A control method and device of a vehicle-mounted redundant controller, equipment and medium

Abstract

The application discloses a control method, device and equipment of a vehicle-mounted redundant controller and a medium, and relates to the technical field of vehicles. The method comprises the following steps: acquiring a first control result of a main controller and a second control result of a backup controller, both of which contain parameters such as vehicle acceleration, braking force and steering force. By analyzing the two sets of results, the first sub-control result with a difference less than or equal to a difference threshold value and the second sub-control result with a difference greater than the difference threshold value are distinguished, the system health degree is determined in combination with the mean value and the difference, when the health degree meets the standard, the abnormal situation is judged according to the control instruction round-trip time and the network jitter variance to determine the delay time, then according to the mapping relationship between the abnormal situation and the preset reference abnormality and fault level, the target fault level is determined, and then the output weight of the main controller and the backup controller is regulated, and the final braking force of the vehicle is determined in combination with the braking force of the two controllers. The method improves the utilization rate of redundant resources and the accuracy of abnormality judgment, and guarantees the driving safety of the vehicle.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of vehicles, in particular to a control method and device of a vehicle-mounted redundant controller, equipment and a medium. BACKGROUND

[0002] At present, with the rapid advancement of intelligentization and networking of automobiles, the driving safety of vehicles has become one of the core indicators for measuring the competitiveness of automobile products. The chassis domain control system, as the hub of key executive mechanisms such as vehicle braking, steering and suspension, its safety redundancy capability and control reliability directly determine the driving safety of vehicles in complex road conditions. To cope with the safety challenges of the chassis domain control system, the traditional technical solution generally adopts redundancy design to improve the reliability of the system.

[0003] Early redundancy designs are mostly based on single-controller architecture, and simple fault backup is achieved by adding backup sensors or actuators; with the development of technology, a master-slave redundancy architecture has gradually formed, that is, a set of backup controllers with the same functions as the main controller is set, and the backup controllers are deployed in a cold backup mode, and when the main controller fails, the backup controllers are activated and take over the control functions.

[0004] However, in the traditional solution, the backup controller may be in an idle state for a long time, which will cause waste of resources. SUMMARY

[0005] The present application provides a control method, device, equipment and medium of a vehicle-mounted redundant controller, which can reduce the waste of resources.

[0006] To achieve the above purpose, the present application adopts the following technical solutions:

[0007] In a first aspect, the present application provides a control method of a vehicle-mounted redundant controller, the redundant controller including a main controller and a backup controller, comprising:

[0008] obtaining a first control result of the main controller, and obtaining a second control result of the backup controller;

[0009] determining an abnormal condition according to the first control result and the second control result;

[0010] controlling the main controller and the backup controller according to the abnormal condition;

[0011] The determination of the abnormal condition according to the first control result and the second control result comprises:

[0012] determining the health degree of the redundant controller according to the first control result and the second control result;

[0013] In a case where the health degree is greater than or equal to a health degree threshold, after delaying for a first duration, it is determined that an abnormal situation exists.

[0014] Optionally, according to the first control result and the second control result, a health degree of the redundant controller is determined, including:

[0015] First and second sub-control results with a difference less than or equal to a difference threshold are determined from the first and second control results, and third and fourth sub-control results with a difference greater than the difference threshold are determined from the first and second control results, wherein the first and third sub-control results belong to the first control result, and the second and fourth sub-control results belong to the second control result;

[0016] According to a mean value between the first and second sub-control results and a difference between the third and fourth sub-control results, a health degree of the redundant controller is determined.

[0017] Optionally, the first duration is determined by:

[0018] A round-trip duration between the main controller and a sensor corresponding to the control instruction and a network jitter variance are obtained;

[0019] According to the round-trip duration and the network jitter variance, the first duration is determined.

[0020] Optionally, according to the abnormal situation, the main controller and the backup controller are controlled, including:

[0021] According to a mapping relationship between the abnormal situation, a pre-set reference abnormality and a reference failure level, a target failure level corresponding to the abnormal situation is determined;

[0022] According to the target failure level, a first output weight of the main controller and a second output weight of the backup controller are controlled.

[0023] Optionally, the method further includes:

[0024] According to the first output weight, the second output weight, a first braking force of the main controller and a second braking force of the backup controller, a braking force of the vehicle is determined.

