Control method and device of vehicle-mounted redundant controller, equipment and medium

Abstract

The invention discloses a control method, device and equipment for a vehicle-mounted redundant controller and a medium, and relates to the technical field of vehicles, the method comprises the steps that a first control result of a main controller and a second control result of a standby controller are obtained firstly, and the first control result and the second control result both comprise vehicle acceleration, braking force, steering force and other parameters; by analyzing the two groups of results, distinguishing a first sub-control result of which the difference is smaller than or equal to a difference threshold value and a second sub-control result of which the difference is greater than the difference threshold value, and determining the health degree of the system by combining the mean value and the difference; and when the health degree reaches the standard, determining a delay duration according to the round-trip duration of the control instruction and the network jitter variance, and then judging an abnormal condition. And determining a target fault level according to a mapping relationship between the abnormal condition and a preset reference abnormality and a fault level, further regulating output weights of the main controller and the standby controller, and determining the final braking force of the vehicle by combining the braking forces of the main controller and the standby controller. The method improves the redundant resource utilization rate and the abnormity judgment accuracy, and guarantees the vehicle driving safety.

Description

Technical Field

[0001] The present application relates to the field of vehicle technology, and in particular to a control method, device, equipment, and medium for a vehicle-mounted redundant controller. Background Art

[0002] With the rapid advancement of intelligent and connected vehicles, vehicle safety has become a core indicator of automotive product competitiveness. As the hub for key actuators such as braking, steering, and suspension, the chassis domain control system (DCS)'s safety redundancy and control reliability directly determine a vehicle's safety in complex road conditions. To address the safety challenges of the DCS, traditional technical solutions generally employ redundant design to improve system reliability.

[0003] Early redundant designs were mostly based on a single-controller architecture, implementing simple fault backup by adding backup sensors or actuators. With technological advancements, a master-slave redundant architecture has gradually emerged. This involves setting up a backup controller with the same functions as the primary controller and deploying it in a cold backup mode. When the primary controller fails, the backup controller is activated and takes over control functions.

[0004] However, in traditional solutions, the standby controller may be idle for a long time, resulting in a waste of resources. Summary of the Invention

[0005] The present application provides a control method, device, equipment and medium for a vehicle-mounted redundant controller, which can reduce waste of resources.

[0006] To achieve the above objectives, this application adopts the following technical solutions: In a first aspect, the present application provides a control method for a vehicle-mounted redundant controller, wherein the redundant controller includes a main controller and a backup controller, including: Obtaining a first control result of the main controller, and obtaining a second control result of the standby controller; determining an abnormal situation according to the first control result and the second control result; Controlling the main controller and the standby controller according to the abnormal situation; The determining of an abnormal situation according to the first control result and the second control result includes: determining a health level of a redundant controller according to the first control result and the second control result; When the health level is greater than or equal to the health level threshold, an abnormality is determined after a first delay.

[0007] Optionally, determining the health of the redundant controller according to the first control result and the second control result includes: Determining a first sub-control result and a second sub-control result, from the first control result and the second control result, whose differences are less than or equal to a difference threshold, and determining a third sub-control result and a fourth sub-control result, from the first control result and the second control result, whose differences are greater than the difference threshold, wherein the first sub-control result and the third sub-control result belong to the first control result, and the second sub-control result and the fourth sub-control result belong to the second control result; The health of the redundant controller is determined according to an average value between the first sub-control result and the second sub-control result, and a difference between the third sub-control result and the fourth sub-control result.

[0008] Optionally, the first duration is determined by: Acquire the round trip time and network jitter variance between the control instruction sent by the main controller and the sensor corresponding to the control instruction; A first duration is determined according to the round-trip duration and the network jitter variance.

[0009] Optionally, controlling the main controller and the standby controller according to the abnormal situation includes: Determining a target fault level corresponding to the abnormal situation according to a mapping relationship between the abnormal situation, a preset reference abnormality, and a reference fault level; According to the target fault level, a first output weight of the main controller and a second output weight of the standby controller are controlled.

