Power domain safe operation system, method and device and vehicle

Abstract

The invention provides a power domain safe operation system, method and device and a vehicle, the power domain safe operation system comprises a plurality of electronic controllers, an accelerator pedal collector and a motor controller, and the accelerator pedal collector is used for generating an input signal according to the collected accelerator opening degree and transmitting the input signal to the electronic controllers; the plurality of electronic controllers respectively receive the input signals transmitted by the accelerator pedal collector, calculate the vehicle torque according to the accelerator opening corresponding to the input signals, generate torque control instructions carrying the vehicle torque, and respectively send the torque control instructions to the motor controller; the motor controller is used for receiving a torque control instruction sent by at least one electronic controller in the multiple electronic controllers and conducting power control on the vehicle according to the torque control instruction. Compared with the prior art, according to the embodiment of the invention, through certain hardware redundancy, the vehicle still has power under the condition that a certain electronic controller breaks down, and the vehicle using experience of a user is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of vehicle technology, and in particular to a power domain safe operation system and method, device, and vehicle. Background Art

[0002] In the existing power domain functional safety system design, the electronic controller (ECU) provides independent power supply for the dual-path accelerator pedal sensor, and calculates the pedal depth by sampling the dual-path accelerator pedal sensor, which is then converted into a torque output request and transmitted to the front motor controller (Motor Control Unit Front, MCUF) and the rear motor controller (Motor Control Unit Rear, MCUR). The motor controller controls the motor to achieve vehicle torque control and energy recovery.

[0003] However, the existing safety system adopts a failsafe architecture. When a serious fault occurs (for example, sensor failure, controller failure, etc.), in order to avoid unexpected excessive / inadequate power output, the system will reset the microcontroller unit (MCU) and cut off the controller's external controller area network (CAN) communication through the safety shutdown device, causing the entire system to enter an inoperative state. At this time, the entire vehicle will lose power, and the vehicle can only stop by coasting or braking, causing the user to have obvious vehicle abnormalities and reducing the user's driving experience. Summary of the Invention

[0004] The present disclosure provides a power domain safety operation system and method, device, and vehicle. Its primary purpose is to address the problem of existing safety systems using a failsafe architecture. In the event of a serious fault, to avoid unexpected over / under power output, the system resets the MCU and, through a safety shutdown device, cuts off the controller's external CAN communication, causing the entire system to enter an inoperative state. This results in a loss of vehicle power, forcing the vehicle to coast to a stop or brake, creating a noticeable vehicle anomaly and degrading the user's driving experience.

[0005] According to a first aspect of the present disclosure, a power domain safe operation system is provided, which includes: multiple electronic controllers, an accelerator pedal collector, and a motor controller.

[0006] The accelerator pedal collector is used to generate an input signal according to the collected throttle opening, and transmit the input signal to the multiple electronic controllers respectively; wherein each electronic controller is electrically connected to the accelerator pedal collector and the motor controller respectively;

[0007] The multiple electronic controllers are respectively used to receive the input signal transmitted by the accelerator pedal collector, calculate the vehicle torque according to the throttle opening corresponding to the input signal, generate a torque control instruction carrying the vehicle torque, and send the torque control instruction to the motor controller respectively;

[0008] The motor controller is configured to receive the torque control instruction sent by at least one electronic controller among the plurality of electronic controllers, and perform power control on the vehicle according to the torque control instruction.

[0009] Optionally, the motor controller is configured to receive the torque control instructions respectively sent by the multiple electronic controllers, and respond to the torque control instruction sent by the electronic controller with a higher priority among the multiple electronic controllers, so as to achieve power control of the vehicle; or,

[0010] The motor controller is configured to receive the torque control instruction sent by any electronic controller among the multiple electronic controllers and respond to the torque control instruction sent by any electronic controller to achieve power control of the vehicle.

[0011] Optionally, the accelerator pedal collector includes: a first accelerator pedal collector and a second accelerator pedal collector,

[0012] The first accelerator pedal collector and the second accelerator pedal collector are respectively used to generate the input signal according to the collected throttle opening, and transmit the input signal to the multiple electronic controllers respectively;

[0013] If the plurality of electronic controllers respectively receive the input signals transmitted by the first accelerator pedal collector or the second accelerator pedal collector, they calculate the vehicle torque according to the throttle opening corresponding to the input signals, generate a torque control instruction carrying the vehicle torque, and send the torque control instruction to the motor controllers respectively;

[0014] If the multiple electronic controllers respectively receive the input signals transmitted by the first accelerator pedal collector and the second accelerator pedal collector, they respond to the input signal sent by the first accelerator pedal collector with a higher priority, calculate the vehicle torque, and generate a torque control instruction carrying the vehicle torque, and send the torque control instruction to the motor controller respectively.

[0015] Optionally, the motor controller includes: a front motor controller and a rear motor controller,

[0016] The front motor controller and / or the rear motor controller are configured to perform power control on the vehicle according to the torque control instruction.

[0017] Optionally, the plurality of electronic controllers include at least a first electronic controller, the first electronic controller including: a first power supply sensor, a second power supply sensor and a limp mode circuit,

[0018] The first power supply sensor is electrically connected to the first accelerator pedal collector, and the second power supply sensor is electrically connected to the second accelerator pedal collector;

[0019] The limp mode circuit is electrically connected to the first power supply sensor and the second power supply sensor respectively;

[0020] The limp home mode circuit is used to provide an operating signal to the first power supply sensor and the second power supply sensor when a failure occurs in the first electronic controller, so as to control the operation of the first power supply sensor and the second power supply sensor.

