Control system and method, storage medium, controller, vehicle and product

Abstract

The invention relates to a control system and method, a storage medium, a controller, a vehicle and a product. The control system comprises a first function controller and a redundant controller. The redundant controller is used for migrating a first function code in a first function controller to a target controller under the condition that the first function controller meets a control abnormal condition, so that the target controller can run the first function code to realize the function of the first function controller; the target controller is the second function controller or the redundant controller, so that when the first function controller is abnormal, the function of the first function controller can be realized, and the reliability and availability of the control system are improved.

Description

Technical Field

[0001] This application relates to the field of control technology, and in particular to a control system, method, storage medium, controller, vehicle, and product. Background Technology

[0002] As vehicles become increasingly intelligent, their functions are becoming more and more abundant. Some functions require powerful computing capabilities, so dedicated controllers are set up for these functions. For example, intelligent driving controllers are set up for advanced intelligent driving functions, and cockpit controllers are set up for intelligent cockpit functions.

[0003] When a controller malfunctions, the corresponding function of that controller cannot be realized, thereby reducing the reliability and availability of the control system. Summary of the Invention

[0004] This application provides a control system that can still perform the functions of the controller when the controller malfunctions, thereby improving the reliability and availability of the control system and at least partially solving the above-mentioned technical problems.

[0005] To achieve the above objectives, according to a first aspect of this application, a control system is provided, including a first functional controller and a redundant controller;

[0006] The redundant controller is used to migrate the first function code in the first function controller to the target controller when the first function controller meets the control abnormality conditions, so that the target controller can run the first function code to realize the function of the first function controller.

[0007] The target controller mentioned above is either the second functional controller or the redundant controller mentioned above.

[0008] Optionally, a first control data transmission channel is provided between the first functional controller and the redundant controller. The first control data transmission channel is used to transmit a first control instruction from the redundant controller. The first control instruction is used to instruct the first functional controller to migrate the first functional code.

[0009] Optionally, the first control data transmission channel is configured to transmit first data from the redundant controller to the first functional controller, the first data including the first control command.

[0010] Optionally, the first functional controller is adapted to establish a second control data transmission channel with the target controller, the second control data transmission channel being used to transmit the first functional code.

[0011] Optionally, the second control data transmission channel is configured to transmit second data from the first functional controller to the target controller, the second data including the first functional code.

[0012] Optionally, a first communication data transmission channel is provided between the first functional controller and the target controller. The first communication data transmission channel is used to transmit the load data received by the first functional controller, and the target controller is used to run the first functional code based on the load data.

[0013] Optionally, when the target controller is the redundant controller, the first communication transmission channel is configured to transmit third data from the first functional controller to the redundant controller, the third data including the load data.

[0014] Optionally, when the target controller is the second functional controller, the first communication transmission channel is configured to transmit data from the first functional controller to the second functional controller and from the second functional controller to the first functional controller.

[0015] Optionally, the aforementioned first functional controller can be any of the following: vehicle control controller, intelligent driving controller, or cockpit controller.

[0016] Optionally, the second functional controller mentioned above is one of the two remaining controllers other than the first controller among the vehicle control controller, intelligent driving controller, and cockpit controller.

[0017] Optionally, the first functional controller is an intelligent driving controller, and the second functional controller is a cockpit controller; or, the first functional controller is a cockpit controller, and the second functional controller is an intelligent driving controller.

[0018] Optionally, the first functional controller is a vehicle control controller, and the target controller is the redundant controller.

[0019] Optionally, if the target controller is a second functional controller, a third control data transmission channel is further provided between the second functional controller and the redundant controller. The third control data transmission channel is used to transmit the second control command of the redundant controller, which is used to instruct the second functional controller to delete the first functional code.

[0020] Optionally, the third control data transmission channel is used to transmit the third control command of the redundant controller, and the third control command is also used to instruct the migration of the second function code in the second function controller to the first function controller.

[0021] The second control data transmission channel between the first functional controller and the second functional controller is used to transmit the second functional code.

[0022] Optionally, the aforementioned control anomaly conditions are used to indicate that the aforementioned first functional controller will malfunction or is malfunctioning.

[0023] Optionally, the above-mentioned control anomaly conditions are determined based on the performance data of the first functional controller.

[0024] Optionally, the control system further includes external devices for the first functional controller, including a target external device and a backup external device. The redundant controller is further configured to control the first functional controller to use the backup external device when the target external device of the first functional controller meets a preset abnormal condition.

[0025] Optionally, the aforementioned external device is a power supply and / or a communication bus.

[0026] Optionally, the aforementioned preset abnormal conditions are determined based on the electrical data of the target power supply and / or the load data of the aforementioned first functional controller.

[0027] Optionally, the aforementioned preset abnormal conditions are used to indicate that the external device will malfunction or is malfunctioning.

[0028] Optionally, the aforementioned control system is integrated into a computing platform.

