A vehicle control system

Abstract

The application provides a vehicle control system and relates to the technical field of vehicles.The system comprises a main power supply, a backup power supply, a high-voltage storage battery, a domain controller and a plurality of subsystems, the plurality of subsystems comprise a braking system and other subsystems, the braking system serves as a backup controller, the domain controller is connected with the plurality of subsystems through a first communication channel, and the backup controller is connected with the domain controller and the other subsystems through a second communication channel; the domain controller and the backup controller are redundant to each other, the control priority of the domain controller is higher than that of the backup controller, the domain controller is used for unified control and scheduling of the subsystems, and the backup controller is used for controlling the subsystems to move the vehicle to a safe area after the domain controller fails; the first communication channel and the second communication channel are redundant to each other, the communication priority of the first communication channel is higher than that of the second communication channel; and the main power supply and the backup power supply are redundant to each other, and the power supply priority of the main power supply is higher than that of the backup power supply.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of vehicles, in particular to a vehicle control system. BACKGROUND

[0002] With the rapid development of automatic driving technology and intelligent transportation systems, the safety and reliability of vehicles have become the focus of the industry. Modern vehicles not only need to have high-precision perception and decision-making capabilities, but also need to be able to operate stably in various complex environments to ensure the safety of passengers and road users. SUMMARY

[0003] The present application aims to at least partially solve one of the technical problems in the related art.

[0004] To this end, one object of the present application is to provide a vehicle control system, comprising a main power supply, a backup power supply, a high-voltage electric storage battery, a domain controller and a plurality of subsystems, the plurality of subsystems comprising a braking system and other subsystems, the braking system serving as a backup controller, wherein: the domain controller is connected to the plurality of subsystems through a first communication channel, and the backup controller is connected to the domain controller and the other subsystems through a second communication channel; the domain controller and the backup controller are redundant to each other, the control priority of the domain controller is higher than that of the backup controller, the domain controller is used for unified control and scheduling of the subsystems, and the backup controller is used for controlling the subsystems to move the vehicle to a safe area after the domain controller fails; the first communication channel and the second communication channel are redundant to each other and are used for communication, the communication priority of the first communication channel is higher than that of the second communication channel; the main power supply and the backup power supply are redundant to each other, the power supply priority of the main power supply is higher than that of the backup power supply, and the backup power supply is used to provide the required power for the vehicle after the main power supply fails, and the domain controller is further used for: sending operation instructions to related sensors when monitoring that the vehicle is in an emergency state, and receiving execution feedback information sent by corresponding subsystems of the related sensors.

[0005] In some implementable ways, the backup power supply is connected to the high-voltage electric storage battery, and the backup power supply refers to an independent power supply provided after the voltage of the high-voltage electric storage battery is converted.

[0006] In some implementable ways, the domain controller is further used for: sending control instructions to related subsystems when monitoring that the vehicle is in a normal state, and receiving execution feedback information sent by the related subsystems; wherein the related subsystems are used for controlling sensors contained in the related subsystems based on the control instructions.

[0007] In some implementable ways, the domain controller is further used for: after monitoring that the first communication channel is in a failure state, switching to the second communication channel to perform unified control and scheduling of the subsystems.

[0008] In some possible implementation manners, the backup controller is kept in instruction synchronization with the domain controller.

[0009] In some possible implementation manners, the other subsystems include a power system, and the high-voltage electric storage battery is further connected with the power system, and the high-voltage electric storage battery is configured to provide power for the power system.

[0010] In some possible implementation manners, the subsystems are configured to: when the domain controller is in the normal state, receive and execute the control instructions sent by the domain controller; and when the domain controller is in the failure state, receive and execute the control instructions sent by the backup controller.

[0011] In some possible implementation manners, the domain controller is further configured to: after monitoring that any subsystem belonging to the first category is in the failure state, control the remaining subsystems other than the subsystem in the failure state to move the vehicle to a safe area; and after monitoring that any subsystem belonging to the second category is in the failure state, limit the related functions of the subsystem in the failure state.

