Vehicle component switching method, computer readable storage medium and program product

Abstract

The invention provides a component switching method of a vehicle, a computer readable storage medium and a program product, the vehicle is deployed with a main system and a standby system, and a main component in the main system and / or a standby component in the standby system maintain a mapping relation between the main component and the standby component with the same function. The mapping relation is created based on a disassembling result of a preset function safety target; the method comprises the steps that under the condition that it is determined that the working state of any main component is abnormal, a target standby component corresponding to the main component in the standby system is determined according to the mapping relation; and any main component is switched to the target standby component, so that the target standby component replaces any main component to work.

Description

Technical Field

[0001] The present specification relates to the field of vehicle control technology, and in particular to a vehicle component switching method, a computer-readable storage medium, and a program product. Background Art

[0002] In the scenario of autonomous driving, a redundant system refers to a technical architecture that uses multiple backup components to replace the corresponding main components when they fail to maintain the safe operation of the vehicle. Its role is to eliminate the risk of single point failure and ensure the minimum safe operation capability. Taking the current mainstream autonomous driving levels L3 and L4 as examples, the former basically only implements basic redundancy such as braking and steering. Although the latter lists power redundancy as a necessary redundancy due to the safety needs of highly autonomous driving, the industry currently lacks a complete set of architectural standards for vehicle redundant systems, resulting in blind spots in the coverage of safety scenarios in existing redundant systems, making it difficult to effectively deal with the risk of failure under complex working conditions. Summary of the invention

[0003] In view of this, the present specification provides a vehicle component switching method, a computer-readable storage medium and a program product to address the deficiencies in the related art.

[0004] Specifically, this specification is implemented through the following technical solutions: According to a first aspect of the present specification, a component switching method of a vehicle is provided, wherein the vehicle is deployed with a main system and a backup system, and a mapping relationship between a main component in the main system and / or a backup component in the backup system is maintained between the main component and the backup component having the same function, and the mapping relationship is created based on a disassembly result of a preset functional safety target; the method comprises: In the case where it is determined that the working state of any main component is abnormal, determining a target standby component in the standby system corresponding to the any main component according to the mapping relationship; Any one of the main components is switched to the target spare component, so that the target spare component replaces the any one of the main components to work.

[0005] According to a second aspect of the present specification, there is provided a computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the steps of the method described in the first aspect.

[0006] According to a third aspect of this specification, a computer program product includes a computer program / instruction, which implements the steps of the method described in the first aspect when executed by a processor.

[0007] The vehicle in the present application may be deployed with a main system and a backup system. The main components in the main system and / or the backup components in the backup system may maintain a mapping relationship between the main components and the backup components with the same functions. In the event of an abnormality in the working state of any main component, the target backup component corresponding to the abnormal main component can be quickly located from the backup system according to the mapping relationship, and then the abnormal main component and the target backup component are switched so that the target backup component replaces the abnormal main component and continues to work normally. The above mapping relationship is created based on the disassembly results of the preset functional safety goals. In other words, which components in the vehicle are the main components and which components are the corresponding backup components can be uniformly determined by the predetermined functional safety goals, and then a complete set of architecture standards is specified around the functional safety goals, covering the scenario blind spots caused by the lack of systematic architecture design in traditional solutions, and avoiding the risk of failure under complex working conditions. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In order to more clearly illustrate the technical solution of this specification, the following is a brief introduction to the drawings required for use in the embodiments or prior art descriptions. Obviously, the drawings described below are only some embodiments of this specification, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0009] Figure 1 It is a schematic diagram of the architecture of a component switching system of a vehicle shown in the embodiment disclosed in this specification; Figure 2 is a flow chart of a vehicle component switching method shown in an embodiment disclosed in this specification; Figure 3a~Figure 3c It is a schematic diagram of the architecture of the communication system between redundant components of a vehicle shown in the embodiment disclosed in this specification; Figure 4 It is a schematic diagram of the architecture of a vehicle redundant component shown in the embodiment disclosed in this specification; Figure 5 is a schematic structural diagram of an electronic device shown in an embodiment of this specification; Figure 6 It is a block diagram of a component switching device for a vehicle shown in an embodiment of this specification. DETAILED DESCRIPTION

[0010] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with this specification. Instead, they are merely examples of devices and methods consistent with some aspects of this specification.

[0011] The terms used in this specification are for the purpose of describing specific embodiments only and are not intended to limit this specification. The singular forms "a", "the" and "the" used in this specification and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0012] It should be understood that although the terms first, second, third, etc. may be used in this specification to describe various information, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of this specification, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0013] The following is a detailed description of an embodiment of a vehicle component switching method of the present specification with reference to the accompanying drawings.

[0014] Figure 1 Schematic diagram of the architecture of a vehicle component switching system shown in the embodiment disclosed in this specification. Figure 1 As shown, the system may include a vehicle 10 , a primary system 11 , and an auxiliary system 12 .

[0015] The vehicle 10 is the carrier for implementing the component switching function in this specification. It builds a redundant architecture through the main system 11 and auxiliary system 12 deployed by itself to ensure the realization of the vehicle's functional safety goal. Specifically, the vehicle 10 is actually equipped with main system components that perform preset functions and corresponding spare components. The mapping relationship established between the components based on the functional safety goals after disassembly forms a switchable logical link. When an abnormality occurs in the main system component, the vehicle 10 can call the spare components of the auxiliary system 12 for functional replacement by executing the corresponding switching mechanism, thereby ensuring the continuity and reliability of the vehicle's operating functions. Among them, the above-mentioned vehicle 10 can be a fuel vehicle, a hybrid vehicle, an electric vehicle, etc., based on different power types and with automatic driving capabilities, and this specification does not limit this.

[0016] The main system 11 is a core execution unit for realizing vehicle functions, which may include m main components, where m is a positive integer. Specifically, the main component may store mapping relationship data of spare components with equivalent functions according to actual conditions, so that when the working state of any main component is abnormal, the corresponding target spare component in the auxiliary system 12 can be quickly located based on the preset mapping relationship data, and the abnormal main component and the backup component can be switched to achieve seamless replacement of the faulty component.

[0017] The auxiliary system 12 serves as a redundant backup unit for the main system 11, which may include n backup components with the same functions as the main components in the main system 11, where n is a positive integer greater than or equal to m. Each backup component forms a one-to-one or many-to-one logical association with the main component through a predefined mapping relationship. For example, backup component A only corresponds to main component B, and backup components C and D both correspond to main component E.