[0029] According to a second aspect of this application, a control method is provided, comprising:

[0030] When the first functional controller meets the control abnormality conditions, the first functional code in the first functional controller is migrated to the target controller, so that the target controller can run the first functional code to realize the function of the first functional controller.

[0031] The target controller mentioned above is a secondary function controller or a redundant controller.

[0032] Optionally, migrating the first function code in the first function controller to the target controller includes:

[0033] A first control instruction is sent to the first function controller, which instructs the first function controller to migrate the first function code to the target controller.

[0034] Optionally, this embodiment also includes:

[0035] The first functional controller is determined to meet the control anomaly conditions, which are used to indicate that the first functional controller will malfunction or is malfunctioning.

[0036] Optionally, determining that the aforementioned first functional controller meets the control anomaly conditions includes:

[0037] Obtain the performance data of the first functional controller from the first functional controller;

[0038] Based on the performance data of the first functional controller, determine whether the first functional controller meets the above-mentioned control anomaly conditions.

[0039] Optionally, the external devices of the aforementioned first functional controller include a target external device and a backup external device. This embodiment also includes:

[0040] When the target external device of the first functional controller meets the preset abnormal conditions, the first functional controller is controlled to use the backup external device.

[0041] Optionally, the aforementioned external device is a power supply and / or a communication bus.

[0042] Optionally, this embodiment also includes:

[0043] Obtain electrical data of the target power supply and / or load data of the first functional controller from the first functional controller mentioned above;

[0044] Based on the electrical data of the target power source, determine whether the target power source meets the aforementioned preset abnormal conditions; and / or,

[0045] Based on the above load data, determine whether the target communication bus meets the above preset abnormal conditions.

[0046] Optionally, the aforementioned preset abnormal conditions are used to indicate that the external device will malfunction or is malfunctioning.

[0047] Optionally, this embodiment also includes:

[0048] A second control instruction is sent to the second function controller, which instructs the second function controller to delete the first function code.

[0049] According to a third aspect of this application, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed by a processor, implements the steps in the embodiments of this application.

[0050] According to a fourth aspect of this application, a controller is also provided, on which a computer program is stored, which, when executed by a processor, implements the steps in the embodiments of this application.

[0051] According to a fifth aspect of this application, a vehicle is also provided, including the controller or control system described in the embodiments of this application.

[0052] According to a sixth aspect of this application, a computer program product is also provided, including a computer program or instructions that, when executed by a processor, implement the steps in the embodiments of this application.

[0053] In summary, in the embodiments of this application, the control system includes a first functional controller and a redundant controller. The redundant controller is used to migrate the first functional code in the first functional controller to the target controller when the first functional controller meets the control abnormal conditions, so that the target controller can run the first functional code to realize the function of the first functional controller. The target controller is a second functional controller or a redundant controller, so that when the first functional controller is abnormal, the function implemented by the functional controller can be realized through the target controller, thereby improving the reliability and availability of the control system.

[0054] Other features and advantages of this application will be described in detail in the following detailed description section. Attached Figure Description

[0055] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0056] To gain a more complete understanding of this application and its beneficial effects, the following description will be provided in conjunction with the accompanying drawings, wherein the same reference numerals in the following description denote the same parts.

[0057] Figure 1 This is a schematic diagram of a control system provided in an exemplary embodiment of this application;

[0058] Figure 2 This is a schematic diagram of a redundant controller provided in an exemplary embodiment of this application;

[0059] Figure 3 This is a schematic diagram of the computing platform provided in an exemplary embodiment of this application;

[0060] Figure 4 This is another schematic diagram of the computing platform provided in an exemplary embodiment of this application;

[0061] Figure 5 This is a flowchart illustrating a control method provided in an exemplary embodiment of this application;

[0062] Figure 6 This is a schematic diagram of a control device provided in an exemplary embodiment of this application. Detailed Implementation

[0063] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the protection scope of this application.

[0064] This application provides a control system; please refer to [link / reference]. Figure 1 The control system includes a first functional controller and a redundant controller. The redundant controller is used to migrate the first functional code in the first functional controller to the target controller when the first functional controller meets the control abnormal conditions, so that the target controller can run the first functional code to realize the function of the first functional controller. The target controller is a second functional controller or a redundant controller.

[0065] When the target controller is a second functional controller, the control system may further include a second functional controller. A functional controller refers to a controller that can perform a specific function. This specific function can be set according to actual conditions. For example, when the control system is a robot control system, the functional controller includes a motion controller or a path planning controller. The specific function implemented by the motion controller is motion, which enables the robot to perform motion. The specific function implemented by the path planning controller is path planning, which enables the robot to perform path planning. As another example, when the control system is a vehicle control system, the functional controller may include a driving controller, a cockpit controller, and a vehicle control controller. The specific function implemented by the driving controller is intelligent driving, which enables the vehicle to drive autonomously. The specific function implemented by the cockpit controller is cockpit functionality, such as entertainment and human-computer interaction, which provides passengers with a comfortable and rich interactive experience. The specific function implemented by the vehicle control controller is vehicle control, which enables the vehicle to control its power system, chassis system, and body system.