[0021] Optionally, the system further includes: a first power supply, a second power supply,

[0022] The first power supply is electrically connected to the first power supply sensor and the plurality of electronic controllers respectively, and supplies power to the first power supply sensor and the plurality of electronic controllers;

[0023] The second power supply is electrically connected to the second power supply sensor and the plurality of electronic controllers, respectively, and supplies power to the second power supply sensor and the plurality of electronic controllers.

[0024] According to a second aspect of the present disclosure, a method for safe operation of a power domain is provided, wherein the method is applied to the system described in the first aspect, comprising:

[0025] Obtaining a throttle opening of a vehicle, and generating at least one input signal according to the throttle opening of the vehicle;

[0026] Calculating vehicle torque according to the throttle opening corresponding to the input signal, and generating at least one torque control instruction carrying the vehicle torque;

[0027] The vehicle is powered by a motor according to the torque control command.

[0028] Optionally, calculating the vehicle torque according to the throttle opening corresponding to the input signal and generating at least one torque control instruction carrying the vehicle torque includes:

[0029] Acquire the first identification information carried by the input signal and the number of the input signals;

[0030] When the number of the input signals is greater than a preset threshold, determining an input signal with a higher priority based on the first identification information, calculating the vehicle torque based on the throttle opening corresponding to the input signal with the higher priority, and generating at least one torque control instruction carrying the vehicle torque, wherein the first identification information includes priority information of the input signal;

[0031] When the number of the input signals is less than or equal to the preset threshold, the vehicle torque is calculated according to the throttle opening corresponding to the input signals, and at least one torque control instruction carrying the vehicle torque is generated.

[0032] Optionally, the performing power control on the vehicle according to the torque control instruction includes:

[0033] Acquire the second identification information carried by the torque control instruction and the number of the torque control instructions;

[0034] When the number of the torque control instructions is greater than the preset threshold, determining a torque control instruction with a higher priority based on the second identification information, and performing power control on the vehicle based on the torque control instruction with the higher priority, the second identification information including priority information of the torque control instructions;

[0035] When the number of the torque control instructions is less than or equal to the preset threshold, the vehicle is powered and controlled according to the torque control instructions.

[0036] According to a third aspect of the present disclosure, a power domain safe operation device is provided, comprising:

[0037] a generating unit, configured to obtain a throttle opening of a vehicle and generate at least one input signal according to the throttle opening of the vehicle;

[0038] a generating unit, configured to calculate a vehicle torque according to the throttle opening corresponding to the input signal, and generate at least one torque control instruction carrying the vehicle torque;

[0039] A control unit is used to perform power control on the vehicle according to the torque control instruction.

[0040] Optionally, the generating unit includes:

[0041] an acquisition module, configured to acquire the first identification information carried by the input signal and the number of the input signals;

[0042] a generating module configured to, when the number of the input signals is greater than a preset threshold, determine an input signal with a higher priority based on the first identification information, calculate the vehicle torque based on the throttle opening corresponding to the input signal with the higher priority, and generate at least one torque control instruction carrying the vehicle torque, wherein the first identification information includes priority information of the input signal;

[0043] The generation module is further configured to, when the number of the input signals is less than or equal to the preset threshold, calculate the vehicle torque based on the throttle opening corresponding to the input signals, and generate at least one torque control instruction carrying the vehicle torque.

[0044] Optionally, the control unit includes:

[0045] an acquisition module, configured to acquire the second identification information carried by the torque control instruction and the number of the torque control instructions;

[0046] a control module configured to, when the number of the torque control instructions is greater than the preset threshold, determine a torque control instruction with a higher priority based on the second identification information, and perform power control on the vehicle based on the torque control instruction with the higher priority, the second identification information including priority information of the torque control instructions;

[0047] The control module is further configured to, when the number of the torque control instructions is less than or equal to the preset threshold, perform power control on the vehicle according to the torque control instructions.

[0048] According to a fourth aspect of the present disclosure, there is provided an electronic device, including:

[0049] at least one processor; and

[0050] a memory communicatively connected to the at least one processor; wherein,

[0051] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described in the second aspect.

[0052] According to a fifth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the method described in the second aspect.

[0053] According to a sixth aspect of the present disclosure, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the method as described in the second aspect above.

[0054] The power domain safe operation system and method, device, and vehicle provided by the present disclosure have the following main technical solutions: multiple electronic controllers, throttle pedal collectors, and motor controllers. The throttle pedal collector is used to generate an input signal based on the collected throttle opening, and transmit the input signal to the multiple electronic controllers respectively; wherein each electronic controller is electrically connected to the throttle pedal collector and the motor controller respectively; the multiple electronic controllers are respectively used to receive the input signal transmitted by the throttle pedal collector, calculate the vehicle torque according to the throttle opening corresponding to the input signal, and generate a torque control instruction carrying the vehicle torque, and send the torque control instruction to the motor controller; the motor controller is used to receive the torque control instruction sent by at least one electronic controller among the multiple electronic controllers, and perform power control on the vehicle according to the torque control instruction. Compared with related technologies, the embodiments of the present disclosure use certain hardware redundancy, namely multiple electronic controllers, to upgrade the original power domain system that becomes non-working after failure to a power domain system that still has all or degraded functions after failure. In the event of a failure in a certain electronic controller, the vehicle still has power. While ensuring functional safety, the system availability is improved and the user experience of the vehicle is enhanced.

[0055] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The accompanying drawings are provided to facilitate a better understanding of the present invention and do not constitute a limitation of the present disclosure.

