Multi-module cooperative safe power supply control method, control system and medium thereof

Abstract

The invention discloses a multi-module collaborative safe power supply control method and system and a medium thereof, and relates to the technical field of motorcycle control, and the method comprises a motorcycle intelligent domain controller applied to a plurality of functional sub-modules; the method comprises the following steps: actively polling a register and a state interface of each functional sub-module, and monitoring a network communication bus and an internal event bus; acquiring running state data and environment context data to obtain a global real-time state list; constructing a multi-dimensional risk assessment matrix based on the global real-time state list; determining a cooperative control strategy according to the multi-dimensional risk assessment matrix, executing the cooperative control strategy, and monitoring a risk suppression effect; if the risk suppression effect does not reach the preset safety standard, a multi-mode intervention plan including power supply cooperation and task migration is started, and self-adaptive safety control is formed. According to the invention, the multi-dimensional operation risk and the power hierarchical architecture are deeply fused, and efficient safety response is realized.

Description

Technical Field

[0001] This application relates to the field of motorcycle control technology, and in particular to a multi-module collaborative safe power supply control method, control system and its medium. Background Technology

[0002] As the intelligence level of electric motorcycles continues to improve, domain controllers are gradually integrating various functional sub-modules such as power control, chassis stability, intelligent sensing, and energy management, forming a highly coupled electronic and electrical architecture. To ensure reliable operation of the system under complex working conditions, existing technologies typically employ a hierarchical power supply design. For example, high-reliability power chips power the core computing unit, while lower-level power chips power peripheral devices such as entertainment and lighting.

[0003] However, current power management strategies are mostly static configurations, meaning that the power distribution relationship is fixed when the system starts up and cannot be dynamically adjusted according to the real-time operating status of the vehicle.

[0004] Furthermore, although some intelligent domain controllers have introduced risk assessment mechanisms based on operational status and adjusted the task priorities of functional submodules accordingly, their risk response measures are limited to software-level scheduling of computing resources and do not consider the impact of the power supply architecture on the system's safety status. In actual operation, even if high-risk events have been identified, non-critical peripheral modules (such as infotainment and ambient lighting) continue to be powered by independent power channels, resulting in the inability to dynamically optimize the vehicle's power consumption. When the system simultaneously encounters multiple pressures such as abnormal battery temperature rise and vehicle dynamic instability, the fixed power supply topology cannot coordinate with risk control strategies to redistribute energy. This may not only delay the execution of critical control commands but also trigger protective shutdown due to power overload, further weakening the vehicle's safety redundancy.

[0005] In summary, existing technologies have significant shortcomings: they lack a dynamic collaborative control mechanism that can deeply integrate multi-dimensional operational risks with a power supply hierarchy architecture. Therefore, there is an urgent need to propose a novel multi-module collaborative safe power supply control method to overcome the aforementioned technical bottlenecks. Summary of the Invention

[0006] To overcome the shortcomings of existing technologies and provide a dynamic collaborative control mechanism that can deeply integrate multi-dimensional operational risks with power supply hierarchical architecture to achieve efficient safety response, this application provides a multi-module collaborative safety power supply control method, control system and its medium.

[0007] Firstly, the objective of this invention is achieved through the following technical solution: A multi-module collaborative safe power supply control method is applied to a motorcycle intelligent domain controller with multiple functional sub-modules; the functional sub-modules include a power domain sub-module, a chassis domain sub-module, an intelligent domain sub-module, and a power management sub-module; wherein, the power management sub-module includes a high-safety-level power chip and a low-safety-level power chip; the method includes: By actively polling the registers and status interfaces of each functional submodule and monitoring the network communication bus and internal event bus, running status data and environmental context data are collected to obtain a real-time status list for the entire domain. Based on the aforementioned real-time status list, a multi-dimensional risk assessment matrix is ​​constructed; Based on the multi-dimensional risk assessment matrix, a collaborative control strategy is determined, which includes a functional module scheduling strategy and a power supply control strategy. The functional module scheduling strategy is configured as follows: the affected critical tasks are migrated from the original processing unit to the target processing unit powered by the high-security-level power chip; the power supply control strategy is configured as follows: when the real-time risk score corresponding to any risk dimension exceeds a preset threshold, the power supply of the low-security-level power chip to non-critical loads is limited or cut off, and the affected critical tasks are migrated to the processing unit powered by the high-security-level power chip. The collaborative control strategy is executed, and the risk suppression effect is monitored. If the risk suppression effect does not meet the preset safety standard, a multimodal intervention plan including power supply coordination and task migration is activated to form adaptive safety control.

[0008] By adopting the above technical solution, high-safety-level power chips are used to power the core processing module and safety-critical sub-modules, while low-safety-level power chips are used to power non-safety-critical peripheral functional modules. The risk dimensions of the multi-dimensional risk assessment matrix include emission exceeding risk, driving instability risk, system downtime risk, and battery thermal runaway risk. Specifically, in order to improve the system's survivability under high-risk conditions and achieve dynamic coupling between power supply strategy and vehicle safety risks, this invention constructs a multi-dimensional risk assessment matrix and uses real-time risk scores as trigger conditions for power supply control. This allows low-safety-level power chips to be actively current-limited or disconnected at the initial stage of risk emergence, thereby preventing non-critical loads from continuously consuming power. Simultaneously, to effectively block risk propagation paths and prevent local faults from evolving into systemic collapse, when any risk dimension exceeds a preset threshold, not only is the low-safety-level power output cut off, but the affected critical tasks are also simultaneously migrated to the processing unit powered by the high-safety-level power chip. This collaborative control method suppresses risk deterioration from the energy source, enhancing the overall robustness of the motorcycle intelligent domain controller. Furthermore, to improve the accuracy and timeliness of risk intervention... The risk assessment matrix, built upon a real-time status inventory, comprehensively reflects the vehicle-human-vehicle-environment interaction status. Based on this, the determined collaborative control strategy can dynamically adapt to different risk scenarios. After execution, monitoring the risk mitigation effect further triggers multimodal intervention plans, ensuring that safety intervention measures match the actual risk level. Because non-critical loads (such as entertainment and ambient lighting) with low-safety-level power supplies are only restricted when risks exceed limits, while allowing full-function operation under normal conditions, the balance between vehicle energy efficiency and functional availability is optimized.

[0009] In a preferred embodiment of this application, the method further includes, prior to constructing the multi-dimensional risk assessment matrix: Receive input risk assessment rule configuration instructions, which define risk assessment factors, weight coefficients, and dynamic threshold adjustment strategies for each risk dimension; Based on the risk assessment rule configuration instructions, initialize the risk assessment engine and associate it with the corresponding real-time data stream channel; The configured risk assessment rules are solidified into an executable risk assessment template; The risk assessment factors include air-fuel ratio deviation, vehicle yaw rate, ECU temperature change rate, and individual battery cell voltage difference.

[0010] By adopting the above technical solution, risk assessment factors, weights, and dynamic threshold strategies for each risk dimension are defined, and the risk assessment engine is initialized and solidified into an executable template, giving the risk assessment system high flexibility and scenario adaptability. Users can dynamically adjust risk sensitivity according to different vehicle models, regional regulations, or driving modes, avoiding misjudgments or omissions caused by fixed rules.

[0011] In a preferred embodiment of this application, the construction of the multi-dimensional risk assessment matrix includes: The collected raw data is filtered to remove noise and outliers to obtain preprocessed data; The continuous variables in the preprocessed data are discretized into risk level intervals, and the categorical variables are mapped into risk contribution weights. Based on the sliding time window, the short-term trend slope of each risk assessment factor is calculated; The fuzzy comprehensive evaluation method is adopted to integrate the static risk value with the dynamic trend term corresponding to the short-term trend slope, and output the real-time risk score of each risk dimension. Based on preset weights, the real-time risk scores of each risk dimension are weighted and synthesized into a comprehensive risk index for the entire domain.