[0025] Optionally, the first control result and the second control result include at least parameters of the following categories:

[0026] Acceleration of the vehicle, braking force of the vehicle and steering force of the vehicle.

[0027] Optionally, the method further comprises:

[0028] In a case where the health degree is less than a health degree threshold, determining an abnormal situation in real time.

[0029] In a second aspect, the present application provides a control device of a vehicle-mounted redundant controller, comprising:

[0030] An acquisition module is configured to acquire a first control result of the primary controller and a second control result of the backup controller;

[0031] A determination module is configured to determine a health degree of the redundant controller according to the first control result and the second control result, and in a case where the health degree is greater than or equal to a health degree threshold, determine an abnormal situation after a delay of a first time length;

[0032] A control module is configured to control the primary controller and the backup controller according to the abnormal situation.

[0033] In a third aspect, the present application provides a computing device comprising a memory and a processor.

[0034] One or more computer programs are stored in the memory, and the one or more computer programs comprise instructions; when the instructions are executed by the processor, the computing device performs the method according to any one of the first aspect.

[0035] In a fourth aspect, the present application provides a computer readable storage medium for storing a computer program, wherein the computer program is used to perform the method according to any one of the first aspect.

[0036] According to the above technical solution, the present application has at least the following beneficial effects:

[0037] In the present application, the method makes the primary controller and the backup controller generate control results synchronously and participate in health degree evaluation, so that the backup controller is no longer in a simple idle waiting state. By dynamically adjusting the output weights of the two according to the target fault level, the backup controller can participate in the control of key parameters such as vehicle braking force and steering force in real time according to the system state, thereby realizing efficient activation and maximum utilization of redundant resources.

[0038] Further, by comparing the difference between the first control result and the second control result, calculating the system health degree, and optimizing the abnormal judgment delay length based on the round trip length and network jitter variance, the misjudgment risk caused by instantaneous network fluctuation is greatly reduced, and the accuracy and timeliness of abnormal situation identification are improved. At the same time, according to the preset mapping relationship to determine the target fault level and dynamically allocate the output weight, the control proportion of the master and backup controllers can be flexibly adjusted in different fault scenarios, ensuring that the vehicle can maintain stable power and steering output when part of the controller is abnormal, avoiding the risk of system failure caused by single controller failure, and providing more reliable protection for driving safety under complex road conditions.

[0039] It should be understood that the description of technical features, technical solutions, beneficial effects or similar language in this application does not imply that all features and advantages can be achieved in any single embodiment. On the contrary, it can be understood that the description of a feature or beneficial effect means that the specific technical feature, technical solution or beneficial effect is included in at least one embodiment. Therefore, the description of technical features, technical solutions or beneficial effects in this specification does not necessarily refer to the same embodiment. Further, the technical features, technical solutions and beneficial effects described in this embodiment can be combined in any appropriate manner. Those skilled in the art will understand that the embodiments can be implemented without one or more specific technical features, technical solutions or beneficial effects of a particular embodiment. In other embodiments, additional technical features and beneficial effects can be identified in specific embodiments that do not embody all embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0040] Figure 1 A schematic diagram of a system structure of a vehicle-mounted redundant controller according to an embodiment of the present application is provided.

[0041] Figure 2 A flowchart of a control method of a vehicle-mounted redundant controller according to an embodiment of the present application is provided.

[0042] Figure 3 A schematic diagram of a control device of a vehicle-mounted redundant controller according to an embodiment of the present application is provided.

[0043] Figure 4 A schematic diagram of a computing device according to an embodiment of the present application is provided. DETAILED DESCRIPTION

[0044] The terms "first", "second" and "third" and the like in the specification and drawings of the present application are used to distinguish different objects, not to limit a specific order.

[0045] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0046] To ensure clarity and conciseness in the description of the following embodiments, a brief introduction to the related technologies is given first:

[0047] Redundant controllers refer to a combination of controllers installed in an onboard system to ensure control reliability. They typically include a main controller and a backup controller. The main controller is the core component that performs the main control functions under normal operating conditions, while the backup controller serves as a backup, participating in or taking over control when the main controller malfunctions. Together, they constitute the system's redundancy safety mechanism.