[0010] Optionally, the method further includes: The braking force of the vehicle is determined according to the first output weight, the second output weight, the first braking force of the main controller, and the second braking force of the standby controller.

[0011] Optionally, the first control result and the second control result include at least the following parameters: The acceleration of the vehicle, the braking force of the vehicle and the steering force of the vehicle.

[0012] Optionally, the method further includes: In a case where the health level is less than a health level threshold, an abnormality is determined in real time.

[0013] In a second aspect, the present application provides a control device for a vehicle-mounted redundant controller, comprising: an acquisition module, configured to acquire a first control result of the main controller and a second control result of the standby controller; a determination module, configured to determine a health of the redundant controller according to the first control result and the second control result; and, if the health is greater than or equal to a health threshold, determine an abnormality after a first delay; The control module is used to control the main controller and the standby controller according to the abnormal situation.

[0014] In a third aspect, the present application provides a computing device, including a memory and a processor; One or more computer programs are stored in the memory, and the one or more computer programs include instructions; when the instructions are executed by the processor, the computing device executes the method as described in any one of the first aspects.

[0015] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program for executing the method as described in any one of the first aspects.

[0016] It can be seen from the above technical solution that this application has at least the following beneficial effects: In this application, this method allows the primary and backup controllers to synchronously generate control results and participate in health assessments, eliminating the need for the backup controller to remain idle. By dynamically adjusting the output weights of the two controllers based on the target fault level, the backup controller can participate in the real-time control of key parameters such as vehicle braking force and steering force based on the system status, effectively activating and maximizing the use of redundant resources.

[0017] Furthermore, by comparing the differences between the first and second control results, calculating system health, and optimizing the anomaly detection delay based on round-trip time and network jitter variance, the risk of misjudgment due to transient network fluctuations is significantly reduced, improving the accuracy and timeliness of anomaly identification. At the same time, by determining the target fault level and dynamically allocating output weights based on preset mapping relationships, the control ratios of the primary and backup controllers can be flexibly adjusted in different fault scenarios, ensuring that the vehicle maintains stable power and steering output even when some controllers are malfunctioning, avoiding the risk of system failure caused by a single controller failure, and providing more reliable protection for driving safety in complex road conditions.

[0018] It should be understood that the description of technical features, technical solutions, beneficial effects or similar language in this application does not imply that all features and advantages can be realized in any single embodiment. On the contrary, it is understood that the description of a feature or beneficial effect means that a specific technical feature, technical solution or beneficial effect is included in at least one embodiment. Therefore, the description of a technical feature, technical solution or beneficial effect in this specification does not necessarily refer to the same embodiment. Furthermore, the technical features, technical solutions and beneficial effects described in the present embodiment can also be combined in any appropriate manner. Those skilled in the art will understand that the embodiment can be implemented without one or more specific technical features, technical solutions or beneficial effects of a specific embodiment. In other embodiments, additional technical features and beneficial effects can also be identified in specific embodiments that do not embody all embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A schematic diagram of the system structure of a vehicle-mounted redundant controller provided in an embodiment of the present application; Figure 2 A flowchart of a control method for a vehicle-mounted redundant controller provided in an embodiment of the present application; Figure 3 A schematic diagram of a control device of a vehicle-mounted redundant controller provided in an embodiment of the present application; Figure 4 A schematic diagram of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0020] The terms "first", "second" and "third" in this application specification and the accompanying drawings are used to distinguish different objects rather than to limit a specific order.

[0021] In the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be interpreted as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0022] To make the description of the following embodiments clear and concise, a brief introduction to the related technologies is first given: A redundant controller refers to a combination of controllers used in vehicle systems to ensure control reliability. These typically include a primary controller and a backup controller. The primary controller is the core component that primarily performs control functions under normal operating conditions, while the backup controller serves as a backup, intervening or taking over control if the primary controller experiences an anomaly. Together, these two components form the system's redundant safety mechanism.

