A chassis domain controller failure level determination system and method

Abstract

The application provides a chassis domain controller fault level determination system and method, and relates to the technical field of automobile fault diagnosis.The system comprises a first chip, a second chip and a diagnosis control chip arranged in a chassis domain controller.The first chip and the second chip are respectively connected to each chassis domain subsystem of a chassis domain system and are interconnected through the diagnosis control chip.The first chip respectively detects faults of each chassis domain subsystem to generate a first fault detection result.The second chip respectively detects faults of each chassis domain subsystem to generate a second fault detection result.The diagnosis control chip determines a chassis domain fault level of the chassis domain controller according to the first fault detection result and the second fault detection result.The application improves the safety, reliability and fault tolerance of the vehicle chassis domain system by introducing the cooperative work of the double-chip redundancy design and the diagnosis control chip.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of automobile fault diagnosis, and in particular to a chassis domain controller fault level determination system and method. BACKGROUND

[0002] In the design of a chassis domain controller, functional safety is a crucial aspect. For a controller with ASIL-D level safety requirements, how to effectively implement fault diagnosis to ensure that the chassis system can quickly take countermeasures when a fault occurs, thereby avoiding affecting the safety of vehicle travel, has become the focus of technical research.

[0003] Currently, new energy vehicles adopt a distributed control architecture, and each domain controller communicates and interacts through a central gateway, which has a serious lack of system redundancy. Since each domain function module operates independently, when a hardware or logic fault occurs in a key chassis system, the functional safety cannot be maintained, which easily leads to functional degradation lag or safety response failure, making it difficult to meet the requirements of ASIL-D and other high functional safety levels, and significantly increasing the risk of driving safety. SUMMARY

[0004] The present application provides a chassis domain controller fault level determination system and method, which aims to solve the problems in the above background technology.

[0005] In order to solve the above technical problems, the present application is implemented as follows:

[0006] In a first aspect, the present application provides a chassis domain controller fault level determination system, which comprises a first chip, a second chip and a diagnostic control chip deployed in a chassis domain controller; the first chip and the second chip are respectively connected to each chassis domain subsystem of a chassis domain system and are interconnected through the diagnostic control chip.

[0007] The first chip respectively detects faults of the each chassis domain subsystem to generate a first fault detection result.

[0008] The second chip respectively detects faults of the each chassis domain subsystem to generate a second fault detection result.

[0009] The diagnostic control chip determines a chassis domain fault level of the chassis domain controller according to the first fault detection result and the second fault detection result, and the chassis domain fault level represents the influence degree of all the failed chassis domain subsystems on the chassis domain system.

[0010] Optionally, the diagnostic control chip determines the chassis domain fault level of the chassis domain controller according to the first fault detection result and the second fault detection result, comprising:

[0011] The diagnostic control chip determines a first fault level according to the first fault detection result, and the first fault level represents a first chassis domain subsystem corresponding to the first fault detection result and an influence degree of the chassis domain subsystem on a chassis domain system;

[0012] The diagnostic control chip determines a second fault level according to the second fault detection result, and the second fault level represents a second chassis domain subsystem corresponding to the second fault detection result and an influence degree of the second chassis domain subsystem on the chassis domain system;

[0013] The diagnostic control chip determines the chassis domain fault level according to the first fault level and the second fault level.

[0014] Optionally, the diagnostic control chip is further configured to:

[0015] The diagnostic control chip determines a first fault response according to the first fault detection result, and a second fault response according to the second fault detection result;

[0016] The diagnostic control chip determines a chassis domain subsystem fault response according to the first fault response and the second fault response;

[0017] The diagnostic control chip sends the chassis domain subsystem fault response and an identifier of a target chassis domain subsystem corresponding to the chassis domain subsystem fault response to a master control chip, and the master control chip is one of the first chip and the second chip; the target chassis domain subsystem is a chassis domain subsystem corresponding to a detection result generated by the master control chip;

[0018] The master control chip sends the chassis domain subsystem fault response to the target chassis domain subsystem according to the identifier of the target chassis domain subsystem;

[0019] The target chassis domain subsystem executes the chassis domain subsystem fault response to repair the target chassis domain subsystem.

[0020] Optionally, the diagnostic control chip is further configured to:

[0021] The diagnostic control chip determines a chassis domain fault response according to the chassis domain fault level;

[0022] The diagnostic control chip determines, from the chassis domain subsystems, identifiers of at least two chassis domain subsystems that need to cooperatively execute the chassis domain fault response;

[0023] The diagnostic control chip sends the chassis domain fault response and the identifiers of the at least two chassis domain subsystems corresponding to the chassis domain fault response to a master control chip, and the master control chip is one of the first chip and the second chip.

[0024] The master chip sends the chassis domain subsystem fault response to the at least two chassis domain subsystems according to the identification of the at least two chassis domain subsystems;

[0025] The at least two chassis domain subsystems cooperatively execute the chassis domain fault response to repair the failed chassis domain subsystem.

[0026] Optionally, the diagnostic control chip is further configured to:

[0027] The diagnostic control chip initializes the first chip as a master chip and initializes the second chip as a backup chip;

[0028] In a case where the first fault level is not higher than the second fault level, the first chip is maintained as a master chip and the second chip is maintained as a backup chip;

[0029] In a case where the first fault level is higher than the second fault level, the second chip is switched to a master chip and the first chip is switched to a backup chip.

[0030] Optionally, the first chip is further configured to generate a first functional control parameter value according to sensor data of the respective chassis domain subsystems;

[0031] The second chip is further configured to generate a second functional control parameter value according to sensor data of the respective chassis domain subsystems;

[0032] The diagnostic control chip determines the chassis domain fault level as a fault level corresponding to a difference between the first functional control parameter value and the second functional control parameter value in a case where the difference is greater than a target threshold.

[0033] Optionally, the first chip is further configured to generate a first functional control instruction according to sensor data of the respective chassis domain subsystems;

[0034] The second chip is further configured to generate a second functional control instruction according to sensor data of the respective chassis domain subsystems;

[0035] The diagnostic control chip determines the chassis domain fault level as a target fault level in a case where control logic of the first functional control instruction is opposite to control logic of the second functional control instruction.

[0036] Optionally, the first chip and the second chip are connected to a vehicle body domain system, respectively;

[0037] The first chip performs collision signal detection on the vehicle body domain system to generate a first collision signal detection result;

[0038] The second chip detects a collision signal of the vehicle body domain system, and generates a second collision signal detection result;

[0039] The diagnostic control chip determines the chassis domain fault level as the highest fault level in a case where it is determined that a vehicle collision fault occurs according to the first collision signal detection result and / or the second collision signal detection result.