[0048] like Figure 1 As shown in the figure, this is a schematic diagram of the system structure provided in the embodiment of this application. The figure employs dual control modules, with both the main and backup controllers using ASILD-level chips and powered by different power modules. ASILD is the highest safety level defined by ISO 26262. The main controller is individually connected to the Inertial Measurement Unit (IMU), acceleration sensor, height sensor, and Continuous Damping Control (CDC) suspension system. The main and backup controllers are jointly connected to the air suspension, brake pedal, Transverse Acceleration Sensor (TAS), accelerator pedal, wheel speed sensor, EMB_CAN, and SBW_CAN electric drive systems. Redundancy is achieved through the connection of important functions between the main and backup controllers. EMB_CAN and SBW_CAN refer to the dedicated CAN bus communication links for the Electro-Mechanical Brake (EMB) system and the Steer-by-Wire (SBW) system, respectively.

[0049] Traditional redundancy schemes suffer from significant resource waste. The backup controller is not involved in actual control under most operating conditions, resulting in inefficient use of its hardware performance and computing resources, leading to a low cost-effectiveness ratio for redundancy designs. Furthermore, in cold backup mode, the backup controller's activation response is slow, potentially posing a risk of failover delays and impacting system emergency response efficiency.

[0050] On the one hand, in traditional solutions, the backup controller's function is limited to passive backup, lacking a real-time coordination mechanism with the main controller. It cannot participate in the control process under normal operating conditions, resulting in idle resources. On the other hand, traditional solutions lack refined health assessment and dynamic delay mechanisms for judging abnormal situations. They are easily affected by interference factors such as instantaneous network jitter, which may lead to misjudgment or untimely response. This not only affects control stability but also fails to optimize resource utilization efficiency through dynamic adjustment.

[0051] In view of this, embodiments of this application provide a control method for an on-board redundant controller. This method can be executed by a vehicle or by a processing device within the vehicle. This application does not specifically limit the executing entity; the following description uses the execution by a processing device as an example.

[0052] To address the problems of resource waste, insufficient accuracy in anomaly detection, and delayed fault switching response caused by long-term idle backup controllers in traditional vehicle-mounted redundant controller solutions, this invention proposes a design approach centered on dynamic collaboration and precise evaluation. By breaking away from the passive master-slave cold backup model, the master and backup controllers participate in the control process in real time and in parallel. Dynamic comparison of control results enables quantifiable health assessment, and the control weights of both controllers are dynamically allocated based on fault levels. Ultimately, this improves resource utilization efficiency while enhancing the system's precise response to anomalies, achieving the dual goals of redundancy safety and resource optimization.

[0053] The system synchronously collects the first control result generated by the main controller and the second control result generated by the backup controller, covering key parameters such as vehicle acceleration, braking force, and steering force. Based on the difference analysis between the first and second control results, it distinguishes between sub-control results with differences within a threshold and sub-control results exceeding the threshold. The system health is calculated by combining the difference characteristics of the two types of sub-results. The dynamic delay time is determined according to the round-trip time of the control command and the network jitter variance. When the health meets the standard, the system delays the judgment of anomalies to reduce misjudgments caused by instantaneous interference. The target fault level is determined according to the anomaly and the preset mapping relationship. The first output weight of the main controller and the second output weight of the backup controller are adjusted according to the level. Finally, the actual control output of the vehicle is determined by combining the output weights of the two controllers and their respective braking force and other parameters, so as to achieve flexible and coordinated control under different fault scenarios.

[0054] To make the technical solution of this application clearer and easier to understand, the control method of an on-board redundant controller provided by an embodiment of this application will be described below with reference to the accompanying drawings. Figure 2 As shown in the figure, this figure is a flowchart of a control method for an on-board redundant controller provided in an embodiment of this application.

[0055] S201, The processing device obtains the first control result of the main controller and the second control result of the backup controller.

[0056] The processing device synchronously acquires the control results of the master controller and the backup controller through the real-time communication link. The first control result directly reflects the control decision of the master controller on the key actuator of the vehicle under the current working condition, covering the key parameters of the core dimensions of the vehicle, based on the real-time acquired vehicle operation data.

[0057] Unlike the backup controller in the traditional cold backup mode, which is only in an idle state, the backup controller in the embodiment of the application always participates in control operation in parallel. The second control result generated by the backup controller fully presents the control decision logic of the backup controller for the current working condition.

