Vehicle-mounted control system based on double-controller architecture

Abstract

The invention relates to the field of vehicle-mounted control systems, in particular to a vehicle-mounted control system based on a double-controller architecture, which comprises a control module, an expansion module, a power supply module, a communication self-checking module and a fault-tolerant decision execution module, and is characterized in that the control module comprises a master control unit and a slave control unit, and the expansion module provides a plurality of expandable interfaces; the power supply module can carry out power supply protection, the communication self-checking module can judge whether communication is overtime based on communication data and execute multi-dimensional fault feature combined diagnosis, and the fault-tolerant decision execution module can adjust transmission of the control module. And the working stability under severe conditions is improved.

Description

Technical Field

[0001] The present invention relates to the field of vehicle-mounted control systems, and in particular to a vehicle-mounted control system based on a dual-controller architecture. Background Art

[0002] With the development of the automotive industry, cars have become a daily necessity. As cars continue to become more intelligent and connected, the traditional distributed electronic and electrical architecture centered around microcontrollers is no longer able to meet the development needs of future automotive products. This has led to the emergence of domain-controlled and central domain-controlled electronic and electrical architectures.

[0003] For example, Chinese patent publication number CN205121333U provides an AGV on-board control system, which includes a main control unit, a digital input / output (IO) port control unit, and a drive and navigation control unit. The digital input / output (IO) port control unit and the drive and navigation control unit are all connected to the main control unit via a CAN bus. The main control unit includes an ARM microprocessor, a CAN bus communication module, an external IO device interface module, an RFID information acquisition module, a human-machine interface module, and a communication module. The drive and navigation control unit includes a DSP processor, a CAN bus communication module, and a wheel drive control module. The digital input / output (IO) port control unit also includes a DSP processor, a CAN bus communication module, and an external IO device interface module.

[0004] However, the prior art still has the following problems:

[0005] The insufficient hardware functions of a single controller result in problems such as low system redundancy, poor working stability under harsh working conditions, and a single communication interface. Summary of the Invention

[0006] In view of this, the purpose of the present invention is to provide a vehicle-mounted control system based on a dual-controller architecture. The dual-controller design improves the system redundancy of the vehicle-mounted control system, improves the working stability under harsh conditions, and provides multiple types of communication interfaces.

[0007] The vehicle-mounted control system based on the dual-controller architecture provided by the present invention includes:

[0008] The control module includes a master control unit and a slave control unit; the master control unit is connected to the corresponding ECU units to drive the operation of each ECU unit; the slave control unit is connected to the master control unit and responds to the start signal sent by the master control module to control the remaining ECU units;

[0009] an expansion module comprising a plurality of expandable interfaces connected to the control module;

[0010] The power supply module is used to supply power to the system, analyze input current data in real time, and perform protection based on the analysis results;

[0011] a communication self-test module connected to the main control module, configured to obtain communication data between the control module and the corresponding ECU unit, determine whether the communication with the main control module has timed out based on the communication data, and perform a retest verification, and determine whether to perform a multi-dimensional fault feature joint diagnosis based on the result of the retest verification;

[0012] A fault-tolerant decision execution module is connected to the communication self-checking module and is used to adjust the transmission of the control module based on the diagnosis result of the multi-dimensional fault feature joint diagnosis.

[0013] Furthermore, the expansion module includes: an input unit, a DC PWM output unit, and a closed-loop feedback PWM output unit;

[0014] Among them, the input unit is connected to the main control unit and the slave control unit respectively, and is used to transmit digital signals and analog signals to the main control unit and the slave control unit; the DC PWM output unit is connected to the slave control unit, and outputs a DC PWM signal based on the output instruction of the slave control unit; the closed-loop feedback PWM output unit is connected to the main control unit, and outputs a PWM signal based on the instruction of the main control unit.

[0015] Furthermore, the communication self-check module determines whether the control module communication has timed out based on the communication data, including:

[0016] If the communication delay between the control module and the corresponding ECU unit exceeds a predetermined delay threshold, it is determined that the control module communication has timed out, and a retest verification is performed.