[0040] Optionally, the chassis domain subsystems include at least a driving subsystem and a steering subsystem.

[0041] The diagnostic control chip latches vehicle collision fault information after an ignition cycle of the vehicle ends in a case where it is determined that a vehicle body collision occurs, and sets the highest fault level as unrecoverable.

[0042] The diagnostic control chip monitors whether the vehicle collision fault is cleared.

[0043] In a case where the vehicle collision fault is not cleared, the diagnostic control chip sends a driving restriction instruction and a steering restriction instruction to a master control chip, the master control chip being one of the first chip and the second chip.

[0044] The master control chip sends the driving restriction instruction to the driving subsystem to restrict a driving function of the driving subsystem.

[0045] The master control chip sends the steering restriction instruction to the steering subsystem to restrict a steering function of the steering subsystem.

[0046] In a second aspect, the embodiments of the present disclosure provide a chassis domain controller fault level determination method, applied to the system of the first aspect, and the method comprises the following steps:

[0047] The first chip detects faults of the chassis domain subsystems respectively, and generates a first fault detection result;

[0048] The second chip detects faults of the chassis domain subsystems respectively, and generates a second fault detection result;

[0049] The diagnostic control chip determines a chassis domain fault level of the chassis domain controller according to the first fault detection result and the second fault detection result, the chassis domain fault level representing an influence degree of all the chassis domain subsystems that have faults on the chassis domain system.

[0050] The technical solution provided by the present application at least brings the following beneficial effects:

[0051] The application avoids single point failure leading to system paralysis and ensures system redundancy and fault tolerance through the cooperation of the double chips, when one of the chips fails, the other chip can still work normally. Meanwhile, the first chip and the second chip respectively detect the chassis domain subsystem for failure, generate independent failure detection results, and the diagnostic control chip comprehensively analyzes the two detection results to judge the chassis domain failure level to reflect the comprehensive influence of multiple failures on the overall chassis domain system performance and safety. On the basis of meeting the ASIL-D (the highest level of automotive functional safety) requirements, the application improves the safety and fault tolerance of the vehicle chassis domain system through the introduction of double chip redundancy design and the cooperative work of the diagnostic control chip. BRIEF DESCRIPTION OF DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0053] Figure 1 is an architecture schematic diagram of a chassis domain controller failure level determination system provided by an embodiment of the present application;

[0054] Figure 2 is an architecture schematic diagram of a chassis domain controller failure level determination system provided by another embodiment of the present application;

[0055] Figure 3 is a step schematic diagram of a chassis domain controller failure level determination method provided by an embodiment of the present application. DETAILED DESCRIPTION

[0056] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0057] In view of the problem of insufficient reliability of single-chip controllers existing in the traditional distributed control architecture, the related technology cannot meet the high safety level control demand of the chassis domain. The present application concept is to build a three-layer architecture system of double-chip cooperative monitoring and diagnosis control chip, by setting a first chip, a second chip and an independent diagnosis control chip as a functional control chip and independent monitoring in the chassis domain controller, compared with the traditional single-chip controller, one-way redundant monitoring is added, which naturally meets the ASIL-D functional safety level requirement of the chassis domain. At the same time, for the establishment of multiple chassis domain subsystems, the diagnosis control chip compares the fault judgment results of the double-chip in real time, and realizes the dynamic fault response decision according to the pre-constructed multiple chassis domain system fault level mapping. The present application makes the disposal of single subsystem fault no longer isolated, but dynamically coordinated response based on the overall safety target, while the heterogeneous operation of the double-chip ensures that the basic safety function can still be maintained even when a single-chip fails, and finally forms a global fault management covering each chassis domain subsystem.

[0058] Figure 1 is a schematic diagram of the architecture of a chassis domain controller fault level determination system provided by an embodiment of the present application, as Figure 1 shown, the system includes a first chip, a second chip and a diagnosis control chip deployed in the chassis domain controller; the first chip and the second chip are respectively connected to each chassis domain subsystem of the chassis domain system, and are interconnected through the diagnosis control chip.

[0059] The first chip and the second chip constitute a redundant control architecture, and are respectively connected to at least two of the brake system, the steering system, the drive system and the suspension system through independent data acquisition channels, to obtain sensor signals and state parameters of each subsystem in real time. The suspension system can be an air suspension system or a continuously adjustable damping suspension system, wherein the continuously adjustable damping suspension system can adjust the damping of the suspension system in real time according to the driving environment and the road conditions.

[0060] In this embodiment, the centralized control architecture of the chassis domain controller divides the chassis function modules into multiple subsystems, and the chassis domain controller uniformly manages fault diagnosis and response. In this embodiment, the brake system, the steering system, the drive system and the suspension system are integrated into a single chassis domain controller as chassis domain subsystems, and the motors and hardware controlled by each subsystem are different, for example, the brake system adopts an electronic mechanical brake scheme, and its actuator is a brake caliper driven by a brushless DC motor; and the steering system is based on a steer-by-wire architecture, and the control object is a permanent magnet synchronous motor.

[0061] The diagnosis control chip is connected to the first chip and the second chip through a high-speed bus to form a triangular monitoring topology.

[0062] The first chip has a dedicated communication interface (such as a CAN bus or analog input port) with each chassis subsystem to receive sensor data from each subsystem, such as dual-channel brake pedal voltage signals, steering gear angle data, and motor IGBT temperature parameters. During initialization, the first chip acts as the master control chip. As the master control chip, it performs logic control calculations on the acquired sensor data and generates control commands for the corresponding subsystems (such as brake pressure distribution values ​​and steering assist torque) based on the calculation results. Simultaneously, the first chip sends the calculated control commands to the diagnostic control chip for logic verification.

[0063] The second chip connects to all identical chassis domain subsystems in a mirror manner, synchronously acquiring all sensor data with the first chip and performing logic control calculations on the sensor data. During initialization, the second chip acts as a backup chip. When acting as a backup chip, the second chip transmits the calculation results to the diagnostic control chip for logic verification, but does not output any control commands.

[0064] The first chip performs fault detection on each of the chassis domain subsystems and generates a first fault detection result.

[0065] The first chip acquires real-time sensor data from multiple sources in chassis subsystems such as the braking system, steering system, drive system, and suspension system (for example, for the braking system, the first chip continuously monitors the voltage signals of the dual brake pedal pressure sensors), and performs fault detection on each chassis subsystem based on the sensor data. Based on the fault detection results for each chassis subsystem, the first chip obtains a first fault detection result, which is transmitted in real-time to the diagnostic control chip via an independent communication link for redundancy comparison and decision arbitration. The first fault result is the detection result obtained by the first chip for fault detection of each chassis subsystem within the chassis domain system; the first fault detection result may include the subsystem identifier and fault type.

