Vehicle redundancy control method and device, computer storage medium and vehicle

Abstract

The invention discloses a redundancy control method and device of a vehicle, a storage medium and the vehicle, and relates to the technical field of automobiles. The method comprises the steps that whether a chassis domain control system breaks down or not is judged according to a target state signal; if yes, determining the fault type of the chassis domain control system; and executing a corresponding redundancy strategy according to the fault type so as to ensure normal operation of the chassis domain control system. By means of the method, the redundancy strategy is added in the chassis domain control system, the corresponding redundancy strategy is executed when the system breaks down, it is guaranteed that the chassis domain control system can operate normally, and the safety of the vehicle is effectively improved.

Description

Technical Field

[0001] This application relates to the field of automotive technologies, and in particular, to a redundant control method, device, computer storage medium, and vehicle for a vehicle. Background Art

[0002] With the development of the automotive industry, automobiles are increasingly involved in our daily life and work. The automotive mechanical system is being replaced by a more intelligent electronic control system, and vehicle manufacturers and suppliers are paying more and more attention to the intelligent level of their products. However, while the electronic control system realizes intelligence, its failure rate is much higher than that of the traditional mechanical system. When developing the electronic control system, how to improve the safety of the vehicle is an urgent problem to be solved. Summary of the Invention

[0003] This application provides a redundant control method, device, storage medium, and vehicle for a vehicle, which can solve the technical problem of low safety of the chassis domain control system in the related art.

[0004] In a first aspect, an embodiment of this application provides a redundant control method for a vehicle. The method includes: determining whether a chassis domain control system fails according to a target status signal; if so, determining the failure type of the chassis domain control system; and executing a corresponding redundant strategy according to the failure type to ensure the normal operation of the chassis domain control system.

[0005] In the above technical solution, by adding a corresponding redundant strategy to the chassis domain control system, when the chassis domain control system fails, the corresponding redundant strategy can be executed, so as to ensure the normal operation of the chassis domain control system, improve the fault tolerance ability of the chassis domain control system, prevent the vehicle from having safety problems due to the failure of the chassis domain control system, effectively ensure the safety of the vehicle during driving, and at the same time improve the intelligent level of the vehicle.

[0006] In combination with the first aspect, in some possible implementation manners, the chassis domain control system further includes an actuator and / or a sensor; the target status signal includes at least one of the following: a self-check status signal of the chassis domain controller, an execution status signal sent by the actuator, an output status signal of the sensor, and an access signal of the chassis domain controller; if the self-check status signal or the execution status signal or the output status signal is a fault signal within a first target number of consecutive cycles, or if the access signals within a second target number of consecutive cycles are all abnormal signals or lost, it is determined that the chassis domain control system fails; where the second target is greater than the first target.

[0007] Through the above solution, the chassis domain control system is determined to have a real failure only when the self-check status signals within a period of time are all failure signals, or the execution status signals within a period of time are all failure signals, or the output status signals within a period of time are all failure signals, or the access signals within a period of time are all abnormal signals or lost, thus avoiding the situation where the redundancy strategy is frequently turned on and off due to the fluctuation of the signal itself triggering a fault error report, and improving the stability and safety of vehicle control.

[0008] Combined with the first aspect, in some possible implementation manners, the chassis domain control system further includes an actuator; if the self-check status signals of the chassis domain controller are all failure signals within the first target number of consecutive cycles, it is determined that the fault type of the chassis domain control system includes a chassis domain controller fault; when the chassis domain controller has a fault, a control failure instruction is sent to the actuator, so that the actuator responds to the control failure instruction to shield the control instruction sent by the chassis domain controller and operates according to its own control instruction to ensure the normal operation of the chassis domain control system.

[0009] Through the above solution, when the chassis domain controller fails, by sending a control failure instruction to the actuator, the actuator is made to shield the subsequent control instructions sent by the chassis domain controller and perform corresponding operations according to its own control instructions, avoiding the situation where the chassis domain controller is unable to send normal control instructions to the actuator or unable to send control instructions due to a fault, resulting in the actuator being unable to complete the actions required for vehicle operation normally. When the chassis domain controller fails, the actuator can independently complete the actions required for vehicle operation to ensure the normal operation of the chassis domain control system.

[0010] Combined with the first aspect and the above implementation manner, in some possible implementation manners, when the chassis domain controller has a fault, if the self-check status signals of the chassis domain controller are all normal signals within the third target number of consecutive cycles, a control recovery instruction is sent to the actuator to restore the control right of the chassis domain controller over the actuator.

[0011] Through the above solution, when the faulty chassis domain controller returns to normal, by sending a control recovery instruction to the actuator to restore the control right of the chassis domain controller over the actuator, the normal operation of the chassis domain control system can be restored, so as to avoid the loss caused by being in the redundancy strategy for a long time and improve the intelligent level of the vehicle.

[0012] Combined with the first aspect, in some possible implementation manners, the chassis domain control system further includes an actuator; if the execution status signals sent by the actuator are all failure signals within the first target number of consecutive cycles, it is determined that the fault type of the chassis domain control system includes an actuator fault; when the actuator has a fault, a redundancy strategy for the actuator is determined based on the execution fault type of the actuator; the actuator is controlled to perform corresponding operations according to the redundancy strategy to ensure the normal operation of the chassis domain control system.

[0013] With the above solution, when a fault occurs in the actuator, according to the type of execution fault of the actuator, the corresponding redundancy strategy for the actuator is activated, avoiding the problem that the vehicle cannot complete the corresponding action due to the actuator fault, enabling the chassis domain controller to coordinate the actuator to complete the corresponding action according to the type of execution fault of the actuator, thus ensuring the normal operation of the chassis domain control system.

[0014] In combination with the first aspect, in some possible implementation manners, the chassis domain control system further includes a sensor; if the output status signals of the sensor are all fault signals within the first target number of consecutive cycles, it is determined that the fault type of the chassis domain control system includes a sensor fault; when there is a sensor fault, the first backup signal of the sensor is input into the chassis domain controller to ensure the normal operation of the chassis domain control system.