[0012] By adopting the above technical solutions, continuous variables are discretized and categorical variables are weighted and mapped to unify the expression of multi-source heterogeneous data; the trend slope is calculated by combining a sliding window to capture the dynamic evolution characteristics of risk; and the static risk value and dynamic trend term are integrated by using the fuzzy comprehensive evaluation method to output real-time scores for each dimension and synthesize a comprehensive risk index for the entire domain. Thus, the risk assessment of the constructed multi-dimensional risk assessment matrix takes into account both the instantaneous state and development trend of risk.

[0013] In a preferred embodiment of this application: the risk dimensions of the multi-dimensional risk assessment matrix include emission exceedance risk, driving instability risk, system shutdown risk, and battery thermal runaway risk; the execution of the coordinated control strategy includes at least one of the following linked operations: When the real-time risk score corresponding to the emission exceedance risk exceeds the first threshold, the CPU utilization rate of the central processing unit of the power domain submodule is increased, and the power supply of the low-security-level power chip to the entertainment or lighting function unit in the intelligent domain submodule is turned off. When the real-time risk score corresponding to the driving instability risk exceeds the second threshold, the chassis domain submodule temporarily takes over the control of the steering subsystem and braking subsystem, reduces the motor output torque, and prohibits the supply of power to unnecessary actuators in the chassis domain submodule through the low safety level power chip. When the real-time risk score corresponding to the system downtime risk exceeds the third threshold, the redundant communication link is activated, the critical task is migrated to the backup processing core, and all power supply to the low-security-level power chip is cut off to reduce the system load. When the real-time risk score corresponding to the battery thermal runaway risk exceeds the fourth threshold, the power domain submodule cuts off the fast charging circuit, starts the liquid cooling pump, triggers a cloud-based early warning command, and only retains the power supply of the high-safety-level power chip to the safety-critical submodule.

[0014] By adopting the above technical solutions, typical risks such as emission exceeding standards, driving instability, system downtime, and battery thermal runaway are mapped to specific domains such as the power domain and chassis domain, and refined linkage control is implemented: for example, when driving instability occurs, the chassis domain takes over steering / braking and cuts off power to unnecessary actuators; when thermal runaway occurs, the power domain starts liquid cooling and maintains a high-safety power supply; thus significantly improving the targeting of intervention.

[0015] In a preferred embodiment of this application, the method further includes: A dual-branch collaborative control model is constructed, which includes a risk prediction subnetwork and an intervention effect evaluation subnetwork. The risk prediction sub-network is based on a hybrid architecture of Long Short-Term Memory (LSTM) network and Transformer, and is used to predict the multidimensional risk evolution trajectory within the next T seconds based on the current risk state. The intervention effect evaluation subnetwork is based on a reinforcement learning policy network and is used to evaluate the expected return of different collaborative control actions on risk suppression. The collaborative control actions include power supply path switching, power chip start-up and shutdown, load redistribution, and functional submodule takeover. Obtain a trajectory dataset, which includes historical risk sequences, coordinated control actions, and subsequent risk changes; Based on the trajectory dataset, the dual-branch cooperative control model is jointly trained using the Actor-Critic algorithm; The real-time risk status is input into the trained dual-branch cooperative control model, which outputs the optimal cooperative control action sequence.

[0016] By employing the aforementioned technical solutions, a risk prediction subnetwork with an LSTM-Transformer hybrid architecture and an intervention effect evaluation subnetwork driven by reinforcement learning are constructed to form a dual-branch collaborative control model. The former can accurately predict the multidimensional risk evolution trajectory within the next T seconds, while the latter quantitatively evaluates the expected returns of collaborative actions such as power supply switching and task migration. After joint training based on historical trajectory data, the model can output the optimal collaborative control sequence online, achieving the effect of proactive risk prediction and control.

[0017] In a preferred embodiment of this application, the jointly trained bi-branch cooperative control model includes: The trajectory dataset is divided into state sequences, action sequences, and reward sequences; The state sequence is input into the risk prediction subnetwork to obtain the predicted risk trajectory; The state sequence and the action sequence are input into the intervention effect evaluation subnetwork, and the action value Q is output. The predicted loss is calculated based on the mean square error between the actual risk trajectory and the predicted risk trajectory. The policy gradient is calculated based on the temporal difference error between the actual reward and the action value Q. The prediction loss and the policy gradient are alternately optimized to achieve end-to-end training of the dual-branch collaborative control model.

[0018] By employing the above technical solution, trajectory data is divided into state, action, and reward sequences, which respectively drive the risk prediction subnetwork to output predicted trajectories and the intervention evaluation subnetwork to output Q-values. The prediction loss is calculated based on mean squared error, and the policy gradient is calculated based on temporal difference error, alternately optimizing the two objectives. This end-to-end training method mutually promotes the accuracy of risk prediction and the effectiveness of the intervention strategy.

[0019] In a preferred example, after executing the collaborative control strategy, the method further includes: Monitor and collect system status parameters after the execution of the collaborative control strategy. The system status parameters include changes in the output characteristics of the power chip under the power supply control strategy and the load of the processing unit and the task response timing under the task migration strategy. Based on the system state parameters, an intervention effectiveness index reflecting the degree of risk suppression is calculated using a preset quantitative evaluation model; the quantitative evaluation model comprehensively considers the speed of short-term risk suppression and long-term system stability. The intervention effect index is compared with a preset safety standard. When the intervention effect index fails to meet the standard, an adjustment instruction for the collaborative control strategy is triggered. The adjustment instruction includes a power redistribution instruction for the power supply control strategy or a target unit optimization instruction for the task migration strategy.

[0020] By adopting the above technical solution, after implementing the collaborative control strategy, the system status parameters such as the output characteristics of the power chip, the load of the processing unit, and the task response timing are monitored. The intervention effect index is calculated using a quantitative evaluation model to comprehensively measure the speed of short-term risk suppression and the long-term system stability.

[0021] Secondly, the objective of this invention is achieved through the following technical solution: A multi-module collaborative safety power supply control system is applied to a motorcycle intelligent domain controller composed of multiple functional sub-modules; the functional sub-modules include a power domain sub-module, a chassis domain sub-module, an intelligent domain sub-module, and a power management sub-module; wherein, the power management sub-module includes a high-safety-level power chip and a low-safety-level power chip; the system includes: The data acquisition unit is used to actively poll the registers and status interfaces of each functional submodule, and listen to the network communication bus and internal event bus to collect running status data and environmental context data, and obtain a real-time status list of the entire domain. The risk assessment unit is used to construct a multi-dimensional risk assessment matrix based on the real-time status list of the entire domain; The strategy decision-making unit is used to determine the collaborative control strategy based on the multi-dimensional risk assessment matrix. The collaborative control strategy includes a functional module scheduling strategy and a power supply control strategy. The functional module scheduling strategy is configured as follows: the affected critical tasks are migrated from the original processing unit to the target processing unit powered by the high-security-level power chip; the power supply control strategy is configured as follows: when the real-time risk score corresponding to any risk dimension exceeds a preset threshold, the power supply of the low-security-level power chip to non-critical loads is limited or cut off, and the affected critical tasks are migrated to the processing unit powered by the high-security-level power chip. The execution and feedback unit is used to execute the collaborative control strategy and monitor the risk suppression effect; if the risk suppression effect does not reach the preset safety standard, a multimodal intervention plan including power supply coordination and task migration is activated to form an adaptive safety control closed loop.

[0022] Thirdly, the objective of this invention is achieved through the following technical solution: A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the aforementioned multi-module collaborative safe power supply control method.

[0023] Fourthly, the objective of this invention is achieved through the following technical solution: A computer program product includes a computer program / instructions that, when executed by a processor, implement the steps of the multi-module collaborative safe power supply control method described above.