[0066] The first functional controller can be any one of the functional controllers. The second functional controller can be any functional controller other than the first functional controller. The functions implemented by the first functional controller and the functions implemented by the second functional controller are different. For ease of description, the function implemented by the first functional controller is referred to as the first function, and the function implemented by the second functional controller is referred to as the second function. For example, the first functional controller is the intelligent driving controller, and the first function is the intelligent driving function; the second controller is the cockpit controller, and the second function is the cockpit function; or, the first functional controller is the cockpit controller, and the first function is the cockpit function; the second controller is the intelligent driving controller, and the second function is the intelligent driving function.

[0067] The first function code refers to the code in the first function controller that implements the first function. The second function controller may include the second function code, which refers to the code that implements the second function. Code migration refers to the technical modification process of copying program code from the original running system to the new target system. It is understood that in this embodiment, when the first function code is migrated to the target controller, the first function controller still retains the first function code.

[0068] A redundant controller is a component designed in a control system to improve the reliability and availability of the control system. When the functional controller fails, it can switch to a backup controller.

[0069] The first functional controller and the second functional controller are redundant controllers. Specifically, the second functional controller can serve as a backup controller for the first functional controller, or the first functional controller can serve as a backup controller for the second functional controller. For example, the functional controller includes an intelligent driving controller and a cockpit controller. The cockpit controller can serve as a backup controller for the intelligent driving controller. In this case, the first functional controller is the intelligent driving controller, and the second functional controller is the cockpit controller. And / or, the intelligent driving controller can serve as a backup controller for the cockpit controller. In this case, the first functional controller is the cockpit controller, and the second functional controller is the intelligent driving controller.

[0070] Optionally, redundant controllers can be configured according to actual conditions. For example, they can be determined based on the chip type and / or the function implemented by the controller. For instance, if the chips on the intelligent driving controller and the cockpit controller are both SOC chips, the intelligent driving controller and the cockpit controller can be redundant controllers. Or, if the chip on the vehicle control controller is an MCU and the chip on the redundant controller is an FPGA, the redundant controller can serve as a backup controller for the vehicle control controller.

[0071] When the target controller is a second functional controller, it is also used to run second functional code to implement the second function. When the target controller is a second functional controller, if any of the redundant functional controllers is malfunctioning or about to malfunction, the function implemented by that functional controller can be implemented through another functional controller. For example, if the first functional controller is the intelligent driving controller and the second functional controller is the cockpit controller, the intelligent driving function can be implemented through the cockpit controller when the intelligent driving controller is malfunctioning or about to malfunction. Alternatively, if the first functional controller is the cockpit controller and the second functional controller is the intelligent driving controller, the cockpit function can be implemented through the intelligent driving controller when the cockpit controller is malfunctioning or about to malfunction, thus ensuring the normal operation of both the intelligent driving function and the cockpit function.

[0072] When the target controller is a redundant controller, it serves as a backup controller for the functional controller. This ensures that if the first functional controller is about to fail, the redundant controller can still perform the function intended by that functional controller. For example, if the first functional controller is a vehicle control controller and the target controller is redundant, the vehicle control function can still operate normally even if the vehicle control controller is currently failing or about to fail.

[0073] Control anomaly conditions are pre-set conditions; for example, control anomaly conditions are used to indicate that the first functional controller will malfunction or is malfunctioning. When control anomaly conditions are used to indicate that the first functional controller will malfunction, it is possible to predict the malfunction before it occurs, thereby further ensuring that the function of the control system is not affected, and further guaranteeing the availability and reliability of the control system.

[0074] In some embodiments, the method for determining whether the first functional controller meets the control anomaly conditions can be set according to the actual situation, and this embodiment does not limit it. For example, the method can be based on at least one of the performance data of the first functional controller, the log file of the first functional controller, and the actuator controlled by the first functional controller. That is, the control anomaly conditions can be determined based on at least one of the performance data of the first functional controller, the log file of the first functional controller, and the actuator controlled by the first functional controller.

[0075] When determining whether the first functional controller meets the control anomaly conditions based on the performance data of the first functional controller, the redundant controller can obtain performance data from the first functional controller. The performance data can be at least one of CPU utilization, memory usage, data processing speed, and latency. Specifically, it can be determined that the first functional controller meets the control anomaly conditions when at least one of CPU utilization, memory usage, data processing speed, and latency is not within a preset threshold range. Alternatively, the performance data can be analyzed using a large language model (AI), and the determination of whether the first functional controller meets the control anomaly conditions can be based on the analysis results.

