Fault switching method, electronic equipment, vehicle, storage medium and program product

Abstract

The invention discloses a fault switching method, electronic equipment, a vehicle, a storage medium and a program product, relates to the technical field of vehicles, and aims to improve the continuity of functions of an automatic driving vehicle-mounted system. The fault switching method comprises the steps that under the condition that it is determined that a first intelligent driving unit breaks down, a second intelligent driving unit serving as a standby unit is bound with a floating internet protocol IP, and the state of the second intelligent driving unit is switched into a main use state.

Description

Technical Field

[0001] The present application relates to the field of vehicle technology, and in particular to a fault switching method, electronic equipment, vehicle, storage medium, and program product. Background Art

[0002] The intelligent driving system is also called the automatic driving system. It relies on modules such as perception and positioning, decision-making and planning, and execution and control. It uses computers to replace the human perception and decision-making process to achieve automatic driving of the vehicle.

[0003] To ensure the reliability and safety of intelligent driving, many intelligent driving systems employ a redundant design. This involves a primary and a backup intelligent driving system. If the primary system fails, the backup system can take over and continue providing necessary functions. However, due to the uneven handover of intelligent driving tasks between the primary and backup systems, it takes time for the backup system to take over tasks from the primary system in the event of a primary system failure. Consequently, during the actual handover process, the autonomous driving function may temporarily fail, impacting the continuity of intelligent driving functionality. Summary of the Invention

[0004] The purpose of the present invention is to provide a fault switching method, electronic equipment, vehicle, storage medium and program product, aiming to improve the continuity of the functions of the autonomous driving vehicle system.

[0005] To achieve the above objectives, this application adopts the following technical solutions:

[0006] In a first aspect, the present application provides a fault switching method for an in-vehicle system, wherein the in-vehicle system includes a first intelligent driving unit and a second intelligent driving unit operating in a master-slave relationship; the first intelligent driving unit and the second intelligent driving unit are communicatively connected; the method includes: when it is determined that the first intelligent driving unit fails, the second intelligent driving unit serving as a backup unit binds a floating Internet Protocol IP and switches its own state to a master state.

[0007] The fault switching method provided in the embodiment of the present application can, when it is determined that the first intelligent driving unit has failed, bind the second intelligent driving unit, which serves as the backup unit, to a floating IP address and switch its own status to the active state. By switching the floating IP address to the second intelligent driving unit, which serves as the backup unit, when the vehicle system fails, the transmission data can be sent to the second intelligent driving unit, which serves as the backup unit. This allows the intelligent driving task to be smoothly switched from the first intelligent driving unit to the second intelligent driving unit, thereby improving the continuity of the autonomous vehicle system function.

[0008] In one possible implementation, the first intelligent driving unit includes a first control unit, and the second intelligent driving unit includes a second control unit.

[0009] In another possible implementation, the first intelligent driving unit includes a first processing unit, and the second intelligent driving unit includes a second processing unit.

[0010] Another possible implementation method is to determine that a fault has occurred in the first intelligent driving unit, including: determining that a fault has occurred in the first control unit when at least one of the following messages is received: receiving a first master-switching notification message, which is a master-switching notification message sent by the first control unit to the second control unit when the first control unit detects an abnormality in its own CAN communication; receiving a connection request message sent by the processing unit, which is used to request to establish a connection with the second control unit; receiving a first fault detection message, which is a fault detection message sent by the Ethernet module to the second control unit when the Ethernet module detects an Ethernet fault in the first control unit; receiving a second fault detection message, which is a fault detection message sent by the Ethernet switch to the second control unit when the Ethernet switch detects an Ethernet fault in the first control unit; receiving a third fault detection message, which is a fault detection message broadcast by the first control unit when the first control unit detects a fault in itself.

[0011] Another possible implementation method is to determine that the first intelligent driving unit has failed, including: determining that the first control unit has failed when at least one of the following messages is received: receiving a second master-switch notification message, which is a master-switch notification message sent by the control units of the first processing unit and the second processing unit to the second processing unit when a fault is detected in the first processing unit; receiving a fourth fault detection message, which is a fault detection message sent by the Ethernet module to the second processing unit when an Ethernet fault is detected in the first processing unit; receiving a fifth fault detection message, which is a fault detection message sent by the Ethernet switch to the second processing unit when an Ethernet fault is detected in the first processing unit; and receiving a sixth fault detection message, which is a fault detection message broadcast by the first processing unit when it detects that a fault has occurred in itself.

[0012] Another possible implementation method is that after the second intelligent driving unit switches its own state to the active state, the method also includes performing at least one of the following operations: sending a first notification message to the application software of the vehicle system, the first notification message is used to instruct the application software to provide application services for the second control unit; broadcasting a notification message that the second control unit performs the switching operation; broadcasting a notification message that the second control unit is in the active state.

[0013] Another possible implementation method is that after the second intelligent driving unit switches its own state to the active state, the method also includes performing at least one of the following operations: putting the application service provided by the application software of the vehicle-mounted system online; broadcasting a notification message that the second processing unit performs the switching operation; broadcasting a notification message that the second processing unit is in the active state.

[0014] In another possible implementation, after the second intelligent driving unit switches its own state to the active state, the method further includes: when it is determined that the second intelligent driving unit has failed, the second intelligent driving unit unbinds the floating IP and switches its own state to the standby state.

[0015] Another possible implementation method is to switch its own state to a standby state when the first intelligent driving unit includes a first processing unit and the second intelligent driving unit includes a second processing unit, including: switching its own state to a standby state when a standby notification message is received; wherein the standby notification message is used to instruct the second processing unit to switch to a standby unit.

[0016] In another possible implementation, the standby notification message is sent by the control units of the first processing unit and the second processing unit to the second processing unit when a fault is detected in the second processing unit.

[0017] In another possible implementation, when it is determined that the second intelligent driving unit has a fault, the method further includes: broadcasting a seventh fault detection message, where the seventh fault detection message is used to indicate that the second intelligent driving unit has a fault.

[0018] Another possible implementation method is that when the first intelligent driving unit includes a first control unit and the second intelligent driving unit includes a second control unit, after the second intelligent driving unit switches its own state to a standby state, the method also includes: sending a second notification message to the application software of the vehicle-mounted system, the second notification message is used to instruct the application software to stop providing application services for the second control; broadcasting a notification message that the second control unit performs a switching operation; and broadcasting a notification message that the second control unit is in a standby state.

[0019] Another possible implementation method is that when the first intelligent driving unit includes a first processing unit and the second intelligent driving unit includes a second processing unit, after the second intelligent driving unit switches its own state to a standby state, the method also includes: taking the application service provided by the application software of the vehicle-mounted system offline; broadcasting a notification message that the second processing unit performs the switching operation; and broadcasting a notification message that the second processing unit is in a standby state.

[0020] Another possible implementation method is that there is a heartbeat signal between the first intelligent driving unit and the second intelligent driving unit; the method also includes: when there is an abnormality in the heartbeat signal between the first control unit and the second control unit, and one of the following conditions is met, the second unit performs a master upgrade operation: the second control unit receives a fault detection message from the first control unit, and the second control unit receives a connection request message sent by the processor, and the connection request message is used to request to establish a connection with the second control unit.

[0021] Another possible implementation is that there is a heartbeat signal between the first intelligent driving unit and the second intelligent driving unit; the method also includes: when there is an abnormality in the heartbeat signal between the first processing unit and the second processing unit, the second processing unit sends an upgrade request message to the control units of the first processing unit and the second processing unit, and the upgrade request message is used to request the control unit to determine whether the second processing unit can be upgraded to a main unit based on reference information.

[0022] Another possible implementation is that there is a heartbeat signal between the first intelligent driving unit and the second intelligent driving unit; the method also includes: when there is an abnormality in the heartbeat signal between the first processing unit and the second processing unit, and the second processing unit has not received the fault detection message of the first processing unit, the second processing unit sends an upgrade request message to the control units of the first processing unit and the second processing unit, and the upgrade request message is used to request the control unit to determine whether the second processing unit can be upgraded to a master unit based on reference information.

[0023] In another possible implementation, the reference information includes at least one of the following: historical communication records; the priority between the first processing unit and the second processing unit; and fault conditions of the first processing unit and the second processing unit.

[0024] In another possible implementation, the abnormality of the heartbeat signal includes: the number of times the heartbeat signal is lost is greater than or equal to a preset threshold.

