, the first torque control related parameters are calculated according to the input signal.

3. The method according to claim 1, characterized in that Also includes: In the safety function monitoring module, when an abnormality is detected in the second torque control related parameters, the actual fault situation is determined based on the abnormal parameters in the second torque control related parameters, and the vehicle is safely controlled in different ways based on the actual fault situation.

4. The method according to claim 3, characterized in that According to the actual situation of the fault, different methods are used to safely control the vehicle, including: For multiple-point failures, controlling the vehicle to enter a safe state to stop torque output; For a single point failure, the vehicle is subjected to safety degradation control to limit the torque output.

5. The method according to claim 3, characterized in that: The abnormal parameter includes a current value, and determining the actual fault condition according to the abnormal parameter in the second torque control related parameter includes: Obtaining a first current value obtained by collecting three-phase currents through a sensor, and using the first current values ​​of any two phase currents of the three-phase currents to calculate a second current value of the third phase current; The second current value of the third phase current and the first current value of the third phase current are verified, and whether a current fault exists is determined based on the verification result.

6. The method according to any one of claims 1 to 5, characterized in that: The monitoring of the safety function monitoring module includes: The program flow in the safety function monitoring module is monitored.

7. The method according to claim 6, characterized in that The motor control unit also has a basic function implementation module, and the basic function implementation module, the safety function monitoring module, and the independent monitoring module are implemented by different cores in the same chip.

8. The method according to any one of claims 1 to 5, characterized in that: The central control unit and the motor control unit of the vehicle perform signal exchange in at least two heterogeneous ways.

9. The method according to claim 8, characterized in that The at least two heterogeneous modes include: a differential line signal interaction mode and a CAN bus signal interaction mode.

10. The method according to claim 1, characterized in that The controlling the vehicle to enter a safe state includes: controlling a drive control panel in the vehicle to perform a specified operation to enter a safe state.

11. The method according to claim 10, characterized in that The specified operation includes: short-circuiting the lower bridge of the three-phase motor, or opening the six-phase bridge of the motor.

12. A vehicle control device, characterized in that: The vehicle has a motor control unit, and the motor control unit has a safety function monitoring module and an independent monitoring module for: In the safety function monitoring module, a second torque control related parameter is calculated according to the input signal, and when it is detected that the acquired first torque control related parameter is inconsistent with the second torque control related parameter, the vehicle is controlled to enter a safe state to stop the torque output; In the independent monitoring module, the safety function monitoring module is monitored, and when it is monitored that the safety function monitoring module is abnormal, the vehicle is controlled to enter a safe state to stop the torque output.

13. A vehicle, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the method according to any one of claims 1 to 11 when executed by the processor.

14. An electronic device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the method according to any one of claims 1 to 11 when executed by the processor.

15. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 11 is implemented.

16. A computer program product, characterized in that The invention comprises a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 11.

Images