[0023] like Figure 1 The figure is a schematic diagram of the system architecture provided by an embodiment of the present application. The figure employs dual control modules, with both the primary and backup controllers utilizing ASIL-D-rated chips and powered by separate power modules. ASIL-D is the highest safety level defined by ISO 26262. The primary controller independently connects to the inertial measurement unit (IMU), accelerometer, height sensor, and continuous damping control (CDC) suspension system. Both the primary and backup controllers are connected to the air suspension, brake pedal, transverse acceleration sensor (TAS), accelerator pedal, wheel speed sensor, and the electric drive system CAN (EMB_CAN) and SBW_CAN. Redundancy is achieved by connecting key functions between the primary and backup controllers. EMB_CAN and SBW_CAN refer to the dedicated CAN bus communication links for the electro-mechanical brake (EMB) system and the steer-by-wire (SBW) system, respectively.

[0024] Traditional redundancy solutions suffer from significant resource waste. The backup controller is not involved in actual control under most operating conditions, and its hardware performance and computing resources are not effectively utilized, resulting in a low cost-effectiveness of the redundancy design. Furthermore, the backup controller's slow activation response in cold backup mode can lead to the risk of delayed failover, impacting the system's emergency response efficiency.

[0025] On the one hand, the function of the backup controller in traditional solutions is limited to passive backup, lacking a real-time coordination mechanism with the main controller, and unable to participate in the control process under normal operating conditions, resulting in idle resources; on the other hand, traditional solutions lack refined health assessment and dynamic delay mechanisms for judging abnormal situations, and are easily affected by interference factors such as instantaneous network jitter, which may lead to misjudgment or untimely response, affecting control stability and making it impossible to optimize resource utilization efficiency through dynamic regulation.

[0026] In view of this, an embodiment of the present application provides a control method for an on-board redundant controller. The method can be executed by the vehicle or by a processing device in the vehicle. This application does not specifically limit the execution subject of the present application. The following description uses the execution of the processing device as an example.

[0027] To address the problems of long-term idleness of backup controllers in traditional on-board redundant controller solutions, leading to resource waste, inaccurate anomaly detection, and delayed fault switching responses, this paper proposes a design approach centered on dynamic collaboration and precise assessment. By breaking the passive mode of master-slave cold backup, the master and backup controllers participate in the control process in real time and in parallel. Dynamic comparison of control results enables quantitative health assessment, and control weights are dynamically allocated based on fault levels. Ultimately, while improving resource utilization efficiency, the system's ability to accurately respond to anomalies is enhanced, achieving the dual goals of redundant safety and resource optimization.

[0028] The first control result generated by the main controller and the second control result generated by the backup controller are synchronously collected, covering key parameters such as vehicle acceleration, braking force, and steering force. Based on the difference analysis between the first and second control results, the sub-control results with differences within the threshold and the sub-control results exceeding the threshold are distinguished, and the system health is calculated by combining the difference characteristics of the two types of sub-results; the dynamic delay duration is determined according to the round-trip time of the control instruction and the network jitter variance, and the abnormality judgment is delayed when the health status meets the standard to reduce misjudgment caused by transient interference; the target fault level is determined according to the abnormal situation and the preset mapping relationship, and the first output weight of the main controller and the second output weight of the backup controller are adjusted according to the level; finally, the output weights of the two are combined with their respective parameters such as braking force to comprehensively determine the actual control output of the vehicle, and realize flexible collaborative control under different fault scenarios.

[0029] In order to make the technical solution of this application clearer and easier to understand, the following describes a control method of a vehicle redundant controller provided by an embodiment of this application in conjunction with the accompanying drawings. Figure 2 As shown in FIG, this figure is a flow chart of a control method of a vehicle-mounted redundant controller provided in an embodiment of the present application.