[0025] In another possible implementation, before the second intelligent driving unit switches its state to the active state, the method further includes: receiving synchronization data sent by the first intelligent driving unit.

[0026] In another possible implementation, after the second intelligent driving unit switches its state to the active state, the method further includes: sending synchronization data to the first intelligent driving unit.

[0027] In another possible implementation, the synchronized data includes at least one of the following: master-slave status data, control data, decision data, perception calculation result data, path planning data, inter-chip data, smart cockpit domain data transmitted via Ethernet, and positioning and navigation data transmitted via Ethernet.

[0028] In another possible implementation, after the second intelligent driving unit switches its state to the active state, the method further includes: determining the control data to be sent to the control unit based on the control data synchronized by the first processing unit.

[0029] In another possible implementation, after the second intelligent driving unit switches its state to the active state, the method further includes: performing a reset operation on the first intelligent driving unit.

[0030] In a second aspect, the present application provides an electronic device comprising: a processor and a memory; the memory stores instructions executable by the processor; when the processor is configured to execute the instructions, the electronic device implements the method of the first aspect above.

[0031] In a third aspect, the present application provides a vehicle, which includes the electronic device as described in the second aspect above.

[0032] In a fourth aspect, the present application provides a computer-readable storage medium, which includes: computer software instructions; when the computer software instructions are executed in an electronic device, the electronic device implements the method of the first aspect above.

[0033] In a fifth aspect, the present application provides a computer program product, which includes a computer program; when the computer program runs in an electronic device, the electronic device implements the method of the first aspect above.

[0034] The beneficial effects of the second to fifth aspects mentioned above refer to the corresponding description of the first aspect and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0036] Figure 1 A schematic diagram of an application environment for a fault switching method provided in this application;

[0037] Figure 2 A system architecture diagram of a failover vehicle system provided by this application;

[0038] Figure 3 A schematic diagram of a flow chart of a fault switching method provided in an embodiment of the present application;

[0039] Figure 4A flowchart of another fault switching method provided in an embodiment of the present application;

[0040] Figure 5 A flowchart of another fault switching method provided in an embodiment of the present application;

[0041] Figure 6 A flowchart of another fault switching method provided in an embodiment of the present application;

[0042] Figure 7 A functional architecture diagram of a failover vehicle system provided by this application;

[0043] Figure 8 A flowchart of another fault switching method provided in an embodiment of the present application;

[0044] Figure 9 A schematic diagram of the composition of a fault switching device provided in this application;

[0045] Figure 10 This is a schematic diagram of the structure of an electronic device provided in this application.

[0046] Figure 1: first intelligent driving unit (110), second intelligent driving unit (120), communication bus (130), first control unit (111), second control unit (121), first processing unit (112), second processing unit (122), CAN bus (131), vehicle Ethernet (132), Ethernet switch (1321), millimeter wave radar (141), ultrasonic radar (142), cockpit domain (151), body / chassis domain (152), global navigation satellite system (161), inertial measurement unit (162), laser radar (171), vehicle camera (181), execution module (801), communication module (802), electronic device (900), memory (901), processor (902), communication interface (903), bus (904). DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0048] In the description of this application, it should be understood that the terms "upper," "lower," "left," "right," "front," "back," "inner," "outer," and the like, indicating directions or positional relationships, are based on the directions or relative positional relationships shown in the accompanying drawings and are intended solely to facilitate the description of this application and simplify the description. They do not indicate or imply that the devices or components referred to must have a specific direction, be constructed, or operate in a specific direction. Therefore, they should not be construed as limitations on this application. Unless otherwise specified, the above-mentioned directionality descriptions may be flexibly set in actual application, provided that the relative positional relationships shown in the accompanying drawings are met.

[0049] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature specified as "first" or "second" may explicitly or implicitly include one or more of such features. Throughout this application, unless otherwise specified, "plurality" means two or more.

[0050] In the description of this application, it should be noted that, unless otherwise expressly specified or limited, the terms "mounted," "connected," "connected," and "connected" should be understood broadly. For example, they may refer to fixed connections, detachable connections, or integral connections. They may be directly connected, indirectly connected through an intermediary, or internally connected between two components. Those skilled in the art will understand the specific meanings of these terms in this application based on the specific circumstances.

[0051] In the embodiments of the present application, the terms "comprises," "comprising," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, article, or device comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of other identical elements in the process, article, or device comprising the element.

[0052] In the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be interpreted as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0053] The term "and / or" in this article is merely a description of the association relationship between associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0054] In the description of this specification, specific features, structures, materials or characteristics may be combined in an appropriate manner in any one or more embodiments or examples.

[0055] The intelligent driving system is also called the automatic driving system. It relies on modules such as perception and positioning, decision-making and planning, and execution and control. It uses computers to replace the human perception and decision-making process to achieve automatic driving of the vehicle.

[0056] To ensure the reliability and safety of intelligent driving, many intelligent driving systems employ a redundant design. This involves a primary and a backup intelligent driving system. If the primary system fails, the backup system can take over and continue providing necessary functions. However, due to the uneven handover of intelligent driving tasks between the primary and backup systems, it takes time for the backup system to take over tasks from the primary system in the event of a primary system failure. Consequently, during the actual handover process, the autonomous driving function may temporarily fail, impacting the continuity of intelligent driving functionality.

[0057] In response to the above technical problems, the present application provides a fault switching method, the idea of which is that when it is determined that the first intelligent driving unit has failed, the second intelligent driving unit serving as the backup unit can be bound to a floating IP and its own state can be switched to the active state. By switching the floating IP to the second intelligent driving unit serving as the backup unit, when a failure occurs in the vehicle-mounted system, the transmission data can be sent to the second intelligent driving unit serving as the backup unit, so that the intelligent driving task can be smoothly switched from the first intelligent driving unit to the second intelligent driving unit, thereby improving the continuity of the functions of the autonomous driving vehicle-mounted system.

[0058] The embodiments provided in this application are described in detail below with reference to the accompanying drawings.

[0059] The failover method provided in this application can be applied to Figure 1 In the application environment shown. Figure 1 As shown, the application environment includes: a first intelligent driving unit 110, a second intelligent driving unit 120 and a communication bus 130. The first intelligent driving unit 110 and the second intelligent driving unit 120 operate in a master-slave relationship and can communicate through the communication bus 130.

[0060] In some embodiments, the first intelligent driving unit 110 and the second intelligent driving unit 120 can be used for data processing, strategy generation and function management within the vehicle system. Exemplarily, the first intelligent driving unit 110 and the second intelligent driving unit 120 can be a system on chip (SoC), a microcontroller unit (MCU), a central processing unit (CPU), an electronic control unit (ECU), a digital signal processor (DSP), a single-chip microcomputer and an embedded device or other forms of processing units with data processing capabilities and / or instruction execution capabilities. This application does not limit the specific form of the first intelligent driving unit 110 and the second intelligent driving unit 120.

[0061] In some embodiments, a heartbeat signal exists between the first intelligent driving unit 110 and the second intelligent driving unit 120. For example, a dedicated communication channel can be established between the first intelligent driving unit 110 and the second intelligent driving unit 120 based on the static IP address of the first intelligent driving unit 110 and the static IP address of the second intelligent driving unit 120, and the heartbeat signal can be regularly exchanged through the dedicated communication channel.

[0062] In some embodiments, the communication bus 130 is used to provide data transmission functions to different units in the vehicle system. For example, the communication bus 130 can be a controller area network (CAN) bus or an in-vehicle Ethernet bus.

[0063] In some embodiments, the first intelligent driving unit 110 and the second intelligent driving unit 120 may obtain messages sent by different functional domains or components of the vehicle through the communication bus 130 .

[0064] Exemplarily, the first intelligent driving unit 110 and the second intelligent driving unit 120 can be connected to the vehicle-mounted camera, millimeter-wave radar, ultrasonic sensor (USS), lidar, global navigation satellite system (GNSS), inertial measurement unit (IMU), cockpit domain, body / chassis domain communication, etc. through the communication bus 130 to obtain messages sent by different functional domains or components of the vehicle.

[0065] In some embodiments, the first intelligent driving unit 110 includes a first control unit 111 and a first processing unit 112, and the second intelligent driving unit includes a second control unit 121 and a second processing unit 122. The first control unit 111 and the second control unit 121 operate in a primary-backup relationship, and the first processing unit 112 and the second processing unit 122 operate in a primary-backup relationship.