[0024] In summary, this application includes at least one of the following beneficial technical effects: 1. The power domain, chassis domain, intelligent domain, and power management sub-modules are integrated into a unified domain controller, and a multi-dimensional risk assessment matrix is ​​constructed based on a real-time status list of the entire domain, achieving deep coupling between risk perception and power supply resources. When any risk score exceeds the limit, the system not only prioritizes the scheduling of functional modules, but also proactively cuts off or limits the power supply to non-critical loads from low-safety-level power chips, while migrating critical tasks to high-safety-level power supply paths; 2. By supporting a configurable evaluation engine that allows for customization of risk factors, weights, and thresholds, the risk identification rules can be flexibly adapted; combined with a fuzzy comprehensive evaluation method that integrates static states and dynamic trends, the accuracy and timeliness of multidimensional risk scoring are significantly improved. 3. Different risk types are accurately mapped to corresponding domain sub-modules to perform coordinated intervention of power cut-off and task migration. Furthermore, a dual-branch prediction-evaluation model based on LSTM-Transformer and reinforcement learning is introduced to achieve proactive prediction of future risks and generation of optimal control actions. Attached Figure Description

[0025] Figure 1 This is a flowchart of a multi-module collaborative safe power supply control method in one embodiment of this application; Figure 2 This is a flowchart following step S4 in a multi-module collaborative safe power supply control method according to an embodiment of this application. Detailed Implementation

[0026] The present application will be further described in detail below with reference to the accompanying drawings.

[0027] In one embodiment, such as Figure 1 As shown, this application discloses a multi-module collaborative safe power supply control method applied to a motorcycle intelligent domain controller with multiple functional sub-modules; the functional sub-modules include a power domain sub-module, a chassis domain sub-module, an intelligent domain sub-module, and a power management sub-module; wherein, the power management sub-module includes a high-safety-level power chip and a low-safety-level power chip, and the multi-module collaborative safe power supply control method specifically includes the following steps: S1: Actively poll the registers and status interfaces of each functional submodule, and monitor the network communication bus and internal event bus; collect running status data and environmental context data to obtain a real-time status list of the entire domain.

[0028] In this embodiment, the power domain controller integrates functions such as EMS (Engine Management System), BMS (Battery Management System), and Hybrid (Hybrid System); the chassis domain controller integrates ABS (Anti-lock Braking System) and self-balancing devices; and the intelligent domain controller integrates BCM / PKE (Body Control Module / Keyless Entry), instrument cluster, virtual key, TBOX (Telematics Box Module), and ADAS (Advanced Driver Assistance Systems). In addition, the system includes a power management submodule, which is located within the domain controller or in a separate power supply unit. The full-domain real-time status list refers to a comprehensive data set reflecting the current operating status and environmental context of each functional submodule of the motorcycle.

[0029] Specifically, the power management submodule includes a high-safety-level power chip and a low-safety-level power chip. When the power management submodule is an independent unit, it is connected to the domain controller's main MCU via hardwired GPIO or a dedicated CAN subnet, with a control command transmission delay ≤5ms. The high-safety-level power chip is dedicated to powering core processing units (such as the main MCU and safety coprocessor) and safety-critical submodules (such as the brake controller, steering actuator, and BMS core logic). The low-safety-level power chip powers non-safety-critical peripheral functions (such as ambient lighting, Bluetooth speakers, TFT instrument panel background display, and ADAS non-core algorithms). In this embodiment, the domain controller includes a main processing core (Core 0) and a backup processing core (Core 1). Core 0 is powered by the high-safety-level power chip, and Core 1 is powered by the low-safety-level power chip. When a risk is triggered, critical tasks are migrated from Core 1 to Core 0 for execution.

[0030] In this embodiment, the main control MCU actively polls the internal registers and status interfaces of each functional submodule at a 10ms cycle, and simultaneously listens to the CAN FD bus and internal event bus (such as the SPI message queue) to collect operational status data and environmental context data. For example, it reads individual cell voltage, motor temperature, and air-fuel ratio from the power domain controller; obtains vehicle yaw rate, front and rear wheel speed difference, and braking pressure from the chassis domain controller; and obtains distance to obstacles ahead, GPS positioning, and driver attention status (via the DMS camera) from the intelligent domain controller. All collected data is aligned with a unified timestamp to form a comprehensive real-time status list.

[0031] S2: Construct a multi-dimensional risk assessment matrix based on a real-time status list covering the entire domain.

[0032] In this embodiment, the multi-dimensional risk assessment matrix refers to a quantitative scoring vector containing four risk dimensions, corresponding to the risks of exceeding emission standards, driving instability, system malfunction, and battery thermal runaway. The risk score for each dimension ranges from 0 to 1, with higher values ​​indicating more severe risks.

[0033] Specifically, the scores for each risk dimension are calculated based on preset rules. For example, when "the vehicle's yaw rate is greater than 15° / s and the front-to-rear wheel speed difference is greater than 30%" is detected, it is judged as a high risk of driving instability, with a corresponding score of 0.92; when "the voltage difference between individual battery cells is greater than 50mV and the temperature rise rate is greater than 2℃ / s", the battery thermal runaway risk score is set to 0.88. The above rules can be graded and assigned values ​​according to the "Motorcycle Functional Safety Design Guidelines (Trial)" and stored in non-volatile memory.

[0034] Furthermore, before constructing a multi-dimensional risk assessment matrix, the multi-module collaborative safe power supply control method also includes: S201: Receive input risk assessment rule configuration instructions. The risk assessment rule configuration instructions define the risk assessment factors, weight coefficients and dynamic threshold adjustment strategies for each risk dimension. Among them, the risk assessment factors include air-fuel ratio deviation, vehicle body yaw rate, electronic control unit (ECU) temperature change rate and individual cell voltage difference.

[0035] In this embodiment, to address the problem that traditional fixed threshold strategies are difficult to adapt to different vehicle platforms, regional regulations, or user driving habits, and to improve the flexibility of the safety power supply control system, the risk assessment factors are original physical quantities or derived indicators used to characterize specific risk states; weighting coefficients are used to reflect the relative importance of each factor in the comprehensive score; and the dynamic threshold adjustment strategy specifies the rules for the risk score trigger threshold to adapt to changes in operating conditions (such as vehicle speed and ambient temperature).

[0036] Specifically, risk assessment factors include, but are not limited to: Air-fuel ratio deviation: refers to the absolute deviation between the actual air-fuel ratio and the stoichiometric air-fuel ratio (14.7:1), used to characterize the risk of exceeding emission standards; when the air-fuel ratio deviation > 2.0, it may cause exhaust pollutants to exceed standards. Vehicle yaw rate: The angular velocity of the vehicle rotating around the vertical axis, collected by a gyroscope, in ° / s, used to characterize the risk of instability during driving; if the yaw rate of a city commuter motorcycle is >12° / s in a curve, it is considered high risk. Electronic Control Unit (ECU) Temperature Change Rate: This refers to the rate at which the ECU chip temperature rises per unit time, measured in °C / s. It is used to characterize the risk of system downtime. If the rate is >3 °C / s for 2 seconds, it indicates heat dissipation failure. Cell voltage difference: refers to the difference between the highest and lowest cell voltages in the battery pack, measured in mV. It is used to characterize the risk of battery thermal runaway. A value >50mV is considered abnormal.

[0037] For example, the weighting coefficients for air-fuel ratio deviation, vehicle body yaw rate, ECU temperature change rate, and individual cell voltage difference are 0.5, 0.4, 0.35, and 0.25, respectively.

[0038] S202: Based on the risk assessment rule configuration command, initialize the risk assessment engine and associate it with the corresponding real-time data stream channel.

[0039] In this embodiment, the risk assessment engine refers to a lightweight rule interpreter running on the main control MCU, which is used to parse and execute risk assessment logic in real time; the real-time data flow channel refers to the data transmission path from each functional submodule to the risk assessment engine, including the CAN signal mapping table, register address list and event subscription queue.