[0076] In this embodiment, a redundant controller is set up. When the first functional controller meets the control abnormality conditions, the first function code in the first functional controller is migrated to the target controller, so that the target controller can run the first function code to realize the function implemented by the first functional controller. The target controller is a second functional controller or a redundant controller, so that when the first functional controller is abnormal, the function implemented by the functional controller can be realized through the target controller, thereby improving the reliability and availability of the control system.

[0077] In some embodiments, a first control data transmission channel is provided between the first functional controller and the redundant controller. The first control data transmission channel is used to transmit a first control instruction from the redundant controller. The first control instruction is used to instruct the first functional controller to migrate the first functional code.

[0078] The type of the first control data transmission channel can be set according to the chip type of the first functional controller. For example, when the chip type of the first functional controller is a SOC chip, the first control data transmission channel can be a PCIe channel; when the chip type of the first functional controller is an MCU, the first control data transmission channel can be an SPI channel. This embodiment does not limit this.

[0079] After receiving the first function code through the first control data channel, the first function controller can send the first function code to the target controller so that the first function code can be migrated to the target controller.

[0080] Optionally, when the target controller is a redundant controller, the first functional controller can send the first functional code to the redundant controller through the first control data transmission channel.

[0081] In this embodiment, a first control data transmission channel is provided between the first functional controller and the redundant controller. The first control data transmission channel is used to transmit the first control command of the redundant controller. The first control command is used to instruct the first functional controller to migrate the first function code, thereby realizing the transmission of the first control command through the first control data transmission channel and improving the transmission efficiency of the first control command.

[0082] In some embodiments, the first control data transmission channel is configured to transmit first data from a self-redundant controller to a first functional controller, the first data including a first control command.

[0083] The data transmitted from the redundant controller to the first functional controller can be referred to as the first data. Optionally, the first control data transmission channel can also be configured to transmit performance data of the first functional controller from the first functional controller to the redundant controller.

[0084] In this embodiment, the first control data transmission channel is configured to transmit first data from the self-redundant controller to the first functional controller. The first data includes a first control command, thereby enabling the redundant controller to actively transmit the first control command to the first functional controller.

[0085] In some embodiments, the first functional controller is adapted to establish a second control data transmission channel with the target controller, the second control data transmission channel being used to transmit the first functional code.

[0086] In this embodiment, when the target controller is a redundant controller, the second control data transmission channel and the first control data transmission channel can be the same transmission channel or different transmission channels; this is not limited in this embodiment. The type of the second control data transmission channel can be set according to the chip type of the first functional controller and the chip type of the target controller. For example, when both the chip type of the first functional controller and the chip type of the second functional controller are SOC chips, the second control data transmission channel can be a PCIe channel or an SPI channel. When the chip type of the first functional controller is an MCU and the chip type of the redundant controller is an FPGA, the second control data transmission channel can be an SPI channel; this is not limited in this embodiment.

[0087] In this embodiment, the first functional controller is adapted to establish a second control data transmission channel with the target controller. The second control data transmission channel is used to transmit the first functional code, so as to improve the transmission efficiency of the first functional code by transmitting the first functional code through the second control data transmission channel.

[0088] In some embodiments, the second control data transmission channel is configured to transmit second data from the first function controller to the target controller, the second data including the first function code.

[0089] Wherein, when the target controller is a redundant controller and the second control data transmission channel and the first control data transmission channel can be the same channel, the data transmitted by the first functional controller to the redundant controller through the first control data transmission channel is called the second data, which includes the first function code or the performance data of the first functional controller. The data transmitted by the redundant controller to the first functional controller through the first control data transmission channel is called the first data, which includes the first control command.

[0090] In this embodiment, the second control data transmission channel is configured to transmit second data from the first functional controller to the target controller. The second data includes the first functional code, thereby enabling the first functional controller to actively transmit the second data to the target controller.

[0091] In some embodiments, a first communication data transmission channel is provided between the first functional controller and the target controller. The first communication data transmission channel is used to transmit load data received by the first functional controller, and the target controller is used to run the first functional code based on the load data.

[0092] The load data may include the input data of the first functional controller, and the first communication data transmission channel may be used to transmit the input data and / or output data of the first functional controller to the target controller.

[0093] Input data may include at least one of the following: data collected by the sensors corresponding to the first functional controller, data output by the ECU, and status data of the actuator; this embodiment does not limit the types of data. Output data is the data processed by the first functional controller, which may be instructions sent by the first functional controller to the actuator or data sent to other controllers.

[0094] It is understandable that when the target controller is a second functional controller, the first communication data transmission channel can also transmit the load data of the second functional controller to the first functional controller. For example, the functional controller includes a driving controller and a cockpit controller, and a first communication data transmission channel is provided between the driving controller and the cockpit controller. The first communication data transmission channel can transmit the load data of the driving controller to the cockpit controller, and vice versa.