[0066] For example, Figure 2 The figure shows the system architecture of a fault switching vehicle-mounted system provided by the present application. The first control unit 111 and the second control unit 121 are both MCUs, with MCU1 serving as the first control unit 111 and MCU2 serving as the second control unit 121. The first processing unit 112 and the second processing unit 122 are both SoCs, with SoC1 serving as the first processing unit 112 and SoC serving as the second processing unit 122.

[0067] The communication bus 130 includes a CAN bus 131 and an in-vehicle Ethernet 132. The in-vehicle Ethernet 132 includes an Ethernet switch 1321, which is used to control the forwarding of traffic in the in-vehicle Ethernet.

[0068] The first control unit 111 and the second control unit 121 are connected to the CAN bus 131 and the vehicle Ethernet 132, and provide continuous services to the vehicle system through the floating IP1; the first processing unit 112 and the second processing unit 122 are connected to the vehicle Ethernet 132, and provide continuous services to the vehicle system through the floating IP2.

[0069] Different functional domains and components in the vehicle can communicate with the first control unit 111 , the second control unit 121 , the first processing unit 112 and the second processing unit 122 in the vehicle system via the CAN bus 131 and / or the vehicle Ethernet 132 .

[0070] The millimeter wave radar 141 and the ultrasonic radar 142 communicate with the first control unit 111 and the second control unit 121 via the CAN bus 131 .

[0071] The cockpit domain 151 and the body / chassis domain 152 communicate with the first control unit 111 , the second control unit 121 , the first processing unit 112 , and the second processing unit 122 via the in-vehicle Ethernet 132 and the CAN bus 131 .

[0072] The global navigation satellite system 161 and the inertial measurement unit 162 communicate with the first control unit 111 , the second control unit 121 , the first processing unit 112 , and the second processing unit 122 via the in-vehicle Ethernet 132 and the CAN bus 131 .

[0073] The laser radar 171 communicates with the first control unit 111 , the second control unit 121 , the first processing unit 112 , and the second processing unit 122 via the in-vehicle Ethernet 132 .

[0074] The vehicle-mounted camera 181 is directly connected to the first processing unit 112 and the second processing unit 122 via a camera harness.

[0075] It should be noted that the system architecture described in the embodiments of the present application is intended to more clearly illustrate the technical solutions of the embodiments of the present application, and does not constitute a limitation on the technical solutions provided in the embodiments of the present application. A person skilled in the art will know that with the evolution of the system architecture, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0076] See also Figure 3 , is a flow chart of a fault switching method provided in an embodiment of the present application. Figure 3 As shown, the fault switching method provided in the present application is applied to a vehicle-mounted system including a first intelligent driving unit and a second intelligent driving unit operating in a master-slave relationship, wherein the first intelligent driving unit and the second intelligent driving unit are communicatively connected, specifically including the following steps S201.

[0077] S201: When it is determined that the first intelligent driving unit fails, the second intelligent driving unit serving as the backup unit binds an IP address and switches its state to the active state.

[0078] In some embodiments, the floating IP address can be bound to the second intelligent driving unit by updating the routing rules of the vehicle's Ethernet network. For example, the floating IP address can be unbound from the primary intelligent driving unit and bound to the backup intelligent driving unit by configuring network address translation (NAT) rules.

[0079] In some embodiments, the first intelligent driving unit includes a first control unit, and the second intelligent driving unit includes a second control unit. Exemplarily, the first control unit and the second control unit may be MCUs.

[0080] In some embodiments, when the first intelligent driving unit includes a first control unit and the second intelligent driving unit includes a second control unit, determining that the first intelligent driving unit has failed in the above step S201 includes: determining that the first control unit has failed when at least one of the following messages A1-A5 is received.

[0081] A1. A first master-changing notification message is received. The first master-changing notification message is sent by the first control unit to the second control unit when the first control unit detects abnormality in its own CAN communication.

[0082] Exemplarily, when the first control unit and the second control unit are MCUs, the MCU communicates with other units via a CAN bus. The MCU includes a CAN management module, which can detect CAN communication anomalies of the MCU.

[0083] A2. Receive a connection request message sent by the processing unit, where the connection request message is used to request to establish a connection with the second control unit.

[0084] In some embodiments, the first control unit as the main unit can communicate with the processing unit. If the first control unit as the main unit fails and the connection with the processing unit is disconnected, the processing unit will send a connection request message to the second control unit.

[0085] A3. Receive a first fault detection message, where the first fault detection message is sent by the Ethernet module to the second control unit when the Ethernet module detects an Ethernet fault in the first control unit.

[0086] In some embodiments, when the Ethernet module detects that an Ethernet fault occurs in the first control unit serving as the master unit, it can multicast information about the Ethernet fault in the first control unit in the form of a first fault detection message and send it to the second control unit.

[0087] Exemplarily, the multicast group may include the second control unit, the first control unit, and the processing unit of the second control unit.

[0088] A4. Receive a second fault detection message, where the second fault detection message is sent by the Ethernet switch to the second control unit when the Ethernet switch detects an Ethernet fault in the first control unit.

[0089] In some embodiments, when the Ethernet switch detects that an Ethernet fault occurs in the first control unit serving as the master unit, it can multicast information about the Ethernet fault in the first control unit in the form of a second fault detection message and send it to the second control unit.

[0090] A5. A third fault detection message is received. The third fault detection message is a fault detection message broadcast by the first control unit when the first control unit detects a fault in itself.

[0091] In some embodiments, when the first control unit serving as the master unit detects that a fault occurs in itself, the information that the first control unit has failed can be broadcast in the form of a third fault detection message.

[0092] For example, the first control unit as the main unit can detect chip-level faults occurring in itself, such as abnormal clock jitter, abnormal reset caused by power supply fluctuation, software execution out of control, abnormal interrupt processing, etc.

[0093] It can be understood that determining the fault status of the first control unit through the above A1-A5 can improve the accuracy of the judgment of the fault status of the first control unit. It can also switch the active and standby states of the first control unit and the second control unit after a fault occurs, so that the second control unit can quickly take over the tasks of the first control unit, thereby improving the smoothness of the operation of the vehicle system.

[0094] In some embodiments, when the first intelligent driving unit includes a first control unit and the second intelligent driving unit includes a second control unit, after step S201, the fault switching method provided in the present application further includes performing at least one of the following operations B1-B3.

[0095] B1. Send a first notification message to the application software of the vehicle system, where the first notification message is used to instruct the application software to provide application services for the second control unit.

[0096] In some embodiments, the application software of the vehicle-mounted system includes the underlying software, middleware modules, and algorithm modules of the vehicle-mounted system.

[0097] In some embodiments, when the first control unit serving as the main unit fails, the first control unit can unbind the floating IP, switch its own status to the standby status, and send a notification message to the application software of the vehicle system to instruct the application software to stop providing application services to the first control unit; the second control unit serving as the backup unit can bind the floating IP, switch its own status to the main status, and send a first notification message to the application software of the vehicle system, and the first notification message is used to instruct the application software to provide application services to the second control unit.

[0098] B2. Broadcast a notification message that the second control unit performs the switching operation.

[0099] In some embodiments, the application software of the vehicle system can receive a notification message that the second control unit performs a switching operation, and can provide application services to the second control unit based on the notification message that the second control unit performs a switching operation.

[0100] B3. Broadcast a notification message that the second control unit is in the active state.

[0101] It should be noted that after the two intelligent driving units switch to the active state, performing at least one of the operations B1-B3 above can, in the event of a failure in the first control unit, cause the vehicle system's application software to stop providing application services to the first control unit and instead provide application services to the second control unit. This can improve the speed of the vehicle system's active / standby unit switching and reduce the likelihood of service downtime and lag caused by the active / standby switching.

[0102] In some embodiments, the first intelligent driving unit includes a first processing unit, and the second intelligent driving unit includes a second processing unit. Exemplarily, the first processing unit and the second processing unit may be SoCs.

[0103] In some embodiments, when the first intelligent driving unit includes a first processing unit and the second intelligent driving unit includes a second processing unit, determining that the first intelligent driving unit has failed in the above step S201 includes: determining that the first processing unit has failed when at least one of the following messages C1-C4 is received.