[0058] The first control result and the second control result at least include the following categories of parameters: acceleration of the vehicle, braking force of the vehicle, and steering force of the vehicle.

[0059] S202, the processing device determines an abnormal situation according to the first control result and the second control result.

[0060] The abnormal situation refers to a situation where the control output of the master controller and the backup controller deviates from the normal logic, or the running state of the controller deviates from the preset health standard. It is the core basis for judging whether the control strategy of the master and backup controllers needs to be adjusted.

[0061] According to the first control result and the second control result, the health degree of the redundant controller is determined; in the case where the health degree is greater than or equal to the health degree threshold, the abnormal situation is determined after a delay of the first time length, and in the case where the health degree is less than the health degree threshold, the abnormal situation is determined in real time.

[0062] The health degree is a key indicator for quantifying the cooperative state of the master and backup controllers. The health degree is calculated based on the difference characteristics of the first control result and the second control result. When the difference between the first control result and the second control result exceeds the difference threshold, an abnormal situation may be triggered, for example, the difference between the braking force calculated by the master controller and the braking force calculated by the backup controller is too large, or there is a logical contradiction in the steering force parameter, which may be identified as an abnormal situation.

[0063] Specifically, the processing device will first subdivide the two sets of control results: determine the first sub-control result and the second sub-control result with a difference less than or equal to the difference threshold from the first control result and the second control result, and determine the third sub-control result and the fourth sub-control result with a difference greater than the difference threshold from the first control result and the second control result, wherein the first sub-control result and the third sub-control result belong to the first control result, and the second sub-control result and the fourth sub-control result belong to the second control result. According to the mean value between the first sub-control result and the second sub-control result, and the difference between the third sub-control result and the fourth sub-control result, the health degree of the redundant controller is determined.

[0064] From the first control result, a first sub-control result is identified whose difference from the second control result is less than or equal to a difference threshold, and a third sub-control result whose difference exceeds the difference threshold. Correspondingly, from the second control result, a second sub-control result with reasonable differences and a fourth sub-control result with excessive differences are identified. Subsequently, by combining the mean between the first and second sub-control results and the difference between the third and fourth sub-control results, the health of the redundant controller is calculated through weighted average. This process, by distinguishing between reasonable and abnormal differences, achieves a refined quantitative assessment of the system state. A higher health indicates better output consistency between the primary and backup controllers, and a more stable system operation. The health calculation expression is:

[0065]

[0066] in, For health, Indicates the first The weighting coefficients of the control results of the items. The attenuation coefficient is... Indicates the first The third sub-control result and the first The difference between the results of the fourth sub-control item Indicates the first The first sub-control result and the second The standard deviation of the second sub-control result, Indicates the first The first sub-control result and the second The mean of the second sub-control result, This represents the number of dimensions of the difference parameter, specifically the number of dimensions of the third and fourth sub-control results with the largest differences. This represents the number of dimensions of the stable parameters, specifically the number of dimensions of the first and second sub-control results with smaller differences.

[0067] For example, the weighting coefficient of the acceleration difference Weighting coefficient of braking force difference Weighting coefficient of steering force difference Weighting coefficient of height sensor difference .

[0068] In this embodiment of the application, the one-sidedness of a single difference parameter is avoided by using health quantification assessment, while the delayed judgment mechanism effectively filters out instantaneous interference. This ensures both sensitive identification of real anomalies and prevents frequent system fluctuations caused by misjudgments, laying a reliable foundation for subsequent precise control of the main and backup controllers.

[0069] When the health degree is less than the health degree threshold, the master and backup controllers determine the abnormal situation in real time; when the health degree is greater than or equal to the health degree threshold, it indicates that the master and backup controllers are in good overall state, but there may be temporary differences caused by non-systematic problems such as transient network jitter and temporary fluctuations in sensor data. At this time, the processing device does not directly determine that there is no abnormal situation, but introduces a delay judgment mechanism. If there is still a significant difference after delaying for the first time, the abnormal situation is finally determined.

[0070] Specifically, the processing device obtains the round-trip time between the control instruction and the corresponding sensor of the master controller and the network jitter variance. According to the round-trip time and the network jitter variance, the first time is determined.