[0018] It is worth mentioning that in addition to the main components, there may be other components in the main system. There are no backup components with the same functions as the above-mentioned other components in the above-mentioned backup system. Of course, the above-mentioned other components can be regarded as having met the above-mentioned functional safety goals, so there is no need to adopt the non-redundant design of the above-mentioned backup components.

[0019] To facilitate the subsequent introduction, this manual explains the relevant technologies around the concept of functional safety goals in advance: Functional safety goals are a core safety criterion based on systematic risk assessment and hazard analysis, which aims to ensure that the vehicle's electronic and electrical systems can maintain an acceptable level of safety when a failure occurs. Specifically, taking the international standard ISO 26262 as an example, after designing and clarifying the functional boundaries, operating environment and interaction between the system or component and other systems, automobile manufacturers can list the possible failure modes of the system and the dangerous events caused by them based on hazard analysis and risk assessment (HARA). For example, failure of the steering system may cause the vehicle to lose control. Then, the above dangerous events are quantified and scored from three dimensions: severity (Severity, S), exposure probability (Exposure, E), and controllability (Controllability, C). Then, the corresponding Automotive Safety Integrity Level (ASIL) is obtained based on the scores of each dimension. The ASIL level is specifically divided into QM (Quality Management, Quality management), A, B, C and D, and the strictness of the safety requirements increases in the above order. For example, if the brake failure causes a fatal accident and is difficult to control, it needs to be assigned ASIL D, or if the failure of the interior lighting system or window control has little impact on safety, it can be assigned ASIL A.

[0020] After determining the ASIL level of the dangerous event, the corresponding quantitative indicators such as fault tolerance rate, failure probability and response time can be formulated to form a real functional safety goal, such as "prevent unexpected braking failure, ensure that the parking brake force is ≥500 N·m, and the switching time is ≤300 ms". However, functional safety goals such as "prevent unexpected braking failure" and "avoid unexpected loss of lateral motion control" are too abstract and cannot directly guide the engineering design of the vehicle. Therefore, they can be disassembled step by step until the concrete minimum functional safety goal is achieved. For the convenience of describing the disassembly results, which are uniformly referred to as functional safety goals below, such as the chip-level redundancy requirements of the circuit board, of course, the embodiments in this specification focus on the redundant architecture design of the bill of materials (BOM) layer of the whole vehicle, and mainly consider whether the selection, layout, interface and other aspects of the parts meet the safety requirements of the whole vehicle, and do not need to go into the details of the specific design inside the chip. For example, if there is an original functional safety goal of "when the main controller of the braking system fails, it is necessary to switch to the backup controller within 10ms to maintain ≥50% braking force, ASIL D", then the main controller and the backup controller can be designed as independent heterogeneous units, in which although the ASIL level of the functional safety goal corresponding to each controller is reduced to ASIL C, the two can meet the ASILD requirements after coordination, and finally achieve the effect of decomposing ASIL D into ASIL C + ASIL C. On this basis, the main controller of the disassembly result of the original functional safety goal in the above example can be used as the main component in the main system, and the backup controller can be used as the backup component in the backup system, and a mapping relationship between the two can be established, so that the main component and the backup component can achieve the above original functional safety goal according to the mapping relationship.

[0021] It can be understood by those skilled in the art that, from the perspective of functional redundancy, although the main component and the backup component with a mapping relationship have the same function, the performance of each component when realizing the same function can be set according to actual needs. For example, in the L3 autonomous driving level, the backup system is required to take over driving only in specific scenarios such as highways, but the driver still needs to take over manually within a certain response time. Therefore, the backup component used to replace the main component only needs to provide the minimum safe operation capability, such as maintaining vehicle stability until the driver takes over, and the backup component does not need to achieve performance that is completely equivalent to the main component; for example, in the L4 autonomous driving level, the system is required to independently respond to all faults in specific scenarios such as urban roads, without human takeover, so the above-mentioned backup component must completely reproduce the performance of the main component to ensure that the system can still operate according to the original design after the fault switch. In particular, when the performance of the main component and the backup component to realize the same function is consistent, the two can be used interchangeably, and there is no need to distinguish between the main system and the backup system. For the sake of convenience, L3 is used as the default autonomous driving level followed by the vehicle in this specification, that is, the backup component is allowed to achieve the same function as the main component with lower performance.

[0022] In short, based on the functional safety goals in this manual, the originally abstract safety requirements can be transformed into executable technical specifications, which in turn enables the vehicle redundancy system designed based on the above functional safety goals to fully cover different safety scenarios and avoid the risk of failure of vehicle functions under complex working conditions.

[0023] Figure 2 The present invention is a flowchart of a component switching method of a vehicle provided by an exemplary embodiment; wherein the vehicle is deployed with a main system and a backup system, and the main component in the main system and / or the backup component in the backup system maintain a mapping relationship between the main component and the backup component with the same function, and the mapping relationship is created based on the disassembly result of the preset functional safety target; the method may include the following steps: Step S202: When it is determined that the working state of any main component is abnormal, a target standby component corresponding to the any main component in the standby system is determined according to the mapping relationship.

[0024] On the basis that the above mapping relationship has characterized the corresponding logic between the main component and the spare component with the same function, once it is determined that the working state of any main component in the main system is abnormal, the corresponding spare component in the spare system can be determined according to the mapping relationship, so as to perform functional replacement in the subsequent steps. Among them, the abnormality of the working state can be further divided into hardware physical failure, such as the pressure sensor of the hydraulic valve detects that the actual pressure is greater than the preset pressure threshold, resulting in abnormal braking force output, software logic failure, such as the automatic driving path planning algorithm continues to generate an erroneous trajectory with an offset greater than the preset offset value within a preset time due to memory overflow, and performance degradation, such as the lens of the vehicle camera is dirty, resulting in a decrease in the signal-to-noise ratio of the captured image, and making the target detection confidence of the object recognized based on the image less than the preset confidence. Of course, no matter what kind of abnormality, it can trigger the operation of determining the above-mentioned target spare component according to the mapping relationship.