[0104] C1. A second master-switch notification message is received. The second master-switch notification message is sent by the control units of the first processing unit and the second processing unit to the second processing unit when a failure of the first processing unit is detected.

[0105] In some embodiments, the control units of the first processing unit and the second processing unit may be communicatively connected to the second processing unit, and may send a master-switch notification message to the second processing unit when the first processing unit serving as the master system fails.

[0106] Exemplarily, the control units of the first processing unit and the second processing unit can be communicatively connected with the second processing unit based on a floating IP.

[0107] C2. A fourth fault detection message is received. The fourth fault detection message is a fault detection message sent by the Ethernet module to the second processing unit when the Ethernet module detects that an Ethernet fault occurs in the first processing unit.

[0108] In some embodiments, when the Ethernet module detects that an Ethernet fault occurs in the first processing unit serving as the master unit, it can multicast information about the Ethernet fault in the first processing unit in the form of a fourth fault detection message and send it to the second processing unit.

[0109] C3. A fifth fault detection message is received. The fifth fault detection message is a fault detection message sent by the Ethernet switch to the second processing unit when the Ethernet switch detects that an Ethernet fault occurs in the first processing unit.

[0110] In some embodiments, when the Ethernet switch detects that an Ethernet fault occurs in the first processing unit serving as the active unit, it can multicast information about the Ethernet fault in the first processing unit in the form of a fifth fault detection message to the second processing unit.

[0111] C4. A sixth fault detection message is received. The sixth fault detection message is a fault detection message broadcast by the first processing unit when the first processing unit detects that a fault occurs in the first processing unit.

[0112] In some embodiments, when the first processing unit serving as the master unit detects that a fault occurs on itself, the information that the first processing unit has failed can be broadcast in the form of a sixth fault detection message.

[0113] In some embodiments, the failure of the first processing unit as the master unit includes chip-level failures and algorithm failures. For example, the failure of the first processing unit may be abnormal clock jitter, abnormal reset caused by power fluctuation, software execution out of control, abnormal interrupt handling, and abnormal algorithm exit.

[0114] It can be understood that by determining the fault status of the first processing unit through the above C1-C4, the accuracy of the judgment of the fault status of the first processing unit can be improved. After a fault occurs, the master-slave status of the first processing unit and the second processing unit can be switched, so that the second processing unit can quickly take over the tasks of the first processing unit, thereby improving the smoothness of the operation of the vehicle system.

[0115] In some embodiments, when the first intelligent driving unit includes a first processing unit and the second intelligent driving unit includes a second processing unit, after step S201, the fault switching method provided in the present application further includes performing at least one of the following operations D1-D3.

[0116] D1. Bring the application services provided by the in-vehicle system’s application software online.

[0117] In some embodiments, the first processing unit, the second processing unit and the control unit are communicatively connected, and the control unit can send a notification message to the application software of the vehicle system to enable the application software to provide application services to the second processing unit, and bring the application services provided by the application software of the vehicle system online.

[0118] D2. Broadcast a notification message that the second processing unit performs a switching operation.

[0119] D3. Broadcast a notification message that the second processing unit is in the active state.

[0120] It should be noted that after the second intelligent driving unit switches to the active state, performing at least one of the operations D1-D3 above enables the vehicle system's application software to provide application services to the second processing unit in the event of a failure in the first processing unit, which is the active unit. This can improve the speed of the vehicle system's active / standby unit switching and the smoothness of application service switching, reducing the likelihood of service downtime and lag caused by the active / standby switching.

[0121] In some embodiments, as Figure 4 As shown, after step S201, the fault switching method provided by the present application further includes the following step S202.

[0122] S202: When it is determined that the second intelligent driving unit fails, the second intelligent driving unit unbinds the floating IP and switches its state to a standby state.

[0123] In some embodiments, when the first intelligent driving unit includes a first processing unit and the second intelligent driving unit includes a second processing unit, switching its own state to a standby state includes: when receiving a standby notification message, switching its own state to a standby state; wherein the standby notification message is used to instruct the second processing unit to switch to a standby unit.

[0124] Exemplarily, the standby notification message is sent by the control units of the first processing unit and the second processing unit to the second processing unit when a fault is detected in the second processing unit.

[0125] It should be noted that the control units of the first processing unit and the second processing unit can be communicatively connected to the second processing unit. For example, the control units of the first processing unit and the second processing unit can communicate with the second processing unit based on a floating IP.

[0126] It is understood that if the second intelligent driving unit fails, it unbinds the floating IP and switches itself to standby mode. By switching the floating IP to the first intelligent driving unit, which is acting as the backup unit, data can be sent to the first intelligent driving unit, ensuring low latency and high reliability during data transmission. Furthermore, by switching the second intelligent unit to standby mode, smooth handover between the primary and standby units can be achieved, thus improving the functional continuity of the autonomous vehicle system.

[0127] In some embodiments, when it is determined that the second intelligent driving unit has a fault, the fault switching method provided in the present application further includes: broadcasting a seventh fault detection message, where the seventh fault detection message is used to indicate that the second intelligent driving unit has a fault.

[0128] In some embodiments, the first intelligent driving unit can receive the seventh fault detection message broadcast by the second intelligent driving unit.

[0129] It should be noted that when the second intelligent driving unit detects that a fault has occurred in itself, it broadcasts the seventh fault detection message, which can enable other units in the vehicle system to obtain the fault status of the second intelligent driving unit in a timely manner, which helps to improve the master-slave switching efficiency of the first intelligent driving unit and the second intelligent driving unit, and improve the reliability of the vehicle system.

[0130] In some embodiments, when the first intelligent driving unit includes a first control unit and the second intelligent driving unit includes a second control unit, as shown in FIG. Figure 5 As shown, after step S202, the fault switching method provided by the present application further includes the following steps S301-S303.

[0131] S301: Send a second notification message to application software of the vehicle-mounted system, where the second notification message is used to instruct the application software to stop providing application services for the second controller.

[0132] In some embodiments, the application software of the vehicle-mounted system includes the underlying software, middleware modules, and algorithm modules of the vehicle-mounted system.

[0133] S302: Broadcast a notification message that the second control unit performs a switching operation.

[0134] S303: Broadcast a notification message that the second control unit is in a standby state.

[0135] It should be noted that after the two intelligent driving units switch to standby mode, executing steps S301-S303 above can stop the vehicle system's application software from providing application services to the second control unit, if the second control unit, acting as the primary unit, fails. This can improve the speed of the vehicle system's active / standby switching and reduce the likelihood of service downtime and lag caused by the active / standby switching.

[0136] In some embodiments, when the first intelligent driving unit includes a first processing unit and the second intelligent driving unit includes a second processing unit, as shown in FIG. Figure 6 As shown, after step S202, the fault switching method provided by the present application further includes the following steps S401-S403.

[0137] S401. Take the application service provided by the application software of the vehicle-mounted system offline.

[0138] In some embodiments, the application software of the vehicle-mounted system includes the underlying software, middleware modules, and algorithm modules of the vehicle-mounted system.

[0139] In some embodiments, the first processing unit, the second processing unit and the control unit are communicatively connected, and the control unit can send a notification message to the application software of the vehicle system to cause the application software to stop providing application services to the second processing unit, thereby taking the application services provided by the application software of the vehicle system offline.

[0140] S402: Broadcast a notification message that the second processing unit performs a switching operation.

[0141] S403: Broadcast a notification message that the second processing unit is in a standby state.

[0142] It should be noted that after the two intelligent driving units switch to standby mode, executing steps S401-S403 above can prevent the vehicle system's application software from providing application services to the second processing unit, acting as the primary unit, if a failure occurs. This can improve the speed of the vehicle system's active / standby unit switching and the smoothness of application service switching, reducing the likelihood of service downtime and lag caused by the active / standby switching.

[0143] In some embodiments, there is a heartbeat signal between the first intelligent driving unit and the second intelligent driving unit.

[0144] Exemplarily, the heartbeat signal between the first intelligent driving unit and the second intelligent driving unit can be implemented based on an independent communication link.

[0145] For example, the transmission channel of the heartbeat signal between the first intelligent driving unit and the second intelligent driving unit can be a link implemented based on the static IP of the first intelligent driving unit and the static IP of the second intelligent driving unit.