[0040] Specifically, upon receiving the risk assessment rule configuration instruction, the domain controller initiates the initialization process: first, it verifies the digital signature of the configuration file to ensure its legitimacy; then, it maps each risk assessment factor to a specific data source. For example, the vehicle body yaw rate is associated with signal bytes 3-4 sent by the chassis domain controller via CAN ID 0x2A1 cycle; the voltage difference of individual battery cells is read from register 0x1F inside the BMS chip via the SPI bus. Simultaneously, a memory buffer is allocated for each factor, and a callback function is registered to automatically trigger a risk score update when new data arrives.

[0041] S203: Solidify the configured risk assessment rules into an executable risk assessment template.

[0042] In this embodiment, the executable risk assessment template refers to a binary or script file generated by compiling or serializing configuration instructions, which can be directly called by the risk assessment engine. It contains complete risk assessment factors, weight coefficients, risk thresholds, and corresponding action mapping relationships.

[0043] For example, the domain controller has a built-in template generator module that, after completing the data channel binding for S202, converts the configuration logic into an internal intermediate representation (IR), such as: "IF (yaw rate > threshold_driving instability) THEN Driving instability score = ",in Current yaw rate, unit: ° / s; =15° / s is the upper limit threshold for safety. =0° / s is the lower limit of the normal range; The preset weighting factor (e.g., 0.7) is used. This IR is serialized into a compact binary format, stored in a dedicated partition of Flash memory, and a unique version number is generated.

[0044] S3: Based on the multi-dimensional risk assessment matrix, determine the collaborative control strategy, which includes a functional module scheduling strategy and a power supply control strategy. The functional module scheduling strategy is configured to migrate the affected critical tasks from the original processing unit to the target processing unit powered by a high-security-level power supply chip. The power supply control strategy is configured to limit the current or cut off the power supply from the low-security-level power supply chip to the non-critical load when the real-time risk score corresponding to any risk dimension exceeds a preset threshold, and migrate the affected critical tasks to the processing unit powered by the high-security-level power supply chip.

[0045] In this embodiment, the core of the power supply control strategy is: when any risk dimension score exceeds a preset threshold, actively limit the current or cut off the power supply of the low-safety-level power chip to the non-critical load, and migrate the affected critical tasks to the processing unit powered by the high-safety-level power chip.

[0046] Specifically, taking battery thermal runaway risk as an example: when its real-time score exceeds 0.90 (the fourth threshold), the system immediately performs the following actions: The fast charging circuit is cut off by the power domain control; Start the liquid cooling pump for thermal management; The GPIO signal is used to shut off the 12V power supply to non-critical loads such as Bluetooth speakers and ambient lights in the smart domain controller. The basic display tasks of the instrument panel are migrated from the secondary core (powered by a low safety power supply) to the main core (a Cortex-R52 processor powered by a high safety power supply).

[0047] S4: Execute the collaborative control strategy and monitor the risk suppression effect; if the risk suppression effect does not meet the preset safety standard, activate the multimodal intervention plan that includes power supply coordination and task migration to form adaptive safety control.

[0048] In this embodiment, the multimodal intervention plan refers to a composite alarm mechanism that integrates tactile, visual, auditory, and control interventions. Risk suppression effectiveness can be monitored by comparing the rate of change in risk scores before and after intervention. If the overall risk index decreases by less than 15% within 2 seconds after intervention, it is determined that the preset safety standard has not been met, triggering the plan. The entire process is independently supervised by a safety watchdog; even if the main application crashes, the watchdog can still enforce minimum power protection actions.

[0049] For example, after power cut-off and task migration, the system continuously monitors the battery cell temperature rise rate: if the temperature rise slope does not drop below 1℃ / s within 5 seconds, it is determined that the risk suppression effect does not meet the preset safety standard, and then the multimodal intervention plan is activated, including: (1) outputting a three-level vibration prompt through the handle vibration motor to carry out tactile intervention; (2) projecting a red "BATTERY OVERHEAT" warning on the HUD to carry out visual intervention; (3) playing a spatial voice warning "Please pull over immediately" through Bluetooth headphones to carry out auditory intervention; (4) automatically limiting the throttle opening to 30% to carry out control intervention.

[0050] In this embodiment, executing the coordinated control strategy includes at least one of the following linkage operations: S41: When the real-time risk score corresponding to the risk of exceeding emission standards exceeds the first threshold, increase the CPU utilization rate of the central processing unit of the power domain submodule and shut down the power supply of the low-security-level power chip to the entertainment or lighting function units in the intelligent domain submodule.

[0051] In this embodiment, the risk of exceeding emission standards is mainly caused by a significant deviation of the air-fuel ratio from the theoretical value (14.7:1) or abnormal temperature of the three-way catalytic converter, which may result in excessive levels of exhaust pollutants (CO, HC, NOx). The first threshold is set at 0.75, representing a high emission risk state.

[0052] Specifically, when the system detects an emission exceedance risk score > 0.75, the power domain submodule immediately executes a dual response: (1) Increase the CPU scheduling priority of its main control MCU (such as NXP S32K144) and increase the CPU utilization rate of EMS (engine management system) tasks from the usual 30% to more than 70% to accelerate the closed-loop regulation frequency of air-fuel ratio. (2) Send a shutdown command to the power management IC via GPIO signal to cut off the 12V power supply of the low-security-level power chip to non-critical loads in the intelligent domain submodule, including Bluetooth audio decoder, ambient light driver circuit, TFT instrument backlight, etc.

[0053] The above operations can be completed within 200ms.

[0054] S42: When the real-time risk score corresponding to the risk of driving instability exceeds the second threshold, the chassis domain submodule temporarily takes over the control of the steering subsystem and braking subsystem, reduces the motor output torque, and prohibits the supply of power to unnecessary actuators in the chassis domain submodule through the low safety level power chip.

[0055] In this embodiment, the risk of vehicle instability is caused by excessive yaw rate, abnormal difference in front and rear wheel speeds, or sudden changes in lateral acceleration, which can easily lead to skidding or rollover. The second threshold is set to 0.82.

[0056] Specifically, when the driving instability risk score is >0.82, the chassis domain submodule initiates an emergency stabilization procedure: (1) Through an internal high-priority arbitration mechanism, the control of the steering subsystem (such as electronic power steering EPS) and braking subsystem (such as ABS / EBD) is temporarily taken over, bypassing the conventional application layer and directly calling the underlying safety control library; (2) Send a torque limit request to the power domain submodule to reduce the maximum output torque of the motor to 40% of the current value; (3) At the same time, low-safety-level power chips are prohibited from supplying power to unnecessary actuators (such as self-balancing device auxiliary motors and seat heating modules) in the chassis domain sub-modules to ensure that the steering and braking actuators receive stable power.

[0057] The entire takeover process was completed within 50ms, meeting the response time requirements of ISO 26262 ASIL-C.

[0058] S43: When the real-time risk score corresponding to the system downtime risk exceeds the third threshold, the redundant communication link is activated, the critical tasks are migrated to the backup processing core, and all power supplies to the low-security-level power chip are cut off to reduce the system load.

[0059] In this embodiment, the risk of system downtime is mainly caused by a sudden increase in ECU temperature, watchdog timeout of the main core, or excessively high memory error rate. The third threshold is set to 0.88.

[0060] Specifically, when the system downtime risk score is >0.88, the domain controller executes a "preserve core, abandon peripheral" strategy: (1) Activate redundant CAN FD communication links (physical layer independent of the main channel) to ensure uninterrupted communication with safety-critical subsystems such as BMS and ABS; (2) The task scheduler migrates critical tasks such as braking command generation and battery high voltage relay control from the main core (Core 0) to the standby processing core (Core 1, which is also a Cortex-R52 architecture). (3) Send a global shutdown signal to the power management submodule to cut off all outputs of the low-safety-level power chip, including power supply to the intelligent domain and some chassis domain peripheral devices, so as to reduce the total power consumption of the system by about 35% and buy time for the main core to recover.

[0061] If the primary core does not recover within 10 seconds, the backup core will continue to run the minimum safety functions until the vehicle comes to a complete stop.