[0012] In some possible implementation manners, the subsystems are further configured to: after monitoring that the vehicle is in an abnormal state or monitoring that the road in front of the vehicle is in an abnormal state, send an abnormal state parameter to other related subsystems and the domain controller.

[0013] In some possible implementation manners, the domain controller is further configured to: in response to monitoring that the vehicle has been involved in an accident and the output torque of the power system of the vehicle is greater than a preset torque threshold, send a stop running instruction to the braking system, and cut off the power of the power system or reduce the output torque of the power system; and in response to monitoring that the vehicle is in a running state and the driver seat of the vehicle is in an unoccupied state, and the vehicle is not in an automatic driving state or an automatic parking state, cut off the power of the power system.

[0014] The vehicle control system provided in the application introduces the redundant design of the main power supply and the backup power supply, the domain controller and the backup controller, the first communication channel and the second communication channel, ensures that the vehicle control system can continue to work when any part fails, especially when the domain controller fails, the backup controller can take over the control to ensure that the vehicle can safely move to the predetermined safe area; the main power supply and the backup power supply are redundant to each other, the main power supply is preferentially powered, and the backup power supply takes over when the main power supply fails, ensuring that the system can continue to work when the power supply fails, avoiding vehicle out of control due to power shortage; the domain controller can monitor the emergency state of the vehicle and actively send operation instructions to the related sensors, so as to quickly respond and schedule each subsystem of the vehicle, take necessary safety measures in time, and reduce the loss caused by the emergency; the domain controller is responsible for the unified control and scheduling of the subsystems, ensuring the cooperative work of each subsystem and improving the efficiency and stability of the overall system; when the domain controller fails, the backup controller can take over the scheduling to ensure the continuity and safety of the vehicle operation. BRIEF DESCRIPTION OF DRAWINGS

[0015] The above and / or additional aspects and advantages of the application will become apparent and more readily appreciated from the following description, taken in conjunction with the accompanying drawings, in which:

[0016] Figure 1 is a schematic diagram of a vehicle control system according to an embodiment of the application. DETAILED DESCRIPTION

[0017] Embodiments of the application are described in detail below with reference to examples illustrated in the accompanying drawings, in which the same or similar reference signs represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by reference to the accompanying drawings are exemplary and are intended to explain the application, and cannot be understood as limiting the application.

[0018] Figure 1 is a schematic diagram of a vehicle control system according to an embodiment of the application. Figure 1 As shown in the figure, the vehicle control system comprises a main power supply, a backup power supply, a high-voltage storage battery, a domain controller and a plurality of subsystems, the plurality of subsystems comprising a braking system and other subsystems Figure 1 The other subsystems shown in the figure in addition to the braking system include a power system, a steering system, a suspension system, an intelligent driving system and other auxiliary systems.

[0019] First, each subsystem involved in the application will be briefly introduced below:

[0020] 1. In some embodiments, the power system refers to the whole vehicle driving form powered by pure electricity or other equipment with high-voltage storage battery as power or auxiliary power.

[0021] 2、In some embodiments, the brake system refers to a brake system equipped with hydraulic, pneumatic or other typical modes such as electromechanical brake (EMB) or hybrid brake.

[0022] 3、In some embodiments, the steering system refers to a steering system with front wheel steering, rear wheel steering, four-wheel steering, multi-wheel steering, and with motor drive, hydraulic drive or hybrid drive as the control mode.

[0023] 4、In some embodiments, the suspension system refers to a suspension system with air, hydraulic, electromagnetic, other media or hybrid media as the control mode.

[0024] 5、In some embodiments, the intelligent driving system refers to the intelligent driving L1, L2, L3, L4, L5 and other automatic driving solutions defined by the Society of Automotive Engineers (SAE), including corresponding radar, camera, intelligent driving controller and other solutions for different solutions.