[0057] Figure 1 A schematic diagram of a power domain safety operation system provided by an embodiment of the present disclosure;

[0058] Figure 2 A schematic block diagram of a power domain safety operation system provided by an embodiment of the present disclosure;

[0059] Figure 3 A schematic block diagram of another power domain safe operation system provided by an embodiment of the present disclosure;

[0060] Figure 4 A flowchart of a method for safe operation of a power domain provided by an embodiment of the present disclosure;

[0061] Figure 5 A schematic structural diagram of a power domain safety operation device provided by an embodiment of the present disclosure;

[0062] Figure 6 A schematic structural diagram of another power domain safety operation device provided by an embodiment of the present disclosure;

[0063] Figure 7 A schematic block diagram of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0064] The following description of exemplary embodiments of the present disclosure is made in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding. These details should be considered as merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0065] The following describes the power domain safe operation system and method, device, and vehicle according to the embodiments of the present disclosure with reference to the accompanying drawings.

[0066] The power domain safe operation system described in the present disclosure has no limit on the number of hardware. In order to facilitate understanding of the system of the embodiment of the present disclosure, two electronic controllers are used as an example for explanation, that is, the multiple electronic controllers include a first electronic controller and a second electronic controller.

[0067] Among them, the embodiment of the present disclosure provides a schematic diagram of a power domain safe operation system, such as Figure 1 As shown, in order to facilitate understanding of the system of the embodiment of the present disclosure, the embodiment of the present disclosure also provides a schematic block diagram of a power domain safe operation system for comparative explanation, as shown in FIG. Figure 2 As shown, the power domain safe operation system includes multiple electronic controllers (a first electronic controller 21 and a second electronic controller 22), an accelerator pedal collector 23 and a motor controller 24.

[0068] The throttle pedal collector 23 is used to generate an input signal based on the collected throttle opening, and transmit the input signal to the first electronic controller 21 and the second electronic controller 22 respectively; wherein, the first electronic controller 21 is electrically connected to the throttle pedal collector 23 and the motor controller 24 respectively, and the second electronic controller 22 is electrically connected to the throttle pedal collector 23 and the motor controller 24 respectively.

[0069] In the embodiments of the present disclosure, Figure 2 The accelerator pedal collector 23 corresponds to Figure 1The accelerator pedal sensor 1 and the accelerator pedal sensor 2, that is, the accelerator pedal collector 23 may include multiple accelerator pedal sensors. Specifically, the embodiment of the present disclosure does not limit the number of accelerator pedal sensors that can be included in the accelerator pedal collector 23.

[0070] It should be noted that in the power domain safe operation system, the information transmission method between all hardware includes but is not limited to: CAN communication, LIN bus (Local Interconnect Network, LIN) communication, MVB bus (Multifunction Vehicle Bus, MVB) communication, etc., which is not limited in the embodiments of the present disclosure.

[0071] In order to facilitate the description of the embodiments of the present disclosure, Figure 1 As shown, the information transmission method between all hardware in the power domain safe operation system is explained by taking CAN communication as an example.

[0072] The first electronic controller 21 and the second electronic controller 22 respectively receive the input signal transmitted by the accelerator pedal collector 23, calculate the vehicle torque according to the throttle opening corresponding to the input signal, and generate a torque control instruction carrying the vehicle torque, and send the torque control instruction to the motor controller 24 respectively.

[0073] In the embodiments of the present disclosure, Figure 2 The first electronic controller 21 and the second electronic controller 22 correspond to Figure 1 ECU1 and ECU2 in the figure contain a variety of chips and hardware, such as algorithm chip (MCU), communication chip (CAN transceiver), etc. Specifically, for the chips and hardware in ECU1 and ECU2, please refer to the description in the relevant technology, so I will not go into details here.

[0074] The first electronic controller 21 and the second electronic controller 22 can be pre-configured as a master electronic controller and a backup electronic controller, so that when the master electronic controller suffers a serious failure and enters a safe state, the backup electronic controller can still calculate the vehicle torque according to the throttle opening corresponding to the input signal, and generate a torque control instruction carrying the vehicle torque, and send the torque control instruction to the motor controller 24 respectively, for example: Figure 1As shown, ECU1 (first electronic controller 21) serves as the main electronic controller and ECU2 (second electronic controller 22) serves as the backup electronic controller. When a serious fault occurs in ECU 1 and the system enters a safe state (external communication is cut off and MCU is reset), ECU2 can calculate the torque request size based on the accelerator pedal sensor input and send the torque control command to the motor controller MCUR and MCUF via CAN.

[0075] The motor controller 24 receives the torque control instructions respectively sent by the first electronic controller 21 and / or the second electronic controller 22 , and performs power control on the vehicle according to the torque control instructions.

[0076] In the embodiments of the present disclosure, Figure 2 The motor controller 24 corresponds to Figure 1 ⑥ Redundant actuator (MCUF, MCUR), that is, the motor controller 24 may include multiple actuators such as: MCUF, MCUR. When the vehicle is normal, all actuators in the motor controller 24 work simultaneously, that is, they simultaneously receive the torque control instructions sent by the first electronic controller 21 and / or the second electronic controller 22 respectively, and perform power control on the vehicle according to the torque control instructions.