[0146] In some embodiments, when the first intelligent driving unit includes a first control unit and the second intelligent driving unit includes a second control unit, the fault switching method provided in the present application further includes: when there is an abnormality in the heartbeat signal between the first control unit and the second control unit and one of the following conditions is met, the second unit performs a master upgrade operation: the second control unit receives a fault detection message from the first control unit, and the second control unit receives a connection request message sent by the processor, and the connection request message is used to request to establish a connection with the second control unit.

[0147] In some embodiments, when the first intelligent driving unit includes a first processing unit and the second intelligent driving unit includes a second processing unit, the fault switching method provided in the present application further includes: when there is an abnormality in the heartbeat signal between the first processing unit and the second processing unit, the second processing unit sends a master upgrade request message to the control units of the first processing unit and the second processing unit, and the master upgrade request message is used to request the control unit to determine whether the second processing unit can be upgraded to a master unit based on reference information.

[0148] In some embodiments, when the first intelligent driving unit includes a first processing unit and the second intelligent driving unit includes a second processing unit, the fault switching method provided in the present application further includes: when there is an abnormality in the heartbeat signal between the first processing unit and the second processing unit and the second processing unit has not received the fault detection message of the first processing unit, the second processing unit sends an upgrade request message to the control units of the first processing unit and the second processing unit, and the upgrade request message is used to request the control unit to determine whether the second processing unit can be upgraded to a master unit based on reference information.

[0149] It can be understood that when there is an abnormality in the heartbeat signal between the first intelligent driving unit and the second intelligent driving unit, arbitrating the master-slave status of the first intelligent driving unit and the second intelligent driving unit can effectively avoid the situation where two master units appear in the vehicle system, causing a malfunction in the vehicle system, thereby improving the reliability of the vehicle system.

[0150] In some embodiments, the reference information includes at least one of the following: historical communication records; a priority between the first processing unit and the second processing unit; and a failure condition of the first processing unit and the second processing unit.

[0151] For example, in order to ensure the reliable operation of the vehicle-mounted system, the processing unit in a non-faulty state can be selected as a processing unit that can be upgraded to a main unit based on the fault conditions of the first processing unit and the second processing unit. In order to improve the smoothness of data transmission in the vehicle-mounted system, the processing unit that is currently participating in the data transmission task can be selected as a processing unit that can be upgraded to a main unit based on historical communication records. Alternatively, the first processing unit or the second processing unit can be set as a high-priority unit. In the case that the processing unit that can be upgraded to the main unit cannot be determined based on the historical communication records and / or the fault conditions of the first processing unit and the second processing unit, the high-priority processing unit can be determined as the processing unit that can be upgraded to the main unit.

[0152] It should be noted that determining whether the second processing unit can be upgraded to the active unit based on the reference information can improve the accuracy of determining whether the second processing unit can be upgraded to the active unit, reduce the possibility of untimely and unnecessary active / standby switching in the vehicle system, and thus improve the smoothness and reliability of the vehicle system.

[0153] In some embodiments, the abnormality of the heartbeat signal includes: the number of times the heartbeat signal is lost is greater than or equal to a preset threshold. For example, the preset threshold may be 3 times.

[0154] In some embodiments, before the second intelligent driving unit switches its state to the active state, the method further includes: receiving synchronization data sent by the first intelligent driving unit.

[0155] In some embodiments, after receiving the synchronization data sent by the first intelligent driving unit, the second intelligent driving unit can generate control data based on the synchronization data sent by the first intelligent driving unit. The control data generated by the second intelligent driving unit serving as a backup unit is stored inside the second intelligent driving unit and will not be sent down as decision data during the period when the second intelligent driving unit serves as a backup unit.

[0156] In some embodiments, when the first intelligent driving unit includes a first control unit and the second driving unit includes a second control unit, before the second control unit switches its state to the primary state, the processing units of the first control unit and the second control unit can generate control data and send the control data to the first control unit; after the second control unit switches its state to the primary state, the processing units of the first control unit and the second control unit can generate control data and send the control data to the second control unit.

[0157] In some embodiments, after the second intelligent driving unit switches its state to the active state, the method further includes: sending synchronization data to the first intelligent driving unit.

[0158] In some embodiments, the synchronized data includes at least one of the following: master-slave status data, control data, decision data, perception calculation result data, path planning data, inter-chip data, smart cockpit domain data transmitted via Ethernet, and positioning navigation data transmitted via Ethernet.

[0159] It should be noted that synchronizing the data between the first intelligent driving unit and the second intelligent driving unit can reduce the possibility of data loss during the master-slave synchronization between the vehicle systems, and improve the smoothness and reliability of the vehicle systems.

[0160] In some embodiments, after the second intelligent driving unit switches its own state to the active state, the method further includes: determining the control data to be sent to the control unit based on the control data synchronized by the first processing unit.

[0161] Exemplarily, the first processing unit can generate control data and number the control data in order, and carry the control data number when sending the control data. After receiving the synchronization data sent by the first processing unit, the second processing unit can generate control data synchronously with the first processing unit based on the synchronization data sent by the first processing unit, and number the control data in order.

[0162] After switching its own state to the active state, the second processing unit can determine the control data to be sent to the control unit based on the control data synchronized by the first processing unit and the control data number carried in the control data synchronized by the first processing unit.

[0163] It is understood that the second processing unit determines the control data to be sent to the control unit based on the control data synchronized with the first processing unit. This ensures the continuity of vehicle processing functions when the first processing unit, which is the primary unit, fails, thereby improving the smoothness and reliability of the vehicle system.

[0164] In some embodiments, after the second intelligent driving unit switches its state to the active state, the method further includes: performing a reset operation on the first intelligent driving unit.

[0165] For example, when the first intelligent driving unit includes a first control unit and the second intelligent driving unit includes a second control unit, the second control unit can actively reset the first control unit after switching its own state to the active state to ensure that the first control unit is in a ready state.

[0166] When the first intelligent driving unit includes a first processing unit and the second intelligent driving unit includes a second processing unit, the second processing unit can send a service request notification to the control units of the first processing unit and the second processing unit after switching its own state to the active state. The reset request notification is used to request the control units of the first processing unit and the second processing unit to actively reset the first processing unit to ensure that the first processing unit is in a ready state.

[0167] In some embodiments, the first intelligent driving unit includes a first control unit and a first processing unit, and the second intelligent driving unit includes a second control unit and a second processing unit. The first control unit and the second control unit operate in a primary-backup relationship, and the first processing unit and the second processing unit operate in a primary-backup relationship.

[0168] For example, Figure 7The figure shows the functional architecture of a failover vehicle-mounted system provided by this application. The first control unit and the second control unit are MCUs, and the first processing unit and the second processing unit are SoCs. The first control unit and the first processing unit operate in the active state, while the second control unit and the second processing unit operate in the standby state. The first control unit, the second control unit, the first processing unit, and the second processing unit are all connected to the vehicle Ethernet network via an Ethernet switch.

[0169] like Figure 7 As shown, the functional modules of the first control unit and the second control unit include: control system, state management, CAN management, master / slave management and fault management.

[0170] In some embodiments, the control system module is used to perform control tasks in the vehicle system.

[0171] In some embodiments, the status management module is used to monitor and maintain the operating status of the MCU and its connected devices.

[0172] In some embodiments, the CAN management module is connected to the vehicle's non-Ethernet bus, namely the CAN bus, and is used to manage and detect faults in communication tasks based on the CAN bus.

[0173] In some embodiments, the active / standby management module is used to manage and determine its own active / standby status.

[0174] In some embodiments, the active / standby management module is also used for disconnection processing. For example, an independent heartbeat link exists between the active / standby management module of the first control unit and the active / standby management module of the second control unit, enabling mutual synchronization of the current active / standby status based on the heartbeat link. The active / standby management module of the first control unit, serving as the active unit, can also send control data of the first control unit to the second control module, serving as the standby unit.

[0175] In some embodiments, the active / standby management module is further configured to perform active / standby arbitration between the first processing unit and the second processing unit.

[0176] In some embodiments, the active / standby management module is also used to unbind / bind the floating IP.

[0177] In some embodiments, the fault management module is used to obtain its own fault status. For example, the fault management module can obtain CAN communication abnormality information reported by CAN, and can also obtain Ethernet fault information reported by an Ethernet module or an Ethernet switch.

[0178] In some embodiments, the fault management module can also broadcast its own fault information and obtain fault information of other units.

[0179] The functional modules of the first processing unit and the second processing unit include: path planning, decision-making system, communication management, data collection, data replication, perception computing and master-slave management.