[0025] 6、In some embodiments, the other auxiliary system refers to systems such as body control, thermal management control, entertainment system, etc.

[0026] In this application, the brake system is used as a backup controller.

[0027] As shown in Figure 1 , the domain controller is connected with multiple subsystems through a first communication channel. The domain controller and the multiple subsystems can communicate based on the first communication channel.

[0028] The first communication channel can be a Controller Area Network (CAN), a Controller Area Network Flexible Data-rate (CANFD) or other forms.

[0029] As shown in Figure 1 , the backup controller is connected with the domain controller and other subsystems through a second communication channel. The backup controller, the domain controller and the other subsystems can communicate based on the second communication channel.

[0030] The second communication channel can be a CAN, a CANFD or other forms.

[0031] The domain controller and the backup controller are redundant to each other, and the control priority of the domain controller is higher than that of the backup controller.

[0032] The domain controller is mainly used for vehicle operation algorithm and control, receives information of vehicle sensors or other systems, including traffic system network, other vehicles, road conditions, vehicle sensors and in-vehicle system sensors, and is used for system-level prediction and control, so as to realize unified control and scheduling of each subsystem on the vehicle.

[0033] The backup controller is used to receive information of other vehicle subsystems and control the subsystems to move the vehicle to a safe area and wait for rescue after the domain controller fails, so as to ensure personnel safety.

[0034] The first communication channel and the second communication channel are redundant to each other and are used for communication, and the communication priority of the first communication channel is higher than that of the second communication channel.

[0035] The main power supply and the backup power supply are redundant to each other, and the main power supply and the backup power supply are connected with the domain controller and each subsystem, and are used to provide power for the vehicle.

[0036] The power supply priority of the main power supply is higher than that of the backup power supply, and the main power supply refers to an independent power supply system with an output voltage of 12 volts or other voltages.

[0037] The backup power supply is connected with the high-voltage storage battery, and the backup power supply refers to an independent power supply converted from the high-voltage storage battery, and the backup power supply is completely independent of the main power supply.

[0038] The backup power supply is used to provide the required power for the vehicle after the main power supply fails.

[0039] When determining whether the main power supply fails, the following determination criteria are followed: if the main power supply voltage is lower than the nominal voltage, it is determined that the main power supply is in a failure mode; if the performance of the main power supply is degraded due to high temperature, it is considered that the main power supply is not in a failure mode; but if the main power supply has no performance and no function due to high temperature, it is determined that the main power supply is in a failure mode.

[0040] In this application, even if the main power supply fails, each subsystem should have the ability not to enter a performance degradation or no function mode due to voltage lower than the nominal voltage, and during the switching from main power supply to backup power supply, each subsystem should have the ability not to enter a performance degradation or no function mode due to power supply switching.

[0041] Wherein, when the main power supply is determined to be in the failure mode, if the domain controller is also in the normal state, the domain controller sends an alarm indication (such as an alarm light, a text reminder, a sound reminder, etc.) to remind the driver to take the vehicle to the inspection and maintenance, and record the fault code; if the domain controller is also in the failure state, the backup controller sends an alarm indication (such as an alarm light, a text reminder, a sound reminder, etc.) to remind the driver to take the vehicle to the inspection and maintenance, and record the fault code.

[0042] Wherein, since the communication priority of the first communication channel is higher than that of the second communication channel, and the control priority of the domain controller is higher than that of the backup controller, in this application, the domain controller + the first communication channel is the highest level, and the domain controller + the second communication channel or the backup controller + the first communication channel is the second level.