[0015] With the above solution, when a fault occurs in the sensor, the chassis domain controller can adopt the first backup signal of the sensor, thereby providing an environment for the chassis domain controller to continue working and ensuring the normal operation of the chassis domain control system.

[0016] In combination with the first aspect, in some possible implementation manners, if the access signal of the chassis domain controller is an abnormal signal or lost within the second target number of consecutive cycles, it is determined that the fault type of the chassis domain control system includes a signal transmission fault; when a signal transmission fault occurs in the chassis domain control system, the operation of the chassis domain control system is controlled based on the second backup signal corresponding to the access signal to ensure the normal operation of the chassis domain control system.

[0017] With the above solution, when a fault occurs in the signal transmission to the chassis domain controller, the corresponding backup signal is adopted, avoiding the problem that the chassis domain controller cannot normally control the operation of the chassis domain control system due to the lack of necessary access signals, and ensuring the normal operation of the chassis domain control system.

[0018] In a second aspect, an embodiment of the present application provides a redundancy control device for a vehicle, and the device includes:

[0019] A judgment module, configured to judge whether a fault occurs in the chassis domain control system according to a target status signal;

[0020] A determination module, configured to, if so, determine the fault type of the chassis domain control system;

[0021] An execution module, configured to execute a corresponding redundancy strategy according to the fault type to ensure the normal operation of the chassis domain control system.

[0022] In a third aspect, an embodiment of the present application provides a computer storage medium, and the computer storage medium stores multiple instructions, and the instructions are adapted to be loaded and executed by a processor to perform the steps of the above method.

[0023] In a fourth aspect, an embodiment of the present application provides a vehicle, including a memory, a processor, and a computer program stored on the memory and executable on the processor, where the computer program is adapted to be loaded and executed by the processor to perform the steps of the above-mentioned method.

[0024] The beneficial effects brought by the technical solutions provided in some embodiments of the present application at least include:

[0025] The present application provides a redundant control method for a vehicle, which determines whether a chassis domain control system fails according to a target status signal; if so, determines the fault type of the chassis domain control system; and executes a corresponding redundant strategy according to the fault type to ensure the normal operation of the chassis domain control system. By adding a redundant strategy in the chassis domain control system, when the chassis domain control system has a fault, a corresponding redundant strategy is executed according to the fault type, so that the normal operation of the chassis domain control system can be ensured, and the safety and the intelligent level of the vehicle are effectively improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only some embodiments of the present application, and those skilled in the art can obtain other drawings without creative efforts based on these drawings.

[0027] Figure 1 It is an exemplary system architecture diagram of a chassis domain control system provided by an embodiment of the present application;

[0028] Figure 2 It is a specific application diagram of a chassis domain control system provided by an embodiment of the present application;

[0029] Figure 3 It is a schematic flowchart of a redundant control method for a vehicle provided by an embodiment of the present application;

[0030] Figure 4 It is a logic framework diagram of a redundant strategy switch provided by an embodiment of the present application;

[0031] Figure 5 It is a schematic diagram of a reminder message provided by an embodiment of the present application;

[0032] Figure 6 It is a schematic flowchart of another redundant control method for a vehicle provided by an embodiment of the present application;

[0033] Figure 7 It is a structural block diagram of a redundant control device for a vehicle provided by an embodiment of the present application;

[0034] Figure 8 A structural schematic diagram of a vehicle provided by an embodiment of the present application. Detailed implementation manners

[0035] To make the features and advantages of the present application more obvious and understandable, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative efforts belong to the scope of protection of the present application.

[0036] When the following description involves the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementation manners described in the following exemplary embodiments do not represent all the implementation manners consistent with the present application. On the contrary, they are only examples of the devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0037] With the continuous development of automotive electronic technology, the automotive mechanical system is being replaced by a more intelligent electronic control system. As people's requirements for traffic safety and comfort are getting higher and higher, automotive intelligent technology has attracted more and more attention from consumers. At the same time, vehicle manufacturers and suppliers also pay more and more attention to the intelligent level of their own products. On the one hand, it is the market demand, and on the other hand, it is the technological progress, both of which make automotive intelligence become the development direction of the automotive industry. Automotive intelligence brings many conveniences. The electronic control systems throughout the vehicle bring a better driving experience to the driver and allow passengers to enjoy a more comfortable riding experience. However, while the intelligent technology is developing rapidly, it also brings safety problems. The failure rate of the electronic control system is much higher than that of the traditional mechanical system while achieving intelligence. When developing the electronic control system, in addition to paying attention to functions, the safety of the product also needs to be considered, and consumers also pay more and more attention to the safety of intelligent products.

[0038] The embodiment of the present application provides a redundant control method for a vehicle. By adding corresponding redundant strategies to the chassis domain control system, when a failure occurs in the chassis domain control system, the corresponding redundant strategies can be executed, so as to ensure that the chassis domain control system can operate normally, improve the fault tolerance ability of the chassis domain control system, prevent the vehicle from having safety problems due to the failure of the chassis domain control system, effectively ensure the safety of the vehicle during driving, and at the same time improve the intelligent level of the vehicle.

[0039] Please refer to Figure 1 , Figure 1An exemplary system architecture diagram of a chassis domain control system provided by an embodiment of the present application. In a possible embodiment, the chassis domain control system 100 includes a chassis domain controller 101, an actuator 102, and a sensor 103. The chassis domain controller 101 is connected to the actuator 102 and the sensor 103 through a bus. The chassis domain controller 101 and the actuator 102 can send signals to each other. The signals include, but are not limited to, a self-check status signal, a command signal, etc. sent by the chassis domain controller 101 to the actuator 102, and an execution status signal sent by the actuator 102 to the chassis domain controller 101. The chassis domain controller 101 can also receive an output status signal sent by the sensor 103, such as, but not limited to, a wheel speed signal, etc.