[0180] In some embodiments, the path planning module is used to perform path planning based on the data collected by the data collection module.

[0181] In some embodiments, the decision system module is used to generate decision data and control data, etc.

[0182] In some embodiments, the communication management module is used to manage data exchange and ensure the real-time and reliability of information transmission.

[0183] In some embodiments, the data acquisition module is used to collect data reported by different functional domains or components of the vehicle, such as on-board camera data, lidar data, etc.

[0184] In some embodiments, a data replication module is used to synchronize data. For example, the data replication module of a first processing unit, serving as a primary unit, can send synchronized data to a second processing unit, serving as a backup unit. For example, data replication between the first and second processing units can be performed based on an open source in-memory database (remote dictionary server, Redis) or a commercial replication technology such as Oracle Data Guard.

[0185] In some embodiments, the perception computing module is used to perform vehicle perception computing based on the data collected by the data collection module.

[0186] In some embodiments, the active / standby management module is used to manage and determine its own active / standby status.

[0187] In some embodiments, the active / standby management module is further used for disconnection processing. Exemplarily, there is an independent heartbeat link between the active / standby management module of the first processing unit and the active / standby management module of the second processing unit, which can synchronize the current active / standby status with each other based on the heartbeat link.

[0188] In some embodiments, the active / standby management module is also used to unbind / bind the floating IP.

[0189] In some embodiments, the active-standby management module is further configured to register its own status in the active-standby management module of the first control unit in the active state.

[0190] In some embodiments, the first processing module operating in the master state can generate control data and send the control data to the first control module operating in the master state.

[0191] The following describes a specific embodiment of the fault switching method of the present application.

[0192] In some embodiments, the first intelligent driving unit includes a first control unit and a first processing unit, and the second intelligent driving unit includes a second control unit and a second processing unit.

[0193] The first control unit and the second control unit operate in a master-slave relationship, and the first processing unit and the second processing unit operate in a master-slave relationship. The first control unit and the first processing unit are in a master state, and the second control unit and the second processing unit are in a standby state. Figure 8 As shown, the specific implementation process of this method includes the following S501-S5014.

[0194] S501: A first processing unit in an active state sends synchronization data to a second processing unit in a standby state. Correspondingly, the second processing unit receives the synchronization data sent by the first processing unit.

[0195] In some embodiments, the synchronized data includes at least one of the following: master-slave status data, control data, decision data, perception calculation result data, path planning data, inter-chip data, smart cockpit domain data transmitted via Ethernet, and positioning navigation data transmitted via Ethernet.

[0196] S502: When a fault occurs in the first processing unit, the first processing unit in the master state sends fault information to the first control unit in the master state. Correspondingly, the first control unit receives the fault information sent by the first control unit.

[0197] In some embodiments, the fault occurring in the first processing unit includes an Ethernet fault, a chip-level fault, and the like.

[0198] S503: The first control unit in the active state sends a switch-to-standby notification message to the first processing unit. The switch-to-standby notification message is used to instruct the first processing unit to switch to the standby unit. Correspondingly, the first processing unit receives the switch-to-standby notification message sent by the first control unit.

[0199] S504 . In response to the switch-to-standby notification message, the first processing unit in the active state broadcasts a notification message of executing the switch operation, unbinds the floating IP, switches its own state to the standby state, and broadcasts a notification message that the first processing unit is in the standby state.

[0200] S505 . The first control unit in the active state sends a notification message to the application software of the vehicle system, causing the application software to stop providing application services to the first processing unit, and takes the application services provided by the application software of the vehicle system offline.

[0201] S506. The first control unit in the master state sends a switchover notification message to the second processing unit. The switchover notification message is used to instruct the second processing unit to switch to the master unit. Correspondingly, the first processing unit receives the switchover notification message sent by the second control unit.

[0202] S507 . In response to the master-switch notification message, the second processing unit in the standby state broadcasts a notification message of executing the switch operation, binds the floating IP, switches its own state to the active state, and broadcasts a notification message that the second processing unit is in the active state.

[0203] S508 . The first control unit in the active state sends a notification message to the application software of the vehicle system, causing the application software to provide application services to the second processing unit, and brings the application services provided by the application software of the vehicle system online.

[0204] S509: The second processing unit in the active state determines control data to be sent to the control unit based on the control data synchronized by the first processing unit.

[0205] S510: The second processing unit in the active state sends a reset request notification to the first control unit. Correspondingly, the first control unit receives the reset request notification sent by the second processing unit.

[0206] The reset request notification is used to request the first control unit to actively reset the first processing unit to ensure that the first processing unit is in a ready state.

[0207] S511 . In response to the reset request notification sent by the second processing unit, the first control unit resets the first processing unit.

[0208] S512. In the event of a failure in the first control unit, the first control unit in the active state broadcasts a notification message to execute a switching operation, unbinds the floating IP, switches its own state to the standby state, broadcasts a notification message that the first control unit is in the standby state, and sends a notification message to the application software of the vehicle-mounted system to cause the application software to stop providing application services to the first processing unit, and takes the application services provided by the application software of the vehicle-mounted system offline.

[0209] In some embodiments, the fault occurring in the first control unit includes CAN communication abnormality, Ethernet fault, chip-level fault, etc.

[0210] S513: The first control unit sends a master-switch notification message to the second control unit in the standby state. The master-switch notification message is used to instruct the second control unit to switch to the active unit. Correspondingly, the second control unit receives the master-switch notification message sent by the first control unit.

[0211] S514. In response to the master-switch notification message, the second control unit in the standby state broadcasts a notification message for executing the switching operation, binds the floating IP, switches its own state to the master state, broadcasts a notification message that the second control unit is in the master state, and sends a notification message to the application software of the vehicle-mounted system for the application software to provide application services to the second processing unit, and brings the application services provided by the application software of the vehicle-mounted system online.

[0212] The technical solutions provided by the above embodiments bring at least the following beneficial effects. The fault switching method provided by the embodiments of the present application, when it is determined that the first intelligent driving unit has failed, can enable the second intelligent driving unit serving as the backup unit to bind the floating IP and switch its own state to the active state. By switching the floating IP to the second intelligent driving unit serving as the backup unit, when the vehicle-mounted system fails, the transmission data can be sent to the second intelligent driving unit serving as the backup unit, so that the intelligent driving task can be smoothly switched from the first intelligent driving unit to the second intelligent driving unit, thereby improving the continuity of the functions of the autonomous driving vehicle-mounted system.

[0213] It can be seen that the above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. In order to achieve the above functions, the embodiment of the present application provides hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily appreciate that, in combination with the modules and algorithm steps of each example described in the embodiment disclosed herein, the embodiment of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in a hardware or computer software driven hardware manner depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0214] In the embodiments of the present application, the functional modules of the fault switching device can be divided according to the above-mentioned method examples. For example, each functional module can be divided according to each function, or two or more functions can be integrated into a single processing module. The above-mentioned integrated modules can be implemented in the form of hardware or software functional modules. Optionally, the division of modules in the embodiments of the present application is illustrative and is only a logical functional division. In actual implementation, other division methods may be used.

[0215] In some embodiments, the present application further provides a fault switching device, which may include one or more functional modules for implementing the fault switching method of the above method embodiment.

[0216] For example, Figure 9 This is a schematic diagram of the composition of a fault switching device provided in an embodiment of the present application. Figure 9 As shown, the fault switching device 800 includes: an execution module 801.

[0217] The execution module 801 is used to, when it is fully determined that the first intelligent driving unit has failed, bind the second intelligent driving unit as a backup unit to the floating Internet Protocol IP and switch its own state to the active state.

[0218] In some embodiments, the first intelligent driving unit includes a first control unit, and the second intelligent driving unit includes a second control unit.

[0219] In other embodiments, the first intelligent driving unit includes a first processing unit, and the second intelligent driving unit includes a second processing unit.

[0220] In some further embodiments, determining that the first intelligent driving unit has failed includes: determining that the first control unit has failed when at least one of the following messages is received: receiving a first master-switching notification message, which is a master-switching notification message sent by the first control unit to the second control unit when the first control unit detects an abnormality in its own CAN communication; receiving a connection request message sent by the processing unit, which is used to request to establish a connection with the second control unit; receiving a first fault detection message, which is a fault detection message sent by the Ethernet module to the second control unit when the Ethernet module detects an Ethernet fault in the first control unit; receiving a second fault detection message, which is a fault detection message sent by the Ethernet switch to the second control unit when the Ethernet switch detects an Ethernet fault in the first control unit; receiving a third fault detection message, which is a fault detection message broadcast by the first control unit when the first control unit detects a fault in itself.