[0025] In this specification, the execution subject of determining the above-mentioned abnormality and the above-mentioned target spare component can be adjusted according to the actual situation. To this end, the above-mentioned main component and the above-mentioned spare component can be further refined, that is, the main component can include a main control component and a first controlled component controlled by the main control component, and the above-mentioned spare component can also include a sub-control component, which can be used to control the second controlled component of the spare system. In the scenario of autonomous driving, the above-mentioned main control component can specifically refer to the Highly Automated Driving (HAD) controller in the vehicle, which is responsible for collecting data from various sensors of the vehicle, performing complex calculations and processing, and then sending instructions to actuators such as steering, braking, and power systems in the vehicle according to preset algorithms and strategies to achieve automatic driving operations such as automatic following, lane keeping, and automatic lane change. Among them, the above-mentioned sensors and actuators can be regarded as the first controlled component. The above-mentioned sub-control component and the above-mentioned main control component, the first controlled component and the second controlled component are basically consistent in specific implementation except that they are in different systems, so this specification will not be repeated here.

[0026] In one embodiment, when the main control component determines that the first controlled component meets the component abnormality condition, the main control component can determine that the working state of the first controlled component is abnormal. The main control component establishes a communication connection with the first controlled component to determine the working state of the first controlled component in an active monitoring or passive receiving manner. Specifically, the main control component can actively poll the status register in the first controlled component through a communication protocol such as a Controller Area Network with Flexible Data Rate CAN FD (CAN FD) / Extended Controller Area Network eXtended Large Frames (CAN XL), or receive the self-test status reported by the first controlled component in a fixed period. The component abnormality condition can be a preset multi-dimensional determination rule set for determining whether the working state of the first controlled component is abnormal. For example, when the first controlled component is a current sensor of a motor and the current exceeds the maximum current threshold set in the component abnormality condition, it can be determined that the working state is abnormal. For example, when the communication between the main control component and the first controlled component times out, it can also be determined that the working state is abnormal. Similarly, a communication connection can also be established between the secondary control component and the second controlled component in the backup system to achieve the same effect as the main control component and the first controlled component in the above text, which will not be described in detail in this specification.

[0027] In another embodiment, when the auxiliary control component determines that the main control component meets the component abnormality condition, the auxiliary control component can determine that the working state of the main control component is abnormal. In this embodiment, the auxiliary control component can be used as the execution subject for determining that the main component is abnormal, so as to solve the special situation that the main control component of the main component in the previous embodiment is abnormal, resulting in the inability to timely determine that the first controlled component or the main control component is abnormal. Specifically, a communication connection can be established between the auxiliary control component and the main control component, thereby realizing communication between the main system and the backup system.

[0028] Those skilled in the art will appreciate that the above two embodiments may be implemented simultaneously to ensure that both the main control component and the first controlled component in the main system can be found abnormal in time, thereby improving the accuracy of abnormality determination for the main component.

[0029] In the case where it is determined that the working state of any main component is abnormal, the present specification can further classify the execution subject of the target standby component corresponding to any of the above main components, thereby realizing dynamic selection of the path for determining the target standby component and accelerating the efficiency of executing subsequent switching operations. The above classification basis can be associated with the maintenance position of the above mapping relationship.

[0030] In one embodiment, when it is determined that the working state of the first controlled component is abnormal, and the above-mentioned mapping relationship is maintained between the above-mentioned main control component and any one of the above-mentioned sub-control components, the above-mentioned any one of the components can determine the second controlled component corresponding to the above-mentioned first controlled component in the above-mentioned backup system as the above-mentioned target backup component according to the above-mentioned mapping relationship. In this embodiment, for the first controlled component, the first situation is: after the main control component determines that it is abnormal, it can directly determine the target backup component corresponding to any main component, and the second situation is: after the main control component synchronizes the determined abnormal result to the sub-control component, the sub-control component determines the target backup component corresponding to any main component. The execution of the above two situations depends on the maintenance position of the mapping relationship. When only the main control component maintains the above-mentioned mapping relationship, the first situation must be realized; when only the sub-control component maintains the above-mentioned mapping relationship, the second situation must be realized; when both the main control component and the sub-control component maintain the above-mentioned mapping relationship, any of the above situations can be realized. The difference is that the first situation omits the synchronization process of the abnormal result compared with the second situation, so it has a higher efficiency in determining the target backup component.

[0031] In another embodiment, when it is determined that the working state of the main control component is abnormal and the sub-control component maintains the mapping relationship, the sub-control component determines the sub-control component as the target standby component according to the mapping relationship. Since the main control component itself is abnormal, even if the main control component maintains the mapping relationship, it cannot be guaranteed that the main control component can successfully determine the sub-control component corresponding to it in the standby system as the target standby component, so it needs to rely on the sub-control component and the mapping relationship maintained in the sub-control component to determine itself as the target standby component.

[0032] It is worth mentioning that the sub-control component and the second controlled component can reduce the probability of common cause failure through heterogeneous design and physical isolation, so that the probability of synchronous abnormality between the main control component and the sub-control component, and the first controlled component and the second controlled component corresponding to the same mapping relationship is extremely low. Of course, even in extreme cases, the main control component and the sub-control component, or the first controlled component and the second controlled component are abnormal at the same time, and the full redundant link failure is triggered at the same time, the system can be forced to enter the static safety mode based on the underlying hardware and the preset failure safety logic, and perform basic safety operations such as electronic parking and double flash warnings.

[0033] Among them, the so-called physical isolation can be understood as isolating the main power supply component from the backup power supply component when the main component includes the main power supply component and the backup component includes the backup power supply component, so that other main components rely on the main power supply component and other backup components rely on the backup power supply component. Specifically, the purpose of the above isolation operation is to build an independent power distribution network and grounding loop for the main system and the backup system. For example, the main power supply component uses a 12V lead-acid battery, and the negative pole is connected to the vehicle body ground. The backup power supply component uses a 48V lithium battery and has an independent negative pole loop. The two can be electrically decoupled through devices such as optocouplers to avoid the failure of dual power supplies and thus the main component and the backup component cannot work properly. In addition, the so-called heterogeneous design can be understood from two aspects: software and hardware. The first aspect: the software of the main component and the backup component adopts a heterogeneous architecture design, that is, avoid using system code to design the scheme of the main component and the backup component, and prevent the same software anomalies in the same architecture from causing the main component and the corresponding backup component to fail together. The second aspect: The hardware platforms of the main components and spare components are deployed heterogeneously, that is, avoiding the use of the same underlying chip to prevent the quality and production process defects of the hardware with the same circuit architecture or the same production batch from causing the main components and the corresponding spare components to fail together.