[0066] The second chip performs fault detection on each of the chassis domain subsystems and generates a second fault detection result.

[0067] The second chip establishes a connection with each chassis domain subsystem through an independent communication interface, and the second chip is completely independent of the first chip at the data acquisition level. The second chip collects sensor data from chassis domain subsystems such as brake systems, steering systems, drive systems, and suspension systems in real time, and performs fault detection on each chassis domain subsystem based on the sensor data of each chassis domain subsystem. The second chip obtains a second fault detection result according to the result of the fault detection for each chassis domain subsystem, and transmits the second fault detection result to the diagnostic control chip in real time through an independent communication link for redundant comparison and decision arbitration. The second fault detection result is a detection result obtained by the second chip for fault detection of each chassis domain subsystem in the chassis domain system, and the second fault detection result can include a subsystem identifier and a fault type.

[0068] The diagnostic control chip determines a chassis domain fault level of the chassis domain controller according to the first fault detection result and the second fault detection result, and the chassis domain fault level represents the degree of influence of all failed chassis domain subsystems on the chassis domain system.

[0069] The diagnostic control chip receives the first fault detection result from the first chip and the second fault detection result from the second chip in real time. The diagnostic control chip compares the first fault detection result and the second fault detection result of the same subsystem item by item, and if the first fault detection result and the second fault detection result reported by the first chip and the second chip for the same subsystem are consistent, it is determined that the fault actually exists, and the fault level mapping process is directly entered. If the first fault detection result and the second fault detection result reported by the first chip and the second chip for the same subsystem are different, a heterogeneous redundancy arbitration mechanism is started: the fault detection result of the master control chip is used as the reference.

[0070] The diagnostic control chip has a built-in multi-dimensional chassis domain fault level mapping table, which can define the correspondence between different combinations of the first fault level and the second fault level and the chassis domain fault level. The diagnostic control chip determines the global chassis domain fault level of the chassis domain system by comprehensively considering the degree of influence of all failed chassis domain subsystems on the chassis domain system. The degree of influence represents the comprehensive action level of the fault on the overall functional safety of the chassis domain system, the cooperative control ability between subsystems, and the drivable state of the vehicle. The degree of influence is determined based on the correlation between fault type and safety redundancy design (for example, when a single failure occurs in a dual brake pedal sensor, the larger value is used for processing, and its degree of influence is lower than that of a dual failure), and the functional coupling strength between subsystems (for example, the IGBT overheat fault of the drive system will dynamically adjust the level according to whether it affects the brake energy recovery function).

[0071] The chassis domain fault level reflects the influence of the faults of at least two chassis domain subsystems on the overall operation and function of the entire chassis domain system, and further reflects the safety risk and performance influence on the entire vehicle system. Different weights can be given to the subsystem fault levels of different chassis domain subsystems according to the influence of the chassis domain subsystems on the safety of the entire vehicle, and finally the final chassis domain fault level is obtained by weighting.

[0072] The present application avoids single point failure leading to system paralysis and ensures system redundancy and fault tolerance through the cooperation of the two chips when one of the chips fails. Meanwhile, the first chip and the second chip respectively perform fault detection on the chassis domain subsystems to generate independent fault detection results, and the diagnosis control chip comprehensively analyzes the two detection results to determine the chassis domain fault level, so as to reflect the comprehensive influence of multiple faults on the performance and safety of the overall chassis domain system. On the basis of meeting the ASIL-D (the highest level of automotive functional safety) requirement, the present application improves the safety, reliability and fault tolerance of the vehicle chassis domain system through the introduction of the redundant design of the two chips and the cooperative work of the diagnosis control chip.

[0073] In an optional embodiment, the diagnosis control chip determines the chassis domain fault level of the chassis domain controller according to the first fault detection result and the second fault detection result, including:

[0074] The diagnosis control chip determines a first fault level according to the first fault detection result, and the first fault level represents the influence degree of the first chassis domain subsystem corresponding to the first fault detection result on the chassis domain system.

[0075] The diagnostic control chip builds a subsystem fault level mapping table (for example, a level table of the brake system, the steering system, the driving system, the suspension system) for each chassis domain subsystem. The diagnostic control chip can define the correspondence between different subsystem faults and subsystem fault levels according to the influence of different subsystem faults on the chassis domain system for each chassis domain subsystem. The subsystem fault is a fault occurring locally in the chassis domain subsystem. The diagnostic control chip can determine all subsystem faults occurring locally in each subsystem according to the first fault detection result, and the influence of each subsystem fault on the chassis domain system. Based on this, the diagnostic control chip can query the predefined subsystem fault level table to determine the corresponding subsystem fault level. The subsystem fault level represents the influence of the fault occurring locally in the corresponding chassis domain subsystem on the chassis domain system (which can be reflected in the influence on the function of the chassis domain system). Each chassis domain subsystem with a fault has a corresponding and independent subsystem fault level, which represents the fault severity of each chassis domain subsystem with a fault. It can be understood as the influence of the fault occurring in a single chassis domain subsystem on the entire chassis domain system. Specifically, for each chassis domain subsystem with a detected fault, the diagnostic control chip matches the preset subsystem fault level according to the fault type (such as voltage anomaly, communication loss, calculation logic conflict, etc.) and the influence of the fault type on the chassis domain system (such as function limitation, performance degradation, function failure, etc.).

[0076] For example, for the brake system, if the first chip detects that the voltages of two brake pedals are inconsistent (fault type), and the fault causes the brake performance to decrease by a first amplitude (influence degree), then according to the subsystem fault level table of the brake system, the subsystem fault level of the brake system is mapped to the second level.

[0077] In the brake system, the first amplitude is the amplitude of a smaller fault or performance decrease. For example, a slight influence caused by a brake pedal voltage difference, such as a slight decrease in the response speed of the brake system, but the basic brake function can still be maintained. In this case, although the performance is affected, the safety of the chassis domain system is not completely affected, and the amplitude of the decrease in brake performance is the first amplitude.

[0078] Based on the subsystem fault levels of each chassis domain subsystem, the first fault level of the first chip is determined. The first fault level is the highest fault level among the subsystem fault levels of each chassis domain subsystem monitored by the first chip.