[0095] In this embodiment, a first communication data transmission channel is provided between the first functional controller and the target controller. The first communication data transmission channel is used to transmit the load data received by the first functional controller. The target controller is used to run the first functional code based on the load data, so that it is not necessary to obtain the load data from the first functional controller. This ensures that the load data of the first functional controller can be transmitted to the target controller, further ensuring the normal functioning of the first functional controller, thereby further ensuring the reliability and availability of the control system.

[0096] In some embodiments, when the target controller is a redundant controller, the first communication transmission channel is configured to transmit third data from the first functional controller to the redundant controller, the third data including load data.

[0097] In some embodiments, when the target controller is a second functional controller, the first communication transmission channel is configured to transmit data from the first functional controller to the second functional controller and from the second functional controller to the first functional controller. Specifically, the first communication data transmission channel can transmit input data and / or output data of the second functional controller to the first functional controller, and vice versa.

[0098] In some embodiments, the first functional controller is any one of the following: vehicle control controller, intelligent driving controller, or cockpit controller.

[0099] In some embodiments, the second functional controller is one of the two remaining controllers other than the first functional controller among the vehicle control controller, intelligent driving controller, and cockpit controller.

[0100] In some embodiments, the first functional controller is a smart driving controller and the second functional controller is a cockpit controller, or the first functional controller is a cockpit controller and the second functional controller is a smart driving controller.

[0101] In some embodiments, the first functional controller is a vehicle control controller, and the target controller is a redundant controller.

[0102] In some embodiments, a third control data transmission channel is further provided between the second functional controller and the redundant controller. This third control data transmission channel is used to transmit a second control command from the redundant controller, which instructs the second functional controller to delete the first functional code. Specifically, when the first functional controller fails to meet the control anomaly conditions, it indicates that the first functional controller has returned to normal and can perform the first function. Therefore, when the redundant controller detects that the first functional controller meets the control anomaly conditions, it can transmit a second control command to the second functional controller via the third control data transmission channel. This allows the second functional controller to delete the first functional code based on the second control command, eliminating the need for the first functional code to be stored in the second functional controller long-term and saving the second functional controller's computer resources.

[0103] It is understandable that when the target controller is a redundant controller, the redundant controller will delete the first function code when it determines that the first function controller does not meet the control anomaly conditions.

[0104] In some embodiments, a third control data transmission channel is used to transmit a third control instruction from the redundant controller. This third control instruction instructs the migration of second function code from the second function controller to the first function controller. A second control data transmission channel between the first and second function controllers is used to transmit the second function code. Specifically, when the redundant controller determines that the second function controller meets control anomaly conditions, it can send a second control instruction to the second function controller via the third control data transmission channel. Based on the second control instruction, the second function controller transmits the second function code to the first function controller, enabling the first function controller to execute the second function code and implement the second function. The method for determining whether the second function controller meets control anomaly conditions can be the same as that for determining whether the first function controller meets control anomaly conditions; this embodiment will not elaborate further.

[0105] Understandably, after the second function code is migrated to the first function controller, the second function controller retains the second function code. Optionally, the redundant controller can also transmit a fifth control instruction through the first control data transmission channel. The fifth control instruction is used to instruct the first function controller to delete the second function code in order to save the computer resources of the first function controller.

[0106] In some embodiments, the control system further includes external devices for the first functional controller, including a target external device and a backup external device. The redundant controller is further configured to control the first functional controller to use the backup external device when the target external device of the first functional controller meets a preset abnormal condition.

[0107] In this context, the external devices of the first functional controller refer to devices connected to the first functional controller and used to assist the first functional controller in its normal operation to achieve specific functions. These devices can be configured according to actual conditions; for example, the external devices can be a power supply and / or a communication bus. The power supply provides power to the first functional controller, which acquires input data and outputs processed data through the communication bus. The type of communication bus can be configured according to actual conditions; for example, the communication bus can be at least one of LLN bus, Ethernet bus, CAN bus, and CANFD bus. This embodiment does not impose any limitations on this.

[0108] The target external device and the backup external device are the same type of external device. For example, when the external device is a power supply, the target external device is the target power supply and the backup external device is the backup power supply. Or, when the external device is a communication bus, the target external device is the communication bus and the backup external device is the backup communication bus.

[0109] When the external device is a power supply, power redundancy is achieved; when the external device is a communication bus, communication redundancy is achieved. This realizes three redundancy architectures: power redundancy, communication redundancy, and control redundancy, ensuring sufficient backup of the control system. When any hardware fails, the function of the first functional controller can still be guaranteed through another redundant hardware, further ensuring the availability and reliability of the control system.