[0077] The power domain safe operation system provided by the present disclosure has a main technical solution including: multiple electronic controllers, throttle pedal collectors and motor controllers, wherein the throttle pedal collector is used to generate an input signal according to the collected throttle opening, and transmit the input signal to the multiple electronic controllers respectively; wherein each electronic controller is electrically connected to the throttle pedal collector and the motor controller respectively; the multiple electronic controllers are respectively used to receive the input signal transmitted by the throttle pedal collector, calculate the vehicle torque according to the throttle opening corresponding to the input signal, and generate a torque control instruction carrying the vehicle torque, and send the torque control instruction to the motor controller; the motor controller is used to receive the torque control instruction sent by at least one electronic controller among the multiple electronic controllers, and perform power control on the vehicle according to the torque control instruction. Compared with related technologies, the embodiments of the present disclosure use certain hardware redundancy, namely multiple electronic controllers, to upgrade the original power domain system that becomes non-working after failure to a power domain system that still has all or degraded functions after failure. In the event of a failure in a certain electronic controller, the vehicle still has power. While ensuring functional safety, the system availability is improved and the user experience of the vehicle is enhanced.

[0078] In one possible implementation of the embodiment of the present disclosure, the motor controller 24 receives the torque control instructions sent by the first electronic controller 21 and the second electronic controller 22 respectively, and responds to the torque control instruction sent by the first electronic controller 21 with a higher electronic controller priority to achieve power control of the vehicle.

[0079] In the embodiment of the present disclosure, the first electronic controller 21 and the second electronic controller 22 can be pre-configured as a master electronic controller and a backup electronic controller to determine the priority of executing the torque control command, for example: Figure 1 As shown, ECU1 (first electronic controller 21) serves as the main electronic controller and ECU2 (second electronic controller 22) serves as the backup electronic controller. The priority of ECU1 is higher than that of ECU2. When ECU1 and ECU2 generate torque control instructions at the same time, only the torque control instruction generated by ECU1 with a higher priority needs to be executed. When ECU1 fails, ECU1 actively reduces the priority of its own torque request CAN command or cuts off external CAN communication; at this time, the torque control instruction generated by ECU2 will be executed.

[0080] In one implementation of the embodiment of the present disclosure, the motor controller 24 receives the torque control instruction sent by the first electronic controller 21 or the second electronic controller 22 and responds to the torque control instruction to achieve power control of the vehicle.

[0081] In the embodiment of the present disclosure, if only one torque control instruction is received, that is, the torque control instruction sent by the first electronic controller 21 or the second electronic controller 22 respectively, it means that one of the first electronic controller 21 or the second electronic controller 22 has failed. At this time, it is only necessary to respond to the received torque control instruction to perform power control of the vehicle.

[0082] In one possible implementation of the embodiment of the present disclosure, in order to facilitate further understanding of the system of the embodiment of the present disclosure, the embodiment of the present disclosure also provides a schematic block diagram of another power domain safe operation system for comparative explanation, such as Figure 3 As shown, the accelerator pedal collector 23 includes: a first accelerator pedal collector 231 and a second accelerator pedal collector 232.

[0083] The first accelerator pedal collector 231 and the second accelerator pedal collector 232 are respectively used to generate the input signal according to the collected throttle opening, and transmit the input signal to the first electronic controller 21 and the second electronic controller 22 respectively.

[0084] In the embodiments of the present disclosure, Figure 3 The first accelerator pedal collector 231 corresponds to Figure 1 The accelerator pedal sensor 1 in Figure 3 The second accelerator pedal collector 232 corresponds to Figure 1 The accelerator pedal sensor 2 in the figure is a refinement of the accelerator pedal collector 23.

[0085] When the first electronic controller 21 and the second electronic controller 22 receive the input signals transmitted by the first accelerator pedal collector 231 or the second accelerator pedal collector 232, respectively, they calculate the vehicle torque according to the throttle opening corresponding to the input signals, generate a torque control command carrying the vehicle torque, and send the torque control command to the motor controller 24.

[0086] In the embodiment of the present disclosure, if only one input signal is received, that is, the first electronic controller 21 or the second electronic controller 22 receives the input signal transmitted by the first accelerator pedal collector 231 or the second accelerator pedal collector 232 respectively, it means that one of the first accelerator pedal collector 231 or the second accelerator pedal collector 232 has failed. At this time, it is only necessary to respond to the received input signal to calculate the vehicle torque.

[0087] If the first electronic controller 21 and the second electronic controller 22 respectively receive the input signals transmitted by the first accelerator pedal collector 231 and the second accelerator pedal collector 232, they respond to the input signal sent by the first accelerator pedal collector 231 with a higher accelerator pedal collector priority, calculate the vehicle torque, and generate a torque control instruction carrying the vehicle torque, and send the torque control instruction to the motor controller 24 respectively.

[0088] In the embodiment of the present disclosure, the first accelerator pedal collector 231 and the second accelerator pedal collector 232 may determine the priority of the input signal in a pre-configured manner, for example: Figure 1 As shown, the priority of the accelerator pedal sensor 1 (first accelerator pedal collector 231) is pre-configured to be higher than that of the accelerator pedal sensor 2 (second accelerator pedal collector 232). When the accelerator pedal sensor 1 and the accelerator pedal sensor 2 generate input signals at the same time, only the input signal generated by the accelerator pedal sensor 1 with a higher priority needs to be calculated. When the accelerator pedal sensor 1 fails, the input signal generated by the accelerator pedal sensor 2 will be calculated.

[0089] Therefore, setting up multiple accelerator pedal collectors can ensure that other accelerator pedal collectors, ECU1, ECU2, and motor controllers all work normally when a single accelerator pedal collector fails (including sensor failure and sensor power supply failure), so that the vehicle still has full power output capability.