[0040] It can be understood that the above-mentioned chassis domain control system 100 may include one or more actuators 102 and one or more sensors 103, and the embodiments of the present application do not limit this.

[0041] Exemplarily, the above-mentioned chassis domain control system 100 may be, but is not limited to, Figure 2 the chassis domain control system 200 shown. In the chassis domain control system 200 of a vehicle, it may include, but is not limited to, a power system 2021, an advanced driving assistance system 2022 (Advanced Driving Assistance System, ADAS), an electronic stability program 2023 (Electronic Stability Program, ESP), an electric power steering system 2024 (Electric Power Steering System, EPS), a rear wheel steer system 2025 (Rear Wheel Steer System, RWS), a variable damping control system 2026, an electronic-controlled air suspension 2027 (Electronic-controlled Air Suspension, ECAS), etc. actuators, a chassis domain controller 201, and a wheel speed sensor 203. The power system 2021, the advanced driving assistance system 2022, the electronic stability program 2023, the electric power steering system 2024, the rear wheel steer system 2025, the variable damping control system 2026, and the electronic-controlled air suspension 2027 are all connected to the chassis domain controller 201 through a bus and can send signals to each other with the chassis domain controller 201. The signals are similar to Figure 1 the signals interacted between the actuator 102 and the chassis domain controller 101 in, and will not be elaborated here. The above-mentioned wheel speed sensor 203 can be connected to the chassis domain controller 201 through a bus and send the wheel speed signal it detects to the chassis domain controller 201.

[0042] Please refer to Figure 3 , Figure 3This is a schematic flowchart of a redundant control method for a vehicle provided by an embodiment of the present application. For ease of description, the following takes the chassis domain controller in the chassis domain control system as the execution subject to introduce the specific execution process of the vehicle redundant control method.

[0043] As Figure 3 shown, the redundant control method for a vehicle may at least include:

[0044] S301. Determine whether the chassis domain control system has a fault according to the target status signal.

[0045] Specifically, to ensure the safety of the chassis domain control system, it is first necessary to have the ability to determine whether the system has a fault. The chassis domain control system may include, but is not limited to, devices such as a chassis domain controller, an actuator, and a sensor. The above-mentioned target status signal may include, but is not limited to, the status signal corresponding to any device in the chassis domain control system, including the status information of the corresponding device. Therefore, it is possible to determine whether the chassis domain control system has a fault through the target status signal in the chassis domain control system.

[0046] In a possible implementation manner, the chassis domain control system further includes an actuator and / or a sensor; the target status signal includes at least one of the following: the self-check status signal of the chassis domain controller, the execution status signal sent by the actuator, the output status signal of the sensor, and the access signal of the chassis domain controller. Among them, the self-check status signal is a signal containing its own status generated after the chassis domain controller performs self-check, and can be used to determine whether the chassis domain controller has a fault. The execution status signal contains the status information of the actuator itself and the corresponding action execution information, and the chassis domain controller can determine whether the actuator has a fault through the status information of the actuator itself in the execution status signal. The output status signal of the sensor contains the data information of the sensor and the status information of the sensor, and the chassis domain controller can determine whether the sensor has a fault through the status information of the sensor in the output status signal. The access signal of the chassis domain controller, such as, but not limited to, the acceleration signal and the steering wheel angle signal accessed by the chassis domain controller, is used to determine whether the signal transmission has a fault by detecting whether all the access signals are abnormal signals or are lost. When the access signal of the chassis domain controller cannot be recognized or there is a recognition error, it can be considered that the access signal is an abnormal signal.

[0047] Further, if the self-check status signal, execution status signal, or output status signal within consecutive first target periods is a fault signal, or if the access signals within consecutive second target periods are all abnormal signals or missing, it is determined that a fault has occurred in the chassis domain control system. Since only when the self-check status signals within a period of time are all fault signals, or the execution status signals within a period of time are all fault signals, or the output status signals within a period of time are all fault signals, or the access signals within a period of time are all abnormal signals or missing, can it be ensured that the chassis domain control system has truly failed, thus avoiding the frequent opening and closing of the redundancy strategy caused by the fluctuation of the signal itself triggering a fault error report, and improving the stability and safety of vehicle control.

[0048] It should be noted that the first target can be, for example but not limited to, 5, 6, etc., and the second target can be, for example but not limited to, 8, 10, etc. At the same time, since there are many factors affecting signal transmission itself, it is difficult to determine whether signal transmission has truly failed or is only interfered with. To accurately judge whether signal transmission has failed, the second target can be set to be greater than the first target to increase the time for judging signal transmission failure, avoiding the problem that abnormal situations caused by short-term interference of signal transmission are misjudged as signal transmission failures due to too short a judgment time, and improving the accuracy of fault judgment of the chassis domain control system. In addition, the duration of each period can be, for example but not limited to, 10 milliseconds, 15 milliseconds, etc., and the embodiments of the present application do not limit this.

[0049] S302: If so, determine the fault type of the chassis domain control system.

[0050] Specifically, when the chassis domain controller determines that a fault has occurred, the fault type of the chassis domain control system can be determined according to the target status signal. The target status signal can include at least one of the self-check status signal of the chassis domain controller, the execution status signal sent by the actuator, the output status signal of the sensor, and the access signal of the chassis domain controller. Therefore, it can be judged whether the chassis domain control system has a fault of the following fault types according to the corresponding target status signal: chassis domain controller fault, actuator fault, sensor fault, signal transmission fault.

[0051] Optionally, when the target status signal includes the self-check status signal of the chassis domain controller, if the self-check status signal of the chassis domain controller is a fault signal for the first consecutive target number of cycles, it can be determined that the chassis domain controller in the chassis domain control system has a fault, that is, the fault type of the chassis domain control system includes chassis domain controller fault. Further, it can be determined whether the self-check status signal is a fault signal by detecting whether the self-check status signal contains, for example but not limited to, hardware damage information, or by judging whether the self-check status signal cannot be recognized. For example, when the self-check status signal of the chassis domain controller contains hardware damage information for 5 consecutive cycles, or cannot be recognized, or when the chassis domain controller does not send out the self-check status signal for 6 consecutive cycles, it can be determined that the chassis domain controller has a fault.