[0062] S44: When the real-time risk score corresponding to the risk of battery thermal runaway exceeds the fourth threshold, the power domain submodule cuts off the fast charging circuit, starts the liquid cooling pump, triggers the cloud warning command, and only retains the power supply of the high safety level power chip to the safety-critical submodule.

[0063] In this embodiment, the risk of battery thermal runaway is caused by excessive voltage difference between individual cells, excessively rapid temperature rise rate, or decreased insulation resistance. The fourth threshold is set to 0.90, representing an extremely high risk.

[0064] Specifically, when the battery thermal runaway risk score is >0.90, the power domain submodule immediately executes a four-level linkage: (1) The fast charging circuit is cut off by the high voltage relay control circuit (DC+ / DC− disconnected) to prevent external energy injection from aggravating heat spread; (2) Start the liquid cooling pump (power 120W) to circulate the coolant at the maximum flow rate to cool the battery pack; (3) Send an emergency message containing location, battery status and risk level to the cloud early warning center through the TBOX module, in accordance with GB / T 32960 standard; (4) The power management submodule is instructed to enter the "safety maintenance mode", that is, only the high safety level power chip is retained to supply power to the BMS core logic, brake controller, steering actuator and other safety-critical submodules, and all other loads (including instrument display, lighting and entertainment system) are powered off.

[0065] In one embodiment, constructing a multi-dimensional risk assessment matrix includes: S21: Filter and remove noise and outliers from the collected raw data to obtain preprocessed data.

[0066] In this embodiment, raw data refers to unprocessed sensor signals or status parameters directly collected from each functional submodule, which often contain high-frequency noise, communication jitter, or occasional jumps; preprocessed data refers to a stable and reliable data stream after cleaning.

[0067] Specifically, a differentiated processing strategy is adopted for different data types: For continuous signals such as ECU temperature and cell voltage, a five-point moving average filter (window length = 5) is used to suppress high-frequency noise, and outliers are eliminated by combining the 3σ principle: if the current sampled value deviates from the average of the past 10 cycles by more than 3 times the standard deviation, the historical average is used instead. For event-type signals such as ABS activation flag and fast charging enable status, a de-jittering logic is adopted: only when the same status lasts for ≥3 sampling cycles (30ms) is it considered a valid change.

[0068] S22: Discretize the continuous variables in the preprocessed data into risk level intervals, and map the categorical variables into risk contribution weights.

[0069] In this embodiment, continuous variables refer to physical quantities that take values ​​in the real number domain, such as yaw rate and temperature rise rate; categorical variables refer to identifiers with finite discrete states, such as the health status of the braking system: normal, degraded, and faulty. In order to unify the evaluation scale, both need to be converted into risk quantification indicators that can participate in the comprehensive scoring.

[0070] Specifically, piecewise linear mapping is used for continuous variables: for example, the yaw rate of the vehicle body is divided into three risk level intervals: [0, 8° / s] is mapped to low risk and assigned a value of 0.2, (8, 15° / s] is mapped to medium risk and assigned a value of 0.6, and >15° / s is mapped to high risk and assigned a value of 0.95; the voltage difference of a single cell is divided into [0, 30mV] and assigned a value of 0.1, (30, 50mV) and assigned a value of 0.5, and >50mV and assigned a value of 0.9.

[0071] For categorical variables, a mapping table is established: for example, in the braking system health status, "normal" is mapped with a weight of 0.1, "degraded" with a weight of 0.6, and "faulty" with a weight of 0.95. The mapping relationship can be adjusted according to the vehicle model's safety level and is stored in the configuration template.

[0072] S23: Calculate the short-term trend slope of each risk assessment factor based on the sliding time window.

[0073] In this embodiment, the short-term trend slope is used to characterize the dynamic evolution direction and speed of risk factors, compensating for the deficiency that static values ​​cannot reflect the accelerated deterioration of risk. The sliding time window length is set to 500ms, corresponding to 50 10ms sampling periods.

[0074] Specifically, taking ECU temperature change rate as an example: the system maintains a FIFO queue of length 5 to store the 5 most recent ECU temperature values. Unit: °C. The slope k was calculated using least-squares linear fitting: ,in Timestamp, unit: seconds; The mean, If k > 3℃ / s, the temperature rise trend is considered drastic, and even if the current temperature does not exceed the limit, it is regarded as a precursor to a high system downtime risk. Similarly, the short-term slopes of factors such as yaw rate and cell voltage difference are calculated as inputs for dynamic risk terms.

[0075] S24: The fuzzy comprehensive evaluation method is adopted to integrate the static risk value and the dynamic trend term corresponding to the short-term trend slope, and output the real-time risk score of each risk dimension.

[0076] In this embodiment, the fuzzy comprehensive evaluation method is a multi-factor decision-making method based on membership functions and weighted synthesis. The risk dimensions of the multi-dimensional risk assessment matrix include emission exceedance risk, driving instability risk, system downtime risk, and battery thermal runaway risk.

[0077] Specifically, taking the risk of battery thermal runaway as an example: Static risk value =Mapped value of voltage difference between individual battery cells, such as 0.9; Dynamic trend items =Cell temperature rise slope mapping value, such as 0.85 for slope > 2℃ / s; Define fuzzy rules: if High and A high score indicates a high risk score; if But If it is low, then the risk score is medium.

[0078] The fuzzy logic is resolved using triangular membership functions and the centroid method, and the final real-time risk score for this dimension is: The weights of 0.6 and 0.4 can be adjusted according to the safety strategy. Similarly, real-time risk scores R1 to R4 are calculated for the three dimensions of excessive emissions, driving instability, and system failure, forming a 4-dimensional risk score vector.

[0079] S25: Based on preset weights, the real-time risk scores of each risk dimension are weighted and synthesized into a comprehensive risk index for the entire domain.

[0080] In this embodiment, the overall risk index is a scalar value, ranging from 0 to 1.

[0081] Specifically, weights are assigned to each dimension based on the vehicle's design objectives: for example, urban commuter motorcycles prioritize battery safety, so a weight is assigned to battery thermal runaway. =0.4; Sport motorcycles prioritize handling stability, so a weight for instability is set. =0.45. The remaining weights, after normalization, yield... =0.2 (emissions) =0.15 (downtime). Therefore, the overall risk index I is calculated as follows: ,in These are the weighting coefficients for the risks of exceeding emission standards, driving instability, system shutdown, and battery thermal runaway, respectively. These are real-time risk scores for the risks of exceeding emission standards, driving instability, system downtime, and battery thermal runaway.

[0082] In one embodiment, the multi-module collaborative safe power supply control method further includes: S10: Construct a dual-branch collaborative control model, which includes a risk prediction subnetwork and an intervention effect evaluation subnetwork. The risk prediction subnetwork is based on a hybrid architecture of Long Short-Term Memory (LSTM) and Transformer, and is used to predict the multidimensional risk evolution trajectory within the next T seconds based on the current risk state. The intervention effect evaluation subnetwork is based on a reinforcement learning policy network and is used to evaluate the expected return of different collaborative control actions on risk suppression. The collaborative control actions include power supply path switching, power chip start-up and shutdown, load redistribution, and functional submodule takeover.

[0083] In this embodiment, the dual-branch collaborative control model is an end-to-end neural network architecture running on the AI ​​acceleration unit of the domain controller, such as an NPU or GPU coprocessor. The risk prediction subnetwork is used to predict future risk evolution trends, and the intervention effect evaluation subnetwork is used to evaluate the risk suppression effects of different control actions.

[0084] Specifically, the risk prediction subnetwork adopts a hybrid architecture of LSTM and Transformer: the front end uses two layers of LSTM (128 hidden units) to capture the long-term temporal dependencies of risk sequences, such as the cumulative effect of cell temperature rise; the back end is connected to a single-layer Transformer encoder with 4 encoder heads and 64 dimensions, which uses a self-attention mechanism to identify cross-dimensional correlations between multi-dimensional risk factors, such as the coupling relationship between a sudden increase in yaw rate and motor torque fluctuations; the output is a 4-dimensional risk trajectory prediction value for the next 6 time steps (corresponding to 3 seconds, with a sampling period of 0.5 seconds): Each dimension corresponds to a risk score for emissions, instability, downtime, and thermal runaway.