[0079] The diagnostic control chip determines a second fault level according to the second fault detection result. The second fault level represents the influence of the second chassis domain subsystem with a fault corresponding to the second fault detection result on the chassis domain system.

[0080] The diagnostic control chip processes the second fault detection result of the second chip with the same logic, and determines the corresponding subsystem fault level by querying the same subsystem fault level table.

[0081] Based on the subsystem fault levels of each chassis domain subsystem locally, the second fault level of the second chip is determined, which is the highest fault level among the subsystem fault levels of each chassis domain subsystem monitored by the second chip.

[0082] The diagnostic control chip determines the chassis domain fault level according to the first fault level and the second fault level. It can be understood that the subsystem fault level is a fault level reflecting the chassis domain subsystem level fault, the first fault level and the second fault level are fault levels reflecting the chip level fault, and the chassis domain fault level is a fault level reflecting the chassis domain system level fault (the linkage effect of multiple chassis domain subsystem faults).

[0083] The diagnostic control chip determines the first fault level and the second fault level according to the combination of the multiple fault levels of the subsystem faults occurring in all chassis domain subsystems on the first chip, and according to the combination of the multiple fault levels of the subsystem faults occurring in all chassis domain subsystems on the second chip, and then determines the global chassis domain fault level based on the chassis domain fault level mapping table according to the combination of the first fault level and the second fault level.

[0084] Table 1 gives an example of the chassis domain fault level mapping table. The chassis domain fault level is a plurality of fault levels in ascending order, as shown in Table 1, the chassis domain fault level is from the zeroth level (no fault) to the eighth level (emergency shutdown), and the fault severity increases. The chassis domain fault level is determined based on the combination of the first fault level and the second fault level of the double chip (such as A0B1 represents that the first chip has no fault and the second chip has the first level fault), and the fault level combination of each chassis domain subsystem (braking / driving / steering / suspension) determines the first fault level or the second fault level.

[0085] For example, the diagnostic control chip analyzes that the fault level of the braking system monitored by the first chip is the highest, which is the fourth level subsystem fault; the fault level of the driving system monitored by the second chip is the highest, which is the second level subsystem fault, and the table lookup obtains the case of A4B2, which corresponds to the chassis domain fault level of the fourth level. The fault description is: auxiliary function is prohibited. The corresponding chassis domain fault response is: prohibit auxiliary function (such as automatic parking), and reserve basic braking / steering capability.

[0086] In Table 1, in the fault description corresponding to the fifth level chassis domain fault level, the second amplitude is the power limitation degree corresponding to the case that the fault causes the performance of the chassis domain system to be reduced, but does not directly affect the safety performance of the vehicle. For example, a small range of faults occurs in a subsystem, such as a 10%-20% power reduction of the driving system, but the vehicle can still continue to travel and will not directly affect the safety performance. For another example, if the motor or driving system is slightly overheated, the power limitation mechanism will be started, but the driver can still normally drive the vehicle. At this time, the fault has a small influence, which belongs to the second amplitude power limitation.

[0087] In the fault description corresponding to the sixth level chassis domain fault level, the third amplitude is the power limitation degree corresponding to the case that the serious fault directly affects the safety performance of the vehicle, but does not cause the vehicle function to completely fail. At this time, stronger power limitation is performed, more subsystems are limited, or the vehicle speed is reduced or some operations are limited to ensure safety, which belongs to the third amplitude power limitation.

[0088] It should be noted that since the fault level of some subsystems is only designed for a specific function scene, other chassis domain subsystems do not participate in response in this scene. For example, in the case of the fourth level chassis domain fault level (auxiliary function prohibition), the subsystem fault level of the braking system is “-”. It is indicated that the braking system does not need to perform fault level evaluation or response in this specific scene. That is, although the chassis domain fault level is high, the work of the braking system is not affected and does not need to participate in the fault level evaluation of the chassis domain. “-” indicates that the chassis domain subsystem does not need to consider or process the fault level in this situation because its function is still normal and its subsystem fault level has no influence on the current scene.

[0089] Table 1

[0090]

[0091] The application constructs a chassis domain fault management system with good redundancy through double-chip cooperative monitoring, fault detection result comparison and fault level mapping. When the vehicle encounters a system fault, the vehicle can take corresponding measures corresponding to the chassis domain fault level to meet the requirements of a high safety level (ASIL-D).

[0092] In an optional implementation, the diagnostic control chip is further configured to:

[0093] The diagnostic control chip determines a first fault response according to the first fault detection result, and determines a second fault response according to the second fault detection result.

[0094] The diagnostic control chip analyzes the subsystem identifier and the fault type of each subsystem according to the received first fault detection result and second fault detection result, and independently generates a first fault response of the first chip and a second fault response of the second chip. The first fault response includes specific control instructions and target chassis domain subsystem identifiers that need to be triggered; the second fault response is generated based on the independent second fault detection result of the second chip.

[0095] The diagnostic control chip determines a chassis domain subsystem fault response according to the first fault response and the second fault response.

[0096] If the first fault response and the second fault response are consistent in the processing measures for the same chassis domain subsystem (for example, both chips require the brake system to perform “turn on the fault light + take the maximum value of two pedal voltages”), the response is directly adopted as the final response. If the first fault response and the second fault response conflict, but the first fault level and the second fault level are different (for example, the first chip requires to limit the driving power to 50%, and the second chip requires to completely prohibit driving), the diagnostic control chip controls the master control chip to select the response with the higher fault level as the final response (for example, the “prohibit driving” of the second chip corresponds to the second fault level of the fifth level, which is higher than the first fault level of the fourth level of the first chip). If the first fault response and the second fault response conflict, but the first fault level and the second fault level are the same, the response with greater impact on vehicle safety is selected according to the preset weight. It can be understood that the diagnostic control chip selects the response that maximizes the safety of the vehicle based on the redundant detection results.

[0097] The diagnostic control chip sends the chassis domain subsystem fault response and the identifier of the corresponding target chassis domain subsystem to the master control chip, and the master control chip is one of the first chip and the second chip; the target chassis domain subsystem is the chassis domain subsystem that generates the detection result corresponding to the master control chip.

[0098] The selection logic of the master control chip follows: by default, the first chip is the master control chip, and the second chip is the standby chip; if the diagnostic control chip detects that the first fault level of the first chip is higher than that of the second chip, the master control chip is switched to the second chip; if the fault levels of the two chips are the same, the current master control chip is maintained.

[0099] The master control chip sends the chassis domain subsystem fault response to the target chassis domain subsystem according to the identifier of the target chassis domain subsystem.