[0221] In some further embodiments, determining that the first intelligent driving unit has failed includes: determining that the first control unit has failed when at least one of the following messages is received: receiving a second master-switching notification message, the second master-switching notification message is a master-switching notification message sent by the control units of the first processing unit and the second processing unit to the second processing unit when detecting that the first processing unit has failed; receiving a fourth fault detection message, the fourth fault detection message is a fault detection message sent by the Ethernet module to the second processing unit when detecting that an Ethernet fault has occurred in the first processing unit; receiving a fifth fault detection message, the fifth fault detection message is a fault detection message sent by the Ethernet switch to the second processing unit when detecting that an Ethernet fault has occurred in the first processing unit; receiving a sixth fault detection message, the sixth fault detection message is a fault detection message broadcast by the first processing unit when detecting that it has failed.

[0222] In some other embodiments, Figure 9 As shown, the fault switching device 800 further includes a communication module 802. The communication module 802 is configured to perform at least one of the following operations after the second intelligent driving unit switches its state to the active state: sending a first notification message to the application software of the vehicle system, the first notification message being used to instruct the application software to provide application services for the second control unit; broadcasting a notification message that the second control unit has executed the switching operation; and broadcasting a notification message that the second control unit is in the active state.

[0223] In yet other embodiments, the execution module 801 is further configured to bring online application services provided by the vehicle system's application software after the second intelligent driving unit switches its state to the active state. The communication module 802 is further configured to broadcast a notification message indicating that the second processing unit has executed the switching operation and a notification message indicating that the second processing unit is in the active state after the second intelligent driving unit switches its state to the active state.

[0224] In some further embodiments, the execution module 801 is further configured to, when it is determined that the second intelligent driving unit fails, cause the second intelligent driving unit to unbind the floating IP and switch its own state to a standby state.

[0225] In some further embodiments, when the first intelligent driving unit includes a first processing unit and the second intelligent driving unit includes a second processing unit, the execution module 801 is specifically used to switch its own state to a standby state when a standby notification message is received; wherein the standby notification message is used to instruct the second processing unit to switch to a standby unit.

[0226] In some further embodiments, the standby notification message is sent by the control units of the first processing unit and the second processing unit to the second processing unit when a failure of the second processing unit is detected.

[0227] In some further embodiments, the communication module 802 is further configured to broadcast a seventh fault detection message when it is determined that a fault occurs in the second intelligent driving unit, where the seventh fault detection message is used to indicate that a fault occurs in the second intelligent driving unit.

[0228] In some further embodiments, when the first intelligent driving unit includes a first control unit and the second intelligent driving unit includes a second control unit, after the second intelligent driving unit switches its state to a standby state, the communication module 802 is further used to send a second notification message to the application software of the vehicle-mounted system, where the second notification message is used to instruct the application software to stop providing application services for the second control; broadcast a notification message that the second control unit performs a switching operation; and broadcast a notification message that the second control unit is in a standby state.

[0229] In some further embodiments, when the first intelligent driving unit includes a first processing unit and the second intelligent driving unit includes a second processing unit, after the second intelligent driving unit switches its state to a standby state, the execution module 801 is further used to take the application service provided by the application software of the vehicle-mounted system offline; the communication module 802 is further used to broadcast a notification message that the second processing unit performs a switching operation; and broadcast a notification message that the second processing unit is in a standby state.

[0230] In some further embodiments, there is a heartbeat signal between the first intelligent driving unit and the second intelligent driving unit; the execution module 801 is also used to cause the second unit to perform a master upgrade operation when there is an abnormality in the heartbeat signal between the first control unit and the second control unit and one of the following conditions is met: the second control unit receives a fault detection message from the first control unit, and the second control unit receives a connection request message sent by the processor, and the connection request message is used to request to establish a connection with the second control unit.

[0231] In some further embodiments, there is a heartbeat signal between the first intelligent driving unit and the second intelligent driving unit; the execution module 801 is also used to send an upgrade request message to the control units of the first processing unit and the second processing unit when there is an abnormality in the heartbeat signal between the first processing unit and the second processing unit. The upgrade request message is used to request the control unit to determine whether the second processing unit can be upgraded to a master unit based on reference information.

[0232] In some further embodiments, there is a heartbeat signal between the first intelligent driving unit and the second intelligent driving unit; the communication module 802 is also used to send an upgrade request message to the control units of the first processing unit and the second processing unit when there is an abnormality in the heartbeat signal between the first processing unit and the second processing unit and the second processing unit has not received the fault detection message of the first processing unit. The upgrade request message is used to request the control unit to determine whether the second processing unit can be upgraded to a master unit based on reference information.

[0233] In some further embodiments, the reference information includes at least one of the following: historical communication records; a priority between the first processing unit and the second processing unit; and a failure condition of the first processing unit and the second processing unit.

[0234] In some further embodiments, the heartbeat signal abnormality includes: the number of times the heartbeat signal is lost is greater than or equal to a preset threshold.

[0235] In some further embodiments, the communication module 802 is further configured to receive synchronization data sent by the first intelligent driving unit before the second intelligent driving unit switches its state to the active state.

[0236] In some further embodiments, the communication module 802 is further configured to send synchronization data to the first intelligent driving unit after the second intelligent driving unit switches its state to the active state.

[0237] In some further embodiments, the synchronized data includes at least one of the following: master-slave status data, control data, decision data, perception calculation result data, path planning data, inter-chip data, smart cockpit domain data transmitted via Ethernet, and positioning navigation data transmitted via Ethernet.

[0238] In some further embodiments, the execution module 801 is further configured to determine the control data to be sent to the control unit based on the control data synchronized by the first processing unit after the second intelligent driving unit switches its state to the active state.

[0239] In some further embodiments, the execution module 801 is further configured to perform a reset operation on the first intelligent driving unit after the second intelligent driving unit switches its state to the active state.

[0240] In the case of implementing the functions of the above-mentioned integrated modules in the form of hardware, the embodiment of the present invention provides a possible structural diagram of the electronic device involved in the above-mentioned embodiment. Figure 10 As shown, the electronic device 900 includes: a processor 902 , a communication interface 903 , and a bus 904 . Optionally, the electronic device 900 may further include a memory 901 .

[0241] Processor 902 may implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 902 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field-programmable gate array, or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. It may implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 902 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, or a combination of a DSP and a microprocessor.

[0242] The communication interface 903 is used to connect to other devices via a communication network, such as Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0243] The memory 901 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0244] As a possible implementation, the memory 901 can exist independently of the processor 902. The memory 901 can be connected to the processor 902 via a bus 904 and used to store instructions or program codes. When the processor 902 calls and executes the instructions or program codes stored in the memory 901, the failover method provided in the embodiment of the present invention can be implemented.

[0245] In another possible implementation, the memory 901 may also be integrated with the processor 902 .

[0246] The bus 904 may be an extended industry standard architecture (EISA) bus, etc. The bus 904 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 10 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0247] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the service calling device can be divided into different functional modules to complete all or part of the functions described above.

[0248] The embodiment of the present application also provides a computer-readable storage medium. All or part of the processes in the above-mentioned method embodiment can be completed by computer instructions to instruct the relevant hardware, and the program can be stored in the above-mentioned computer-readable storage medium. When the program is executed, it may include the processes of the above-mentioned method embodiments. The computer-readable storage medium can be the memory of any of the above-mentioned embodiments. The above-mentioned computer-readable storage medium can also be an external storage device of the above-mentioned service calling device, such as a plug-in hard disk, a smart memory card (smart media card, SMC), a secure digital (secure digital, SD) card, a flash card (flash card), etc. equipped on the above-mentioned service calling device. Furthermore, the above-mentioned computer-readable storage medium can also include both the internal storage unit of the above-mentioned service calling device and an external storage device. The above-mentioned computer-readable storage medium is used to store the above-mentioned computer program and other programs and data required by the above-mentioned service calling device. The above-mentioned computer-readable storage medium can also be used to temporarily store data that has been output or is to be output.

[0249] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program product runs on a computer, the computer is enabled to execute any one of the fault switching methods provided in the above embodiments.