[0030] S201: The processing device obtains a first control result of the main controller and obtains a second control result of the standby controller.

[0031] The processing device synchronously collects data via a real-time communication link, generating control results from both the primary and backup controllers. The primary control result, based on real-time collected vehicle operating data, directly reflects the primary controller's control decisions on key vehicle actuators under current operating conditions, encompassing key parameters across core dimensions of vehicle operation.

[0032] Unlike the traditional cold backup mode in which the standby controller is only in an idle state, the standby controller in the embodiment of the present application always participates in the control operation in parallel, and the second control result generated by the standby controller fully presents the control decision logic of the standby controller for the current working conditions.

[0033] The first control result and the second control result include at least parameters of the following categories: acceleration of the vehicle, braking force of the vehicle, and steering force of the vehicle.

[0034] S202: The processing device determines an abnormal situation according to the first control result and the second control result.

[0035] Abnormal situations refer to situations where the control outputs of the primary and backup controllers deviate from normal logic, or where the operating status of the controllers themselves deviates from the preset health standards. These situations are the core basis for determining whether the control strategies of the primary and backup controllers need to be adjusted.

[0036] The health of the redundant controller is determined based on the first control result and the second control result; when the health is greater than or equal to the health threshold, the abnormal situation is determined after a first delay; when the health is less than the health threshold, the abnormal situation is determined in real time.

[0037] Health is a key metric for quantifying the coordinated state of the primary and backup controllers. It is calculated based on the difference between the primary and secondary control results. When the difference between the first and second control results exceeds a threshold, an abnormality may be detected. For example, a significant difference in the braking force calculated by the primary and backup controllers, or a logical inconsistency in the steering force parameters, could be considered an abnormality.

[0038] Specifically, the processing device first subdivides the two groups of control results: determining a first sub-control result and a second sub-control result from the first and second control results, whose difference is less than or equal to a difference threshold; and determining a third sub-control result and a fourth sub-control result from the first and second control results, whose difference is greater than the difference threshold. The first and third sub-control results belong to the first control result, while the second and fourth sub-control results belong to the second control result. The health of the redundant controller is determined based on the average of the first and second sub-control results and the difference between the third and fourth sub-control results.

[0039] From the first control result, a first sub-control result whose difference with the second control result is less than or equal to the difference threshold is divided, and a third sub-control result whose difference is greater than the difference threshold is divided; correspondingly, a second sub-control result whose difference is reasonable and a fourth sub-control result whose difference exceeds the standard are divided from the second control result. Subsequently, the health of the redundant controller is obtained by weighted calculation based on the mean between the first sub-control result and the second sub-control result, and the difference between the third sub-control result and the fourth sub-control result. This process achieves a refined quantitative assessment of the system status by distinguishing reasonable differences from abnormal differences. The higher the health, the better the output consistency of the active and standby controllers and the more stable the system operation. The calculation expression of health is:

[0040] in, For health, Indicates the The weight coefficient of the item control result, is the attenuation coefficient, Indicates the The third sub-control result and the The fourth sub-item controls the differences between the results. Indicates the The first sub-control result and the The standard deviation of the second sub-control result, Indicates the The first sub-control result and the The mean of the second sub-control result, Indicates the number of dimensions of the difference parameter, that is, the number of dimensions of the third sub-control result and the fourth sub-control result with larger differences, The number of dimensions representing the stable parameters, that is, the number of dimensions of the first sub-control result and the second sub-control result with the smallest difference.

[0041] For example, the weight coefficient of the acceleration difference , the weight coefficient of the braking force difference , the weight coefficient of the steering force difference , the weight coefficient of the height sensor difference .

[0042] In the embodiment of the present application, the one-sidedness of a single difference parameter is avoided through quantitative evaluation of health metrics, while the delayed judgment mechanism effectively filters out instantaneous interference, which not only ensures sensitive identification of real anomalies, but also prevents frequent system fluctuations caused by misjudgment, laying a solid foundation for subsequent precise control of the main and standby controllers.

