Vehicle control system

Abstract

The invention provides a vehicle control system, and relates to the technical field of vehicles. The system comprises a main power supply, a backup power supply, a high-voltage storage battery, a domain controller and a plurality of subsystems, the subsystems comprise a braking system and other subsystems, the braking system serves as the backup controller, the domain controller is connected with the subsystems through a first communication channel, and the domain controller is connected with the other subsystems through a second communication channel. The backup controller is connected with the domain controller and other subsystems through a second communication channel; the domain controller and the backup controller are mutually redundant, the control priority of the domain controller is higher than that of the backup controller, the domain controller is used for uniformly controlling and scheduling the subsystem, and the backup controller is used for controlling the subsystem to move the vehicle to a safe area after the domain controller fails; the first communication channel and the second communication channel are mutually redundant, and the communication priority of the first communication channel is higher than that of the second communication channel; the main power supply and the backup power supply are mutually redundant, and the power supply priority of the main power supply is higher than that of the backup power supply.

Description

Technical Field

[0001] The present application relates to the field of vehicle technology, and in particular to a vehicle control system. Background Art

[0002] With the rapid development of autonomous driving technology and intelligent transportation systems, the safety and reliability of vehicles have become the focus of the industry. Modern vehicles not only need to have highly accurate perception and decision-making capabilities, but also be able to operate stably in various complex environments to ensure the safety of passengers and road users. Summary of the invention

[0003] The present application aims to solve one of the technical problems in the related art at least to some extent.

[0004] To this end, one purpose of the present application is to propose a vehicle control system, including a main power supply, a backup power supply, a high-voltage battery, a domain controller and multiple subsystems, the multiple subsystems including a braking system and other subsystems, the braking system serving as a backup controller, wherein: the domain controller is connected to the multiple subsystems through a first communication channel, and the backup controller is connected to the domain controller and other subsystems through a second communication channel; the domain controller and the backup controller are redundant with each other, the control priority of the domain controller is higher than that of the backup controller, the domain controller is used to uniformly control and schedule the subsystems, and the backup controller is used to control the subsystems to move the vehicle to a safe area after the domain controller fails; the first communication channel and the second communication channel are redundant with each other and are used for communication, and the communication priority of the first communication channel is higher than that of the second communication channel; the main power supply and the backup power supply are redundant with each other, the power supply priority of the main power supply is higher than that of the backup power supply, and the backup power supply is used to provide the required power for the vehicle after the main power supply fails, and the domain controller is also used to: when it is detected that the vehicle is in an emergency state, send operation instructions to relevant sensors, and receive execution feedback information sent by the subsystems corresponding to the relevant sensors.

[0005] In some practicable embodiments, the backup power supply is connected to a high-voltage battery, and the backup power supply refers to an independent power supply provided after the voltage is converted by the high-voltage battery.

[0006] In some achievable embodiments, the domain controller is further used to: when it is detected that the vehicle is in a normal state, send control instructions to the relevant subsystems, and receive execution feedback information sent by the relevant subsystems; wherein the relevant subsystems are used to control the sensors included in the relevant subsystems based on the control instructions.

[0007] In some achievable embodiments, the domain controller is further configured to: after detecting that the first communication channel is in a failed state, switch to the second communication channel to perform unified control and scheduling of the subsystems.

[0008] In some implementations, the backup controller keeps instructions synchronized with the domain controller.

[0009] In some achievable embodiments, the other subsystems include a power system, and the high-voltage electric battery is also connected to the power system, and the high-voltage electric battery is used to provide power for the power system.

[0010] In some achievable embodiments, the subsystem is used to: when the domain controller is in a normal state, receive and execute control instructions sent by the domain controller; and when the domain controller is in a failed state, receive and execute control instructions sent by the backup controller.

[0011] In some achievable embodiments, the domain controller is further used to: after detecting that any subsystem belonging to the first category is in a failed state, control the remaining subsystems except the subsystem in the failed state to move the vehicle to a safe area; and, after detecting that any subsystem belonging to the second category is in a failed state, limit the relevant functions of the subsystem in the failed state.

[0012] In some achievable embodiments, the subsystem is further configured to: after detecting that the vehicle is in an abnormal state or that the road ahead of the vehicle is in an abnormal state, send abnormal condition parameters to other related subsystems and a domain controller.