[0034] Regarding the process in which the main control component determines that the working state of the first controlled component is abnormal, this specification can be based on Figure 3a~Figure 3c Different communication systems between the components shown are implemented to support multiple anomaly detection.

[0035] In one embodiment, the main control component determines that the working state of the first controlled component is abnormal based on the first connection between the main control component and the first controlled component. At this time, the first connection may correspond to Figure 3a The communication connection of the centralized architecture between the main control component and the x first controlled components in the communication connection can also correspond to the communication connection between the sub-control component and the x second controlled components. In short, when the above-mentioned main control component communicates with any first controlled component through the first connection, the communication content can carry control information from the main control component, status information from any of the above-mentioned first controlled components, and other information such as handshake information, so that the main control component can quickly locate the first controlled component where the abnormality occurs according to the above-mentioned status information, and send corresponding control information to the abnormal first controlled component and the sub-control component to indicate the switching operation of the target standby component in the subsequent steps.

[0036] Among them, a main power supply component and a main control component in the main system can also be established. Figure 3aThe special first connection shown, the communication content corresponding to this connection only needs to include battery status information. The reason is that the core control of the vehicle power supply is usually controlled by a dedicated power management module. For example, the main control components such as the HAD controller cannot directly control the power on / off or voltage regulation. Therefore, the main control component cannot carry control information for the main power supply component in the communication with the main power supply component. Of course, the main control component can interact with the power management system through the communication protocol to indirectly affect the power supply strategy, such as adjusting the load priority of different first controlled components, thereby meeting the flexibility requirements of the autonomous driving system while ensuring the safety and reliability of power management. The same is true between the auxiliary control component and the backup power supply component in the backup system, which will not be repeated in this manual.

[0037] In another embodiment, the main control component may determine that the working state of the first controlled component is abnormal based on the second connection between the main control component and other first controlled components, where the other first controlled components are controlled components in the main component that are different from the first controlled component, for example Figure 3b The first controlled components 2 to y in the embodiment, the other first controlled components have a third connection with the first controlled component, for example Figure 3b The connection between the first controlled component 1 and each of the first controlled components 2 to y. At this time, the second connection may correspond to Figure 3b The communication connection of the distributed architecture between the main control component and the first controlled component 1 in the system, the first controlled component 1 can independently process the information of the first controlled components 2~y through the third connection, and finally uniformly feed back the processing results to the main control component to share and reduce the calculation pressure of the main control component, thereby improving the overall efficiency of determining abnormal components. Among them, taking the brake components, brake light components and wheel speed sensing modules in the vehicle chassis domain as an example, the above-mentioned brake components can establish the above-mentioned third connection with the brake light components and the wheel speed sensing modules, so that the brake components can manage and control the above-mentioned brake light components and the above-mentioned wheel speed sensing modules, and at the same time establish a second connection with the main control component to feed back its own status information and the control results of the above-mentioned brake light components and the above-mentioned wheel speed sensing modules to the main control component. In addition, Figure 3b The same applies to the middle sub-control component and the y second controlled components, which will not be described in detail in this specification.

[0038] In particular, based on the second connection and the third connection, the following can also be derived: Figure 3cThe special communication structure shown in the figure, in which, although the first controlled component 1 establishes a third connection with other first controlled components 3, the first controlled component 3 further establishes a communication connection with the first controlled component 2 (for the convenience of distinction, this connection is called the fourth connection), so that the three and the main control component form a hierarchical nested communication link of "main control component → (second connection) → first controlled component 1 → (third connection) → first controlled component 3 → (fourth connection) → first controlled component 2", that is, the first controlled component 3 can independently process the information of the first controlled component 2 through the fourth connection, and its processing result and the state information of the first controlled component 3 itself are then handed over to the first controlled component 1 for independent processing through the third connection, and its processing result and the state information of the first controlled component 1 are then handed over to the main control component 1 for processing through the second connection, which further distributes and reduces the calculation pressure of the main control component, thereby improving the overall efficiency of determining abnormal components.

[0039] also, Figure 3c In fact, the first controlled component 3 that has established the third connection with the first controlled component 1 can also establish a special connection with the main control component (for the sake of distinction, this connection is called the fifth connection), which has reduced the communication link between the main control component and the corresponding first controlled component. Specifically, for security reasons, the time required for the main component to detect the abnormality, determine the target spare component, and then switch to the subsequent steps needs to be controlled within a short fixed time, such as 100 milliseconds. Therefore, blindly performing hierarchical communication on the above-mentioned first controlled components is likely to result in a lot of time consumption. Therefore, the first controlled components in these "inner layers" can establish a fifth connection with the main control component, and the key message that can prove that the corresponding first controlled component has an abnormality can be quickly obtained by the main control component through the fifth connection. As for the remaining non-critical messages, they can be handed over to the first controlled component with the outer layer of the original hierarchical communication relationship for analysis and processing. In short, this design effectively compresses the time consumption of critical abnormality judgment, and optimizes bandwidth resources through heterogeneous communication links.

[0040] The following takes "the driver intervention module is the first controlled component 1, the vehicle driving angle module is the first controlled component 2, the steering component is the first controlled component 3, and the HAD main controller is the main control component" as an example. When the driver intervention module receives the real-time torque data of the steering component through the third connection, it obtains the yaw rate information of the vehicle driving angle module through the fourth connection. When the steering component detects that the angle command and the actual wheel angle deviation are greater than 15% and last for 20ms, it can directly send the corresponding abnormal emergency fault code to the HAD main controller through the fifth connection, and the HAD main controller triggers redundant switching within 5ms; at the same time, the steering component still uploads detailed diagnostic logs (such as temperature and current waveforms) through the hierarchical link (component 3→component 1→main control). This example ensures that when a single point of the steering system fails, the main control component can make quick decisions and retain deep analysis capabilities, and can reduce the load of the main control component through local preprocessing of the driver intervention module.

[0041] Step S204: switch any main component to the target spare component, so that the target spare component replaces any main component to work.

[0042] After the target spare part is determined, any of the main parts that is executing the target task can be stopped, and the target task can be continued by the target spare part, so that the target spare part can replace any of the main parts.

[0043] Among them, the specific execution mode between the main component and the target backup component can be adaptively adjusted according to the execution relationship between the two and the target task before switching, thereby expanding the application scenario of the solution of this specification.