[0043] Wherein, the domain controller is further configured to: when it is monitored that the vehicle is in an emergency state, directly send an operation instruction (such as an opening, closing, adjusting, etc. instruction) to a related sensor (such as a motor, a valve or other sensor), the related sensor directly executes after receiving the operation instruction, then feeds back the execution result to the corresponding subsystem, and the subsystem returns the execution feedback information to the domain controller after processing, so that the domain controller receives the execution feedback information sent by the corresponding subsystem of the related sensor, to save the analysis and communication time of each subsystem, and improve the execution efficiency of the sensor in the emergency state. Each subsystem in the vehicle, such as braking, suspension and steering, needs to have a good driving interface.

[0044] Wherein, the domain controller is further configured to: when it is monitored that the vehicle is in a normal state, send a control instruction to a related subsystem (each subsystem also needs to be controlled when the vehicle is in a normal state), and receive execution feedback information sent by the related subsystem; wherein, the related subsystem is configured to control the sensor contained in the related subsystem based on the control instruction.

[0045] Wherein, the domain controller preferentially controls each subsystem through the first communication channel, but when the domain controller monitors that the first communication channel is in a failure state, it switches to the second communication channel to control and schedule the subsystems.

[0046] Wherein, the judgment logic of whether the first communication channel is failure is: when the domain controller controls based on the first communication channel, if the feedback information of 2 or more subsystems cannot be received, it is determined that the first communication channel is failure.

[0047] Wherein, the backup controller and the domain controller keep the instruction synchronization, that is, the backup controller also needs to know the instruction sent by the domain controller.

[0048] The domain controller and the backup controller check each other through the first communication channel and the second communication channel to know whether the other party is in a normal working state.

[0049] The backup controller periodically sends a state check code and a communication instruction to each other subsystem in the vehicle to know the current state of the other subsystem.

[0050] The high-voltage battery is also connected to the power system, and the high-voltage battery is used to provide power for the power system.

[0051] Each subsystem is configured to receive and execute the control instruction sent by the domain controller when the domain controller is in a normal state.

[0052] Each subsystem is configured to receive and execute the control instruction sent by the backup controller when the domain controller is in a failure state, that is, to receive the control instruction sent by the backup controller to move the vehicle to a safe area.

[0053] For any subsystem, when the subsystem monitors that the vehicle is in an abnormal state or that the road in front of the vehicle is in an abnormal state, the subsystem sends an abnormal condition parameter to other related subsystems to enable the other related subsystems to immediately execute a risk avoidance measure, and the subsystem sends the abnormal condition parameter to the domain controller, respectively, to enable the domain controller to quickly know and respond to the abnormality, save the reaction time of each subsystem, and improve the safety of the vehicle.

[0054] The domain controller is also configured to control the remaining subsystems except for the subsystem in the failure state to move the vehicle to a safe area to ensure personnel safety and prevent safety accidents after monitoring that any subsystem belonging to the first category is in a failure state (or can also be understood as a lost node).

[0055] The subsystems belonging to the first category include the power system, the braking system, and the steering system.

[0056] When the domain controller monitors that the power system is in a failure state, the domain controller sends a command to the steering system to steer to a roadside safe area, the braking system to slow down, and the suspension system to control the vehicle body to return to a nominal suspension position or a domain controller required position.

[0057] When the domain controller monitors that the braking system is in a failure state, the domain controller slows down the vehicle by reversing the power motor, raises the parking caliper to stop the vehicle, controls the vehicle to a safe area by the steering system, and controls the vehicle body to a nominal suspension position or a domain controller required position by the suspension system.

[0058] When the domain controller monitors that the steering system is in a failure state, the domain controller reduces the motor driving torque, the vehicle driving wheel applies different deflection torque, the vehicle stops in a safe area such as a roadside, and the suspension system controls the vehicle body to a nominal suspension position or a domain control required position.

[0059] The domain controller is further configured to limit the related function of the subsystem in the failure state after monitoring that any subsystem belonging to the second category is in the failure state.

[0060] The subsystems belonging to the second category include a suspension system, an intelligent driving system, and other auxiliary systems.