[0043] When the health level is below the health threshold, the active and standby controllers detect an abnormality in real time. When the health level is greater than or equal to the health threshold, the active and standby controllers are generally healthy, but there may be temporary discrepancies caused by non-systemic issues such as transient network jitter or brief fluctuations in sensor data. In this case, the processing device does not directly determine that there is no abnormality. Instead, it introduces a delayed judgment mechanism. If a significant difference still exists after the initial delay, an abnormality is finally determined.

[0044] Specifically, the processing device obtains the round-trip time and network jitter variance between the control instruction from the main controller and the sensor corresponding to the control instruction, and determines the first duration based on the round-trip time and the network jitter variance.

[0045] First, the first duration (i.e., a reasonable delay waiting time) is calculated based on the round-trip time of the control command between the main controller and the corresponding sensor (reflecting the basic communication delay) and the network jitter variance (reflecting the communication stability). After the first delay, the difference between the two sets of control results is re-evaluated. If the difference still exists after the delay or exceeds the standard, an abnormality is finally determined. If the difference disappears, it is determined to be a transient interference and no subsequent control adjustment is required. The calculation expression for the first duration is:

[0046] in, Indicates the first delay duration. Indicates the total number of dimensions of the control instructions, Indicates the The weight coefficient of the control instruction, Indicates the The control instructions are sent by the main controller and the The round trip time between sensors corresponding to each control instruction, represents the network jitter variance, Represents a very small constant that prevents it from becoming zero.

[0047] S203: The processing device controls the main controller and the backup controller according to the abnormal situation.

[0048] The processing device determines the target fault level corresponding to the abnormal situation based on the mapping relationship between the abnormal situation, the preset reference abnormality, and the reference fault level. An example is given below.

[0049] By analyzing the difference of key vehicle parameters (acceleration, braking force, steering force, etc.) and counting the number of sensor conflicts, three reference fault levels are defined: Level-1 (corresponding to minor faults): corresponds to a single difference value exceeding the threshold by less than 20% or the number of sensor conflicts is ≤ 2. For example, the main controller obtains the acceleration through the acceleration sensor. =3, the acceleration calculated by the standby controller through the wheel speed is 2.5, the difference If the threshold is 0.6 (corresponding to the upper limit of 20%), the single parameter difference is within the range of 20% exceeding the threshold; or due to instantaneous network fluctuations during driving, the brake pedal displacement sensor and EMB data have two brief conflicts and then quickly synchronized.

[0050] Level-2 (corresponding to moderate fault): corresponds to two or more differences exceeding the threshold by 20% or the number of sensor conflicts ≥ 3 times. For example, the braking force calculated by the main controller =400, calculated by the standby controller =500 (differential braking force is 100, threshold 80, over-threshold 25%), while steering force =200 and =250 (steering force difference is 50, threshold is 40, and exceeds the threshold by 25%), that is, the difference between the two parameters exceeds the threshold by 20%; or the wheel speed sensor and acceleration sensor data continue to conflict within three consecutive control cycles.

[0051] Level-3 (corresponding to serious faults): corresponds to a single difference exceeding the threshold by 50% or two or more differences exceeding the threshold by 40%. For example, the braking force calculated by the main controller =300, calculated by the standby controller =500 (braking force difference is 200, threshold is 100, exceeding threshold by 100%), that is, the difference of a single parameter exceeds the threshold by 50%; or the braking force difference is 140 (threshold is 100N, exceeding 40%) and the acceleration difference is 0.6 (threshold is 0.4, exceeding 50%), and both parameters exceed the threshold by more than 40%.

[0052] For acceleration, the main controller obtains , the standby controller obtains the wheel speed sensor , the calculation expression is:

[0053] in, is the acceleration of the backup controller, Indicates speed, Indicates time.