[0052] Optionally, when the target status signal includes the execution status signal sent by the actuator, if the execution status signal sent by the actuator is a fault signal for the first consecutive target number of cycles, it can be determined that the actuator corresponding to the execution status signal has a fault, that is, the fault type of the chassis domain control system includes actuator fault. The chassis domain controller determines the working status of the actuator by detecting whether the execution status signal sent by the actuator is a fault signal. Among them, the execution status signal sent by the actuator contains the status information of the actuator itself. For example, if the execution status signal sent by the actuator received by the chassis domain controller contains hardware damage information or abnormal working information for 5 consecutive cycles, or if the chassis domain controller does not receive the execution status signal of the actuator for 6 consecutive cycles, it can be determined that the actuator has a fault.

[0053] Optionally, when the target status signal includes the output status signal of the sensor, if the output status signal of the sensor is a fault signal for the first consecutive target number of cycles, it can be determined that the sensor has a fault, that is, the fault type of the chassis domain control system includes sensor fault. When the sensor sends the output status signal to the chassis domain controller, the output status signal contains not only the data information of the sensor but also the status information of the sensor itself. After receiving the output status signal, the chassis domain controller can judge whether the sensor has a fault according to the status information of the sensor itself in the output status signal. Among them, the sensor can be, for example but not limited to, a wheel speed sensor. For example, if the output status signal sent by the sensor received by the chassis domain controller contains fault information for 5 consecutive cycles, it can be determined that the sensor has a fault.

[0054] Optionally, when the target status signal includes the access signal of the chassis domain controller, if the access signal of the chassis domain controller in the second consecutive target cycles is an abnormal signal or missing, it can be determined that a signal transmission failure has occurred, that is, the fault type of this chassis domain control system includes signal transmission failure. When the access signal of the chassis domain controller is frame loss, unrecognizable or missing, in the next second target cycle, the chassis domain controller will perform logical calculation based on the previous correct access signal and the next received access signal to determine whether the currently received access signal is correct. If the access signals in the second consecutive target cycles are all incorrect signals or are all missing, it can be determined that the signal transmission corresponding to this access signal has failed. For example, if the chassis domain controller does not receive this access signal for 10 consecutive cycles, or this access signal is an unrecognizable abnormal signal, it can be determined that the signal transmission corresponding to this access signal has failed. The access signal of the chassis domain controller includes, for example but not limited to, the acceleration signal sent by the electronic control air suspension system received by the chassis domain controller, the steering wheel angle signal sent by the electric power steering system received by the chassis domain controller, etc.

[0055] It can be understood that the target status signal can include one or more of the self-check status signal of the chassis domain controller, the execution status signal sent by the actuator, the output status signal of the sensor, and the access signal of the chassis domain controller. When a fault occurs in the chassis domain control system, the corresponding fault type can also correspondingly include one or more faults among the chassis domain controller fault, actuator fault, sensor fault, and signal transmission fault. The embodiments of the present application do not limit this.

[0056] S303. Execute the corresponding redundancy strategy according to the fault type to ensure the normal operation of the chassis domain control system.

[0057] Optionally, when the fault type is a chassis domain controller fault, the chassis domain controller sends a control failure instruction to the actuator. After receiving the control failure instruction, the actuator masks the control instructions sent by the chassis domain controller and operates according to its own control instructions to ensure the normal operation of the chassis domain control system. Among them, the control failure instruction can be a self-check status signal containing fault information sent by the chassis domain controller, or a downgrade instruction sent by the chassis domain controller. It should be noted that after the chassis domain controller fails, it generally retains the communication function and sends corresponding instructions to the actuator, while the actuator retains the algorithm that can independently complete the corresponding actions. When the chassis domain controller fails, the actuator can receive the self-check status signal or downgrade instruction containing fault information sent by the chassis domain controller, and then mask (i.e., does not respond to) the control instructions sent by the chassis domain controller, and uses a part of the algorithm retained by itself to generate its own control instructions to independently complete the corresponding actions, avoiding the situation that the chassis domain controller cannot send normal control instructions to the actuator or cannot send control instructions, resulting in the actuator being unable to normally complete the actions required for vehicle operation, so as to ensure the normal operation of the chassis domain control system.

[0058] Optionally, when the fault type is an actuator fault, the redundancy strategy for the actuator can be determined first based on the execution fault type of the actuator, and then the actuator can be controlled to perform corresponding work according to the redundancy strategy to ensure the normal operation of the chassis domain control system. When the actuator fails, the chassis domain controller adjusts the functional implementation logic of the internal collaborative software according to the execution fault type of the actuator. The execution fault types of the actuator include, for example, but are not limited to, the loss of ability type, the weakening of ability type, etc.

[0059] For example, if the vehicle is performing the collaborative control function of the braking system and the rear-wheel steering system to adjust the vehicle's yaw, and among them, the rear-wheel steering system fails (loss of ability type), the chassis domain controller will adjust the corresponding redundancy strategy, control the rear-wheel steering system to automatically return the rear wheels to the zero position, and at the same time control the braking system to independently complete the deviation yaw compensation. Another example is that when the vehicle is in a special working condition and needs the front-wheel steering and the rear-wheel steering to guide the vehicle out, if the rear-wheel steering system fails (loss of ability type), the chassis domain controller can adjust the corresponding redundancy strategy, control the vehicle's left and right wheels to achieve different clamping forces, adjust the rotation speeds of the left and right wheels, so that there is a rotation speed difference between the left and right wheels, thereby realizing vehicle steering.