[0110] When the external devices are a power supply and a communication bus, the redundant controller can have four functions: redundant control of the power supply, redundant control of the communication bus, redundant control of the controller itself, and a backup controller for the functional controller. Redundant control of the power supply includes determining whether the target power supply meets preset abnormal conditions and switching the target power supply to the backup power supply. Redundant control of the communication bus includes determining whether the target communication bus meets preset abnormal conditions and switching the target communication bus to the backup communication bus. The redundant controller is used to determine whether the first functional controller meets control abnormal conditions, migrate the first functional code to the target controller, and execute the first functional code through the target controller. Figure 2 As shown.

[0111] The target external device and the backup external device are redundant. Typically, the function controller uses the target external device, and when the target external device meets preset abnormal conditions, it controls the first function controller to use the backup external device. For example, when the target power supply meets preset abnormal conditions, the first function controller is controlled to use the backup power supply, meaning the backup power supply powers the first function controller. Similarly, when the target communication bus meets preset abnormal conditions, the first function controller is controlled to use the backup communication bus to acquire input data and output processed data.

[0112] Preset anomaly conditions are used to indicate that an anomaly exists in the target external device. Specifically, they can be used to indicate that the target external device is about to malfunction or is malfunctioning. When preset anomaly conditions are used to indicate that the target external device is about to malfunction, the fault can be predicted before it occurs, thereby further ensuring that the function of the control system is not affected and further guaranteeing the availability and reliability of the control system.

[0113] Optionally, the method for determining whether an external device meets the preset abnormal conditions can be set according to the actual situation. For example, when the external device includes a target power supply and a backup power supply, the preset abnormal conditions can be determined based on the electrical data of the target power supply. The electrical data can include at least one of the power, voltage and temperature of the target power supply, and / or, when the external device includes a target communication bus and a backup communication bus, the preset abnormal conditions can be determined based on the load data of the first function controller. This embodiment does not limit this.

[0114] Optionally, when the external device is a power supply, the target power supply may be determined to meet the preset abnormal conditions when at least one of the following is not within the preset range: the rate of decrease of the target power supply's charge, voltage, and temperature. Alternatively, the target power supply's charge, power, and temperature may be analyzed using a large language model (AI), and the target power supply may be determined to meet the preset abnormal conditions based on the analysis results. This embodiment does not limit the specifics.

[0115] Optionally, when the external device is a communication bus, it can be determined that the target communication bus meets the preset abnormal conditions when the input data cannot be obtained through the target communication bus and / or other devices cannot obtain the data processed by the first function controller from the first function controller through the target communication bus. Alternatively, the communication data can be analyzed by a large language model (AI), and the target communication bus can be determined based on the analysis results. This embodiment does not limit this.

[0116] Optionally, when the external device includes a power supply and a communication bus, the preset abnormal conditions may include a first preset abnormal condition and a second preset abnormal condition, determining whether the target power supply meets the first preset abnormal condition and whether the target communication bus meets the second preset abnormal condition.

[0117] In this embodiment, a backup external device is provided. The redundant controller is also used to control the first functional controller to use the backup external device when the target external device of the first functional controller meets the preset abnormal conditions. This ensures that the backup external device can be used when the target external device is abnormal, thereby ensuring the normal operation of the first functional controller and further ensuring the availability and reliability of the control system.

[0118] In some embodiments, the second functional controller may also have external devices. The control method of the external devices of the second functional controller can refer to the control method of the external devices of the first functional controller, which will not be repeated here.

[0119] In some embodiments, the control system is located on a computing platform. This computing platform, also known as a central computing platform, highly integrates computing resources, reduces the number of ECUs and wiring harnesses, and effectively lowers hardware costs and production assembly complexity. Simultaneously, the centralized architecture facilitates unified software development and management, accelerates the development and deployment of new features, and meets the needs of automakers for rapid new product launches and iterative upgrades.

[0120] For example, when the functional controller includes the intelligent driving controller, cockpit controller, and vehicle control controller, and external devices are used as power sources, the computing platform can, as follows: Figure 3 As shown, in Figure 3 In the context of the above, when the first functional controller is the intelligent driving controller, the target controller is the second functional controller, and the second functional controller is the cockpit controller, the PCIe channel or SPI channel between the intelligent driving controller and the cockpit controller is the second control data transmission channel; the PCIe channel between the intelligent driving controller and the redundant controller is the first control data transmission channel; and the PCIe channel between the cockpit controller and the redundant controller is the third control data transmission channel. When the first functional controller is the cockpit controller, the target controller is the second functional controller, and the second functional controller is the intelligent driving controller, the PCIe channel or SPI channel between the intelligent driving controller and the cockpit controller is the second control data transmission channel; the PCIe channel between the cockpit controller and the redundant controller is the first control data transmission channel; and the PCIe channel between the intelligent driving controller and the redundant controller is the third control data transmission channel. When the first functional controller, the vehicle control controller, and the target controller are all redundant controllers, the SPI channel between the vehicle control controller and the redundant controller is not only the first control data transmission channel but also the second control data transmission channel.