[0054] Regarding the braking force, the main controller obtains the braking force from the brake pedal displacement. , the standby controller obtains the , the calculation expression is:

[0055] in, Braking force of the main controller (unit: N), Indicates the displacement-force conversion coefficient (unit: N / m), for example, the braking force generated per unit travel distance of the brake pedal, Indicates the dynamic compensation coefficient (unit: Ns / m), such as the braking force generated by the unit change rate of the brake pedal. Indicates the travel distance of the brake pedal (unit: m).

[0056]

[0057] in, is the braking force of the standby controller (unit: N), is the transmission efficiency, is the motor torque constant (unit: Nm / A), is the motor current during kinetic energy recovery (unit: A), is the reduction ratio, is the equivalent braking radius (unit: m), such as the radius of the wheel hub.

[0058] Regarding steering force, the main controller obtains , the standby controller obtains , the calculation expression is:

[0059] in, The steering force of the main controller (unit: N), is the steering angle-steering force gain coefficient (unit: N / deg), which is determined by the stiffness of the steering system. is the steering dynamic damping coefficient (unit: N·s / deg), which suppresses steering wheel vibration. is the torque-steering force conversion coefficient (unit: N / (N·m)), which maps the driver's torque demand to steering force. is the steering wheel angle (unit: deg), is the steering wheel torque (unit: Nm).

[0060]

[0061] in, is the steering force of the backup controller (unit: N), is the torque constant of the SBW motor (unit: N·m / A); is the transmission ratio of the steering reduction mechanism, is the transmission efficiency, is the vehicle speed damping coefficient (unit: N·s / m), which is used to suppress excessive sensitivity during high-speed steering. is the motor current (unit: A), is the equivalent steering mechanism radius (unit: m).

[0062] Calculate the acceleration difference separately , braking force difference , steering force difference .

[0063] When the system detects an abnormal situation (such as the braking force difference between the main and standby controllers When a braking force difference of 30% (exceeding the threshold by 20% but less than 50%) is detected and no other parameters are abnormal, the target fault level is set to Level-2.

[0064] According to the target fault level, the first output weight of the main controller and the second output weight of the standby controller are controlled.

[0065] At Level-1: The first output weight of the main controller can be expressed as:

[0066] in, Indicates the first weight of the main controller, is the maximum allowed difference.

[0067] The second output weight of the standby controller is .at this time When it is close to 1, the main controller takes the lead in control, and the backup controller only participates through fine-tuning (the weight of the second output is extremely small).

[0068] At Level-2: The decay rate is exponential with the duration of the fault, and the expression is:

[0069] in, is the weight reduction rate coefficient, is the fault duration. The second output weight of the standby controller Gradually increase and gradually take over some control rights (such as from from 0.5 to 0).

[0070] At Level-3: Forced to 0, the second output weight of the standby controller is , completely take over vehicle control (e.g. braking force output is only controlled by the standby controller Decide).

[0071] Finally, the processing device determines the braking force of the vehicle based on the first output weight, the second output weight, the first braking force of the main controller, and the second braking force of the backup controller. The calculation expression is:

[0072] in, The braking force of the vehicle.

[0073] Based on the above description, this application has the following beneficial effects: This method allows the primary and backup controllers to synchronously generate control results and participate in health assessments, eliminating the need for the backup controller to remain idle. By dynamically adjusting the output weights of the two controllers based on the target fault level, the backup controller can participate in real-time control of key parameters such as vehicle braking and steering forces based on system status, effectively activating and maximizing redundant resources.

[0074] Furthermore, by comparing the differences between the first and second control results, calculating system health, and optimizing the anomaly detection delay based on round-trip time and network jitter variance, the risk of misjudgment due to transient network fluctuations is significantly reduced, improving the accuracy and timeliness of anomaly identification. At the same time, by determining the target fault level and dynamically allocating output weights based on preset mapping relationships, the control ratios of the primary and backup controllers can be flexibly adjusted in different fault scenarios, ensuring that the vehicle maintains stable power and steering output even when some controllers are malfunctioning, avoiding the risk of system failure caused by a single controller failure, and providing more reliable protection for driving safety in complex road conditions.