[0044] In one embodiment, when any of the above main components and the above target spare component work independently, any of the main components is switched to the above target spare component, so that the above target spare component completely replaces any of the above main components. Wherein, any of the above main components performs the target task based on the independent working mode, and the corresponding target spare component only performs diagnostic monitoring and data transmission at most under normal conditions, and does not participate in real-time control; only when the main component fails, the spare component will completely take over all its functions. For example, in the hydraulic braking system of a vehicle, the main brake component independently responds to the boost demand and controls the ABS system, and the spare brake component only monitors the pressure and fault status under normal conditions. If the main brake fails, the spare unit immediately takes over the brake boost and ABS control, and the main brake exits the working state.

[0045] In another embodiment, when any of the above-mentioned main components and the above-mentioned target spare components work in coordination, any of the main components is switched to the above-mentioned target spare components, so that the above-mentioned target spare components synchronously take over the work of any of the above-mentioned main components. Among them, the main component and the spare component cooperate to perform tasks under normal circumstances based on the collaborative working mode. The task can refer to the same task or different interrelated tasks under the same task. The main component leads the control decision; when the main component fails, the spare component increases its own control weight to maintain the full functionality of the system. For example, in the vehicle's steering system, the main steering component controls 50% of the torque output of the motor assist, and the spare steering component synchronously executes the remaining 50%. If the main unit fails, the spare unit automatically increases the output to 100% and takes over the parsing function of the steering command of the HAD main controller.

[0046] This manual can provide different switching strategies for abnormal situations of special main components to maintain the integrity and normal implementation of vehicle functions.

[0047] In one embodiment, when the working state of the main control component or the main power supply component is abnormal, each main component in the main system can be switched to the corresponding backup component in the backup system. Different from other main components, the main control component and the main power supply component are the core components of the main system. The former is used to control the functions and behaviors of other first controlled components, and the latter provides power support for all main components. Therefore, even if there is no abnormality in other first controlled components, the backup component used to replace the main component or the main power supply component may not meet the normal operation requirements of all main components in the main system. For example, when the main power fails, the backup power supply actually only supports some key first controlled components such as braking and steering, and non-key modules (such as entertainment systems) are powered off, resulting in abnormalities in related functions. It is necessary to switch each main component in the main system to the corresponding backup component in the backup system. Of course, this embodiment is applicable to the L3 autonomous driving level where the performance of the main component and the backup component is not required to be consistent. If it is in the case of the L4 autonomous driving level, the vehicle does not actually need to perform an overall switch on the main control component or the main power supply component, but only needs to replace it with the corresponding backup component.

[0048] Combine the following Figure 4 The architectural design of vehicle redundant components is explained in detail. Figure 4As shown, the driving power module 1, main brake 1, brake light 1, wheel speed sensing module 1, parking 1, data recording 1, turn signal module 1, driver intervention module 1, vehicle driving angle module 1, main steering 1, vehicle posture information 1, visible warning light for rear vehicles 1, HMI alarm reminder 1, on-board lighting 1, navigation / positioning 1, perception redundancy 1, HAD main controller 1 and main power supply 1 in the main component can establish a one-to-one mapping relationship with the driving power module 2, auxiliary brake 2, brake light 2, wheel speed sensing module 2, parking 2, data recording 2, turn signal module 2, driver intervention module 2, vehicle driving angle module 2, auxiliary steering 2, vehicle posture information 2, visible warning light for rear vehicles 2, HMI alarm reminder 2, on-board lighting 2, navigation / positioning 2, perception redundancy 2, HAD sub-controller 2 and backup power supply 2 in the backup components respectively, and the above mapping relationship is created based on the disassembly result of the functional safety target under the ISO 26262 standard. For example, the functional safety target of "avoiding unexpected loss of lateral motion control" belongs to ASIL D, so the risk of single point failure can be reduced through redundant design, that is, the main steering 1 (ASIL B) and the auxiliary steering 2 (ASIL B) are designed independently to ensure that there is no common cause failure between the two; for example, the functional safety goal of "avoiding unexpected loss of deceleration capability" belongs to ASILD, so it can involve a braking redundancy system, that is, the main brake 1 (ASIL B) and the auxiliary brake 2 (ASIL B) control different hydraulic circuits respectively, for example, the main brake 1 uses traditional hydraulic control, and the auxiliary brake 2 integrates electronic mechanical brakes. The creation process of the mapping relationship between other main components and sub-components is basically the same, so it will not be repeated in this manual.

[0049] In particular, the functional safety goal of "avoiding unexpected loss of the vehicle's own external lighting and indication during the operation of the autonomous driving function" belongs to ASIL A independently. Considering the vehicle level, non-redundant design is feasible. However, based on the disassembly results of functional safety requirements, when the HAD main controller 1 is in control, if the vehicle's autonomous driving technology uses a pure visual solution, then after the lighting fails, the duration of the vehicle's lane route at night must not be continuous. Therefore, complementary redundant design for the on-board lighting is necessary, and the design requirements of the backup link of the ASILB level of the perception link are met. In other words, the lighting system needs to at least meet the total decomposition functional safety requirements of ASILB, and a redundant design solution is required, that is, Figure 4 The vehicle lighting lamp 1 and the vehicle lighting lamp 2 components.

[0050] In addition, if the vehicle corresponds to L3 autonomous driving level, it is possible to consider omitting the redundant design of the drive power module 2 to save the vehicle's production cost and interior space without affecting the minimum safety requirements.

[0051] Below Figure 4 An embodiment of the present invention explains the minimum safety requirements corresponding to the main component and the backup component associated with each mapping relationship, wherein the minimum safety requirements are obtained by the disassembly result of the above-mentioned preset functional safety goals.

[0052] 1. Driving power module 1 and driving power module 2: When module 1 fails, driving power module 2 must provide a peak torque output of ≥8%, corresponding to an acceleration of 0.15g, and support the full speed range of 0-150km / h and cornering conditions with a curvature radius of ≥30m, ensuring power continuity and a switching delay of ≤50ms.

[0053] 2. Main brake 1 and auxiliary brake 2: When the main brake 1 fails, the auxiliary brake 2 must achieve a deceleration of ≥0.6g, for example, on a dry road with an initial vehicle speed of 80km / h, and activate the anti-lock brake system (ABS) function, with wheel speed fluctuation controlled to ≤±5% and response time ≤100ms.