[0121] In related technologies, the computing platform integrates functional controllers such as vehicle control controller, intelligent driving controller, and cockpit controller to realize the vehicle control function. Once any abnormality occurs in the functional controller, it will affect the computing platform, thereby affecting the vehicle function and ultimately affecting driving safety.

[0122] In this embodiment, the control system includes a functional controller and a redundant controller. The redundant controller is used to migrate the first functional code in the first functional controller to the target controller when the first functional controller meets the control anomaly conditions, so that the target controller can run the first functional code to realize the function implemented by the first functional controller. The target controller is a second functional controller or a redundant controller. The control system is set on a computing platform so that the function of the first functional controller can be guaranteed even when the first functional controller is abnormal, so that the function of the computing platform is not affected by the anomaly, thereby improving the reliability, availability and functional safety level of the computing platform and ensuring the reliability and safety of driving under the control of the computing platform.

[0123] In some embodiments, the circuit connection method on the computing platform can be configured according to actual conditions. For example, the circuit connection method of the computing platform can be as follows: Figure 4 As shown, the communication bus includes an Ethernet bus. Figure 4 The ADAS camera in this context refers to the camera used in advanced driver assistance systems. Figure 4 In this context, DMS camera refers to the driver monitoring system camera, OMS camera refers to the passenger monitoring system camera, DVR camera refers to the digital video recorder camera, CMS refers to the camera monitoring system, and ICMS refers to the integrated camera monitoring system.

[0124] The control system provided in this application will be further described below. In this embodiment, intelligent driving control, cockpit controller, and vehicle control controller are used as examples of functional controllers, and power supply and communication bus are used as examples of external devices. Control abnormal conditions are used to indicate that the first functional controller is about to malfunction, and preset abnormal conditions are used to indicate that the external device is about to malfunction.

[0125] The computing platform includes not only intelligent driving control, cockpit controller, vehicle control controller, and redundant controllers, but also target power supply and backup power supply, as well as target communication bus and backup communication bus. The computing platform incorporates three types of redundancy control: power supply redundancy control, communication bus redundancy control, and controller redundancy control. Power supply redundancy control is achieved through the target power supply and backup power supply; communication bus redundancy control is achieved through the target communication bus and backup communication bus; and controller redundancy control is achieved through the intelligent driving control, cockpit controller, vehicle control controller, and redundant controllers. This triple redundancy architecture ensures sufficient backup for the computing platform's hardware design. Even if any hardware component fails, the redundant hardware component can still ensure the computing platform continues to operate normally.

[0126] In terms of controller redundancy, the intelligent driving controller and the cockpit controller are redundant. When the intelligent driving controller malfunctions, its first function code can be migrated to the cockpit controller, which then runs both the first and second function codes simultaneously, ensuring the intelligent driving function continues to operate normally even when the intelligent driving controller malfunctions. Similarly, when the cockpit controller malfunctions, its second function code can be migrated to the intelligent driving controller, which also runs both functions simultaneously, ensuring the cockpit function continues to operate normally even when the cockpit controller malfunctions. The vehicle control controller and the redundant controller are also redundant. When the vehicle control controller malfunctions, its first function code can be migrated to the redundant controller, ensuring the vehicle control function continues to operate normally even when the vehicle control controller malfunctions.

[0127] For fault prediction, the redundant controller is connected to the intelligent driving controller and the cockpit controller (e.g., via PCIe channels) Figure 3 As shown, the redundant controller connects to the vehicle control controller via an SPI channel to obtain performance data and power supply electrical data (the power supply electrical data can also be obtained directly from the power supply). The redundant controller also connects to the power supply via an SPI / IIC channel to obtain electrical data from the power supply. Based on the electrical data, the redundant controller predicts potential faults in the target power supply; based on load data, it predicts potential faults in the target communication bus; and based on performance data, it predicts potential faults in the functional controller.

[0128] When the redundant controller predicts a failure in the target power supply, it sets the target power supply to sleep mode or disconnects its input power, while simultaneously activating the backup power supply for power switching. When a failure in the target communication bus is predicted, a command is sent to the corresponding functional controller, which then switches the target communication bus to the backup communication bus. When a failure in the first functional controller is predicted, its functions are migrated to the target controller, and the first functional controller is either set to sleep mode or its input power is turned off.

[0129] In this embodiment, a triple redundancy architecture—power redundancy, communication redundancy, and control redundancy—ensures sufficient backup for the computing platform's hardware design. Even if any hardware component fails, the redundant hardware component ensures the platform's continued operation. Furthermore, a redundant controller is implemented. This controller uses AI to perform real-time dynamic analysis of the electrical, load, and performance data transmitted to the computing platform. This allows for fault prediction, early isolation, and real-time switching before failures occur, ensuring the computing platform's functionality is unaffected by faults. This significantly improves the platform's reliability and functional safety level, guaranteeing operational reliability within the computing platform architecture.