[0013] In some achievable embodiments, the domain controller is also used to: in response to monitoring that a vehicle accident has occurred and the output torque of the vehicle's power system is greater than a preset torque threshold, send a stop command to the braking system, and cut off the power of the power system or reduce the output torque of the power system; in response to monitoring that the vehicle is in a running state and the driver's seat of the vehicle is unmanned, and the vehicle is not in an automatic driving state or an automatic parking state, cut off the power of the power system.

[0014] The present application achieves at least the following beneficial effects: the vehicle control system proposed in the present application introduces a redundant design of the main power supply and the backup power supply, the domain controller and the backup controller, the first communication channel and the second communication channel, ensuring that the vehicle control system can continue to work when any part fails, especially after the domain controller fails, the backup controller can take over the control to ensure that the vehicle can be safely moved to the predetermined safe area; the main power supply and the backup power supply are redundant to each other, the main power supply has priority power supply, and the backup power supply takes over when the main power supply fails, ensuring that the system can continue to work in the event of a power failure and avoiding vehicle loss of control due to insufficient power; the domain controller can monitor the emergency status of the vehicle and actively send operating instructions to related sensors, so as to quickly respond and dispatch the various subsystems of the vehicle, take necessary safety measures in time, and reduce losses caused by emergencies; the domain controller is responsible for the unified control and scheduling of the subsystems, ensuring that the various subsystems work together to improve the efficiency and stability of the overall system; when the domain controller fails, the backup controller can take over the scheduling to ensure the continuity and safety of vehicle operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0016] Figure 1 It is a schematic diagram of a vehicle control system shown in one embodiment of the present application. DETAILED DESCRIPTION

[0017] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0018] Figure 1 is a schematic diagram of a vehicle control system shown in this application, such as Figure 1 As shown, the vehicle control system includes: a main power supply, a backup power supply, a high-voltage battery, a domain controller and multiple subsystems, and the multiple subsystems include a braking system and other subsystems ( Figure 1 Other subsystems besides the braking system shown in the figure include the power system, steering system, suspension system, intelligent driving system and other auxiliary systems).

[0019] The following is a brief introduction to each subsystem involved in this application:

[0020] 1. In some embodiments, the power system refers to a vehicle drive form that is pure electric or otherwise equipped with a high-voltage battery as power or auxiliary power.

[0021] 2. In some embodiments, the braking system refers to a braking method equipped with hydraulic pressure, pneumatic pressure or other typical braking methods such as electromechanical brake (EMB) or hybrid brake.

[0022] 3. In some embodiments, the steering system refers to front-wheel steering, rear-wheel steering, four-wheel steering, multi-wheel steering, and a steering system controlled by motor drive, hydraulic drive or hybrid drive.

[0023] 4. In some embodiments, the suspension system refers to a suspension system controlled by air, hydraulic, electromagnetic, other media or mixed media.

[0024] 5. In some embodiments, the intelligent driving system refers to the intelligent driving L1, L2, L3, L4, L5 and other autonomous driving solutions defined by the Society of Automotive Engineers (SAE), including corresponding radars, cameras, intelligent driving controllers, etc. of different solutions.

[0025] 6. In some embodiments, other auxiliary systems refer to systems such as body control, thermal management control, entertainment system, etc.

[0026] In this application, the braking system is used as a backup controller.

[0027] Among them, Figure 1 As shown, the domain controller is connected to the multiple subsystems via a first communication channel. The domain controller and the multiple subsystems can communicate with each other based on the first communication channel.

[0028] The first communication channel may be presented in a controller area network (CAN), a controller area network flexible data rate (CANFD) or other forms.

[0029] Among them, Figure 1 As shown, the backup controller is connected to the domain controller and other subsystems through the second communication channel. The backup controller, the domain controller and other subsystems can communicate based on the second communication channel.

[0030] The second communication channel can be presented in CAN, CANFD or other forms.

[0031] The domain controller and the backup controller are redundant, and the control priority of the domain controller is higher than that of the backup controller.

[0032] Among them, the domain controller is mainly based on the whole vehicle operation algorithm and control, and is used to receive the whole vehicle sensor or other system information, including the traffic system network, other vehicles, road conditions, its own whole vehicle sensors, sensors of various systems in the vehicle, etc., for system-level prediction and control, so as to realize unified control and scheduling of various subsystems on the vehicle.