[0071] First, the round-trip time (reflecting the basic communication delay) and the network jitter variance (reflecting the communication stability) between the control instruction and the corresponding sensor of the master controller are calculated to calculate the first time (i.e. reasonable delay waiting time); After delaying for the first time, the difference state of the two sets of control results is evaluated again. If the difference still exists or exceeds the standard after the delay, the abnormal situation is finally determined; if the difference disappears, it is determined to be transient interference, and subsequent control adjustment is not triggered. The calculation expression of the first time is:

[0072]

[0073] Among them, represents the delay of the first time, represents the total dimension number of the control instruction, represents the weight coefficient of the th control instruction, represents the round-trip time between the th control instruction and the corresponding sensor of the master controller, represents the network jitter variance, represents a very small constant to prevent zero.

[0074] S203, the processing device controls the master controller and the backup controller according to the abnormal situation.

[0075] The processing device determines the target fault level corresponding to the abnormal situation according to the mapping relationship between the abnormal situation, the pre-set reference abnormality and the reference fault level. The following examples are introduced.

[0076] Through the difference analysis of the key parameters (acceleration, braking force, steering force, etc.) of the vehicle and the number of sensor conflicts, three types of reference fault levels are drawn:

[0077] ​Level-1 (corresponding to minor faults): corresponds to a single difference exceeding the threshold by less than 20% or the number of sensor collisions ≤ 2. For example, the acceleration obtained by the main controller through the accelerometer. The value is 3, and the acceleration is calculated by the backup controller based on the wheel speed. The difference is 2.5. If the threshold is 0.6 (corresponding to the upper limit of 20% difference), then the difference of a single parameter is within the range of 20% above the threshold; or during driving, due to instantaneous network fluctuations, the brake pedal displacement sensor and EMB data will quickly synchronize after two brief conflicts.

[0078] Level-2 (corresponding to moderate faults): This corresponds to two or more differences exceeding a threshold by 20% or the number of sensor conflicts being ≥3. For example, the braking force calculated by the main controller... =400, calculated by the backup controller. =500 (differential braking force is 100, threshold is 80, exceeding threshold is 25%), while steering force =200 and =250 (steering force difference is 50, threshold is 40, exceeding threshold is 25%), meaning that the difference between the two parameters exceeds the threshold by 20%; or the wheel speed sensor and acceleration sensor data continue to conflict within 3 consecutive control cycles.

[0079] Level-3 (corresponding to severe faults): corresponds to a single difference exceeding the threshold by 50% or two or more differences exceeding the threshold by 40%. For example, the braking force calculated by the main controller... =300, calculated by the backup controller. =500 (braking force difference is 200, threshold is 100, exceeding threshold is 100%), that is, the difference of a single parameter exceeds the threshold by 50%; or the braking force difference is 140 (threshold is 100N, exceeding by 40%) and the acceleration difference is 0.6 (threshold is 0.4, exceeding by 50%), both parameters exceed the threshold by more than 40%.

[0080] Regarding acceleration, the main controller obtains the acceleration data through the accelerometer. The backup controller obtains the speed through the wheel speed sensor. The calculation expression is:

[0081]

[0082] in, To prepare for the controller's acceleration, Indicates speed, Indicates time.

[0083] Regarding braking force, the main controller obtains the braking force from the brake pedal displacement. The backup controller obtains this information via EMB. The calculation expression is:

[0084]

[0085] wherein, is the master controller braking force (unit: N), is the displacement-force conversion coefficient (unit: N / m), e.g. braking force generated by unit stroke distance of brake pedal, is the dynamic compensation coefficient (unit: Ns / m), e.g. braking force generated by unit rate of change of brake pedal, is the stroke distance of brake pedal (unit: m).

[0086]

[0087] wherein, is the backup controller braking force (unit: N), is the transmission efficiency, is the motor torque constant (unit: Nm / A), is the motor current (unit: A) when kinetic energy is recovered, is the reduction ratio, is the equivalent braking radius (unit: m), e.g. the radius of the wheel hub.