[0100] The master control chip sends control instructions to the target chassis domain subsystem through a hardware direct connection port (such as a PWM output interface, a digital interface) or an intra-domain bus (such as a CAN bus or a LIN bus), and the target chassis domain subsystem is a chassis domain subsystem that exists a fault and needs to execute a fault response.

[0101] The target chassis domain subsystem executes the chassis domain subsystem fault response to repair the target chassis domain subsystem.

[0102] The target chassis domain subsystem executes a corresponding response according to the control instruction. For example, the braking system switches to a redundant sensor channel and activates a backup power supply; the drive system calls a safety routine to gradually reduce the IGBT switching frequency to reduce the temperature rise. When the chassis domain subsystem detects that the fault condition disappears (such as the sensor voltage returning to the normal range), the master control chip sends a recovery signal to the diagnostic control chip, and the diagnostic control chip resets the related fault level and removes the related restrictions.

[0103] In an optional implementation, the diagnostic control chip is further configured to:

[0104] The diagnostic control chip determines a chassis domain fault response according to the chassis domain fault level.

[0105] The diagnostic control chip determines a chassis domain fault response that matches the current chassis domain fault level by querying a chassis domain fault response mapping table according to the chassis domain fault level. The chassis domain fault response includes control instructions that need to be triggered (such as limiting power, disabling a functional module, and lighting a fault light) and the cooperative operation logic of the target chassis domain subsystem. For example, when the chassis domain system fault level is the fifth level (system second amplitude power limiting), the chassis domain fault response is to simultaneously limit the torque of the drive system and the braking force distribution of the braking system to balance the dynamic stability of the vehicle.

[0106] The diagnostic control chip determines the identities of at least two chassis domain subsystems that need to cooperatively execute the chassis domain fault response from the respective chassis domain subsystems.

[0107] The diagnostic control chip determines the associated chassis domain subsystems affected by the current chassis domain fault from the respective chassis domain subsystems. For example, when the chassis domain fault is a loss of steering assist, the braking system needs to provide additional braking torque to the steering system to compensate for the risk of insufficient steering, and at this time, the at least two chassis domain subsystems are the steering system and the braking system. According to the contribution of the chassis domain subsystem to the safety of the vehicle (such as the weight of the braking system > the weight of the suspension system), the high-weight chassis domain subsystems that need to be cooperatively prioritized are selected. For the chassis domain fault response corresponding to a higher fault level (such as the seventh level of the chassis domain fault level), multiple chassis domain subsystems are assigned to perform complementary operations (such as the drive system reducing the torque and the suspension system adjusting the vehicle body height to lower the center of gravity).

[0108] The diagnostic control chip sends the chassis domain fault response and the identifiers of at least two corresponding chassis domain subsystems to the main control chip, which is one of the first chip and the second chip.

[0109] The main control chip sends the chassis domain subsystem fault response to the at least two chassis domain subsystems based on their identifiers.

[0110] The main control chip parses and diagnoses the chassis domain subsystem identifier list in the control commands issued by the control chip, and distributes the control commands to each target chassis domain subsystem through the corresponding communication interface.

[0111] The at least two chassis domain subsystems coordinate to execute the chassis domain fault response in order to repair the faulty chassis domain subsystem.

[0112] Each chassis domain subsystem executes the received control commands synchronously and achieves operational interlocking through shared state variables (such as vehicle speed and yaw rate). For example, when the drive system reduces torque, the braking system dynamically adjusts the braking force to prevent vehicle instability. If one chassis domain subsystem fails to execute, other related chassis domain subsystems trigger compensation measures. The chassis domain subsystems transmit the execution results back to the diagnostic control chip in real time through the main control chip. The diagnostic control chip dynamically adjusts the response parameters based on the feedback data until the fault is eliminated or the safety tolerance is reached.

[0113] In an optional implementation, the diagnostic control chip is further used for:

[0114] The diagnostic control chip initializes the first chip as the main control chip and the second chip as a backup chip.

[0115] During the power-on initialization phase of the chassis domain controller, the diagnostic control chip performs the main control chip allocation, setting the first chip as the main control chip, responsible for the generation and output of real-time control commands for each chassis domain subsystem; simultaneously, the second chip is initialized as a backup chip, putting it into redundant monitoring mode. The second chip performs parallel calculations based on the same sensor data source as the first chip, generating mirror control logic but not participating in the actual control output, only feeding back the calculation results and the second fault detection results to the diagnostic control chip for consistency verification.

[0116] If the first fault level is not higher than the second fault level, the first chip is maintained as the main control chip, and the second chip is maintained as the backup chip.

[0117] During system operation, the diagnostic control chip continuously compares the first fault level and the second fault level in real time, and when the first fault level is less than or equal to the second fault level, it indicates that the reliability of the master chip is not lower than that of the standby chip, and the current control architecture is maintained, that is, the first chip continues to serve as the master chip and exercises the control right of the chassis domain to output control instructions to the chassis domain subsystem actuators, and the second chip remains in standby state and continuously synchronously calculates and monitors the system state, and the control logic output port thereof remains in disabled state.

[0118] In the case where the first fault level is higher than the second fault level, the second chip is switched to the master chip, and the first chip is switched to the standby chip.

[0119] When the first fault level is greater than the second fault level, it indicates that the severity of the fault of the master chip has exceeded that of the standby chip, and there is a risk of control failure, the diagnostic control chip sends a suspension instruction to the first chip to close its control output port, and at the same time sends an activation instruction to the second chip to authorize it to take over the control right of the chassis domain and become the new master chip, and after obtaining the control right, the second chip switches from standby mode to active control mode, generates control instructions based on real-time sensor data and outputs them to each chassis domain subsystem, and the first chip becomes a standby chip and stops control output.

[0120] The present application realizes seamless redundancy takeover between the two chips through the initialization allocation and dynamic switching mechanism, quantitatively compares the chip reliability through the first fault level and the second fault level, ensures that the healthier standby chip is enabled in time when the single-chip performance degrades, maintains the ASIL-D level functional safety requirement, improves the fault tolerance capability of the chassis domain controller in single-point fault, progressive failure and other scenarios, and ensures that the vehicle can still maintain the basic safety function under chip-level failure.

[0121] In an optional embodiment, the first chip is further configured to generate first function control parameter values according to sensor data of the chassis domain subsystems.

[0122] The first chip generates first function control parameter values for each chassis domain subsystem based on real-time collected chassis domain subsystem sensor data (such as brake pedal voltage, steering machine angle, motor temperature, etc.) through a preset control logic algorithm, for example, target steering torque of the steering system, steering wheel assist gain coefficient, motor target output torque of the drive system, and power limitation ratio.