[0060] It should be noted that since more energy is consumed during braking, the chassis domain controller usually considers the method of controlling the braking system to implement the redundancy strategy as the last resort to achieve the effect of saving resources. When a fault occurs in the actuator, the corresponding redundancy strategy for the actuator is enabled according to the type of execution fault of the actuator, so as to avoid the problem that the vehicle cannot normally complete the actions required for vehicle operation due to the actuator fault, enabling the chassis domain controller to coordinate the actuator to complete the corresponding actions according to the type of execution fault of the actuator, thereby ensuring the normal operation of the chassis domain control system.

[0061] Optionally, when the fault type is a sensor fault, the first backup signal of the sensor is input into the chassis domain controller to ensure the normal operation of the chassis domain control system. When a sensor fault occurs, the chassis domain controller can choose to use the first backup signal corresponding to the sensor. For example, the hardware backup of the wheel speed sensor is utilized. Since each wheel speed sensor is connected to both the chassis domain controller and the braking system. When the signal of the wheel speed sensor connected to the chassis domain controller fails, the signal of the wheel speed sensor (the first backup signal) connected to the braking system is input into the chassis domain controller, thereby providing the chassis domain controller with the environment and conditions to continue working and ensuring the normal operation of the chassis domain control system.

[0062] Optionally, when the fault type is a signal transmission fault, the operation of the chassis domain control system can be controlled based on the second backup signal corresponding to the signal accessed by the chassis domain controller to ensure the normal operation of the chassis domain control system. For example, in the chassis domain control system, the acceleration signal used by the chassis domain controller is usually the acceleration signal in the electronically controlled air suspension system (the accessed signal). When the transmission of this acceleration signal (the accessed signal) fails, the acceleration signal in the airbag system (the second backup signal) can be used instead. Another example is that the steering wheel angle signal can be backed up by the steering system and the angle sensor. When the transmission of the steering wheel angle signal in the steering system fails, the chassis domain control system can use the steering wheel angle signal transmitted by the accessed angle sensor to avoid the problem that the chassis domain controller cannot normally control the operation of the chassis domain control system due to the lack of necessary accessed signals, ensuring the normal operation of the chassis domain control system.

[0063] In the embodiment of the present application, a redundancy control method for a vehicle is provided. By adding a redundancy strategy to the chassis domain control system of the vehicle, when a fault occurs in the chassis domain control system, the corresponding redundancy strategy is enabled to ensure that the chassis domain control system can operate normally, improving the fault tolerance of the chassis domain control system, thereby effectively improving the safety of the vehicle during driving. At the same time, it can also remind the driver that the vehicle has a fault, improving the intelligent level of the vehicle.

[0064] Please refer to Figure 4 , Figure 4It is a logic framework diagram of a redundancy strategy switch provided by an embodiment of the present application. As Figure 4 shown, the chassis domain controller performs real-time fault detection. If a fault is detected in the chassis domain control system, the corresponding redundancy strategy will be activated according to the fault type to ensure the normal operation of the chassis domain control system. When the chassis domain controller performs real-time fault detection, if no fault is detected in the chassis domain control system, the redundancy strategy will be turned off to avoid unnecessary energy consumption caused by the vehicle being in the redundancy strategy for a long time.

[0065] Optionally, after determining that there is a fault in the chassis domain control system, a reminder message can be output to remind the user of the fault that has occurred in the chassis domain control system of the vehicle. Exemplarily, the output reminder message can be to display corresponding reminder text on the in-vehicle display screen, such as but not limited to Figure 5 shown, when it is determined that the chassis domain controller is faulty, "The chassis domain controller of the vehicle has a fault, and corresponding measures have been activated" can be displayed on the in-vehicle display screen. The above output reminder message can also be a voice prompt for the user through the in-vehicle speaker, or this reminder message can be sent to the user terminal through the vehicle server to remind the user, including but not limited to sending it to the user's smartphone, smartwatch, smart interaction tablet, etc. The embodiments of the present application do not limit this.

[0066] Please refer to Figure 6 , Figure 6 It is a schematic flow diagram of another vehicle redundancy control method provided by an embodiment of the present application. As Figure 6 shown, the vehicle redundancy control method at least includes:

[0067] S601. Determine whether the chassis domain control system has a fault according to the target status signal.

[0068] Specifically, S601 is the same as S301, and details are not described here again.

[0069] S602. If the self-check status signals of the chassis domain controller are all fault signals within the first target number of consecutive cycles, determine that the fault type of the chassis domain control system includes a chassis domain controller fault.

[0070] Specifically, the chassis domain controller can perform self-check in real time and generate corresponding self-check status signals. If the self-check status signals within the first target number of cycles are all fault signals, it can be determined that the chassis domain control system has a fault, and the fault type of the chassis domain control system includes a chassis domain controller fault.

[0071] S603. When the chassis domain controller fails, send a control failure instruction to the actuator, so that the actuator responds to the control failure instruction to mask the control instruction sent by the chassis domain controller, and operates according to its own control instruction of the actuator to ensure the normal operation of the chassis domain control system.

[0072] Specifically, the implementation process of the above S603 is the same as the implementation process of the corresponding redundant strategy when the fault type in S303 is the chassis domain controller failure, and will not be elaborated here.

[0073] S604. If the self-check status signals of the chassis domain controller are all normal signals within the third target consecutive cycles, send a control recovery instruction to the actuator to restore the control right of the chassis domain controller over the actuator.

[0074] Specifically, when the chassis domain controller fails and the corresponding redundant strategy is executed, the chassis domain controller will still perform real-time self-check. If the self-check status signals of the chassis domain controller are all normal signals within the third target consecutive cycles, it can be considered that the faulty chassis domain controller has returned to normal, and the corresponding redundant strategy can be closed to avoid energy consumption caused by the vehicle being in the redundant strategy for a long time. At the same time, the chassis domain controller will also send a control recovery instruction to the actuator to restore the control right of the chassis domain controller over each chassis system, and the chassis domain controller sends control instructions to each actuator. Among them, the third target can be, for example, but not limited to 5, 6, etc., and this embodiment does not make a limit thereon. The self-check status signal being a normal signal indicates that the self-check status signal of the chassis domain controller does not contain fault information and can be normally recognized.