[0085] The intervention effect evaluation subnetwork is constructed based on the Deep Deterministic Policy Gradient (DDPG) framework, which includes an Actor network and a Critic network. The Actor network is a three-layer fully connected network (256→128→4), which outputs continuous action vectors. After discretization, it is mapped to four types of collaborative control actions: power supply path switching (0 / 1), power chip start / stop (0 / 1), load redistribution ratio (0%~100%), and functional submodule takeover flag (0 / 1). The Critic network receives the state and action as input and outputs the expected reward Q value of the action, which reflects its suppression effect on the overall risk index.

[0086] S20: Obtain the trajectory dataset, which includes historical risk sequences, coordinated control actions, and subsequent risk changes.

[0087] In this embodiment, the trajectory dataset refers to a multi-round "state-action-result" triple sequence collected from real vehicle testing, hardware-in-the-loop (HIL) simulation, or historical accident playback, which is used to train the model to learn the risk evolution pattern and the effectiveness of intervention.

[0088] S30: Based on the trajectory dataset, the Actor-Critic algorithm is used to jointly train the dual-branch collaborative control model.

[0089] In this embodiment, joint training refers to alternately optimizing risk prediction loss and strategy evaluation loss; Specifically, the training process is completed on a cloud server (GPU cluster, Tesla V100×8): First, a risk prediction subnetwork is pre-trained separately using mean squared error (MSE) as the loss function, so that the RMSE between its predicted trajectory and the true trajectory is less than 0.08. Subsequently, fixing some parameters of the prediction network, its real-time output risk trajectory is used as part of the state input of the Critic network, and the DDPG algorithm is used in conjunction with fine-tuning of the two-branch model; during training, the reward function is designed as follows: α=0.7 emphasizes risk suppression, and β=0.3 punishes over-intervention; after 50 epochs, the model's average Q-value on the validation set converged to above 0.85.

[0090] In this embodiment, the joint training of the two-branch cooperative control model includes: S301: Divide the trajectory dataset into state sequences, action sequences, and reward sequences.

[0091] In this embodiment, the state sequence represents the system risk evolution process, the action sequence represents the controller response behavior, and the reward sequence represents the quantitative feedback of the intervention effect. After each trajectory is aligned by time step, a 4-dimensional risk score and a comprehensive risk index are extracted to form the state sequence. The four types of control actions, including power supply path switching and power start / stop, are encoded into continuous / discrete hybrid vectors to form action sequences. Based on formula ,in, Let I(t+1) be the reward value at time step t, and let I(t+1) be the global comprehensive risk index (0~1) at the next time step. This is the currently executing collaborative control action vector. The L1 norm is used to measure the intensity of action intervention. A reward sequence is formed by calculating the scalar reward value at each time step. All sequences are stored in HDF5 format.

[0092] S302: Input the state sequence into the risk prediction subnetwork to obtain the predicted risk trajectory.

[0093] In this embodiment, the risk prediction subnetwork is the forward sensing branch of the two-branch model. Its function is to predict the risk evolution trend at multiple future time steps based on the current and historical states. Specifically, a time window state sequence of length 5 (corresponding to 2.5 seconds of history) is input into an LSTM-Transformer hybrid network: the LSTM layer (128 units) captures the long-term dependencies of variables such as temperature rise and yaw rate, while the Transformer encoder (4 heads, 64 dimensions) models the coupling relationships between multiple risk dimensions; the network outputs a 5-dimensional prediction vector for the next 6 time steps (3 seconds), which constitutes the predicted risk trajectory. The sampling frequency is 2Hz.

[0094] S303: Input the state sequence and action sequence into the intervention effect evaluation subnetwork and output the action value Q value.

[0095] In this embodiment, the intervention effect evaluation subnetwork is the strategy evaluation branch of the two-branch model. Its role is to quantify the expected return of a certain collaborative control action in future risk suppression, i.e., the action value (Q value).

[0096] Specifically, the current state (5-dimensional) and action (4-dimensional) concatenation into 9-dimensional joint input, fed into a three-layer fully connected Critic network (256→128→1), outputting a scalar Q-value. A higher scalar Q value indicates that the action can reduce overall risk while minimizing the cost of functional degradation. For example, "cutting off power to entertainment devices only" may achieve a higher Q value than "complete power outage".

[0097] S304: Calculate the predicted loss based on the mean square error between the actual risk trajectory and the predicted risk trajectory.

[0098] In this embodiment, the prediction loss is used to measure the accuracy of the risk prediction sub-network and is the supervised learning objective.

[0099] Specifically, let the true future risk trajectory be... The model predicts that Then predict the loss. The mean square error between the two is calculated using the following formula: ,in This is the sequence number of the future time step, with each step spaced 0.5 seconds apart.

[0100] S305: Calculate the policy gradient based on the temporal difference error between the actual reward and the action value Q.

[0101] In this embodiment, the temporal difference (TD) error is the core signal of reinforcement learning, used to evaluate the Q-value estimation bias and calculate the update direction of the Actor and Critic networks accordingly.

[0102] Specifically, the TD target is calculated first: ,in For the time difference (TD) objective, γ=0.95 is the discount factor. These are the outputs of the target Critic network and the target Actor network, respectively; the TD error is... ; Critic loss is: The Actor's loss is By minimizing and maximizing The policy gradient is jointly calculated and the network parameters are updated.

[0103] S306: Alternately optimize the prediction loss and policy gradient to achieve end-to-end training of the dual-branch collaborative control model.

[0104] In this embodiment, alternating optimization refers to first fixing the intervention evaluation subnetwork and updating the risk prediction subnetwork using only the prediction loss within a training iteration cycle; then fixing the risk prediction subnetwork and updating the intervention evaluation subnetwork using the policy gradient.

[0105] Specifically, training uses a batch size of 64 and is performed on an NVIDIA A100 GPU: each round first uses... Update the prediction network once, then use and The evaluation network is jointly updated once; the target network parameters are synchronized every 100 steps using a soft update method (τ=0.005); training lasts for 50 epochs until the validation set prediction RMSE < 0.075 and the average Q value > 0.85. Finally, the model is deployed to the domain controller NPU module. The quantized INT8 model has 3.2MB of parameters, peak inference power consumption < 2W, and a single inference time of 18ms on the Horizon J5 NPU, meeting the 500ms control cycle requirement.

[0106] For example, each trajectory record is 10 seconds long, with a sampling frequency of 2Hz, and includes: State sequence: 4-dimensional real-time risk score and global comprehensive risk index I(t) at each time step; Action sequence: Coordinated control actions executed at corresponding time steps (such as "cut off low security power" or "migrate task to main core"). Result sequence: Actual risk changes within 3 seconds after the action is performed.

[0107] The dataset contains 12,000 valid trajectories, covering typical high-risk scenarios such as urban congestion, highway curves, battery overcharging, and ECU overheating. After being anonymized, the data is stored in the vehicle's SSD.

[0108] S40: Input the real-time risk status into the trained dual-branch cooperative control model and output the optimal cooperative control action sequence.

[0109] In this embodiment, the trained model is quantized and compressed (FP32→INT8) and deployed to the NPU module of the domain controller.

[0110] Specifically, during vehicle operation, the system inputs the current 4D risk score into the dual-branch collaborative control model every 500ms: the risk prediction sub-network outputs the risk evolution trajectory for the next 3 seconds; the intervention effect evaluation sub-network evaluates the expected Q-values ​​of various candidate actions based on the predicted trajectory of the risk for the next 3 seconds; various candidate actions include "power off only" vs. "power off + migration + torque reduction". The action sequence with the highest Q-value is ultimately selected as the optimal collaborative control strategy, for example: "cut off the low-safety power supply at t+0.5s, start the liquid cooling pump at t+1.0s, and limit the motor torque to 50% at t+1.5s". This action sequence is parsed and executed step-by-step by the main control MCU.