[0061] When the domain controller monitors that the suspension system is in a failure state, the domain controller limits part of the functions of the vehicle, including but not limited to reasonably limiting the driving mode or pedal feeling, and informs the driver in the form of text, sound, image, etc. at a related position such as an instrument, and the driver is asked to repair as soon as possible.

[0062] When the domain controller monitors that the intelligent driving system is in a failure state, the domain controller limits part of the functions of the vehicle, including but not limited to automatic driving of the vehicle and automatic parking of the vehicle, and informs the driver in the form of text, sound, image, etc. at a related position such as an instrument, and the driver is asked to repair as soon as possible.

[0063] When the domain controller monitors that the other auxiliary system is in a failure state, according to the specific failure form, the domain controller limits part of the functions of the vehicle, such as but not limited to the entertainment function of the vehicle and the output of electric energy to the power grid, and informs the driver in the form of text, sound, image, etc. at a related position such as an instrument, and the driver is asked to repair as soon as possible.

[0064] The judgment logic of whether any subsystem is in a failure state is that if the domain controller cannot receive feedback information of the subsystem but can receive feedback information of other subsystems except the subsystem, it is determined that the subsystem is in a failure state.

[0065] Each subsystem should have the ability to send the current state to the domain controller again after the failure of the subsystem is removed.

[0066] The domain controller is further configured to send a stop running instruction to the braking system and cut off the power of the power system or reduce the output torque of the power system to ensure the safety of the people on the vehicle if it is monitored that the vehicle has been in an accident and the output torque of the power system of the vehicle is greater than a preset torque threshold.

[0067] The domain controller is further configured to cut off the power of the power system to ensure the safety of the people on the vehicle and the safety of the vehicle if it is monitored that the vehicle is in a running state, the driver seat of the vehicle is in an unoccupied state, and the vehicle is not in an automatic driving state or an automatic parking state.

[0068] In the present application, other auxiliary systems can extend their functions according to the instructions of the domain controller.

[0069] The vehicle control system proposed in the present application introduces the redundant design of the main power supply and the backup power supply, the domain controller and the backup controller, the first communication channel and the second communication channel, ensuring that the vehicle control system can continue to work when any part fails, especially when the domain controller fails, the backup controller can take over the control, ensuring that the vehicle can safely move to the predetermined safe area; the main power supply and the backup power supply are redundant to each other, the main power supply is preferentially powered, and the backup power supply takes over when the main power supply fails, ensuring that the system can continue to work when the power supply fails, avoiding the loss of vehicle control due to power shortage; the domain controller can monitor the emergency state of the vehicle and actively send operation instructions to related sensors, so as to quickly respond and dispatch each subsystem of the vehicle, take necessary safety measures in time, and reduce the loss caused by emergency situations; the domain controller is responsible for the unified control and scheduling of the subsystems, ensuring the cooperative work of each subsystem and improving the efficiency and stability of the overall system; when the domain controller fails, the backup controller can take over the scheduling, ensuring the continuity and safety of the vehicle operation.

[0070] In the description of the present application, it should be understood that the terms "center", "longitudinal", "transverse", "length", "width", "thickness", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", "clockwise", "counterclockwise", "axial", "radial", "circumferential" and the like indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present application and simplifying the description, and do not indicate or imply that the device or element referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as a limitation on the present application.

[0071] In addition, the terms "first", "second" are only for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the technical features indicated. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more of the features. In the description of the present application, the meaning of "multiple" is two or more, unless otherwise specifically limited.

[0072] In the description of the specification, the description using the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" etc. means that the particular feature, structure, material or characteristic being described is included in at least one embodiment or example of the present application. The illustrative appearances of the above-mentioned terms in various places in the specification are not necessarily referred to the same embodiment or example. Moreover, the particular features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples. Furthermore, the terms "comprise", "comprising", "include", "including", "contain", "containing" or variations thereof are used inclusively and do not exclude the additional inclusion of unrecited features, structures, materials, or characteristics. In addition, it is understood that the description of the present application is not intended to limit the application to the particular form and embodiment disclosed herein; various modifications, equivalents, and alternatives, etc. of the embodiments described herein can be made by those skilled in the art without departing from the scope of the application.