[0075] The embodiment of the present application provides another method for redundant control of a vehicle. When there is a chassis domain controller failure in the chassis domain control system, a control failure instruction can be sent to the actuator, so that the actuator responds to the control failure instruction to mask the control instruction sent by the chassis domain controller, and operates according to its own control instruction of the actuator, ensuring the normal operation of the chassis domain control system and improving the driving safety of the vehicle. When the faulty chassis domain controller returns to normal, the redundant strategy can also be automatically closed, and a control recovery instruction is sent to the actuator to restore the control right of the chassis domain controller over the actuator, avoiding unnecessary energy consumption caused by the vehicle turning on the redundant strategy for a long time and improving the intelligent level of the vehicle.

[0076] Please refer to Figure 7 , Figure 7 which is the structural block diagram of a redundant control device for a vehicle provided by the embodiment of the present application. As Figure 7 shown, the redundant control device 700 of the vehicle includes: a judgment module 710, a determination module 720, and an execution module 730. Among them:

[0077] A judgment module 710, configured to judge whether a chassis domain control system has a fault according to a target status signal;

[0078] A determination module 720, configured to, if so, determine the fault type of the chassis domain control system;

[0079] An execution module 730, configured to execute a corresponding redundancy policy according to the fault type to ensure the normal operation of the chassis domain control system.

[0080] In some possible implementation manners, the chassis domain control system further includes an actuator and / or a sensor; the target status signal includes at least one of the following: a self-check status signal of a chassis domain controller, an execution status signal sent by an actuator, an output status signal of a sensor, and an access signal of the chassis domain controller;

[0081] The judgment module 710 includes:

[0082] A first determination unit, configured to determine that the chassis domain control system has a fault if the self-check status signal or the execution status signal or the output status signal is a fault signal within a continuous first target number of cycles, or if the access signals within a continuous second target number of cycles are all abnormal signals or lost; wherein, the second target is greater than the first target.

[0083] In some possible implementation manners, the chassis domain control system further includes an actuator;

[0084] The determination module 720 includes:

[0085] A second determination unit, configured to determine that the fault type of the chassis domain control system includes a chassis domain controller fault if the self-check status signal of the chassis domain controller is a fault signal within a continuous first target number of cycles;

[0086] The execution module 730 includes:

[0087] A sending unit, configured to, when a chassis domain controller fault occurs, send a control failure instruction to the actuator, so that the actuator responds to the control failure instruction to mask a control instruction sent by the chassis domain controller and work according to its own control instruction to ensure the normal operation of the chassis domain control system.

[0088] In some possible implementation manners, the sending unit further includes:

[0089] A sending subunit, configured to send a control recovery instruction to the actuator if the self-check status signal of the chassis domain controller is a normal signal within a continuous third target number of cycles to restore the control right of the chassis domain controller over the actuator.

[0090] In some possible implementation manners, the chassis domain control system further includes an actuator;

[0091] The determination module 720 includes:

[0092] A third determination unit, configured to determine that the fault type of the chassis domain control system includes actuator fault if the actuator status signals sent within consecutive first target cycles are all fault signals;

[0093] The execution module 730 includes:

[0094] A fourth determination unit, configured to determine a redundancy strategy for the actuator based on the execution fault type of the actuator when the actuator fails;

[0095] A first control unit, configured to control the actuator to perform corresponding operations according to the redundancy strategy to ensure the normal operation of the chassis domain control system.

[0096] In some possible implementation manners, the chassis domain control system further includes a sensor;

[0097] The determination module 720 includes:

[0098] A fifth determination unit, configured to determine that the fault type of the chassis domain control system includes sensor fault if the output status signals of the sensor are all fault signals within consecutive first target cycles;

[0099] The execution module 730 includes:

[0100] An input unit, configured to input the first backup signal of the sensor into the chassis domain controller when the sensor fails to ensure the normal operation of the chassis domain control system.

[0101] In some possible implementation manners, the determination module 720 includes:

[0102] A sixth determination unit, configured to determine that the fault type of the chassis domain control system includes signal transmission fault if the access signal of the chassis domain controller is an abnormal signal or lost within consecutive second target cycles;

[0103] The execution module 730 includes:

[0104] A second control unit, configured to control the operation of the chassis domain control system based on the second backup signal corresponding to the access signal when the chassis domain control system has a signal transmission fault to ensure the normal operation of the chassis domain control system.

[0105] In the embodiments of the present application, a redundancy control device for a vehicle is provided. By adding a redundancy strategy to the chassis domain control system of the vehicle, when the chassis domain control system fails, the corresponding redundancy strategy is enabled to ensure the normal operation of the chassis domain control system, improve the fault tolerance of the chassis domain control system, effectively improve the safety of the vehicle during driving, and improve the intelligent level of the vehicle.

[0106] It should be noted that when the redundant control device of the vehicle provided in the above embodiments executes the redundant control method of the vehicle, only the division of the above functional modules is used for illustration. In actual applications, the above functions can be allocated to different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the redundant control device of the vehicle provided in the above embodiments and the embodiments of the redundant control method of the vehicle belong to the same concept. The implementation process is shown in detail in the method embodiments and will not be repeated here.

[0107] The serial numbers of the embodiments of the present application above are only for description and do not represent the advantages and disadvantages of the embodiments.

[0108] Please refer to Figure 8 , Figure 8 which is a schematic structural diagram of a vehicle provided by an embodiment of the present application. As Figure 8 shown, the vehicle 800 may include: at least one vehicle processor 801, at least one network interface 804, a user interface 803, a memory 805, and at least one communication bus 802.

[0109] Among them, the communication bus 802 is used to realize the connection and communication between these components.

[0110] Among them, the user interface 803 may include a display screen (Display). Optionally, the user interface 803 may further include a standard wired interface and a wireless interface.

[0111] Among them, the network interface 804 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface).