[0090] In one possible implementation of the embodiment of the present disclosure, Figure 3 As shown, the motor controller 24 includes: a front motor controller 241 and a rear motor controller 242.

[0091] The front motor controller 241 and / or the rear motor controller 242 is configured to perform power control on the vehicle according to the torque control instruction.

[0092] In the embodiments of the present disclosure, Figure 3 The front motor controller 241 corresponds to Figure 1 MCUF in, Figure 3 The rear motor controller 242 corresponds to Figure 1 In the MCUR, under normal circumstances, the vehicle is powered by both MCUF and MCUR, ensuring that the vehicle has full power output capacity. When the vehicle is in an abnormal situation, that is, if one of the MCUF or MCUR fails, the other can operate normally, ensuring that the vehicle still has approximately half of the power output capacity. For example, the MCUF controls the two front wheels of the vehicle, and the MCUR controls the two rear wheels of the vehicle. Under normal circumstances, the vehicle is a four-wheel drive that can maintain full power output capacity. When the MCUF fails, the MCUR can still operate normally, and the vehicle is a two-wheel drive that still has approximately half of the power output capacity.

[0093] Therefore, MCUR and MCUF can work simultaneously or individually. When MCUF or MCUR fails, the vehicle can still have about half of its power output capacity, and the vehicle will not be forced to stop by coasting or braking.

[0094] In one possible implementation of the embodiment of the present disclosure, Figure 3 As shown, the first electronic controller 21 includes: a first power supply sensor 211, a second power supply sensor 212 and a limp mode circuit 213,

[0095] The first power supply sensor 211 is electrically connected to the first accelerator pedal collector 231 , and the second power supply sensor 212 is electrically connected to the second accelerator pedal collector 232 .

[0096] In the embodiments of the present disclosure, Figure 3 The first power supply sensor 211 corresponds to Figure 1 Sensor power supply 1, Figure 3 The second power supply sensor 212 corresponds to Figure 1 The sensor power supply 2 in the embodiment includes a first power supply sensor 211 for powering the first accelerator pedal collector 231 and a second power supply sensor 212 for powering the second accelerator pedal collector 232 to ensure the normal operation of the first accelerator pedal collector 231 and the second accelerator pedal collector 232.

[0097] Among them, setting up multiple power supply sensors can ensure that when one power supply sensor fails, the other power supply sensor and the corresponding accelerator pedal collector can work normally, so that the vehicle still has full power output capability.

[0098] The limp mode circuit 213 is electrically connected to the first power supply sensor 211 and the second power supply sensor 212 , respectively.

[0099] In the embodiments of the present disclosure, Figure 3 The limp mode circuit 213 corresponds to Figure 1 ③Sensor powered Limphome circuit in.

[0100] The limp mode circuit 213 is configured to provide an operating signal to the first power supply sensor 211 and the second power supply sensor 212 to control the operation of the first power supply sensor 211 and the second power supply sensor 212 when a fault occurs in the first electronic controller 21 .

[0101] In the embodiment of the present disclosure, Figure 1 As shown in the figure, when ECU1 fails (MCU failure, PMIC power supply failure, etc.), the ECU1 MCU is reset and the external CAN communication is cut off; the two accelerator pedal power supplies are kept output through the Limphome circuit, and the two accelerator pedal sensors, ECU2, MCUF, and MCUR still work normally, so that the vehicle still has full power output capability.

[0102] In one possible implementation of the embodiment of the present disclosure, Figure 3 As shown, the system further includes: a first power supply 25, a second power supply 26,

[0103] The first power supply 25 is electrically connected to the first power supply sensor 211 , the first electronic controller 21 and the front motor controller 241 , respectively, and supplies power to the first power supply sensor 211 , the first electronic controller 21 and the front motor controller 241 .

[0104] In the embodiments of the present disclosure, Figure 3 The first power supply 25 corresponds to Figure 1②12V power supply 1 in the dual 12V power supply.

[0105] The second power supply 26 is electrically connected to the second power supply sensor 212 , the second electronic controller 22 and the rear motor controller 242 , respectively, and supplies power to the second power supply sensor 212 , the second electronic controller 22 and the rear motor controller 242 .

[0106] In the embodiments of the present disclosure, Figure 3 The second power supply 26 corresponds to Figure 1 ②12V power supply 2 in the dual 12V power supply.

[0107] It should be noted that the provision of the first power supply 25 and the second power supply 26 can ensure that when one 12V power supply fails (eg power supply is lost), at least one power supply sensor + one ECU can work normally and continue to realize vehicle power output.

[0108] In summary, the power domain safe operation system of the embodiment of the present disclosure can have the effects shown in Table 1, wherein the single point failure points and the components corresponding to the system response in Table 1 are shown in Table 1. Figure 1 .

[0109] Table 1

[0110]

[0111] Figure 4 This is a flow chart of a method for safe operation of a power domain provided by an embodiment of the present disclosure. Figure 4 As shown, the method comprises the following steps:

[0112] Step 401: Acquire the throttle opening of the vehicle, and generate at least one input signal according to the throttle opening of the vehicle.

[0113] In the embodiment of the present disclosure, the throttle opening in the engine control system can control the power output by the engine. The throttle opening is adjusted by the angle of the accelerator pedal. The throttle opening ultimately determines the torque and power output of the engine. The larger the throttle opening, the higher the power output of the engine. The throttle opening can generate an input signal of the engine's torque and power output.

[0114] It should be noted that, due to hardware redundancy, there is at least one accelerator pedal sensor that responds to the accelerator opening and generates at least one input signal.