[0054] 3. Brake light 1 and brake light 2: When brake light 1 fails, brake light 2 must activate the dual-light synchronous lighting mode (brightness ≥ 200 cd / m²) within 50ms, covering all-speed braking scenarios (including AEB emergency braking) and ensuring that the rear vehicle recognition delay is ≤ 300ms.

[0055] 4. Wheel speed sensor module 1 and wheel speed sensor module 2: Although the ABS that handles the braking system requires feedback on the status of each wheel, some high-attachment operational design domain (ODD) applications may consider non-redundant four-wheel sensors and only two front wheel redundancies. However, considering that when the single wheel speed sensor module 1 of the architectural design fails, the estimation of the rear wheel speed by the inertial measurement unit (IMU) and the redundant status of each wheel obtained by the wheel speed sensor module 2 for the two front wheel speeds are not reliable, the wheel speed sensor module 2 needs to be designed as an independent redundant design for four wheels, and the IMU estimation error compensation threshold is ≤2km / h. When the main module fails, the backup module can provide four-wheel speed data within 20ms (accuracy ±0.5km / h) to meet the full functional requirements of ABS / ESP.

[0056] 5. Parking 1 and Parking 2: In the event that the main control of Parking 1 fails, Parking 2 requires the auxiliary control to be able to maintain a slope holding capability of not less than 8% under the condition of maintaining pressure to a stationary vehicle, the hydraulic pressure maintenance leakage rate ≤0.5bar / min, and the electronic parking command response time ≤200ms.

[0057] 6. HAD main controller and HAD sub-controller: In the event of failure of the HAD main controller, for the L3 system, the HAD sub-controller needs to maintain a 10-second control window, provided that the vehicle speed is ≤60km / h, and simultaneously trigger the driver to take over prompts through methods such as "sound, light + tactile warning". For the L4 system, the HAD sub-controller cooperates with power redundancy to perform side parking control or parking control in the lane under non-high-speed conditions, relying on high-precision map positioning error ≤30cm.

[0058] 7. Data Recording 1 and Data Recording 2: The two can be divided into two recording modes. In the case of Data Recording 1 failure, Data Recording 2 needs to support dual-channel synchronous writing of cloud design and local storage, where the data loss rate is ≤0.1% when a single channel fails, the recording frequency is ≥100Hz, and the pre-caching time of key events (such as AEB triggering) is ≥30s. Data can be recorded and extracted for accident scene reproduction or data proofreading.

[0059] 8. Turn signal module 1 and turn signal module 2: In L3 design, if the turn signal module 1 fails, the vehicle can directly stop in the lane without turning, and there is no need to consider the redundancy of the turn signal module 2. However, in the process of steering function application, if the turn signal module fails, the steering indication is lost, resulting in the risk that the adjacent vehicle cannot perform controllable avoidance. The left and right turn signals can be respectively handed over to the turn signal module 1 and the turn signal module 2 (at this time, both modules can be regarded as the main components), but when any of the modules (assuming that it is the turn signal module 1) is abnormal, the other turn signal module 2 can be determined as a spare component, which can achieve the same effect as the warning light by flashing at a fast frequency (flashing frequency 2Hz, brightness ≥150 cd / m²). If it is L4, the turn signal module 1 can pursue a dual-channel redundant design, that is, the turn signal module 2 is independently redundant for the left and right turn signals, and the light logic can be switched through CAN signal remapping when it fails.

[0060] 9. Driver intervention module 1 and driver intervention module 2: To achieve the functional safety goal of the driver smoothly taking over the autonomous driving state and overtaking control in an emergency, the steering wheel torque sensor (torque detection sensitivity ±0.5Nm) can be used as a part of the driver intervention module for redundant design without using a switch combination; or the autonomous driving function switch that complies with ASILB (switch response time ≤50ms) and the torque sensor can be combined to form an ASILD design to meet the safety goal.

[0061] 10. Vehicle driving angle module 1 and vehicle driving angle module 2. For the vehicle steering angle, vehicle driving angle module 2 needs to provide steering wheel angle redundant detection, angle resolution error ≤ 0.5°, yaw rate data fusion cycle ≤ 10ms, and support steering control closed-loop correction. The vehicle driving angle is essentially based on the original data collected by the steering wheel angle sensor (such as (dual potentiometer + Hall sensor)) and the algorithm conversion of the vehicle steering system. The result can be combined with vehicle posture information, etc., and the HAD main controller performs algorithm calculation.

[0062] 11. Main steering 1 and auxiliary steering 2: In case of failure of main steering 1, auxiliary steering 2 is required to maintain steering assistance at a vehicle speed of ≥5km / h, that is, the output torque is ≥30Nm, the steering angle tracking error is ≤2°, and the minimum turning radius is ≤6m.

[0063] 12. Vehicle posture information 1 and vehicle posture information 2. First, the components corresponding to any vehicle posture information are required to be used to analyze the collected chassis dynamic information through the chassis dynamics algorithm to obtain the vehicle state characteristics, such as longitudinal acceleration ax, lateral acceleration ay, yaw rate (YawRate), roll angle, slip rate, stability state, slope and other information as the processing results of vehicle posture information 1 or vehicle posture information 2. The subsequent control and management are required to rely on the HAD main controller and HAD sub-controller respectively. Among them, the longitudinal / lateral acceleration detection accuracy is ±0.05g, the yaw rate accuracy is ±0.1° / s, and the data output frequency is ≥100Hz.

[0064] 13. Rear vehicle visible warning light 1 and rear vehicle visible warning light 2: Consistent with the above-mentioned turn signal module, it can be classified and designed based on the left and right lights. When the rear vehicle visible warning light 1 is abnormal, the rear vehicle visible warning light 2 can achieve the same effect as the double flash light by flashing at a fast frequency (4Hz, brightness ≥300 cd / m², night visibility distance ≥200m).

[0065] 14. HMI alarm reminder 1 and HMI alarm reminder 2: HMI alarm reminder 1 can be expressed in the form of voice + text; HMI alarm reminder 2 can adopt design schemes such as vibration seat (5-15Hz) + interior lighting (interior RGB atmosphere light red gradient warning) + brake reminder (1Hz, deceleration ≤0.1g), that is, alarms are complemented through diversified combinations. Among them, voice backup broadcast can be performed between HMI alarm reminder 1 and HMI alarm reminder 2 at the voice level, and the voice alarm delay is required to be ≤200ms.