[0123] The second chip is further configured to generate second function control parameter values according to sensor data of the chassis domain subsystems.

[0124] The second chip generates second function control parameter values based on the same sensor data source as the first chip, including the same control parameter types as the first chip.

[0125] The diagnostic control chip determines the chassis domain fault level as a fault level corresponding to the difference value in a case where the difference value between the first function control parameter value and the second function control parameter value is greater than a target threshold value.

[0126] The diagnostic control chip compares the difference between the first function control parameter value and the second function control parameter value in real time, and dynamically adjusts the fault level according to the difference degree: target threshold values (such as brake pressure error ≤5%, steering torque error ≤3%) are preset for different chassis domain subsystems and parameter types; the target threshold values can be dynamically adjusted based on the vehicle state.

[0127] When the difference between the first function control parameter value and the second function control parameter value is ≤ the target threshold value, it is determined that the double-chip control logic is consistent, and the current chassis domain fault level is maintained; when the difference is > the target threshold value, the difference degree is determined, including mild difference, moderate difference, and severe difference.

[0128] As described previously, the chassis domain fault level can be divided into multiple increasing levels, which can include the zeroth level (no fault) to the eighth level, for example. In the case of mild difference (for example, brake pressure difference 5%-10%), the diagnostic control chip raises the chassis domain fault level to the second level (slight influence); in the case of moderate difference (for example, steering torque difference 3%-8%), it is determined that the control logic is invalid, and the chassis domain fault level is raised to the fifth level (system second amplitude power limit); in the case of severe difference (for example, motor torque difference >10%), it is determined that the chip-level function is abnormal, and the chassis domain fault level is set to the seventh level.

[0129] In an optional implementation, the first chip is further configured to generate the first function control instruction based on sensor data of the respective chassis domain subsystems.

[0130] The first chip executes a preset function control algorithm (i.e., logic control calculation) based on real-time collected sensor data of brake, steering, drive, and suspension subsystems, to generate the first function control instruction.

[0131] The second chip is further configured to generate the second function control instruction based on sensor data of the respective chassis domain subsystems.

[0132] The second chip synchronously acquires the same sensor data to generate the second function control instruction in a redundant calculation manner, but does not output to the actuators of the chassis domain subsystems by default.

[0133] The diagnostic control chip determines the chassis domain fault level as a target fault level in a case where the control logic of the first function control instruction is opposite to the control logic of the second function control instruction.

[0134] The diagnostic control chip receives the first function control instruction and the second function control instruction in real time, and compares the key control parameters (such as torque direction, brake force sign, steering angle correction amount) item by item. When the chassis domain fault level is the lowest level, and the first function control instruction and the second function control instruction are opposite in logic (such as the main chip outputting positive torque and the auxiliary chip outputting negative torque), the chassis domain fault level is determined as the target fault level (the target fault level can be the seventh level). The purpose of requiring the chassis domain fault level to be the lowest level here is to ensure that the chassis domain system is fault-free, that is, in the case that the instructions of the two chips are opposite, the system can still be adjusted through the redundancy mechanism, and the safety will not be threatened.

[0135] The diagnostic control chip controls the first chip and the second chip in multiple control cycles, and each cycle in the multiple control cycles is a control period. In the current control period in which the chassis domain fault level is determined as the target level corresponding to the first function control instruction and the second function control instruction being opposite in logic, if it is detected that the logic of the first function control instruction and the second function control instruction returns to be the same, the chassis domain fault level is restored from the target fault level to the lowest level.

[0136] Figure 2 is a schematic diagram of the architecture of a chassis domain controller fault level determination system provided by another embodiment of the application, as shown in an optional implementation, the first chip and the second chip are connected to the outer domain system, for example: the vehicle body domain, the cabin domain, the power domain, etc. Figure 2

[0137] As shown in Figure 2 , the first chip and the second chip are connected to the vehicle body domain controller through independent communication interfaces, and real-time receive the collision signals transmitted by the vehicle body domain system. The collision signals provided by the vehicle body domain system include two types: the collision state signal generated by the vehicle body domain controller through sensor fusion calculation (based on acceleration sensor, pressure sensor, etc. Data), and the vehicle collision hard-wire trigger signal (such as airbag explosion hard-wire signal). The first chip and the second chip respectively establish independent data acquisition channels to ensure the redundancy of collision signal detection.

[0138] The first chip detects the collision signal of the vehicle body domain system and generates a first collision signal detection result.

[0139] ​The first chip continuously monitors the state of two types of collision signals of the body domain system. When a collision state signal sent by the body domain controller is received, a software level collision event is determined. When a collision hardwire signal level jump (e.g., from high level to low level) is detected, a hardware level collision event is determined. The first chip generates a first collision signal detection result according to the triggering state of the two types of signals, and transmits the first collision signal detection result to the diagnostic control chip in real time through a dedicated communication link. The first collision signal detection result includes collision type (software / hardware), triggering timestamp, and signal strength parameters.

[0140] The second chip detects collision signals of the body domain system to generate a second collision signal detection result.

[0141] The second chip independently monitors the collision signals of the body domain system with the same logic to generate a second collision signal detection result and transmit the second collision signal detection result to the diagnostic control chip through an independent channel, ensuring physical isolation from the detection process of the first chip.

[0142] The diagnostic control chip determines that the chassis domain fault level is the highest fault level when a vehicle collision fault is determined according to the first collision signal detection result and / or the second collision signal detection result.

[0143] The diagnostic control chip performs redundancy arbitration on the collision detection results of the two chips. If collision signals are detected by any one of the first chip or the second chip, the diagnostic control chip immediately sets the collision fault flag. When the collision fault is triggered, the diagnostic control chip forcibly sets the chassis domain fault level to the highest level and cannot be restored. Only after power-off and manual clearing of the fault code, the chassis domain controller can be reinitialized.

[0144] In an optional embodiment, the various chassis domain subsystems at least include a driving subsystem and a steering subsystem.

[0145] The diagnostic control chip latches vehicle collision fault information after the ignition cycle of the vehicle ends when a vehicle body collision is determined, and sets the highest fault level as non-recoverable.

[0146] When the diagnostic control chip confirms the vehicle collision fault, the collision event timestamp, the collision signal source (first / second chip), and the fault level are written to the non-volatile memory, i.e., the vehicle collision fault information is latched. After the ignition cycle of the vehicle ends, the diagnostic control chip reads the stored vehicle collision fault information. If the vehicle collision fault is not cleared, the chassis domain fault level is maintained as the highest fault level, and the state is marked as non-recoverable.