[0112] Among them, the vehicle processor 801 may include one or more processing cores. The vehicle processor 801 connects various parts within the entire vehicle 800 through various interfaces and lines. By running or executing instructions, programs, code sets, or instruction sets stored in the memory 805, and by calling data stored in the memory 805, it performs various functions of the vehicle 800 and processes data. Optionally, the vehicle processor 801 may be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), or programmable logic array (PLA). The vehicle processor 801 may integrate a combination of one or several of a central processing unit (CPU), a graphics processing unit (GPU), and a modem, etc. Among them, the CPU mainly processes the operating system, user interface, application programs, etc.; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communication. It can be understood that the above-mentioned modem may not be integrated into the vehicle processor 801 and may be implemented separately by a single chip.

[0113] Among them, the memory 805 may include random access memory (RAM) and may also include read-only memory (ROM). Optionally, the memory 805 includes a non-transitory computer-readable storage medium. The memory 805 can be used to store instructions, programs, code, code sets, or instruction sets. The memory 805 may include a program storage area and a data storage area. Among them, the program storage area may store instructions for implementing the operating system, instructions for at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the above-mentioned method embodiments, etc.; the data storage area may store the data involved in the above-mentioned method embodiments. Optionally, the memory 805 may also be at least one storage device located far from the aforementioned vehicle processor 801. As Figure 8 shown, the memory 805, as a computer storage medium, may include an operating system, a network communication module, a user interface module, and a redundant control program for the vehicle.

[0114] In Figure 8In the vehicle 800 shown, the user interface 803 is mainly used to provide an interface for the user to input and obtain the data input by the user; while the vehicle processor 801 can be used to call the redundant control program of the vehicle stored in the memory 805 and specifically perform the following operations:

[0115] Judge whether the chassis domain control system fails according to the target status signal;

[0116] If so, determine the fault type of the chassis domain control system;

[0117] Execute the corresponding redundancy strategy according to the fault type to ensure the normal operation of the chassis domain control system.

[0118] In some possible implementation manners, the chassis domain control system further includes an actuator and / or a sensor; the target status signal includes at least one of the following: the self-check status signal of the chassis domain controller, the execution status signal sent by the actuator, the output status signal of the sensor, and the access signal of the chassis domain controller. When the processor 801 executes to judge whether the chassis domain control system fails according to the target status signal, it is specifically used to execute: if the self-check status signal or the execution status signal or the output status signal within the first target consecutive cycles is a fault signal, or, if the access signals within the second target consecutive cycles are all abnormal signals or lost, it is determined that the chassis domain control system fails; where the second target is greater than the first target.

[0119] In some possible implementation manners, the chassis domain control system further includes an actuator; when the processor 801 executes to determine the fault type of the chassis domain control system, it is specifically used to execute: if the self-check status signal of the chassis domain controller within the first target consecutive cycles is a fault signal, it is determined that the fault type of the chassis domain control system includes a chassis domain controller fault; when the processor 801 executes to execute the corresponding redundancy strategy according to the fault type to ensure the normal operation of the chassis domain control system, it is specifically used to execute: when the chassis domain controller fails, send a control failure instruction to the actuator, so that the actuator responds to the control failure instruction to block the control instruction sent by the chassis domain controller and work according to its own control instruction to ensure the normal operation of the chassis domain control system.

[0120] In some possible implementation manners, after the processor 801 executes to send a control failure instruction to the actuator when the chassis domain controller fails, it is further used to execute: if the self-check status signal of the chassis domain controller within the third target consecutive cycles is a normal signal, send a control recovery instruction to the actuator to restore the control right of the chassis domain controller over the actuator.

[0121] In some possible embodiments, the chassis domain control system further includes an actuator; when the processor 801 determines the fault type of the chassis domain control system, it is specifically configured to perform: if the execution status signals sent by the actuator are all fault signals within the first target consecutive cycles, determine that the fault type of the chassis domain control system includes actuator fault; when the processor 801 executes the corresponding redundancy policy according to the fault type to ensure the normal operation of the chassis domain control system, it is specifically configured to perform: when there is an actuator fault, determine the redundancy policy for the actuator based on the execution fault type of the actuator; control the actuator to perform corresponding operations according to the redundancy policy to ensure the normal operation of the chassis domain control system.

[0122] In some possible embodiments, the chassis domain control system further includes a sensor; when the processor 801 determines the fault type of the chassis domain control system, it is specifically configured to perform: if the output status signals of the sensor are all fault signals within the first target consecutive cycles, determine that the fault type of the chassis domain control system includes sensor fault; when the processor 801 executes the corresponding redundancy policy according to the fault type to ensure the normal operation of the chassis domain control system, it is specifically configured to perform: when there is a sensor fault, input the first backup signal of the sensor into the chassis domain controller to ensure the normal operation of the chassis domain control system.

[0123] In some possible embodiments, when the processor 801 determines the fault type of the chassis domain control system, it is specifically configured to perform: if the access signal of the chassis domain controller is an abnormal signal or lost within the second target consecutive cycles, determine that the fault type of the chassis domain control system includes signal transmission fault; when the processor 801 executes the corresponding redundancy policy according to the fault type to ensure the normal operation of the chassis domain control system, it is specifically configured to perform: when the chassis domain control system has a signal transmission fault, control the operation of the chassis domain control system based on the second backup signal corresponding to the access signal to ensure the normal operation of the chassis domain control system.

[0124] In the embodiments of the present application, a vehicle capable of implementing a redundancy control method for a vehicle is provided. By adding a redundancy policy to the chassis domain control system of the vehicle, when the chassis domain control system fails, the corresponding redundancy policy is activated to ensure the normal operation of the chassis domain control system, improve the fault tolerance of the chassis domain control system, thereby effectively improving the safety of the vehicle during driving and the intelligent level of the vehicle.

[0125] The embodiments of the present application further provide a computer-readable storage medium, in which instructions are stored. When it runs on a computer or a processor, it causes the computer or the processor to execute the above Figure 3 or Figure 6One or more steps in the illustrated embodiments. If each component module of the redundant control device of the above vehicle is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in the computer-readable storage medium.