[0115] Step 402 : Calculate the vehicle torque according to the throttle opening corresponding to the input signal, and generate at least one torque control instruction carrying the vehicle torque.

[0116] In the embodiment of the present disclosure, when calculating the vehicle torque, the following steps are included but not limited to: throttle opening signal: when the driver steps on the accelerator pedal, the sensor detects the throttle opening and converts it into an electrical signal, which is sent to the ECU; power demand calculation: the ECU calculates the current power demand based on the throttle opening signal and other relevant inputs, such as vehicle speed, engine speed, vehicle load, etc.; engine characteristic analysis: the ECU also considers the current operating state of the engine, including its efficiency, combustion characteristics, emission limits, etc. This information helps the ECU determine how to best adjust the engine output to meet the power demand; torque calculation: based on the above information, the ECU calculates the torque value that the engine needs to generate.

[0117] It should be noted that, due to hardware redundancy, there will be at least one electronic controller that responds to the input signal and generates at least one torque control instruction that carries the vehicle torque.

[0118] Step 403: Perform power control on the vehicle according to the torque control instruction.

[0119] In the embodiment of the present disclosure, the power output of the vehicle can be controlled according to the torque carried by the torque control instruction.

[0120] The power domain safe operation method provided by the present disclosure mainly includes: multiple electronic controllers, throttle pedal collectors and motor controllers, the throttle pedal collectors are used to generate input signals according to the collected throttle openings, and transmit the input signals to the multiple electronic controllers respectively; wherein each electronic controller is electrically connected to the throttle pedal collector and the motor controller respectively; the multiple electronic controllers are used to receive the input signals transmitted by the throttle pedal collectors, calculate the vehicle torque according to the throttle openings corresponding to the input signals, and generate torque control instructions carrying the vehicle torque, and send the torque control instructions to the motor controller; the motor controller is used to receive the torque control instructions sent by at least one electronic controller among the multiple electronic controllers, and perform power control on the vehicle according to the torque control instructions. Compared with related technologies, the embodiments of the present disclosure use certain hardware redundancy, namely multiple electronic controllers, to upgrade the original power domain system that becomes non-working after failure to a power domain system that still has all or degraded functions after failure. In the event of a failure in a certain electronic controller, the vehicle still has power. While ensuring functional safety, the system availability is improved and the user experience of the vehicle is enhanced.

[0121] In one possible implementation of the embodiment of the present disclosure, since at least one input signal is generated, in order to ensure accurate identification of the input signal and avoid causing confusion in the power system, it can be implemented in the following manner but not limited to: obtaining the first identification information carried by the input signal and the number of the input signals; when the number of the input signals is greater than a preset threshold, determining the input signal with a higher priority through the first identification information, calculating the vehicle torque according to the throttle opening corresponding to the input signal with a higher priority, and generating at least one torque control instruction carrying the vehicle torque, the first identification information includes the priority information of the input signal; when the number of the input signals is less than or equal to the preset threshold, calculating the vehicle torque according to the throttle opening corresponding to the input signal, and generating at least one torque control instruction carrying the vehicle torque.

[0122] In the embodiment of the present disclosure, the preset threshold is a custom-set value, generally 1. When there is more than one input signal, it is necessary to determine the priority of the input signal. Specifically, for the implementation process of the embodiment of the present disclosure, please refer to the description in the above-mentioned power domain safety operation system, so it will not be repeated here.

[0123] In one possible implementation of the embodiment of the present disclosure, since at least one torque control instruction is generated, in order to ensure accurate identification of the torque control instruction and avoid causing confusion in the power system, it can be implemented in but not limited to the following manner: obtaining the second identification information carried by the torque control instruction and the number of the torque control instructions; when the number of the torque control instructions is greater than the preset threshold, determining the torque control instruction with a higher priority through the second identification information, and performing power control on the vehicle according to the torque control instruction with a higher priority, the second identification information includes the priority information of the torque control instruction; when the number of the torque control instructions is less than or equal to the preset threshold, performing power control on the vehicle according to the torque control instruction.

[0124] Specifically, regarding the implementation process of the embodiment of the present disclosure, please refer to the description in the above-mentioned power domain safe operation system, so it will not be repeated here.

[0125] Corresponding to the above-mentioned power domain safe operation method, the present invention also provides a power domain safe operation device. Since the device embodiment of the present invention corresponds to the above-mentioned method embodiment, details not disclosed in the device embodiment can be referred to the above-mentioned method embodiment and will not be repeated in this invention.

[0126] Figure 5 A schematic diagram of the structure of a power domain safety operation device provided by an embodiment of the present disclosure is shown as follows: Figure 5 As shown, including:

[0127] a generating unit 51 for acquiring a throttle opening of a vehicle and generating at least one input signal according to the throttle opening of the vehicle;

[0128] a generating unit 52 for calculating the vehicle torque according to the throttle opening corresponding to the input signal, and generating at least one torque control instruction carrying the vehicle torque;

[0129] The control unit 53 is configured to perform power control on the vehicle according to the torque control instruction.