[0147] The diagnostic control chip monitors whether the vehicle collision fault is cleared.

[0148] The diagnostic control chip determines whether the vehicle collision fault is cleared by monitoring a collision reset signal (such as a repair mode activation signal) sent by the body domain controller, or by receiving a UDS protocol reset instruction from a diagnostic tool through the CAN bus.

[0149] In the case where the vehicle collision fault is not cleared, the diagnostic control chip sends a driving restriction instruction and a steering restriction instruction to the master control chip, which is one of the first chip and the second chip.

[0150] The master control chip sends the driving restriction instruction to the driving subsystem to restrict the driving function of the driving subsystem.

[0151] The master control chip sends the steering restriction instruction to the steering subsystem to restrict the steering function of the steering subsystem.

[0152] The driving restriction instruction is used to restrict the driving function of the driving subsystem to prevent the vehicle from continuing to accelerate or generating excessive power. The steering restriction instruction is used to restrict the steering function of the steering subsystem to avoid secondary accidents caused by uncontrolled steering system after a collision. After receiving the restriction instruction from the diagnostic control chip, the master control chip sends the driving restriction instruction to the driving subsystem to restrict its output power or power transmission, ensuring that the vehicle cannot continue to drive at high speed or accelerate, and sends the steering restriction instruction to the steering subsystem to restrict the steering function of the vehicle, preventing the problem of direction control due to steering system failure after a collision.

[0153] The present application restricts the driving and steering functions to ensure that the key control functions of the chassis domain do not continue to function when the vehicle has a collision fault, thereby reducing the potential harm of further faults to the vehicle and passengers. Through real-time fault detection, fault information latching and dynamic restriction instruction issuance, it can effectively avoid the vehicle continuing to run after a collision accident and ensure the safety of the passengers.

[0154] Figure 3 is a step schematic diagram of a chassis domain controller fault level determination method provided by an embodiment of the present application. As shown in Figure 3 The method comprises:

[0155] In step S101, the first chip detects faults of each chassis domain subsystem respectively to generate a first fault detection result.

[0156] The first chip collects multi-source sensor data from each subsystem through a dedicated communication interface between each chassis domain subsystem (such as the braking system, the steering system, the driving system and the suspension system).

[0157] For example, the first chip continuously monitors the dual brake pedal pressure sensor voltage signal in the braking system, the steering angle data in the steering system, the temperature parameters of the motor IGBT, etc. Based on the collected sensor data, the first chip performs fault detection on each chassis domain subsystem. For each chassis subsystem, the first chip performs corresponding fault detection, and the first chip generates a first fault detection result according to the detection result of each subsystem.

[0158] Step S102, the second chip respectively performs fault detection on each chassis domain subsystem to generate a second fault detection result.

[0159] The second chip independently performs fault detection on the chassis domain subsystem, and the flow is as follows:

[0160] The second chip is connected with each chassis domain subsystem through an independent communication interface, and real-time sensor data from the braking system, the steering system, the driving system, and the suspension system, etc. are collected. Similar to the first chip, the second chip also monitors the sensor data (for example, brake pedal pressure, motor temperature, steering angle, etc.) and performs real-time collection. Based on the collected data, the second chip also performs fault detection on each chassis domain subsystem to generate a second fault detection result.

[0161] Step S103, the diagnostic control chip determines the chassis domain fault level of the chassis domain controller according to the first fault detection result and the second fault detection result, and the chassis domain fault level represents the influence degree of all failed chassis domain subsystems on the chassis domain system.

[0162] The diagnostic control chip receives the first fault detection result from the first chip and the second fault detection result from the second chip. The diagnostic control chip compares the fault detection results from the two chips item by item to confirm whether the fault of each chassis domain subsystem really exists. If the fault detection results of the same subsystem from the first chip and the second chip are consistent, the diagnostic control chip will consider that the fault really exists, and directly enter the fault level mapping process. If there is inconsistency, the diagnostic control chip will start the heterogeneous redundancy arbitration mechanism, and preferentially adopt the detection result of the master chip as the reference. The diagnostic control chip has a built-in fault level mapping table, which maps the corresponding chassis domain fault level according to the fault type and influence degree. If the priority of different chassis domain subsystems or the influence degree on the whole vehicle safety is defined, the diagnostic control chip will also weight the fault levels of different subsystems, and finally obtain a global chassis domain fault level.

[0163] Those skilled in the art will appreciate that embodiments of the application can be devised for a variety of electronic devices. It is therefore intended that the embodiments of the application can be carried out in other specific forms than those set forth herein without departing from the spirit and essential characteristics of the application. Accordingly, the drawings and descriptions should be regarded as illustrative in nature rather than restrictive. Although the application embodiments have been described with reference to the preferred embodiments, it will be clear to those skilled in the art that additional changes and modifications can be made thereto without departing from the scope of the application. It is therefore intended that the appended claims be construed to include all such changes and modifications as fall within the scope of the application.

[0164] Embodiments of the application are described herein with reference to the drawings, in which are shown preferred embodiments by way of example. It is intended that the embodiments of the application cover any and all modifications within the scope of the application. In particular, although the method and apparatus according to embodiments of the application have been described with reference to particular structures, acts, and materials, those skilled in the art will recognize that many changes can be made thereto without departing from the scope of the present application. It is intended that any additional changes or modifications to the embodiments of the application described herein can be made without departing from the spirit and scope of the present application. Accordingly, the disclosed embodiments are to be considered as illustrative and not restrictive, and the scope of the application is to be determined not with reference to the above description but with reference to the appended claims, along with their equivalents. Figure 1 one or more processes and / or blocks Figure 1 one or more processes and / or blocks Figure 1 one or more processes and / or blocks Figure 1 one or more processes and / or blocks Figure 1 one or more processes and / or blocks Figure 1 one or more processes and / or blocks

[0165] While the preferred embodiments of the application have been described, additional variations and modifications can be employed, as will be appreciated, by one of ordinary skill in the art, once armed with the content of this disclosure. Accordingly, such additional variations and modifications are intended to fall within the scope of the application. It is therefore intended that the appended claims be construed to include all such additional variations and modifications as fall within the true spirit and scope of the application.

[0166] Finally, it is to be understood that the phraseology or terminology such as "first" and "second" etc. used herein is merely intended to differentiate one entity or operation from another entity or operation, without necessarily requiring or implying any actual such relationship or order between such entities or operations. Moreover, the term "comprising" or any other variant thereof is intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element preceded by "comprises" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that comprises the recited element.