[0250] The above are only specific embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any changes or replacements within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A fault switching method for an in-vehicle system, characterized in that: The vehicle-mounted system includes a first intelligent driving unit and a second intelligent driving unit operating in a master-slave relationship; The first intelligent driving unit and the second intelligent driving unit are communicatively connected; the method includes: When it is determined that the first intelligent driving unit fails, the second intelligent driving unit serving as a backup unit is bound to a floating Internet Protocol IP and switches its own state to an active state.

2. The method according to claim 1, characterized in that The first intelligent driving unit includes a first control unit, and the second intelligent driving unit includes a second control unit.

3. The method according to claim 1, characterized in that The first intelligent driving unit includes a first processing unit, and the second intelligent driving unit includes a second processing unit.

4. The method according to claim 2, characterized in that The determining that the first intelligent driving unit fails includes: Upon receiving at least one of the following messages, determining that the first control unit fails; receiving a first master-switch notification message, where the first control unit sends the master-switch notification message to the second control unit when the first control unit detects a CAN communication abnormality of the first control unit; receiving a connection request message sent by the processing unit, where the connection request message is used to request establishment of a connection with the second control unit; receiving a first fault detection message, where the first fault detection message is a fault detection message sent by the Ethernet module to the second control unit when the Ethernet module detects that an Ethernet fault occurs in the first control unit; receiving a second fault detection message, where the second fault detection message is a fault detection message sent by the Ethernet switch to the second control unit when the Ethernet switch detects that a processing unit of the first control unit fails; A third fault detection message is received, where the third fault detection message is a fault detection message broadcast by the first control unit when the first control unit detects that a fault occurs in the first control unit.

5. The method according to claim 3, characterized in that The determining that the first intelligent driving unit fails includes: Upon receiving at least one of the following messages, determining that the first processing unit fails; receiving a second master-switch notification message, where the second master-switch notification message is sent by the control unit of the first processing unit and the second processing unit to the second processing unit when a failure of the first processing unit is detected; receiving a fourth fault detection message, where the fourth fault detection message is a fault detection message sent by the Ethernet module to the second processing unit when the Ethernet module detects that an Ethernet fault occurs in the first processing unit; receiving a fifth fault detection message, where the fifth fault detection message is a fault detection message sent by the Ethernet switch to the second processing unit when the Ethernet switch detects that an Ethernet fault occurs in the first processing unit; A sixth fault detection message is received, where the sixth fault detection message is a fault detection message broadcast by the first processing unit when the first processing unit detects that a fault occurs in the first processing unit.

6. The method according to claim 2, characterized in that After the second intelligent driving unit switches its state to the active state, the method further includes performing at least one of the following operations: Sending a first notification message to the application software of the vehicle system, where the first notification message is used to instruct the application software to provide application services for the second control unit; broadcasting a notification message that the second control unit performs a switching operation; Broadcast a notification message that the second control unit is in the active state.

7. The method according to claim 3, characterized in that After the second intelligent driving unit switches its state to the active state, the method further includes performing at least one of the following operations: Bringing online the application services provided by the in-vehicle system's application software; broadcasting a notification message that the second processing unit performs a switching operation; Broadcast a notification message that the second processing unit is in the active state.

8. The method according to claim 1, characterized in that After the second intelligent driving unit switches its state to the active state, the method further includes: When it is determined that the second intelligent driving unit fails, the second intelligent driving unit unbinds the floating IP and switches its own state to a standby state.

9. The method according to claim 8, characterized in that In a case where the first intelligent driving unit includes a first processing unit and the second intelligent driving unit includes a second processing unit, switching the state of the unit to a standby state includes: When receiving the switch-to-standby notification message, the state of the processing unit is switched to the standby state; wherein the switch-to-standby notification message is used to instruct the second processing unit to switch to the standby unit.

10. The method according to claim 9, characterized in that The standby notification message is sent by the control units of the first processing unit and the second processing unit to the second processing unit when a fault is detected in the second processing unit.

11. The method according to claim 8, characterized in that When it is determined that the second intelligent driving unit fails, the method further includes: A seventh fault detection message is broadcast, where the seventh fault detection message is used to indicate that a fault occurs in the second intelligent driving unit.

12. The method according to claim 8, characterized in that In a case where the first intelligent driving unit includes a first control unit and the second intelligent driving unit includes a second control unit, after the second intelligent driving unit switches its state to a standby state, the method further includes: Sending a second notification message to the application software of the in-vehicle system, where the second notification message is used to instruct the application software to stop providing application services for the second control; broadcasting a notification message that the second control unit performs a switching operation; A notification message that the second control unit is in a standby state is broadcasted.

13. The method according to claim 8, characterized in that In a case where the first intelligent driving unit includes a first processing unit and the second intelligent driving unit includes a second processing unit, after the second intelligent driving unit switches its state to a standby state, the method further includes: Take the application services provided by the in-vehicle system's application software offline; broadcasting a notification message that the second processing unit performs a switching operation; A notification message that the second processing unit is in a standby state is broadcasted.

14. The method according to claim 2, characterized in that There is a heartbeat signal between the first intelligent driving unit and the second intelligent driving unit; the method further includes: If the heartbeat signal between the first control unit and the second control unit is abnormal and one of the following conditions is met, the second control unit performs the master upgrade operation: The second control unit receives a fault detection message from the first control unit, and the second control unit receives a connection request message sent by the processor, where the connection request message is used to request to establish a connection with the second control unit.

15. The method according to claim 3, characterized in that There is a heartbeat signal between the first intelligent driving unit and the second intelligent driving unit; the method further includes: When an abnormality occurs in the heartbeat signal between the first processing unit and the second processing unit, the second processing unit sends an upgrade request message to the control units of the first processing unit and the second processing unit, where the upgrade request message is used to request the control unit to determine whether the second processing unit can be upgraded to a master unit based on reference information.

16. The method according to claim 3, characterized in that There is a heartbeat signal between the first intelligent driving unit and the second intelligent driving unit; the method further includes: When an abnormality occurs in the heartbeat signal between the first processing unit and the second processing unit, and the second processing unit does not receive a fault detection message from the first processing unit, the second processing unit sends an upgrade request message to the control units of the first processing unit and the second processing unit. The upgrade request message is used to request the control unit to determine, based on reference information, whether the second processing unit can be upgraded to a master unit.

17. The method according to claim 15 or 16, characterized in that The reference information includes at least one of the following: Historical communication records; a priority between the first processing unit and the second processing unit; Failure conditions of the first processing unit and the second processing unit.

18. The method according to any one of claims 14 to 16, characterized in that The abnormality of the heartbeat signal includes: the number of times the heartbeat signal is lost is greater than or equal to a preset threshold.

19. The method according to claim 1, wherein Before the second intelligent driving unit switches its own state to the active state, the method further includes: Receive synchronization data sent by the first intelligent driving unit.

20. The method according to claim 1, wherein After the second intelligent driving unit switches its state to the active state, the method further includes: Send synchronization data to the first intelligent driving unit.

21. The method according to claim 19 or 20, characterized in that The synchronization data includes at least one of the following: Active / standby status data, control data, decision data, perception calculation result data, path planning data, inter-chip data, smart cockpit domain data transmitted via Ethernet, and positioning and navigation data transmitted via Ethernet.

22. The method according to claim 3, characterized in that After the second intelligent driving unit switches its state to the active state, the method further includes: Based on the control data synchronized by the first processing unit, control data to be sent to the control unit is determined.

23. The method according to claim 1, wherein After the second intelligent driving unit switches its state to the active state, the method further includes: Perform a reset operation on the first intelligent driving unit.

24. An electronic device, characterized in that: The device comprises a processor and a memory, wherein the processor is coupled to the memory; the memory is used to store computer instructions, and the computer instructions are loaded and executed by the processor to enable the computer device to implement the fault switching method according to any one of claims 1 to 23.

25. A vehicle, characterized in that: Comprising the electronic device as claimed in claim 24.

26. A computer-readable storage medium, characterized in that The computer-readable storage medium includes computer-executable instructions, and when the computer-executable instructions are executed on a computer, the computer is caused to execute the failover method according to any one of claims 1 to 23.

27. A computer program product, characterized in that The computer program product includes a computer program, and when the computer program is run on an electronic device, the electronic device is caused to execute the failover method according to any one of claims 1 to 23.

Images