[0017] Furthermore, the communication self-test module performs retest verification including:

[0018] Restarting the communication between the control module and the ECU unit, determining whether the communication of the control module has timed out, and if so, restarting the communication between the main control module and the ECU unit after a retry interval, and performing a multi-dimensional fault feature joint diagnosis if the number of restarts reaches a predetermined restart threshold;

[0019] The retry interval increases gradually, the increment is positively correlated with the number of timeouts, and the maximum number of restarts is less than a predetermined restart threshold.

[0020] Furthermore, the multi-dimensional fault feature joint diagnosis includes time domain dimension diagnosis, environment correlation dimension diagnosis and topology verification dimension diagnosis.

[0021] The time domain dimension diagnosis includes counting the frequency of communication timeout events within a preset time window through a sliding window algorithm;

[0022] The environment-related dimension diagnosis includes detecting the communication bus load rate, power supply voltage fluctuation value and ECU temperature sensor data;

[0023] The topology verification diagnosis includes checking the communication status of sensor nodes having a relationship with the target ECU in real time.

[0024] Furthermore, the fault-tolerant decision execution module receives the diagnosis result obtained by the communication self-test module, analyzes the diagnosis result and then executes a preset fault-tolerant decision, including:

[0025] If the diagnostic result shows that the bus load rate is greater than a preset load threshold and the voltage fluctuation exceeds a preset maximum fluctuation threshold, compressing the data transmitted by the control module;

[0026] If the diagnosis result shows that the gateway node fails, switching to an alternative communication path and reconstructing the message routing table;

[0027] If the diagnosis result shows that a non-safety-critical ECU has a fault, the imp-home mode is activated to retain the basic functional communication channel between the control module and the safety-critical ECU.

[0028] Furthermore, it is characterized in that the closed-loop feedback PWM output unit can monitor the PWM signal in real time and transmit it to the main control unit, so that the main control unit uses a PID control method to dynamically adjust the PWM signal.

[0029] Furthermore, it is characterized in that the power supply module is used to analyze input current data in real time and perform protection based on the analysis results, including:

[0030] Used to obtain input current data, including current and voltage;

[0031] If the voltage is detected to be out of the preset voltage range, the current cut-off protection is triggered;

[0032] If reverse current or short circuit is detected, the current cut-off protection is triggered;

[0033] If it is detected that the circuit fault is resolved, the power supply is restarted.

[0034] Furthermore, it is characterized in that the master control unit and the slave control unit are connected using an encrypted communication protocol, and the encrypted communication protocol adds a check bit to the data packet header to ensure the stability of communication.

[0035] Furthermore, the control module is connected to the corresponding ECU unit using CAN communication.

[0036] Compared with the prior art, the beneficial effects of the present invention are that, through the dual-controller design, the system redundancy of the vehicle control system is improved, the working stability under harsh conditions is improved, and multiple types of communication interfaces are provided.

[0037] In particular, when the present invention is applied to extreme working scenarios such as heavy-loaded mining trucks, the trucks have to bear tens of tons of load when transporting ore, and frequently start and stop, climb and descend, and are in a harsh environment with high dust, high humidity, severe vibration, and extreme temperature. The dual control architecture improves system redundancy and improves driving safety.

[0038] In particular, the communication self-check module and the fault-tolerant decision execution module of the present invention can monitor each vehicle ECU and each vehicle communication connection in real time and correct errors in a timely manner, thereby quickly resolving potential hidden dangers that affect driving safety.

[0039] In particular, the power supply module described in the present invention has a power protection function and has preset processing solutions for faults such as overvoltage, undervoltage, and reverse connection, thereby avoiding damage to the entire vehicle control system due to current and voltage fluctuations, and further improving system reliability. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A schematic structural diagram of a vehicle control system based on a dual-controller architecture according to an embodiment of the invention;

[0041] Figure 2 A logic block diagram of a communication self-check module determining whether communication with a control module has timed out according to an embodiment of the invention;

[0042] Figure 3 A logic block diagram of a communication self-test module performing retest verification according to an embodiment of the invention;

[0043] Figure 4 This is a logic block diagram of voltage detection of a power supply module according to an embodiment of the invention. DETAILED DESCRIPTION

[0044] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are merely used to explain the present invention and are not intended to limit the present invention.