[0126] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of modules is only a logical function division. In actual implementation, there may be other division methods. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed coupling or direct coupling or communication connection to each other can be through some interfaces. The indirect coupling or communication connection of devices or modules can be in electrical, mechanical or other forms.

[0127] The modules described as separate components may or may not be physically separated. The components shown as modules may or may not be physical modules. They can be located in one place or distributed to multiple network modules. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0128] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The above computer program product includes one or more computer instructions. When the above computer program instructions are loaded and executed on a computer, the processes or functions described in the embodiments of this specification are generated in whole or in part. The above computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The above computer instructions can be stored in a computer-readable storage medium or transmitted through the above computer-readable storage medium. The above computer instructions can be transmitted from a website, computer, server or data center to another website, computer, server or data center in a wired (such as coaxial cable, optical fiber, Digital Subscriber Line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) manner. The above computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more integrated available media. The above available medium can be a magnetic medium (for example, floppy disk, hard disk, magnetic tape), an optical medium (for example, Digital Versatile Disc (DVD)), or a semiconductor medium (for example, Solid State Disk (SSD)), etc.

[0129] It should be noted that, for the foregoing method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations. However, those skilled in the art should be aware that this application is not limited by the described action sequence, because according to this application, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to this application. In the above embodiments, the descriptions of the respective embodiments have their own emphases. For the parts not detailed in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0130] The above description of the disclosed embodiments enables those skilled in the art to implement or use this application. Various modifications to these embodiments will be obvious to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application will not be limited to the embodiments shown herein, but rather to the broadest scope consistent with the principles and novel features disclosed herein.

Claims

1. A redundant control method for a vehicle, characterized in that A chassis domain controller applied to a chassis domain control system, the method comprising: Determining whether the chassis domain control system has a fault according to a target status signal; If so, determining the fault type of the chassis domain control system; Executing a corresponding redundancy policy according to the fault type to ensure the normal operation of the chassis domain control system.

2. The method according to claim 1, wherein The chassis domain control system further includes an actuator and / or a sensor; the target status signal includes at least one of the following: a self-check status signal of the chassis domain controller, an execution status signal sent by the actuator, an output status signal of the sensor, and an access signal of the chassis domain controller; The determining whether the chassis domain control system has a fault according to the target status signal includes: If the self-check status signal or the execution status signal or the output status signal is a fault signal within a continuous first target number of cycles, or if the access signals are all abnormal signals or missing within a continuous second target number of cycles, it is determined that the chassis domain control system has a fault; Wherein, the second target is greater than the first target.

3. The method according to claim 1 or 2, characterized in that, The chassis domain control system further includes an actuator; The determining the fault type of the chassis domain control system includes: If the self-check status signal of the chassis domain controller is a fault signal within a continuous first target number of cycles, it is determined that the fault type of the chassis domain control system includes a chassis domain controller fault; The executing a corresponding redundancy policy according to the fault type to ensure the normal operation of the chassis domain control system includes: When the chassis domain controller has a fault, sending a control failure instruction to the actuator, so that the actuator responds to the control failure instruction to block the control instruction sent by the chassis domain controller, and work according to its own control instruction of the actuator to ensure the normal operation of the chassis domain control system.

4. The method according to claim 3, wherein After sending a control failure instruction to the actuator when the chassis domain controller has a fault, the method further includes: If the self-check status signal of the chassis domain controller is a normal signal within a continuous third target number of cycles, sending a control recovery instruction to the actuator to restore the control right of the chassis domain controller over the actuator.

5. The method according to claim 1 or 2, characterized in that, The chassis domain control system further includes an actuator; The determining the fault type of the chassis domain control system includes: If the execution status signal sent by the actuator is a fault signal within a continuous first target number of cycles, it is determined that the fault type of the chassis domain control system includes an actuator fault; The executing a corresponding redundancy policy according to the fault type to ensure the normal operation of the chassis domain control system includes: When the actuator has a fault, determining a redundancy policy for the actuator based on the execution fault type of the actuator; Controlling the actuator to execute corresponding work according to the redundancy policy to ensure the normal operation of the chassis domain control system.

6. The method according to claim 1 or 2, characterized in that, The chassis domain control system further includes a sensor; The determining the fault type of the chassis domain control system includes: If the output status signals of the sensor are all fault signals within the first target consecutive cycles, it is determined that the fault type of the chassis domain control system includes the sensor fault; Performing a corresponding redundancy strategy according to the fault type to ensure the normal operation of the chassis domain control system, including: When the sensor fails, input the first backup signal of the sensor into the chassis domain controller to ensure the normal operation of the chassis domain control system.

7. The method according to claim 1 or 2, characterized in that Determining the fault type of the chassis domain control system includes: If the access signal of the chassis domain controller within the second target consecutive cycles is an abnormal signal or missing, it is determined that the fault type of the chassis domain control system includes a signal transmission fault; Performing a corresponding redundancy strategy according to the fault type to ensure the normal operation of the chassis domain control system, including: When the signal transmission fault occurs in the chassis domain control system, control the operation of the chassis domain control system based on the second backup signal corresponding to the access signal to ensure the normal operation of the chassis domain control system.

8. A redundant control device for a vehicle, characterized in that, A chassis domain controller applied to a chassis domain control system, the device includes: A judgment module, configured to judge whether the chassis domain control system fails according to the target status signal; A determination module, configured to, if so, determine the fault type of the chassis domain control system; An execution module, configured to perform a corresponding redundancy strategy according to the fault type to ensure the normal operation of the chassis domain control system.

9. A computer storage medium, characterized in that, The computer storage medium stores multiple instructions, and the instructions are suitable for being loaded and executed by a processor to perform the steps of the method according to any one of claims 1 to 7.

10. A vehicle, characterized in that, Including a memory, a processor, and a computer program stored on the memory and executable on the processor, and when the processor executes the program, the steps of the method according to any one of claims 1 to 7 are implemented.

Images