[0066] 15. On-board lighting 1 and on-board lighting 2: On-board lighting 1 and on-board lighting 2 can be complementary to high beam and low beam, for example, on-board lighting 1 is high beam and on-board lighting 2 is low beam. Specifically, they can be designed according to different recognition capabilities of visual perception. For example, in the scenario of autonomous driving, whether the forward objects and lane lines can be accurately recognized is the minimum requirement, and further, the maximum driving speed is the key basis. For example, if the speed is too fast, the lighting distance of on-board lighting 2 as a low beam does not match the perception processing time and cannot be used for a long time. In short, for the complementation of high beam or low beam, when the low beam fails, the high beam automatically reduces the power to 50% to maintain basic lighting (irradiation distance ≥ 60m), which can achieve the selection of low-cost solutions. If the requirements are higher, a redundant design of dual high beams can be carried out, and the brightness is maintained at ≥ 800 lumens when a single lamp fails, and the beam deflection compensation angle is ± 1.5°.

[0067] 16. Navigation / Positioning 1 and Navigation / Positioning 2: Navigation / Positioning 1 can be integrated for positioning of electronic maps and IMU + Global Navigation Satellite System (GNSS), and Navigation / Positioning 2 can be used for safe operation of Advanced Driving Assistance System (ADAS) maps and perception self-built maps. The positioning data update frequency is ≥10Hz, and the time synchronization error with the main system (i.e. GNSS+IMU) is ≤10ms.

[0068] 17. Perception Redundancy 1 and Perception Redundancy 2: refers to a series of sensor devices used by the vehicle to perceive the surrounding environment. Considering the large number and variety, they are collectively referred to as perception redundancy. In the event of failure of perception redundancy 1, perception redundancy 2 is required to maintain at least 80% of the original perception coverage, such as a 120° horizontal field of view, and key target detection capabilities, such as obstacle recognition accuracy within 50 meters ≥ 95%, and through heterogeneous sensor combinations, such as LiDAR + millimeter wave radar in perception redundancy 2 to replace the failed visual module in perception redundancy 2, to ensure the continuity of multi-source data fusion, while meeting the fault response time required by ASIL B functional safety.

[0069] Figure 5 is a schematic structural diagram of an electronic device in an exemplary embodiment. Figure 5At the hardware level, the electronic device includes a processor 502, an internal bus 510, a network interface 504, a memory 506, and a non-volatile memory 508, and may also include other required hardware. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming a risk code detection device at the logical level. Of course, in addition to the software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0070] Figure 6 The block diagram of a vehicle component switching device shown in the embodiment of this specification. Figure 6 As shown, in the device, the vehicle is deployed with a main system and a backup system, the main component in the main system and / or the backup component in the backup system maintains a mapping relationship between the main component and the backup component with the same function, and the mapping relationship is created based on the disassembly result of the preset functional safety target; the device may include: A target standby component determining unit 602 is configured to determine, when it is determined that the working state of any main component is abnormal, a target standby component corresponding to any main component in the standby system according to the mapping relationship; The target standby component switching unit 604 is used to switch any main component to the target standby component, so that the target standby component replaces any main component to work.

[0071] Optionally, the main component includes a main control component and a first controlled component controlled by the main control component, and the backup component includes a sub-control component; and the device further includes: a first abnormality determination unit, wherein when the main control component determines that the first controlled component meets the component abnormality condition, the main control component determines that the working state of the first controlled component is abnormal; The second abnormality determination unit is configured to determine that an abnormality occurs in the working state of the main control component when the auxiliary control component determines that the main control component meets the component abnormality condition.

[0072] Optionally, the backup component further includes a second controlled component controlled by the sub-control component; the target backup component determination unit 602 is specifically configured to: When it is determined that the working state of the first controlled component is abnormal, and the mapping relationship is maintained between the main control component and any one of the sub-control components, the any one of the components determines, according to the mapping relationship, a second controlled component in the backup system corresponding to the first controlled component as the target backup component; When it is determined that the working state of the main control component is abnormal and the sub-control component maintains the mapping relationship, the sub-control component determines the sub-control component as the target backup component according to the mapping relationship.

[0073] Optionally, the first abnormality determination unit is specifically configured to: The main control component determines that an abnormality occurs in the working state of the first controlled component based on a first connection between the main control component and the first controlled component; or The main control component determines that an abnormality occurs in the working state of the first controlled component based on a second connection between the main control component and other first controlled components. The other first controlled components are controlled components in the main component that are different from the first controlled component, and a third connection is established between the other first controlled components and the first controlled component.

[0074] Optionally, the device further comprises: The power supply isolation unit isolates the main power supply component from the backup power supply component when the main component includes a main power supply component and the backup component includes a backup power supply component.

[0075] Optionally, the main component includes a main control component, and the device further includes: The full component switching unit switches each main component in the main system to a corresponding backup component in the backup system when an abnormality occurs in the working state of the main control component or the main power supply component.

[0076] Optionally, the target spare component switching unit 604 is specifically configured to: In the case where any of the main components and the target spare component work independently, switching any of the main components to the target spare component so that the target spare component completely replaces any of the main components to work; In the case that any of the main components and the target spare component work in cooperation, any of the main components is switched to the target spare component, so that the target spare component synchronously takes over the work of any of the main components.

[0077] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0078] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can refer to the partial description of the method embodiments. The device embodiments described above are only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this specification. Ordinary technicians in this field can understand and implement it without paying creative work.

[0079] Based on the same concept as the above method, this specification also provides an electronic device, including: a processor; a memory for storing processor executable instructions; wherein the processor implements the steps of the method described in any of the above embodiments by running the executable instructions.

[0080] Based on the same concept as the above method, this specification also provides a computer-readable storage medium on which computer instructions are stored. When the instructions are executed by a processor, the steps of the method described in any of the above embodiments are implemented.

[0081] Based on the same concept as the above method, this specification also provides a computer program product, including a computer program / instruction, which implements the steps of the method described in any of the above embodiments when executed by a processor.