[0045] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0046] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside", and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the accompanying drawings. This is only for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0047] Furthermore, it should be noted that, in the description of the present invention, unless otherwise expressly specified or limited, the terms "mounted," "connected," and "connected" should be understood in a broad sense. For example, they may refer to fixed connections, detachable connections, or integral connections; mechanical connections or electrical connections; direct connections or indirect connections through an intermediate medium; and internal communication between two components. Those skilled in the art will understand the specific meanings of the above terms in the present invention based on specific circumstances.

[0048] See also Figure 1 , Figure 1 This is a schematic diagram of the structure of an on-board control system based on a dual-controller architecture according to an embodiment of the invention. The on-board control system based on a dual-controller architecture provided by the embodiment of the invention includes:

[0049] The control module includes a master control unit and a slave control unit; the master control unit is connected to the corresponding ECU units to drive the operation of each ECU unit; the slave control unit is connected to the master control unit and responds to the start signal sent by the master control module to control the remaining ECU units;

[0050] an expansion module comprising a plurality of expandable interfaces connected to the control module;

[0051] The power supply module is used to supply power to the MCS system, analyze input current data in real time, and perform protection based on the analysis results;

[0052] a communication self-test module connected to the main control module, configured to obtain communication data between the control module and the corresponding ECU unit, determine whether the communication with the main control module has timed out based on the communication data, and perform a retest verification, and determine whether to perform a multi-dimensional fault feature joint diagnosis based on the result of the retest verification;

[0053] A fault-tolerant decision execution module is connected to the communication self-checking module and is used to adjust the transmission of the control module based on the diagnosis result of the multi-dimensional fault feature joint diagnosis.

[0054] Specifically, the expansion module includes: an input unit, a DC PWM output unit, and a closed-loop feedback PWM output unit;

[0055] Among them, the input unit is connected to the main control unit and the slave control unit respectively, and is used to transmit digital signals and analog signals to the main control unit and the slave control unit; the DC PWM output unit is connected to the slave control unit, and outputs a DC PWM signal based on the output instruction of the slave control unit; the closed-loop feedback PWM output unit is connected to the main control unit, and outputs a PWM signal based on the instruction of the main control unit.

[0056] In some possible implementations: the input unit may include CAN, LIN, RS485, RS232, UART, SPI basic communication interfaces.

[0057] Specifically, the master control unit and the slave control unit are implemented by the MCS system.

[0058] Specifically, the communication self-check module determines whether the control module communication has timed out based on the communication data, including:

[0059] If the communication delay between the control module and the corresponding ECU unit exceeds a predetermined delay threshold, it is determined that the control module communication has timed out, and a retest verification is performed, such as Figure 2 FIG2 is a logic block diagram of a communication self-test module according to an embodiment of the present invention for determining whether communication with a control module has timed out.

[0060] Specifically, the communication self-test module performs retest verification including:

[0061] Restarting the communication between the control module and the ECU unit, determining whether the communication of the control module has timed out, and if so, restarting the communication between the main control module and the ECU unit after a retry interval, and performing a multi-dimensional fault feature joint diagnosis if the number of restarts reaches a predetermined restart threshold;

[0062] Among them, the retry interval increases gradually, the increment is positively correlated with the number of timeouts, and the maximum number of restarts is less than the predetermined restart threshold. Figure 3 FIG. 1 is a logic block diagram of a communication self-test module executing a retest verification according to an embodiment of the present invention.

[0063] In some possible implementations, the retry interval is dynamically adjusted based on an exponential backoff algorithm, with an initial interval of 50ms. After each failure, the interval increases by 2^n times until the maximum retry threshold of 5 times is reached.

[0064] Specifically, the multi-dimensional fault feature joint diagnosis includes time domain dimension diagnosis, environment correlation dimension diagnosis and topology verification dimension diagnosis.