[0033] Among them, the backup controller is used to receive information from other subsystems of the vehicle after the domain controller fails and control the subsystems to move the vehicle to a safe area to wait for rescue to ensure the safety of personnel.

[0034] The first communication channel and the second communication channel are redundant and are used for communication. The communication priority of the first communication channel is higher than that of the second communication channel.

[0035] Among them, the main power supply and the backup power supply are redundant. The main power supply and the backup power supply are connected to the domain controller and each subsystem to provide power for the vehicle.

[0036] Among them, the main power supply has a higher priority than the backup power supply. The main power supply refers to an independent power supply system with an output of 12 volts or other voltages.

[0037] Among them, the backup power supply is connected to the high-voltage battery. The backup power supply refers to an independent power supply provided after the voltage is converted by the high-voltage battery. The backup power supply is completely independent of the main power supply.

[0038] Among them, the backup power supply is used to provide the required power for the vehicle after the main power supply fails.

[0039] Among them, when determining whether the main power supply has failed, the following judgment criteria are observed: if the main power supply voltage is lower than the nominal voltage, it is determined that the main power supply is in failure mode; if the performance of the main power supply is degraded due to the main power supply temperature being too high, it is deemed that the main power supply is not in failure mode; but if the main power supply has no performance and no function due to the main power supply temperature being too high, it is determined that the main power supply is in failure mode.

[0040] Among them, in this application, even if the main power supply fails, each subsystem should have the ability to not enter performance degradation or non-functional mode due to the voltage being lower than the nominal voltage, and in the process of switching from the main power supply to the backup power supply, each subsystem should have the ability to not enter performance degradation or non-functional mode due to the power supply switching.

[0041] Among them, after determining that the main power supply is in failure mode, if the domain controller is still in normal state, an alarm indication (warning light, text reminder, sound reminder, etc.) is issued based on the domain controller to remind the driver to go for inspection and repair of the vehicle, and record the fault code at the same time; if the domain controller is also in a failure state, an alarm indication (warning light, text reminder, sound reminder, etc.) is issued based on the backup controller to remind the driver to go for inspection and repair of the vehicle, and record the fault code at the same time.

[0042] Among them, since the communication priority of the first communication channel is higher than that of the second communication channel, and the control priority of the domain controller is higher than that of the backup controller, in this application, the domain controller + first communication channel is the highest level, and the domain controller + second communication channel or the backup controller + first communication channel is the second priority level.

[0043] The domain controller is also used to: when the vehicle is detected to be in an emergency state, directly send operation instructions (such as opening, closing, adjusting, etc.) to relevant sensors (such as motors, valves or other sensors). After receiving the operation instructions, the relevant sensors directly execute them, and then feedback the execution results to their corresponding subsystems, and the subsystems return the execution feedback information to the domain controller after processing. Thus, the domain controller receives the execution feedback information sent by the subsystem corresponding to the relevant sensor, so as to save the analysis and communication time of each subsystem and improve the execution efficiency of the sensor in an emergency state. This requires the subsystems in the vehicle, such as braking, suspension, and steering, to have good drive interfaces.

[0044] Among them, the domain controller is also used to: when it monitors that the vehicle is in a normal state, send control instructions to the relevant subsystems (when the vehicle is in a normal state, each subsystem also needs to perform corresponding control), and receive execution feedback information sent by the relevant subsystems; wherein the relevant subsystems are used to control the sensors contained in the relevant subsystems based on the control instructions.

[0045] The domain controller preferentially controls each subsystem through the first communication channel. However, when the domain controller detects that the first communication channel is in a failed state, it switches to the second communication channel to uniformly control and schedule the subsystems.

[0046] The judgment logic of whether the first communication channel is invalid is as follows: when the domain controller performs control based on the first communication channel, if it fails to receive feedback information from two or more subsystems, it is determined that the first communication channel is invalid.

[0047] The backup controller keeps command synchronization with the domain controller, that is, the backup controller also needs to know the command sent by the domain controller.

[0048] The domain controller and the backup controller check each other through the first communication channel and the second communication channel to find out whether the other party is in a normal working state.

[0049] Among them, the backup controller regularly sends status verification codes and communication instructions to other subsystems in the vehicle to understand the current status of other subsystems.

[0050] Among them, the high-voltage electric battery is also connected to the power system, and the high-voltage electric battery is used to provide power for the power system.