[0082] The embodiments of the subject matter and functional operations described in this specification may be implemented in the following: digital electronic circuits, tangibly embodied computer software or firmware, computer hardware including the structures disclosed in this specification and their structural equivalents, or a combination of one or more of them. The embodiments of the subject matter described in this specification may be implemented as one or more computer programs, i.e., one or more modules in computer program instructions encoded on a tangible non-temporary program carrier to be executed by a data processing device or to control the operation of the data processing device. Alternatively or additionally, the program instructions may be encoded on an artificially generated propagation signal, such as a machine-generated electrical, optical or electromagnetic signal, which is generated to encode information and transmit it to a suitable receiver device for execution by a data processing device. The computer storage medium may be a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or a combination of one or more of them.

[0083] The processes and logic flows described in this specification can be performed by one or more programmable computers executing one or more computer programs to perform corresponding functions by operating on input data and generating output. The processes and logic flows can also be performed by special-purpose logic circuits, such as FPGAs (field programmable gate arrays) or ASICs (application-specific integrated circuits), and the apparatus can also be implemented as special-purpose logic circuits.

[0084] Computers suitable for executing computer programs include, for example, general and / or special microprocessors, or any other type of central processing unit. Typically, the central processing unit will receive instructions and data from a read-only memory and / or a random access memory. The basic components of a computer include a central processing unit for implementing or executing instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include one or more large-capacity storage devices for storing data, such as a disk, a magneto-optical disk, or an optical disk, or the computer will be operably coupled to this large-capacity storage device to receive data from it or to transmit data to it, or both. However, a computer does not necessarily have such a device. In addition, a computer can be embedded in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device such as a universal serial bus (USB) flash drive, to name a few.

[0085] Computer readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media and memory devices, including, for example, semiconductor memory devices (e.g., EPROM, EEPROM and flash memory devices), magnetic disks (e.g., internal hard disks or removable disks), magneto-optical disks, and CD ROM and DVD-ROM disks. The processor and memory may be supplemented by, or incorporated in, special purpose logic circuitry.

[0086] Although this specification includes many specific implementation details, these should not be interpreted as limiting the scope of any invention or the scope of protection claimed, but are mainly used to describe the features of the specific embodiments of specific inventions. Certain features described in multiple embodiments in this specification may also be implemented in combination in a single embodiment. On the other hand, the various features described in a single embodiment may also be implemented separately in multiple embodiments or in any suitable sub-combination. In addition, although features may work in certain combinations as described above and even initially claim protection, one or more features from the claimed combination may be removed from the combination in some cases, and the claimed combination may point to a sub-combination or a variation of a sub-combination.

[0087] Similarly, although operations are depicted in a particular order in the accompanying drawings, this should not be understood as requiring that these operations be performed in the particular order shown or performed sequentially, or requiring that all illustrated operations be performed to achieve the desired results. In some cases, multitasking and parallel processing may be advantageous. In addition, the separation of various system modules and components in the above-described embodiments should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product, or packaged into multiple software products.

[0088] Thus, specific embodiments of the subject matter have been described. Furthermore, the processes depicted in the figures do not necessarily require the particular order shown or sequential order to achieve desired results. In some implementations, multitasking and parallel processing may be advantageous.

[0089] The above description is only a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of this specification should be included in the scope of protection of this specification.

Claims

1. A method for switching components of a vehicle, characterized in that: The vehicle is deployed with a main system and a backup system, and the backup components in the main system and / or the backup system maintain a mapping relationship between the main components and the backup components with the same functions, and the mapping relationship is created based on the disassembly result of the preset functional safety target; the method includes: In the case where it is determined that the working state of any main component is abnormal, determining a target standby component in the standby system corresponding to the any main component according to the mapping relationship; Any one of the main components is switched to the target spare component, so that the target spare component replaces the any one of the main components to work.

2. The method according to claim 1, characterized in that The main component includes a main control component and a first controlled component controlled by the main control component, and the backup component includes a sub-control component; The determining that the working state of any main component is abnormal includes: When the main control component determines that the first controlled component meets the component abnormality condition, the main control component determines that the working state of the first controlled component is abnormal; When the sub-control component determines that the main control component meets the component abnormality condition, the sub-control component determines that the working state of the main control component is abnormal.

3. The method according to claim 2, characterized in that The backup component also includes a second controlled component controlled by the secondary control component; and determining the target backup component corresponding to any of the main components in the backup system according to the mapping relationship includes: When it is determined that the working state of the first controlled component is abnormal, and the mapping relationship is maintained between the main control component and any one of the sub-control components, the any one of the components determines, according to the mapping relationship, a second controlled component in the backup system corresponding to the first controlled component as the target backup component; When it is determined that the working state of the main control component is abnormal and the sub-control component maintains the mapping relationship, the sub-control component determines the sub-control component as the target backup component according to the mapping relationship.

4. The method according to claim 2, characterized in that: The main control component determines that the working state of the first controlled component is abnormal, including: The main control component determines that an abnormality occurs in the working state of the first controlled component based on a first connection between the main control component and the first controlled component; or The main control component determines that an abnormality occurs in the working state of the first controlled component based on a second connection between the main control component and other first controlled components. The other first controlled components are controlled components in the main component that are different from the first controlled component, and a third connection is established between the other first controlled components and the first controlled component.

5. The method according to claim 1, characterized in that The method further comprises: In case the primary component comprises a primary power supply component and the backup component comprises a backup power supply component, the primary power supply component is isolated from the backup power supply component.

6. The method according to claim 5, characterized in that The main component includes a main control component, and the method further includes: When an abnormality occurs in the working state of the main control component or the main power supply component, each main component in the main system is switched to a corresponding backup component in the backup system.

7. The method according to claim 1, characterized in that The step of switching any main component to the target spare component comprises: In the case where any of the main components and the target spare component work independently, switching any of the main components to the target spare component so that the target spare component completely replaces any of the main components to work; In the case that any of the main components and the target spare component work in cooperation, any of the main components is switched to the target spare component, so that the target spare component synchronously takes over the work of any of the main components.

8. The method according to claim 1, characterized in that The software of the main component and the backup component adopts a heterogeneous architecture design, and the hardware platforms of the main component and the backup component adopt a heterogeneous deployment.

9. A computer-readable storage medium, characterized in that: Computer instructions are stored thereon, and when the instructions are executed by a processor, the steps of the method as described in any one of claims 1 to 8 are implemented.

10. A computer program product, characterized in that The method comprises a computer program / instruction, which, when executed by a processor, implements the steps of the method as claimed in any one of claims 1 to 8.

Images