[0088] For the steering force, the master controller gets from the TAS, and the backup controller gets from the SBW, and the calculation expression is:

[0089]

[0090] wherein, is the master controller steering force (unit: N), is the steering angle-steering force gain coefficient (unit: N / deg), determined by the steering system stiffness, is the steering dynamic damping coefficient (unit: N·s / deg), which suppresses steering wheel jitter, is the torque-steering force conversion coefficient (unit: N / (N·m)), which maps the driver torque demand to the steering force, is the steering angle of the steering wheel (unit: deg), is the steering torque of the steering wheel (unit: Nm).

[0091]

[0092] wherein, is the backup controller steering force (unit: N), is the SBW motor torque constant (unit: N·m / A); is the steering reduction mechanism transmission ratio, For transmission efficiency, For vehicle speed damping coefficient (unit: N·s / m), used to suppress excessive sensitivity when steering at high speed, For motor current (unit: A), For equivalent steering mechanism radius (unit: m).

[0093] Calculate the acceleration difference , brake force difference , steering force difference .

[0094] When the system detects abnormal conditions (such as brake force difference of the main and backup controllers exceeds the threshold), it compares the actual abnormal characteristics with the above reference abnormalities, matches the corresponding reference fault level, and determines the target fault level of the current abnormality. For example, if the brake force difference is detected to be 30% (exceeding the threshold of 20% but not reaching 50%), and there is no other parameter abnormality, the target fault level is Level-2.

[0095] According to the target fault level, control the first output weight of the main controller and the second output weight of the backup controller.

[0096] Level-1: The first output weight of the main controller can be represented as:

[0097]

[0098] Where, represents the first weight of the main controller, is the maximum allowed difference.

[0099] The second output weight of the backup controller is At this time approaches 1, the main controller dominates the control, and the backup controller only participates through fine tuning (the second output weight is very small).

[0100] Level-2: Exponentially decays with fault duration, expression:

[0101]

[0102] Where, is the weight reduction rate coefficient, is the fault duration. The second output weight of the backup controller gradually increases, gradually taking over part of the control authority (such as from 0.5 to 0).

[0103] Level-3: Forced to be set to 0, the second output weight of the backup controller is Completely take over vehicle control (e.g., braking force output is solely controlled by the backup controller). Decide).

[0104] Finally, the processing equipment determines the vehicle's braking force based on the first output weight, the second output weight, the first braking force of the main controller, and the second braking force of the backup controller. The calculation expression is as follows:

[0105]

[0106] in, For the braking force of the vehicle.

[0107] Based on the above description, this application has the following beneficial effects:

[0108] This method enables the primary and backup controllers to synchronously generate control results and participate in health assessments, preventing the backup controller from simply remaining idle. By dynamically adjusting the output weights of both controllers based on the target fault level, the backup controller can participate in the control of key parameters such as vehicle braking force and steering force in real time according to the system status, achieving efficient activation and maximum utilization of redundant resources.

[0109] Furthermore, by comparing the differences between the first and second control results, calculating the system health, and optimizing the anomaly detection delay based on round-trip time and network jitter variance, the risk of misjudgment caused by instantaneous network fluctuations is significantly reduced, improving the accuracy and timeliness of anomaly identification. Simultaneously, by determining the target fault level based on a preset mapping relationship and dynamically allocating output weights, the control ratio of the primary and backup controllers can be flexibly adjusted under different fault scenarios. This ensures that the vehicle can maintain stable power and steering output even when some controllers malfunction, avoiding the risk of system failure caused by a single controller failure and providing more reliable protection for driving safety in complex road conditions.

[0110] Combination Figure 2 The control method of the vehicle-mounted redundant controller provided in the embodiments of this application has been described in detail. The device and equipment provided in the embodiments of this application will be described below with reference to the accompanying drawings.

[0111] like Figure 3 As shown in the figure, this is a schematic diagram of a control device for an on-board redundant controller provided in an embodiment of this application. The device includes:

[0112] The acquisition module 301 is used to acquire the first control result of the main controller and the second control result of the backup controller;

[0113] The determining module 302 is configured to determine a health degree of the redundant controller according to the first control result and the second control result, and determine an abnormal situation after a first time length is delayed when the health degree is greater than or equal to a health degree threshold.

[0114] The control module 303 is configured to control the main controller and the backup controller according to the abnormal situation.