[0111] In one embodiment, such as Figure 2 As shown, after step S4, the specific steps include: S51: Monitor and collect system status parameters after the execution of the collaborative control strategy. System status parameters include changes in the output characteristics of the power chip under the power supply control strategy and the load of the processing unit and the task response timing under the task migration strategy.

[0112] In this embodiment, the collaborative control strategy includes a power supply control strategy and a functional module scheduling strategy. The power supply control strategy includes the identifier of the power chip that is cut off / current limited, the list of affected loads, and the current limit value or shutdown flag. The functional module scheduling strategy includes the source processing unit, the target processing unit, the migration task ID list, and the migration trigger timestamp. Changes in power chip output characteristics include changes in output voltage, output current, status flags, power consumption, and response latency. Processing unit load and task response timing include CPU utilization of processing unit load, DDR bandwidth utilization of memory pressure, task start timestamp, task completion timestamp, end-to-end response latency, and context switching time of task migration overhead.

[0113] Specifically, after the collaborative control strategy is triggered, the domain controller starts a high-frequency monitoring mode with a sampling period of 50ms. The output voltage, current and enable status of the low-safety-level power chip are collected through the telemetry interface of the power management IC to determine whether it is turned off according to the instruction. The CPU utilization, memory bandwidth utilization, and response latency of critical tasks (such as braking instruction generation) of the high-security-level processing core (Core 0) are recorded through the built-in performance counter of the main control MCU. The response latency refers to the time from event triggering to output completion. Simultaneously, the load decrease of the secondary core (Core 1) and the load increase slope of the primary core are recorded before and after the task migration to ensure that the migration does not cause new bottlenecks. All parameters are stored in a circular buffer after being timestamped.

[0114] S52: Based on system state parameters, an intervention effect index reflecting the degree of risk suppression is calculated through a preset quantitative evaluation model; the quantitative evaluation model comprehensively considers the speed of short-term risk suppression and long-term system stability.

[0115] In this embodiment, the Intervention Effectiveness Index (IEI) is a scalar value between 0 and 1; the short-term risk suppression rate focuses on the rate of decrease in the risk score within 1 second after the intervention, while the long-term system stability focuses on whether the system experiences oscillations, overload, or functional abnormalities within the following 3 seconds. The quantitative assessment model is a mathematical / logical model used to calculate the Intervention Effectiveness Index (IEI).

[0116] Specifically, the quantitative evaluation model is defined as follows: Among them, the speed of short-term risk suppression The relative decrease rate of the overall risk index within 1 second, with an upper limit of 1.0; long-term system stability. The slope of the risk change over the next 3 seconds is considered smoother; a smaller slope indicates higher stability. I(t) represents the overall risk index. Weights... This reflects the priority given to rapid response. For example, the risk of a 1-second delay in prognosis is reduced by 40% (…). =0.4), and there were no drastic fluctuations afterward ( =0.9), then IEI=0.6×0.4+0.4×0.9=0.60.

[0117] S53: Compare the intervention effect index with the preset safety standard. When the intervention effect index fails to meet the standard, trigger the adjustment command for the collaborative control strategy. The adjustment command includes the power redistribution command for the power supply control strategy or the target unit optimization command for the task migration strategy.

[0118] In this embodiment, the preset safety standard refers to the lowest acceptable threshold of the intervention effect index, which is set to 0.55. When IEI ≥ 0.55, the intervention is deemed effective, but there is still room for optimization, and the system automatically generates instructions for adjustment and optimization.

[0119] For example, if the IEI meets the standard but the power chip output current is far below the rated value (e.g., only 30% capacity is used), a power reallocation instruction is generated, such as: "Restore the instrument backlight power supply in the intelligent domain submodule (current limited to 200mA)". If task migration causes the main core CPU utilization to remain >85%, a target unit optimization instruction is generated, such as: "Write the non-urgent log to the task migration back to the auxiliary core (after low-security power is restored)". These instructions are generated by the policy optimization engine and sent to the power management submodule and task scheduler via the internal message bus, taking effect in the next control cycle.

[0120] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0121] In one embodiment, a multi-module collaborative safety power supply control system is provided, which corresponds to the multi-module collaborative safety power supply control method in the above embodiments.

[0122] A multi-module collaborative safety power supply control system is applied to a motorcycle intelligent domain controller composed of multiple functional sub-modules. These sub-modules include a power domain sub-module, a chassis domain sub-module, an intelligent domain sub-module, and a power management sub-module. The power management sub-module includes high-safety-level power chips and low-safety-level power chips. The system includes a data acquisition unit, a risk assessment unit, a strategy decision-making unit, and an execution and feedback unit. Detailed descriptions of each functional unit are as follows: The data acquisition unit is used to actively poll the registers and status interfaces of each functional submodule, and listen to the network communication bus and internal event bus to collect running status data and environmental context data, and obtain a real-time status list of the entire domain. The risk assessment unit is used to construct a multi-dimensional risk assessment matrix based on the real-time status list of the entire domain; The strategy decision-making unit is used to determine the collaborative control strategy based on the multi-dimensional risk assessment matrix. The collaborative control strategy includes the functional module scheduling strategy and the power supply control strategy. The functional module scheduling strategy is configured as follows: the affected critical tasks are migrated from the original processing unit to the target processing unit powered by the high-safety-level power chip; the power supply control strategy is configured as follows: when the real-time risk score corresponding to any risk dimension exceeds the preset threshold, the power supply of the low-safety-level power chip to the non-critical load is limited or cut off, and the affected critical tasks are migrated to the processing unit powered by the high-safety-level power chip. The execution and feedback unit is used to execute the collaborative control strategy and monitor the risk suppression effect. If the risk suppression effect does not meet the preset safety standard, a multimodal intervention plan including power supply coordination and task migration is activated to form an adaptive safety control closed loop.

[0123] For specific limitations regarding the multi-module collaborative safety power supply control system, please refer to the limitations of the multi-module collaborative safety power supply control method mentioned above, which will not be repeated here. Each module in the above-mentioned multi-module collaborative safety power supply control system can be implemented entirely or partially through software, hardware, or a combination thereof. Each module can be embedded in the processor of the computer device in hardware form or independent of it, or it can be stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0124] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor: S1: Actively poll the registers and status interfaces of each functional submodule, and monitor the network communication bus and internal event bus; collect running status data and environmental context data to obtain a real-time status list of the entire domain; S2: Construct a multi-dimensional risk assessment matrix based on a real-time status list covering the entire domain; S3: Based on the multi-dimensional risk assessment matrix, determine the collaborative control strategy, which includes the functional module scheduling strategy and the power supply control strategy. The power supply control strategy is configured as follows: when the real-time risk score corresponding to any risk dimension exceeds the preset threshold, the power supply of the low-safety-level power chip to the non-critical load is limited or cut off, and the critical tasks affected are migrated to the processing unit powered by the high-safety-level power chip. S4: Execute the collaborative control strategy and monitor the risk suppression effect; if the risk suppression effect does not meet the preset safety standard, activate the multimodal intervention plan that includes power supply coordination and task migration to form adaptive safety control.

[0125] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0126] In one embodiment, particularly according to embodiments of the present invention, the processes described above with reference to the flowchart can be implemented as a computer software program. For example, embodiments of the present invention include a computer program product comprising a computer program / instructions that, when executed by a processor, implement the steps of the multi-module collaborative secure power supply control method described above. In such embodiments, the computer program can be downloaded and installed from a network via a communication module, and / or installed from a removable medium. When the computer program is executed by a central processing unit (CPU), it performs the various functions defined in the present invention.