[0065] The time domain dimension diagnosis includes counting the frequency of communication timeout events within a preset time window through a sliding window algorithm;

[0066] The environment-related dimension diagnosis includes detecting the communication bus load rate, power supply voltage fluctuation value and ECU temperature sensor data;

[0067] The topology verification diagnosis includes checking the communication status of sensor nodes having a relationship with the target ECU in real time.

[0068] Specifically, the fault-tolerant decision execution module receives the diagnosis result obtained by the communication self-test module, analyzes the diagnosis result and then executes a preset fault-tolerant decision, including:

[0069] If the diagnosis result shows that the bus load rate is greater than a preset bus load threshold and the voltage fluctuation exceeds a preset voltage maximum fluctuation threshold, data compression is performed on the control module transmission;

[0070] If the diagnosis result shows that the gateway node fails, switching to an alternative communication path and reconstructing the message routing table;

[0071] If the diagnosis result shows that a non-safety-critical ECU has a fault, the imp-home mode is activated to retain the basic functional communication channel between the control module and the safety-critical ECU.

[0072] In implementation, the purpose of setting the load threshold is to characterize situations with higher loads. To ensure diagnostic sensitivity, the preset bus load threshold is set to 85%. Similarly, the purpose of setting the preset maximum voltage fluctuation threshold is to characterize situations with larger voltage fluctuations. Generally, voltage fluctuations exceeding 15% may cause damage to the system's electrical components. Therefore, the preset maximum fluctuation threshold is set to 15%.

[0073] Specifically, it is characterized in that the closed-loop feedback PWM output unit can monitor the PWM signal in real time and transmit it to the main control unit, so that the main control unit uses a PID control method to dynamically adjust the PWM signal.

[0074] Specifically, it is characterized in that the power supply module is used to analyze input current data in real time and perform protection based on the analysis results, including:

[0075] Used to obtain input current data, including current and voltage;

[0076] If the voltage is detected to be out of the preset voltage range, the current cut-off protection is triggered;

[0077] If reverse current or short circuit is detected, the current cut-off protection is triggered;

[0078] If it is detected that the circuit fault is resolved, the power supply will be restarted. Figure 4 Shown is a logic block diagram of voltage detection of a power supply module according to an embodiment of the invention.

[0079] Specifically, it is characterized in that the master control unit and the slave control unit are connected using an encrypted communication protocol, and the encrypted communication protocol adds a check bit to the data packet header to ensure the stability of communication.

[0080] Specifically, the control module is connected to the corresponding ECU unit using CAN communication.

[0081] In some possible implementations, the main control unit receives the engine speed and battery SOC signals via CAN communication, and controls the PWM interface to drive the motor to perform corresponding actions;

[0082] In some possible implementations, the main control unit uses domestically produced GD32 series chips to process digital signals to achieve high-precision signal processing and multi-task scheduling;

[0083] Specifically, the control module has a multifunctional interface, which is used to supply power to the control module and transmit data signals.

[0084] In some possible implementations, the pins are shown in Table 1.

[0085] Table 1: Multi-function interface pin description

[0086]

[0087]

[0088]

[0089]

[0090] Thus far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art may make equivalent changes or substitutions to the relevant technical features, and the technical solutions after such changes or substitutions will fall within the scope of protection of the present invention.

Claims

1. A vehicle-mounted control system based on a dual-controller architecture, characterized in that: include: A control module comprising a master control unit and a slave control unit; the master control unit is connected to a plurality of corresponding ECU units to drive the operation of each of the ECU units; The slave control unit is connected to the master control unit and is used to control the remaining ECU units in response to the start signal sent by the master control module; an expansion module comprising a plurality of expandable interfaces connected to the control module; The power supply module is used to supply power to the system, analyze input current data in real time, and perform protection based on the analysis results; a communication self-test module connected to the main control module, configured to obtain communication data between the control module and the corresponding ECU unit, determine whether the communication with the main control module has timed out based on the communication data, and perform a retest verification, and determine whether to perform a multi-dimensional fault feature joint diagnosis based on the result of the retest verification; A fault-tolerant decision execution module is connected to the communication self-checking module and is used to adjust the transmission of the control module based on the diagnosis result of the multi-dimensional fault feature joint diagnosis.