[0130] The power domain safe operation device provided by the present disclosure has a main technical solution including: multiple electronic controllers, throttle pedal collectors and motor controllers, wherein the throttle pedal collector is used to generate an input signal according to the collected throttle opening, and transmit the input signal to the multiple electronic controllers respectively; wherein each electronic controller is electrically connected to the throttle pedal collector and the motor controller respectively; the multiple electronic controllers are respectively used to receive the input signal transmitted by the throttle pedal collector, calculate the vehicle torque according to the throttle opening corresponding to the input signal, and generate a torque control instruction carrying the vehicle torque, and send the torque control instruction to the motor controller; the motor controller is used to receive the torque control instruction sent by at least one electronic controller among the multiple electronic controllers, and perform power control on the vehicle according to the torque control instruction. Compared with related technologies, the embodiments of the present disclosure use certain hardware redundancy, namely multiple electronic controllers, to upgrade the original power domain system that becomes non-working after failure to a power domain system that still has all or degraded functions after failure. In the event of a failure in a certain electronic controller, the vehicle still has power. While ensuring functional safety, the system availability is improved and the user experience of the vehicle is enhanced.

[0131] Furthermore, in a possible implementation of the embodiment of the present disclosure, as Figure 6 As shown, the generating unit 52 includes:

[0132] An acquisition module 521 is configured to acquire the first identification information carried by the input signal and the number of the input signals;

[0133] a generating module 522 configured to, when the number of the input signals is greater than a preset threshold, determine an input signal with a higher priority based on the first identification information, calculate the vehicle torque based on the throttle opening corresponding to the input signal with the higher priority, and generate at least one torque control instruction carrying the vehicle torque, wherein the first identification information includes priority information of the input signal;

[0134] The generating module 522 is further configured to, when the number of the input signals is less than or equal to the preset threshold, calculate the vehicle torque according to the throttle opening corresponding to the input signals, and generate at least one torque control instruction carrying the vehicle torque.

[0135] Furthermore, in a possible implementation of the embodiment of the present disclosure, as Figure 6 As shown, the control unit 53 includes:

[0136] An acquisition module 531 is configured to acquire the second identification information carried by the torque control instruction and the number of the torque control instructions;

[0137] a control module 532 configured to, when the number of the torque control instructions is greater than the preset threshold, determine a torque control instruction with a higher priority based on the second identification information, and perform power control on the vehicle based on the torque control instruction with the higher priority, wherein the second identification information includes priority information of the torque control instructions;

[0138] The control module 532 is further configured to, when the number of the torque control instructions is less than or equal to the preset threshold, perform power control on the vehicle according to the torque control instructions.

[0139] It should be noted that the above explanation of the method embodiment is also applicable to the device of the embodiment of the present disclosure, and the principles are the same, which is no longer limited in the embodiment of the present disclosure.

[0140] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0141] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0142] like Figure 7As shown, the device 700 includes a computing unit 701, which can perform various appropriate actions and processes according to a computer program stored in a ROM (Read-Only Memory) 702 or a computer program loaded from a storage unit 708 into a RAM (Random Access Memory) 703. Various programs and data required for the operation of the device 700 can also be stored in the RAM 703. The computing unit 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An I / O (Input / Output) interface 705 is also connected to the bus 704.

[0143] Various components in device 700 are connected to I / O interface 705, including an input unit 706, such as a keyboard, mouse, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a magnetic disk, optical disk, etc.; and a communication unit 709, such as a network card, modem, wireless communication transceiver, etc. The communication unit 709 allows device 700 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0144] The computing unit 701 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a CPU (Central Processing Unit), a GPU (Graphic Processing Unit), various specialized AI (Artificial Intelligence) computing chips, various computing units that run machine learning model algorithms, a DSP (Digital Signal Processor), and any suitable processor, controller, microcontroller, etc. The computing unit 701 performs the various methods and processes described above, such as the power domain safe operation method. For example, in some embodiments, the power domain safe operation method can be implemented as a computer software program tangibly embodied in a machine-readable medium, such as the storage unit 708. In some embodiments, part or all of the computer program can be loaded and / or installed on the device 700 via the ROM 702 and / or the communication unit 709. When the computer program is loaded into the RAM 703 and executed by the computing unit 701, one or more steps of the method described above can be performed. Alternatively, in other embodiments, the computing unit 701 may be configured to execute the aforementioned power domain safe operation method in any other appropriate manner (for example, by means of firmware).

[0145] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, FPGAs (Field Programmable Gate Arrays), ASICs (Application-Specific Integrated Circuits), ASSPs (Application Specific Standard Products), SOCs (System on Chips), CPLDs (Complex Programmable Logic Devices), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special-purpose or general-purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0146] The program code for implementing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0147] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or apparatus. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any suitable combination of the foregoing. More specific examples of machine-readable storage media may include an electrical connection based on one or more wires, a portable computer disk, a hard disk, RAM, ROM, EPROM (Electrically Programmable Read-Only-Memory) or flash memory, optical fiber, CD-ROM (Compact Disc Read-Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0148] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (Cathode-Ray Tube) or LCD (Liquid Crystal Display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0149] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: LAN (Local Area Network), WAN (Wide Area Network), the Internet, and blockchain networks.

[0150] A computer system may include a client and a server. The client and server are generally remote from each other and typically interact via a communication network. This client-server relationship is established by computer programs running on the respective computers, establishing a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host, a host product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosts and VPS services ("Virtual Private Servers" or simply "VPS"). The server may also be a server in a distributed system or a server integrated with blockchain.

[0151] It's important to note that artificial intelligence (AI) is the study of how computers can simulate certain human thought processes and intelligent behaviors (such as learning, reasoning, thinking, and planning). This encompasses both hardware and software technologies. AI hardware technologies generally include sensors, specialized AI chips, cloud computing, distributed storage, and big data processing. AI software technologies primarily encompass computer vision, speech recognition, natural language processing, machine learning / deep learning, big data processing, and knowledge graphs.