[0127] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0128] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A multi-module collaborative safe power supply control method, characterized in that, A motorcycle intelligent domain controller applied to multiple functional submodules; the functional submodules include a power domain submodule, a chassis domain submodule, an intelligent domain submodule, and a power management submodule; wherein, the power management submodule includes a high-safety-level power chip and a low-safety-level power chip; the method includes: By actively polling the registers and status interfaces of each functional submodule and monitoring the network communication bus and internal event bus, running status data and environmental context data are collected to obtain a real-time status list for the entire domain. Based on the aforementioned real-time status list, a multi-dimensional risk assessment matrix is ​​constructed; Based on the multi-dimensional risk assessment matrix, a collaborative control strategy is determined, which includes a functional module scheduling strategy and a power supply control strategy. The functional module scheduling strategy is configured as follows: the affected critical tasks are migrated from the original processing unit to the target processing unit powered by the high-security-level power chip; the power supply control strategy is configured as follows: when the real-time risk score corresponding to any risk dimension exceeds a preset threshold, the power supply of the low-security-level power chip to non-critical loads is limited or cut off, and the affected critical tasks are migrated to the processing unit powered by the high-security-level power chip. The collaborative control strategy is executed, and the risk suppression effect is monitored. If the risk suppression effect does not meet the preset safety standard, a multimodal intervention plan including power supply coordination and task migration is activated to form adaptive safety control.

2. The multi-module collaborative safe power supply control method according to claim 1, characterized in that, Before constructing the multi-dimensional risk assessment matrix, the method further includes: Receive input risk assessment rule configuration instructions, which define risk assessment factors, weight coefficients, and dynamic threshold adjustment strategies for each risk dimension; Based on the risk assessment rule configuration instructions, initialize the risk assessment engine and associate it with the corresponding real-time data stream channel; The configured risk assessment rules are solidified into an executable risk assessment template; The risk assessment factors include air-fuel ratio deviation, vehicle yaw rate, ECU temperature change rate, and individual battery cell voltage difference.

3. The multi-module collaborative safe power supply control method according to claim 1, characterized in that, The construction of the multi-dimensional risk assessment matrix includes: The collected raw data is filtered to remove noise and outliers to obtain preprocessed data; The continuous variables in the preprocessed data are discretized into risk level intervals, and the categorical variables are mapped into risk contribution weights. Based on the sliding time window, the short-term trend slope of each risk assessment factor is calculated; The fuzzy comprehensive evaluation method is adopted to integrate the static risk value with the dynamic trend term corresponding to the short-term trend slope, and output the real-time risk score of each risk dimension. Based on preset weights, the real-time risk scores of each risk dimension are weighted and synthesized into a comprehensive risk index for the entire domain.

4. The multi-module collaborative safe power supply control method according to claim 1, characterized in that, The risk dimensions of the multi-dimensional risk assessment matrix include emission exceedance risk, driving instability risk, system downtime risk, and battery thermal runaway risk; the execution of the coordinated control strategy includes at least one of the following linked operations: When the real-time risk score corresponding to the emission exceedance risk exceeds the first threshold, the CPU utilization rate of the central processing unit of the power domain submodule is increased, and the power supply of the low-security-level power chip to the entertainment or lighting function unit in the intelligent domain submodule is turned off. When the real-time risk score corresponding to the driving instability risk exceeds the second threshold, the chassis domain submodule temporarily takes over the control of the steering subsystem and braking subsystem, reduces the motor output torque, and prohibits the supply of power to unnecessary actuators in the chassis domain submodule through the low safety level power chip. When the real-time risk score corresponding to the system downtime risk exceeds the third threshold, the redundant communication link is activated, the critical task is migrated to the backup processing core, and all power output of the low-security-level power chip is cut off to reduce the system load. When the real-time risk score corresponding to the battery thermal runaway risk exceeds the fourth threshold, the power domain submodule cuts off the fast charging circuit, starts the liquid cooling pump, triggers a cloud-based early warning command, and only retains the power supply of the high-safety-level power chip to the safety-critical submodule.

5. The multi-module collaborative safe power supply control method according to claim 1, characterized in that, The method further includes: A dual-branch collaborative control model is constructed, which includes a risk prediction subnetwork and an intervention effect evaluation subnetwork. The risk prediction sub-network is based on a hybrid architecture of Long Short-Term Memory (LSTM) network and Transformer, and is used to predict the multidimensional risk evolution trajectory within the next T seconds based on the current risk state. The intervention effect evaluation subnetwork is based on a reinforcement learning policy network and is used to evaluate the expected return of different collaborative control actions on risk suppression. The collaborative control actions include power supply path switching, power chip start-up and shutdown, load redistribution, and functional submodule takeover. Obtain a trajectory dataset, which includes historical risk sequences, coordinated control actions, and subsequent risk changes; Based on the trajectory dataset, the dual-branch cooperative control model is jointly trained using the Actor-Critic algorithm; The real-time risk status is input into the trained dual-branch cooperative control model, which outputs the optimal cooperative control action sequence.

6. The multi-module collaborative safe power supply control method according to claim 5, characterized in that, The jointly trained dual-branch cooperative control model includes: The trajectory dataset is divided into state sequences, action sequences, and reward sequences; The state sequence is input into the risk prediction subnetwork to obtain the predicted risk trajectory; The state sequence and the action sequence are input into the intervention effect evaluation subnetwork, and the action value Q is output. The predicted loss is calculated based on the mean square error between the actual risk trajectory and the predicted risk trajectory. The policy gradient is calculated based on the temporal difference error between the actual reward and the action value Q. The prediction loss and the policy gradient are alternately optimized to achieve end-to-end training of the dual-branch collaborative control model.

7. The multi-module collaborative safe power supply control method according to claim 5, characterized in that, After implementing the coordinated control strategy, the method also includes: Monitor and collect system status parameters after the execution of the collaborative control strategy. The system status parameters include changes in the output characteristics of the power chip under the power supply control strategy and the load of the processing unit and the task response timing under the task migration strategy. Based on the system state parameters, an intervention effectiveness index reflecting the degree of risk suppression is calculated using a preset quantitative evaluation model; the quantitative evaluation model comprehensively considers the speed of short-term risk suppression and long-term system stability. The intervention effect index is compared with a preset safety standard. When the intervention effect index fails to meet the standard, an adjustment instruction for the collaborative control strategy is triggered. The adjustment instruction includes a power redistribution instruction for the power supply control strategy or a target unit optimization instruction for the task migration strategy.

8. A multi-module collaborative safety power supply control system, characterized in that, An intelligent domain controller for motorcycles, comprising multiple functional submodules, is provided. These submodules include a power domain submodule, a chassis domain submodule, an intelligent domain submodule, and a power management submodule. The power management submodule includes a high-safety-level power chip and a low-safety-level power chip. The system includes: The data acquisition unit is used to actively poll the registers and status interfaces of each functional submodule, and listen to the network communication bus and internal event bus to collect running status data and environmental context data, and obtain a real-time status list of the entire domain. The risk assessment unit is used to construct a multi-dimensional risk assessment matrix based on the real-time status list of the entire domain; The strategy decision-making unit is used to determine the collaborative control strategy based on the multi-dimensional risk assessment matrix. The collaborative control strategy includes a functional module scheduling strategy and a power supply control strategy. The functional module scheduling strategy is configured as follows: the affected critical tasks are migrated from the original processing unit to the target processing unit powered by the high-security-level power chip; the power supply control strategy is configured as follows: when the real-time risk score corresponding to any risk dimension exceeds a preset threshold, the power supply of the low-security-level power chip to non-critical loads is limited or cut off, and the affected critical tasks are migrated to the processing unit powered by the high-security-level power chip. The execution and feedback unit is used to execute the collaborative control strategy and monitor the risk suppression effect; if the risk suppression effect does not reach the preset safety standard, a multimodal intervention plan including power supply coordination and task migration is activated to form an adaptive safety control closed loop.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the multi-module collaborative safe power supply control method as described in any one of claims 1 to 7.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the steps of the multi-module collaborative safe power supply control method as described in any one of claims 1 to 7.

Images