[0115] Optionally, the determining module 302 is specifically configured to determine first sub-control results and second sub-control results with a difference less than or equal to a difference threshold from the first control result and the second control result, and determine third sub-control results and fourth sub-control results with a difference greater than the difference threshold from the first control result and the second control result, wherein the first sub-control results and the third sub-control results belong to the first control result, and the second sub-control results and the fourth sub-control results belong to the second control result; and determine the health degree of the redundant controller according to an average value between the first sub-control results and the second sub-control results and a difference between the third sub-control results and the fourth sub-control results.

[0116] Optionally, the obtaining module 301 is specifically configured to obtain a round-trip time length between a control instruction and a sensor corresponding to the control instruction and a network jitter variance.

[0117] The determining module 302 is specifically configured to determine the first time length according to the round-trip time length and the network jitter variance.

[0118] Optionally, the determining module 302 is specifically configured to determine a target failure level corresponding to the abnormal situation according to a mapping relationship between the abnormal situation, a pre-set reference abnormality and a reference failure level, and control a first output weight of the main controller and a second output weight of the backup controller according to the target failure level.

[0119] Optionally, the determining module 302 is further configured to determine a braking force of the vehicle according to the first output weight, the second output weight, a first braking force of the main controller and a second braking force of the backup controller.

[0120] Optionally, the determining module 302 is further configured to determine an abnormal situation in real time when the health degree is less than a health degree threshold.

[0121] The control device of the vehicle-mounted redundant controller according to the embodiments of the present application can correspond to the method described in the embodiments of the present application, and the above-mentioned other operations and / or functions of each module / unit of the control device of the vehicle-mounted redundant controller are respectively implemented to achieve Figure 2For brevity, the corresponding flow of each method in the illustrated embodiments will not be described here again.

[0122] The embodiments of the present application also provide a computing device. As shown in the figure, the figure is a schematic diagram of a computing device provided by the embodiments of the present application, the computing device 400 includes a bus 401, a processor 402, a communication interface 403 and a memory 404. The processor 402, the memory 404 and the communication interface 403 communicate through the bus 401. Figure 4

[0123] The bus 401 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, Figure 4 In the figure, only one thick line is used to represent the bus, but it does not mean that there is only one bus or only one type of bus.

[0124] The processor 402 can be any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP) processor.

[0125] The communication interface 403 is used for external communication.

[0126] The memory 404 can include a volatile memory (volatile memory), such as a random access memory (RAM). The memory 404 can also include a non-volatile memory (non-volatile memory), such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD) or a solid state drive (SSD).

[0127] The memory 404 stores executable code, and the processor 402 executes the executable code to perform the control method of the vehicle-mounted redundant controller.

[0128] Specifically, in the case of implementing the embodiments shown, and Figure 3 Figure 3 ​​In the case that the modules or units of the control device of the vehicle-mounted redundant controller described in the embodiments are implemented by software, the software or program codes required for the functions of the modules / units in Figure 3 The software or program codes required for the functions of the modules / units in

[0129] The embodiments of the present application also provide a computer readable storage medium. The computer readable storage medium can be any available medium or data storage device that can be accessed by a computing device, such as a data center containing one or more available media. The available medium can be a magnetic medium (such as a floppy diskette, a hard disk, or a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid state disk), etc. The computer readable storage medium includes instructions that instruct the computing device to execute the control method of the vehicle-mounted redundant controller described above.

[0130] The embodiments of the present application also provide a computer program product including one or more computer instructions. When the computer instructions are loaded and executed on a computing device, the flow or function described in the embodiments of the present application is generated in whole or in part.

[0131] The computer instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be transmitted from one website, computer or data center to another website, computer or data center through wired (such as coaxial cable, optical fiber, digital subscriber line) or wireless (such as infrared, wireless, microwave, etc.) mode.

[0132] The computer program product is executed by a computer, and the computer executes any of the control methods of the vehicle-mounted redundant controller described above. The computer program product can be a software installation package, and when any of the control methods of the vehicle-mounted redundant controller described above is needed, the computer program product can be downloaded and executed on the computer.

[0133] The descriptions of the corresponding flows or structures of the above various figures are each focused on, and the parts not described in detail in a certain flow or structure can be referred to the related descriptions of other flows or structures.

[0134] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto, any change or replacement within the technical scope disclosed in the present application should be covered in the protection scope of the present application.