[0075] Combine Figure 2 The control method of the vehicle-mounted redundant controller provided in the embodiment of the present application is introduced in detail. The device and equipment provided in the embodiment of the present application will be introduced in conjunction with the accompanying drawings.

[0076] like Figure 3 As shown, this figure is a schematic diagram of a control device of a vehicle-mounted redundant controller provided by an embodiment of the present application, the device comprising: An acquisition module 301 is configured to acquire a first control result of the primary controller and a second control result of the standby controller; A determination module 302 is configured to determine a health level of the redundant controller based on the first control result and the second control result; and if the health level is greater than or equal to a health level threshold, determine an abnormality after a first delay. The control module 303 is configured to control the main controller and the standby controller according to the abnormal situation.

[0077] Optionally, the determination module 302 is specifically used to determine a first sub-control result and a second sub-control result whose difference is less than or equal to a difference threshold from the first control result and the second control result, and to determine a third sub-control result and a fourth sub-control result whose difference is greater than the difference threshold from the first control result and the second control result, wherein the first sub-control result and the third sub-control result belong to the first control result, and the second sub-control result and the fourth sub-control result belong to the second control result; and determine the health of the redundant controller based on the mean between the first sub-control result and the second sub-control result, and the difference between the third sub-control result and the fourth sub-control result.

[0078] Optionally, an acquisition module 301 is specifically configured to acquire a round trip time and a network jitter variance between a control instruction sent by the main controller and a sensor corresponding to the control instruction; The determination module 302 is specifically configured to determine a first duration according to the round-trip duration and the network jitter variance.

[0079] Optionally, the determination module 302 is specifically used to determine the target fault level corresponding to the abnormal situation based on the mapping relationship between the abnormal situation, a pre-set reference abnormality and a reference fault level; and control the first output weight of the main controller and the second output weight of the standby controller according to the target fault level.

[0080] Optionally, the determination module 302 is further configured to determine the braking force of the vehicle based on the first output weight, the second output weight, the first braking force of the main controller, and the second braking force of the standby controller.

[0081] Optionally, the determination module 302 is further configured to determine an abnormality in real time when the health level is less than a health level threshold.

[0082] The control device of the vehicle redundant controller according to the embodiment of the present application may correspond to the method described in the embodiment of the present application, and the above-mentioned other operations and / or functions of each module / unit of the control device of the vehicle redundant controller are respectively to realize Figure 2 For the sake of brevity, the corresponding processes of the various methods in the illustrated embodiments are not described again here.

[0083] The present application also provides a computing device. Figure 4 As shown, this figure is a schematic diagram of a computing device provided by an embodiment of the present application, and the computing device 400 includes a bus 401, a processor 402, a communication interface 403 and a memory 404. The processor 402, the memory 404 and the communication interface 403 communicate with each other via the bus 401.

[0084] The bus 401 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0085] The processor 402 may be any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0086] The communication interface 403 is used for communicating with the outside.

[0087] Memory 404 may include volatile memory, such as random access memory (RAM). Memory 404 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0088] The memory 404 stores executable codes, and the processor 402 executes the executable codes to perform the aforementioned control method of the vehicle-mounted redundant controller.

[0089] Specifically, in the implementation Figure 3 In the case of the embodiment shown, and Figure 3 When each module or unit of the control device of the vehicle redundant controller described in the embodiment is implemented by software, Figure 3 The software or program code required for the functions of each module / unit in the vehicle can be partially or completely stored in the memory 404. The processor 402 executes the program code corresponding to each unit stored in the memory 404 to perform the control method of the vehicle redundant controller.