[0051] Each subsystem is used to receive and execute control instructions sent by the domain controller when the domain controller is in a normal state.

[0052] Among them, each subsystem is used to: when the domain controller is in a failed state, receive and execute the control instructions sent by the backup controller, that is, receive the control instructions sent by the backup controller to move the vehicle to a safe area.

[0053] Among them, for any subsystem, when the subsystem detects that the vehicle is in an abnormal state or that the road ahead of the vehicle is in an abnormal state, it sends abnormal condition parameters to other related subsystems so that other related subsystems can immediately execute risk avoidance measures, and sends abnormal condition parameters to the domain controller respectively, so that the domain controller can quickly know and respond to the abnormality quickly, saving the reaction time of each subsystem and improving the safety of the vehicle.

[0054] The domain controller is also used to: after detecting that any subsystem belonging to the first category is in a failed state (or it can also be understood as a lost node), control the remaining subsystems except the one in the failed state to move the vehicle to a safe area to ensure the safety of personnel and prevent safety accidents.

[0055] Among them, the subsystems belonging to the first category include the power system, braking system and steering system.

[0056] When the domain controller detects that the power system is in a failed state, the domain controller sends instructions to the steering system to steer to a safe roadside area, the braking system to slow down, and the suspension system to control the vehicle body to return to the nominal suspension position or the position required by the domain controller.

[0057] When the domain controller detects that the brake system is in a failed state, the domain controller uses the power motor to reverse the vehicle to slow down, pulls up the parking caliper to stop the vehicle, the steering system controls the vehicle to a safe area, and the suspension system controls the vehicle body to the nominal suspension position or the position required by the domain controller.

[0058] When the domain controller detects that the steering system is in a failed state, the domain controller reduces the motor drive torque and applies different deflection torques to the vehicle drive wheels to stop the vehicle in a safe area such as the roadside. The suspension system controls the vehicle body to the nominal suspension position or the position required by the domain controller.

[0059] The domain controller is further used for: after detecting that any subsystem belonging to the second category is in a failed state, restricting the relevant functions of the subsystem in the failed state.

[0060] Among them, the subsystems belonging to the second category include suspension systems, intelligent driving systems, and other auxiliary systems.

[0061] When the domain controller detects that the suspension system is in a failed state, it will limit some functions of the vehicle, including but not limited to reasonable restrictions on driving mode or pedal feel, and inform the driver in the form of text, sound, images, etc. at relevant locations such as the instrument panel to repair it as soon as possible.

[0062] When the domain controller detects that the intelligent driving system is in a failed state, the domain controller will limit some functions of the vehicle, including but not limited to automatic driving and automatic parking, etc., and inform the driver in the form of text, sound, images, etc. at relevant locations such as the instrument panel to carry out repairs as soon as possible.

[0063] When the domain controller detects that other auxiliary systems are in a failed state, based on the specific form of failure, the domain controller will limit some functions of the vehicle, such as, but not limited to, vehicle entertainment functions, power output to the grid, etc., and inform the driver in the form of text, sound, images, etc. at relevant locations such as the instrument panel to repair as soon as possible.

[0064] The judgment logic of whether any subsystem fails is as follows: if the domain controller cannot receive feedback information of the subsystem but can receive feedback information of other subsystems except the subsystem, the subsystem is determined to be failed.

[0065] Among them, each subsystem should have the ability to resend the current status to the domain controller when the failure of the subsystem is resolved.

[0066] The domain controller is also used to: if it is detected that a vehicle accident has occurred and the output torque of the vehicle's power system is greater than a preset torque threshold, send a stop operation instruction to the braking system, and cut off the power of the power system or reduce the output torque of the power system to ensure the safety of people on the vehicle.

[0067] The domain controller is also used to: if it is detected that the vehicle is in operation and the driver's seat is unoccupied, and the vehicle is not in automatic driving or automatic parking, then cut off the power of the power system to ensure the safety of the people on board and the vehicle.

[0068] Among them, in this application, other auxiliary systems can expand their own functions according to the instructions of the domain controller.