[0152] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved. This is not limited herein.

[0153] The above specific embodiments do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure shall be included within the scope of protection of this disclosure.

Claims

1. A power domain safe operation system, characterized in that: include: Multiple electronic controllers, accelerator pedal collectors and motor controllers, The accelerator pedal collector is used to generate an input signal according to the collected throttle opening, and transmit the input signal to the multiple electronic controllers respectively; wherein each electronic controller is electrically connected to the accelerator pedal collector and the motor controller respectively; The multiple electronic controllers are respectively used to receive the input signal transmitted by the accelerator pedal collector, calculate the vehicle torque according to the throttle opening corresponding to the input signal, generate a torque control instruction carrying the vehicle torque, and send the torque control instruction to the motor controller; The motor controller is configured to receive the torque control instruction sent by at least one electronic controller among the plurality of electronic controllers, and perform power control on the vehicle according to the torque control instruction.

2. The system according to claim 1, wherein: The motor controller is configured to receive the torque control instructions respectively sent by the multiple electronic controllers and respond to the torque control instruction sent by the electronic controller with a higher priority among the multiple electronic controllers to achieve power control of the vehicle; or The motor controller is configured to receive the torque control instruction sent by any electronic controller among the multiple electronic controllers and respond to the torque control instruction sent by any electronic controller to achieve power control of the vehicle.

3. The system according to claim 1, wherein: The accelerator pedal collector includes: a first accelerator pedal collector and a second accelerator pedal collector, The first accelerator pedal collector and the second accelerator pedal collector are respectively used to generate the input signal according to the collected throttle opening, and transmit the input signal to the multiple electronic controllers respectively; If the plurality of electronic controllers respectively receive the input signals transmitted by the first accelerator pedal collector or the second accelerator pedal collector, they calculate the vehicle torque according to the throttle opening corresponding to the input signals, generate a torque control instruction carrying the vehicle torque, and send the torque control instruction to the motor controllers respectively; If the multiple electronic controllers respectively receive the input signals transmitted by the first accelerator pedal collector and the second accelerator pedal collector, they respond to the input signal sent by the first accelerator pedal collector with a higher priority, calculate the vehicle torque, and generate a torque control instruction carrying the vehicle torque, and send the torque control instruction to the motor controller respectively.

4. The system according to claim 3, characterized in that The plurality of electronic controllers include at least a first electronic controller, the first electronic controller including: a first power supply sensor, a second power supply sensor and a limp mode circuit, The first power supply sensor is electrically connected to the first accelerator pedal collector, and the second power supply sensor is electrically connected to the second accelerator pedal collector; The limp mode circuit is electrically connected to the first power supply sensor and the second power supply sensor respectively; The limp home mode circuit is used to provide an operating signal to the first power supply sensor and the second power supply sensor when a failure occurs in the first electronic controller, so as to control the operation of the first power supply sensor and the second power supply sensor.

5. The system according to claim 4, characterized in that The system further includes: a first power supply, a second power supply, The first power supply is electrically connected to the first power supply sensor and the plurality of electronic controllers respectively, and supplies power to the first power supply sensor and the plurality of electronic controllers; The second power supply is electrically connected to the second power supply sensor and the plurality of electronic controllers, respectively, and supplies power to the second power supply sensor and the plurality of electronic controllers.

6. A method for safe operation of a power domain, said method being applied to the system according to any one of claims 1 to 5, characterized in that: include: Obtaining a throttle opening of a vehicle, and generating at least one input signal according to the throttle opening of the vehicle; Calculating vehicle torque according to the throttle opening corresponding to the input signal, and generating at least one torque control instruction carrying the vehicle torque; The vehicle is powered by a motor according to the torque control command.

7. The method according to claim 6, characterized in that The calculating the vehicle torque according to the throttle opening corresponding to the input signal and generating at least one torque control instruction carrying the vehicle torque includes: Acquire the first identification information carried by the input signal and the number of the input signals; When the number of the input signals is greater than a preset threshold, determining an input signal with a higher priority based on the first identification information, calculating the vehicle torque based on the throttle opening corresponding to the input signal with the higher priority, and generating at least one torque control instruction carrying the vehicle torque, wherein the first identification information includes priority information of the input signal; When the number of the input signals is less than or equal to the preset threshold, the vehicle torque is calculated according to the throttle opening corresponding to the input signals, and at least one torque control instruction carrying the vehicle torque is generated.

8. The method according to claim 6, characterized in that The performing power control on the vehicle according to the torque control instruction includes: Acquire the second identification information carried by the torque control instruction and the number of the torque control instructions; When the number of the torque control instructions is greater than the preset threshold, determining a torque control instruction with a higher priority based on the second identification information, and performing power control on the vehicle based on the torque control instruction with the higher priority, the second identification information including priority information of the torque control instructions; When the number of the torque control instructions is less than or equal to the preset threshold, the vehicle is powered and controlled according to the torque control instructions.

9. A power domain safe operation device, the device being applied to the system according to any one of claims 1 to 5, characterized in that: include: a generating unit, configured to obtain a throttle opening of a vehicle and generate at least one input signal according to the throttle opening of the vehicle; a generating unit, configured to calculate a vehicle torque according to the throttle opening corresponding to the input signal, and generate at least one torque control instruction carrying the vehicle torque; A control unit is used to perform power control on the vehicle according to the torque control instruction.

10. A vehicle, characterized in that: The vehicle includes the power domain safe operation system according to any one of claims 1 to 5 or the power domain safe operation device according to claim 9.

Images