[0167] The above describes in detail the chassis domain controller fault level determination system and method provided by the present application, and the principles and implementation manners of the present application are described by using specific examples. The above description of the examples is only used to help understand the method of the present application and its core idea. Meanwhile, for those skilled in the art, the specific implementation manners and application ranges will be changed according to the idea of the present application. In summary, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A chassis domain controller failure level determination system, characterized by, The system comprises a first chip, a second chip and a diagnostic control chip deployed in a chassis domain controller; the first chip and the second chip are respectively connected to each chassis domain subsystem of a chassis domain system and are interconnected through the diagnostic control chip; The first chip collects sensor data of the chassis domain subsystems and respectively performs fault detection on the chassis domain subsystems based on the sensor data of the chassis domain subsystems, generates a first fault detection result, and transmits the first fault detection result to the diagnostic control chip for redundant comparison and decision arbitration; The second chip collects sensor data of the chassis domain subsystems and respectively performs fault detection on the chassis domain subsystems based on the sensor data of the chassis domain subsystems, generates a second fault detection result, and transmits the second fault detection result to the diagnostic control chip for redundant comparison and decision arbitration; The diagnostic control chip determines a chassis domain fault level of the chassis domain controller according to the first fault detection result and the second fault detection result, and the chassis domain fault level represents the influence degree of all the chassis domain subsystems that have faults on the chassis domain system.

2. The system of claim 1, wherein, The diagnostic control chip determines a chassis domain fault level of the chassis domain controller according to the first fault detection result and the second fault detection result, and the chassis domain fault level represents the influence degree of all the chassis domain subsystems that have faults on the chassis domain system. The diagnostic control chip determines a first fault level according to the first fault detection result, and the first fault level represents the influence degree of a first chassis domain subsystem that has faults corresponding to the first fault detection result on the chassis domain system; The diagnostic control chip determines a second fault level according to the second fault detection result, and the second fault level represents the influence degree of a second chassis domain subsystem that has faults corresponding to the second fault detection result on the chassis domain system; The diagnostic control chip determines the chassis domain fault level according to the first fault level and the second fault level.

3. The system of claim 1, wherein, The diagnostic control chip is further configured to: The diagnostic control chip determines a first fault response according to the first fault detection result, and a second fault response according to the second fault detection result; The diagnostic control chip determines a chassis domain subsystem fault response according to the first fault response and the second fault response; The diagnostic control chip sends the chassis domain subsystem fault response and an identifier of a target chassis domain subsystem corresponding to the chassis domain subsystem fault response to a master control chip, and the master control chip is one of the first chip and the second chip; The target chassis domain subsystem is a chassis domain subsystem that has faults corresponding to a detection result generated by the master control chip; The master control chip sends the chassis domain subsystem fault response to the target chassis domain subsystem according to the identifier of the target chassis domain subsystem; The target chassis domain subsystem executes the chassis domain subsystem fault response to repair the target chassis domain subsystem.

4. The system of claim 1, wherein, The diagnostic control chip is further configured to: The diagnostic control chip determines a chassis domain fault response according to the chassis domain fault level; The diagnostic control chip determines, from the individual chassis domain subsystems, identification of at least two chassis domain subsystems that need to cooperatively execute the chassis domain fault response; The diagnostic control chip sends the chassis domain fault response and the identification of the corresponding at least two chassis domain subsystems to a master control chip, the master control chip being one of the first chip and the second chip; The master control chip sends the chassis domain subsystem fault response to the at least two chassis domain subsystems according to the identification of the at least two chassis domain subsystems; The at least two chassis domain subsystems cooperatively execute the chassis domain fault response to repair the faulty chassis domain subsystem.

5. The system according to any of claims 2, 3, 4, characterized in that, The diagnostic control chip is further configured to: The diagnostic control chip initializes the first chip as a master control chip and initializes the second chip as a backup chip; In a case where the first fault level is not higher than the second fault level, the first chip is maintained as the master control chip and the second chip is maintained as the backup chip; In a case where the first fault level is higher than the second fault level, the second chip is switched to the master control chip and the first chip is switched to the backup chip.

6. The system of claim 1, wherein: The first chip is further configured to generate a first functional control parameter value according to sensor data of the individual chassis domain subsystems; The second chip is further configured to generate a second functional control parameter value according to sensor data of the individual chassis domain subsystems; The diagnostic control chip determines the chassis domain fault level as a fault level corresponding to a difference between the first functional control parameter value and the second functional control parameter value in a case where the difference is greater than a target threshold.

7. The system of claim 1, wherein: The first chip is further configured to generate a first functional control instruction according to sensor data of the individual chassis domain subsystems; The second chip is further configured to generate a second functional control instruction according to sensor data of the individual chassis domain subsystems; The diagnostic control chip determines the chassis domain fault level as a target fault level in a case where control logic of the first functional control instruction is opposite to control logic of the second functional control instruction.

8. The system of claim 1, wherein, The first chip and the second chip are respectively connected to a vehicle body domain system; The first chip performs collision signal detection on the vehicle body domain system to generate a first collision signal detection result; The second chip performs collision signal detection on the vehicle body domain system to generate a second collision signal detection result; The diagnostic control chip determines the chassis domain fault level as a highest fault level in a case where a vehicle collision fault is determined according to the first collision signal detection result and / or the second collision signal detection result.

9. The system of claim 8, wherein, The individual chassis domain subsystems at least include a driving subsystem and a steering subsystem; The diagnostic control chip latches vehicle collision fault information after an ignition cycle of the vehicle ends in a case where a vehicle body collision is determined, and sets the highest fault level as unrecoverable; The diagnostic control chip monitors whether the vehicle collision fault is cleared; In the case that the vehicle collision fault is not cleared, the diagnostic control chip sends a driving restriction instruction and a steering restriction instruction to a master control chip, the master control chip being one of the first chip and the second chip; The master control chip sends the driving restriction instruction to the driving subsystem to restrict the driving function of the driving subsystem; The master control chip sends the steering restriction instruction to the steering subsystem to restrict the steering function of the steering subsystem.

10. A method of chassis domain controller failure level determination, the method comprising: The method is applied to the system according to any one of claims 1-9, and the method comprises: The first chip respectively detects faults of each chassis domain subsystem to generate a first fault detection result; The second chip respectively detects faults of each chassis domain subsystem to generate a second fault detection result; The diagnostic control chip determines a chassis domain fault level of the chassis domain controller according to the first fault detection result and the second fault detection result, the chassis domain fault level representing the influence degree of all the chassis domain subsystems with faults on the chassis domain system.

Images