[0069] The vehicle control system proposed in the present application introduces a redundant design of a main power supply and a backup power supply, a domain controller and a backup controller, a first communication channel and a second communication channel, to ensure that the vehicle control system can continue to work when any part fails, especially after the domain controller fails, the backup controller can take over control to ensure that the vehicle can be safely moved to a predetermined safe area; the main power supply and the backup power supply are mutually redundant, the main power supply has priority power supply, and the backup power supply takes over when the main power supply fails, to ensure that the system can continue to work in the event of a power failure, to avoid vehicle loss of control due to insufficient power; the domain controller can monitor the emergency status of the vehicle and actively send operating instructions to relevant sensors, so as to quickly respond to and dispatch the various subsystems of the vehicle, take necessary safety measures in time, and reduce losses caused by emergency situations; the domain controller is responsible for unified control and scheduling of the subsystems, to ensure that the various subsystems work in coordination and improve the efficiency and stability of the overall system; when the domain controller fails, the backup controller can take over scheduling to ensure the continuity and safety of vehicle operations.

[0070] In the description of the present application, it should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise", "axial", "radial", "circumferential" and the like indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present application and simplifying the description, and do not indicate or imply that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present application.

[0071] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0072] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0073] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A vehicle control system, characterized in that: It includes a main power supply, a backup power supply, a high-voltage battery, a domain controller and multiple subsystems, wherein the multiple subsystems include a braking system and other subsystems, and the braking system serves as a backup controller, wherein: The domain controller is connected to the multiple subsystems via a first communication channel, and the backup controller is connected to the domain controller and the other subsystems via a second communication channel; The domain controller and the backup controller are mutually redundant, the control priority of the domain controller is higher than that of the backup controller, the domain controller is used to uniformly control and schedule the subsystem, and the backup controller is used to control the subsystem to move the vehicle to a safe area after the domain controller fails; The first communication channel and the second communication channel are redundant with each other and are used for communication, and the communication priority of the first communication channel is higher than that of the second communication channel; The main power supply and the backup power supply are mutually redundant, the power supply priority of the main power supply is higher than that of the backup power supply, and the backup power supply is used to provide the required power for the vehicle after the main power supply fails; The domain controller is also used to send operation instructions to relevant sensors when it is detected that the vehicle is in an emergency state, and receive execution feedback information sent by the subsystem corresponding to the relevant sensor.

2. The system according to claim 1, characterized in that The backup power supply is connected to the high-voltage battery, and the backup power supply refers to an independent power supply provided after the voltage is converted by the high-voltage battery.

3. The system according to claim 2, characterized in that The domain controller is also used to: When it is detected that the vehicle is in a normal state, a control instruction is sent to a relevant subsystem, and execution feedback information sent by the relevant subsystem is received; Wherein, the related subsystem is used to control the sensor included in the related subsystem based on the control instruction.

4. The system according to claim 3, characterized in that The domain controller is also used to: After detecting that the first communication channel is in a failed state, the second communication channel is switched to perform unified control and scheduling of the subsystem.

5. The system according to claim 4, characterized in that The backup controller keeps instruction synchronization with the domain controller.

6. The system according to claim 5, characterized in that The other subsystems include a power system, and the high-voltage battery is also connected to the power system. The high-voltage battery is used to provide power for the power system.

7. The system according to claim 6, characterized in that The subsystem is used to: When the domain controller is in a normal state, receiving and executing a control instruction sent by the domain controller; and, When the domain controller is in a failed state, a control instruction sent by the backup controller is received and executed.

8. The system according to claim 7, characterized in that The domain controller is also used to: After any subsystem belonging to the first category is detected to be in a failure state, controlling the remaining subsystems except the subsystem in the failure state to move the vehicle to a safe area; as well as, After any subsystem belonging to the second category is detected to be in a failure state, related functions of the subsystem in the failure state are restricted.

9. The system according to claim 8, characterized in that The subsystem is also used to: After monitoring that the vehicle is in an abnormal state or monitoring that the road ahead of the vehicle is in an abnormal state, abnormal condition parameters are sent to other related subsystems and the domain controller.

10. The system according to claim 9, characterized in that The domain controller is also used to: In response to monitoring that the vehicle has had an accident and the output torque of the power system of the vehicle is greater than a preset torque threshold, sending a stop operation instruction to the brake system, and cutting off the power of the power system or reducing the output torque of the power system; In response to monitoring that the vehicle is in a running state and the driver's seat of the vehicle is unmanned, and the vehicle is not in an automatic driving state or an automatic parking state, the power of the power system is cut off.

Images