2. The vehicle-mounted control system based on a dual-controller architecture according to claim 1, characterized in that: The expansion module includes: an input unit, a DC PWM output unit, and a closed-loop feedback PWM output unit; Among them, the input unit is connected to the main control unit and the slave control unit respectively, and is used to transmit digital signals and analog signals to the main control unit and the slave control unit; the DC PWM output unit is connected to the slave control unit, and outputs a DC PWM signal based on the output instruction of the slave control unit; the closed-loop feedback PWM output unit is connected to the main control unit, and outputs a PWM signal based on the instruction of the main control unit.

3. The vehicle-mounted control system based on a dual-controller architecture according to claim 1, characterized in that: The communication self-check module determines whether the control module communication has timed out based on the communication data, including: If the communication delay between the control module and the corresponding ECU unit exceeds a predetermined delay threshold, it is determined that the control module communication has timed out, and a retest verification is performed.

4. The vehicle-mounted control system based on a dual-controller architecture according to claim 3, characterized in that: The communication self-test module performs retest verification including: Restarting the communication between the control module and the ECU unit, determining whether the communication of the control module has timed out, and if so, restarting the communication between the main control module and the ECU unit after a retry interval, and performing a multi-dimensional fault feature joint diagnosis if the number of restarts reaches a predetermined restart threshold; The retry interval increases gradually, the increment is positively correlated with the number of timeouts, and the maximum number of restarts is less than a predetermined restart threshold.

5. The vehicle-mounted control system based on a dual-controller architecture according to claim 1, characterized in that: The multi-dimensional fault feature joint diagnosis includes time domain dimension diagnosis, environment correlation dimension diagnosis and topology verification dimension diagnosis. The time domain dimension diagnosis includes counting the frequency of communication timeout events within a preset time window through a sliding window algorithm; The environment-related dimension diagnosis includes detecting the communication bus load rate, power supply voltage fluctuation value and ECU temperature sensor data; The topology verification diagnosis includes checking the communication status of sensor nodes having a relationship with the target ECU in real time.

6. The vehicle-mounted control system based on a dual-controller architecture according to claim 1 is characterized in that The fault-tolerant decision execution module receives the diagnosis result obtained by the communication self-test module, analyzes the diagnosis result and then executes the preset fault-tolerant decision. include, If the diagnostic result shows that the bus load rate is greater than a preset load threshold and the voltage fluctuation exceeds a preset maximum fluctuation threshold, compressing the data transmitted by the control module; If the diagnosis result shows that the gateway node fails, switching to an alternative communication path and reconstructing the message routing table; If the diagnosis result shows that a non-safety-critical ECU has a fault, the imp-home mode is activated to retain the basic functional communication channel between the control module and the safety-critical ECU.

7. The vehicle-mounted control system based on a dual-controller architecture according to claim 3 is characterized in that The closed-loop feedback PWM output unit can monitor the PWM signal in real time and transmit it to the main control unit, so that the main control unit dynamically adjusts the PWM signal using a PID control method.

8. The vehicle-mounted control system based on a dual-controller architecture according to claim 1 is characterized in that The power supply module is used to analyze input current data in real time and perform protection based on the analysis results, including: Used to obtain input current data, including current and voltage; If the voltage is detected to be out of the preset voltage range, the current cut-off protection is triggered; If reverse current or short circuit is detected, the current cut-off protection is triggered; If it is detected that the circuit fault is resolved, the power supply is restarted.

9. The vehicle-mounted control system based on a dual-controller architecture according to claim 1 is characterized in that The master control unit and the slave control unit are connected using an encrypted communication protocol, which adds a check bit to the data packet header to ensure the stability of communication.

10. The vehicle-mounted control system based on a dual-controller architecture according to claim 1, characterized in that: The control module is connected to the corresponding ECU unit using CAN communication.

Images