[0090] Embodiments of the present application also provide a computer-readable storage medium. The computer-readable storage medium can be any available medium capable of being stored by a computing device, or a data storage device such as a data center that contains one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, hard disk, or magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the control method for the vehicle-mounted redundant controller described above.

[0091] The present application also provides a computer program product comprising one or more computer instructions that, when loaded and executed on a computing device, fully or partially generate the process or function described in the present application.

[0092] The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer, or data center to another website, computer, or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0093] When the computer program product is executed by a computer, the computer performs any of the aforementioned methods for controlling a redundant vehicle controller. The computer program product may be a software installation package. When any of the aforementioned methods for controlling a redundant vehicle controller is required, the computer program product may be downloaded and executed on the computer.

[0094] The descriptions of the processes or structures corresponding to the above figures have different emphases. For parts that are not described in detail in a certain process or structure, please refer to the relevant descriptions of other processes or structures.

[0095] The above description is only a specific implementation method of the present application, but the protection scope of the present application is not limited thereto. Any changes or replacements within the technical scope disclosed in the present application should be included in the protection scope of the present application.

Claims

1. A control method for a vehicle-mounted redundant controller, characterized in that: The redundant controller includes a main controller and a standby controller, and the method includes: Obtaining a first control result of the main controller, and obtaining a second control result of the standby controller; determining an abnormal situation according to the first control result and the second control result; Controlling the main controller and the standby controller according to the abnormal situation; The determining of an abnormal situation according to the first control result and the second control result includes: determining a health level of a redundant controller according to the first control result and the second control result; When the health level is greater than or equal to the health level threshold, an abnormality is determined after a first delay.

2. The method according to claim 1, characterized in that Determining the health of the redundant controller according to the first control result and the second control result includes: Determining a first sub-control result and a second sub-control result, from the first control result and the second control result, whose differences are less than or equal to a difference threshold, and determining a third sub-control result and a fourth sub-control result, from the first control result and the second control result, whose differences are greater than the difference threshold, wherein the first sub-control result and the third sub-control result belong to the first control result, and the second sub-control result and the fourth sub-control result belong to the second control result; The health of the redundant controller is determined according to an average value between the first sub-control result and the second sub-control result, and a difference between the third sub-control result and the fourth sub-control result.

3. The method according to claim 1, characterized in that The first duration is determined by: Acquire the round trip time and network jitter variance between the control instruction sent by the main controller and the sensor corresponding to the control instruction; A first duration is determined according to the round-trip duration and the network jitter variance.

4. The method according to any one of claims 1 to 3, characterized in that The controlling the main controller and the standby controller according to the abnormal situation includes: Determining a target fault level corresponding to the abnormal situation according to a mapping relationship between the abnormal situation, a preset reference abnormality, and a reference fault level; According to the target fault level, a first output weight of the main controller and a second output weight of the standby controller are controlled.

5. The method according to claim 4, characterized in that The method further comprises: The braking force of the vehicle is determined according to the first output weight, the second output weight, the first braking force of the main controller, and the second braking force of the standby controller.

6. The method according to claim 1, characterized in that The first control result and the second control result include at least the following parameters: The acceleration of the vehicle, the braking force of the vehicle and the steering force of the vehicle.

7. The method according to claim 1, characterized in that The method further comprises: In a case where the health level is less than a health level threshold, an abnormality is determined in real time.

8. A control device for a vehicle-mounted redundant controller, characterized in that: The device comprises: an acquisition module, configured to acquire a first control result of the main controller and a second control result of the standby controller; a determination module, configured to determine a health of the redundant controller according to the first control result and the second control result; and, if the health is greater than or equal to a health threshold, determine an abnormality after a first delay; The control module is used to control the main controller and the standby controller according to the abnormal situation.

9. A computing device, characterized in that including memory and processor; One or more computer programs are stored in the memory, and the one or more computer programs include instructions; when the instructions are executed by the processor, the computing device executes the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium is used to store a computer program, and the computer program is used to execute the method according to any one of claims 1 to 7.

Images