[0073] Although the embodiments of the present application have been shown and described above, it is understood that the above-described embodiments are exemplary and are not to be interpreted as limiting the present application, and ordinary skilled in the art can make changes, modifications, replacements and variations to the above-described embodiments within the scope of the present application.

Claims

1. A vehicle control system characterized by comprising: The system comprises a main power supply, a backup power supply, a high-voltage battery, a domain controller and a plurality of subsystems, the plurality of subsystems comprising a braking system and other subsystems, the braking system serving as a backup controller, wherein: The domain controller is connected with the plurality of subsystems through a first communication channel, and the backup controller is connected with the domain controller and the other subsystems through a second communication channel; The domain controller and the backup controller are redundant to each other, the control priority of the domain controller is higher than that of the backup controller, the domain controller is configured to control and schedule the plurality of subsystems, and the backup controller is configured to control the plurality of subsystems to move the vehicle to a safe area when the domain controller fails; The first communication channel and the second communication channel are redundant to each other and are used for communication, and the communication priority of the first communication channel is higher than that of the second communication channel; The main power supply and the backup power supply are redundant to each other, the power supply priority of the main power supply is higher than that of the backup power supply, and the backup power supply is configured to provide required power for the vehicle when the main power supply fails; The domain controller is further configured to send an operation instruction to a related sensor when it is monitored that the vehicle is in an emergency state, and receive execution feedback information sent by a corresponding subsystem of the related sensor.

2. The system of claim 1, wherein, The backup power supply is connected with the high-voltage battery, and the backup power supply is an independent power supply converted from the high-voltage battery.

3. The system of claim 2, wherein, The domain controller is further configured to: send a control instruction to a related subsystem when it is monitored that the vehicle is in a normal state, and receive execution feedback information sent by the related subsystem; The related subsystem is configured to control a sensor included in the related subsystem based on the control instruction.

4. The system of claim 3, wherein, The domain controller is further configured to: switch to the second communication channel to control and schedule the plurality of subsystems after it is monitored that the first communication channel is in a failure state.

5. The system of claim 4, wherein, The backup controller and the domain controller keep instruction synchronization.

6. The system of claim 5, wherein, The other subsystems include a power system, and the high-voltage battery is further connected with the power system, and the high-voltage battery is configured to provide power for the power system.

7. The system of claim 6, wherein, The plurality of subsystems are configured to: receive and execute a control instruction sent by the domain controller when the domain controller is in a normal state; and receive and execute a control instruction sent by the backup controller when the domain controller is in a failure state.

8. The system of claim 7, wherein, The domain controller is further configured to: control the remaining subsystems except for the subsystem in the failure state to move the vehicle to a safe area after it is monitored that any subsystem belonging to a first category is in a failure state; and limit a related function of the subsystem in the failure state after it is monitored that any subsystem belonging to a second category is in a failure state. The plurality of subsystems are further configured to:

9. The system of claim 8, wherein, send an abnormal condition parameter to other related subsystems and the domain controller after it is monitored that the vehicle is in an abnormal state or that a road in front of the vehicle is in an abnormal state. The domain controller is further configured to:

10. The system of claim 9, wherein, ​ in response to monitoring that the vehicle has occurred accident and the output torque of the power system of the vehicle is greater than a preset torque threshold, sending a stop running instruction to the brake system, and cutting off power of the power system or reducing the output torque of the power system; in response to monitoring that the vehicle is in a running state and the driver seat of the vehicle is in an unoccupied state, and the vehicle is not in an automatic driving state or an automatic parking state, cutting off the power of the power system.

Images