Claims

1. A control method of a vehicle-mounted redundant controller, characterized by, The redundant controller comprises a main controller and a backup controller, and the method comprises: obtaining a first control result of the main controller and a second control result of the backup controller; determining an abnormal condition according to the first control result and the second control result; controlling the main controller and the backup controller according to the abnormal condition; the determining of the abnormal condition according to the first control result and the second control result comprises: determining a health degree of the redundant controller according to the first control result and the second control result, wherein the calculation expression of the health degree is: in, For health, Indicates the first The weighting coefficients of the control results of the items. The attenuation coefficient is... Indicates the first The third sub-control result and the first The difference between the results of the fourth sub-control item Indicates the first The first sub-control result and the second The standard deviation of the second sub-control result, Indicates the first The first sub-control result and the second The mean of the second sub-control result, The number of dimensions representing the difference parameter. The dimension of the stable parameter is represented by the first sub-control result, which is the control result in which the difference is less than or equal to the difference threshold; the second sub-control result is the control result in which the difference is less than or equal to the difference threshold; the third sub-control result is the control result in which the difference is greater than the difference threshold; and the fourth sub-control result is the control result in which the difference is greater than the difference threshold. in the case that the health degree is greater than or equal to a health degree threshold, determining the abnormal condition after a first time delay.

2. The method of claim 1, wherein, the determining of the health degree of the redundant controller according to the first control result and the second control result comprises: determining first sub-control results and second sub-control results with a difference less than or equal to a difference threshold from the first control result and the second control result, and determining third sub-control results and fourth sub-control results with a difference greater than the difference threshold from the first control result and the second control result, wherein the first sub-control results and the third sub-control results belong to the first control result, and the second sub-control results and the fourth sub-control results belong to the second control result; determining the health degree of the redundant controller according to the mean value between the first sub-control results and the second sub-control results and the difference between the third sub-control results and the fourth sub-control results.

3. The method of claim 1, wherein, the first time is determined by: obtaining a control instruction, a round-trip time between the main controller and a sensor corresponding to the control instruction, and a network jitter variance; determining the first time according to the round-trip time and the network jitter variance.

4. The method according to any one of claims 1 to 3, characterized in that, the controlling of the main controller and the backup controller according to the abnormal condition comprises: determining a target failure level corresponding to the abnormal condition according to a mapping relationship between the abnormal condition, a pre-set reference abnormality and a reference failure level; controlling a first output weight of the main controller and a second output weight of the backup controller according to the target failure level.

5. The method of claim 4, wherein, The method further comprises: determining a braking force of the vehicle according to the first output weight, the second output weight, a first braking force of the main controller and a second braking force of the backup controller.

6. The method of claim 1, wherein, The first control result and the second control result at least comprise parameters of the following categories: acceleration of the vehicle, braking force of the vehicle and steering force of the vehicle.

7. The method of claim 1, wherein, The method further comprises: in the case that the health degree is less than the health degree threshold, determining the abnormal condition in real time.

8. A control device of a redundant controller for a vehicle, characterized by comprising: The device comprises: an obtaining module for obtaining a first control result of the main controller and a second control result of the backup controller; a determining module for determining a health degree of the redundant controller according to the first control result and the second control result, and determining an abnormal condition after a first time delay in the case that the health degree is greater than or equal to a health degree threshold, wherein the calculation expression of the health degree is: wherein, a healthiness, denotes the weighting coefficient of the decay coefficient, denotes the difference between the third sub-control result and the fourth sub-control result, denotes the standard deviation of the first sub-control result and the second sub-control result, denotes the mean value of the first sub-control result and the second sub-control result, denotes the dimension number of the difference parameter, denotes the dimension number of the stability parameter, the first sub-control result is the control result in the first control result with the difference less than or equal to the difference threshold value, the second sub-control result is the control result in the second control result with the difference less than or equal to the difference threshold value, the third sub-control result is the control result in the first control result with the difference greater than the difference threshold value, and the fourth sub-control result is the control result in the second control result with the difference greater than the difference threshold value. A control module is configured to control the primary controller and the backup controller according to the abnormal situation.

9. A computing device, comprising: comprising a memory and a processor; wherein the memory stores one or more computer programs comprising instructions that, when executed by the processor, cause the computing device to perform the method of any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium is configured to store a computer program for performing the method of any one of claims 1 to 7.

Images