[0130] As can be seen from the above, in the embodiments of this application, the control system includes a first functional controller and a redundant controller. The redundant controller is used to migrate the first functional code in the first functional controller to the target controller when the first functional controller meets the control abnormal conditions, so that the target controller can run the first functional code to realize the function of the first functional controller. The target controller is a second functional controller or a redundant controller, so that when the first functional controller is abnormal, the function implemented by the functional controller can be realized through the target controller, thereby improving the reliability and availability of the control system.

[0131] The following is based on Figure 5 The control method provided in this application will be described below. In this embodiment, the control method includes step 100, which will be described in detail below.

[0132] Step 100: If the first functional controller meets the control abnormality conditions, the first functional code in the first functional controller is migrated to the target controller, so that the target controller can run the first functional code to realize the function of the first functional controller. The target controller is a second functional controller or a redundant controller.

[0133] The control anomaly condition is a pre-set condition used to indicate an anomaly in the first functional controller. Specifically, it determines whether the first functional controller meets the control anomaly condition, which indicates whether the first functional controller will malfunction or is malfunctioning. When the control anomaly condition indicates that the first functional controller will malfunction, it allows for prediction of the malfunction before it occurs, thereby further ensuring that the function of the control system is not affected and further guaranteeing the availability and reliability of the control system.

[0134] The first function controller is set according to the actual situation. The first function controller can be any one of the intelligent driving controller, cockpit controller and vehicle control controller.

[0135] The second function controller can be configured according to the actual situation. For example, the first function controller can be the intelligent driving controller and the second function controller can be the cockpit controller, or the first function controller can be the cockpit controller and the second function controller can be the intelligent driving controller.

[0136] Optionally, when the first functional controller is a vehicle control controller, the target controller is a redundant controller; when the first functional controller is a smart driving controller or a cockpit controller, the target controller is a second functional controller.

[0137] Optionally, when the first function code of the first function controller is migrated to the target controller, the first function code can still be retained in the first function controller.

[0138] The target controller includes first function code and second function code, which execute the first function code and second function code to implement the first function and the second function.

[0139] In this embodiment, when the first functional controller meets the control abnormality conditions, the first functional code in the first functional controller is migrated to the target controller, which is a second functional controller or a redundant controller. The first functional code is run through the target controller to implement the function implemented by the first functional controller. This ensures that the function implemented by the first functional controller can be implemented through the target controller even when the first functional controller is in control abnormality, thereby ensuring the normal implementation of the first function and thus ensuring the reliability and availability of the control system in which the functional controller is located.

[0140] In some embodiments, migrating the first function code in the first function controller to the target controller includes:

[0141] Send a first control instruction to the first function controller, the first control instruction being used to instruct the first function controller to migrate the first function code to the target controller.

[0142] In this embodiment, when the control method is executed through the redundant controller, a first control command can be sent to the first functional controller via the first control data transmission channel. A second control data transmission channel can be provided between the first functional controller and the target controller to migrate the first functional code to the target controller.

[0143] Optionally, a first communication data transmission channel may be provided between the first functional controller and the target controller. The first functional controller transmits its load data to the target controller through the first communication data transmission channel, and the target controller runs the first functional code based on the load data.

[0144] The load data may include the input data and / or output data of the first functional controller, and the first communication data transmission channel may be used to transmit the input data and / or output data of the first functional controller to the target controller.

[0145] Input data may include at least one of the following: data collected by the sensors corresponding to the first functional controller, data output by the ECU, and status data of the actuator; this embodiment does not limit the types of data. Output data is the data processed by the first functional controller, which may be instructions sent by the first functional controller to the actuator or data sent to other controllers.

[0146] It is understandable that when the target controller is a second functional controller, the first communication data transmission channel can also transmit the load data of the second functional controller to the first functional controller. For example, the functional controller includes an intelligent driving controller and a cockpit controller, and a first communication data transmission channel is provided between the intelligent driving controller and the cockpit controller. The first communication data transmission channel can transmit the load data of the intelligent driving controller to the cockpit controller, and vice versa.

[0147] In some embodiments, determining whether the first functional controller meets a control anomaly condition includes:

[0148] Obtain the performance data of the first functional controller from the first functional controller;

[0149] Based on the performance data of the functional controller, determine whether the first functional controller meets the control anomaly conditions.

[0150] The performance data of the first functional controller is used to indicate the performance of the first functional controller. It may include at least one of CPU utilization, memory usage, data processing speed and latency. Specifically, it can be determined that the first functional controller meets the control anomaly condition when at least one of CPU utilization, memory usage, data processing speed and latency is not within the preset threshold range. Alternatively, the performance data can be analyzed by a large language model (AI) and the analysis results can be used to determine whether the first functional controller meets the control anomaly condition.

[0151] In this embodiment, the performance data of the first functional controller is obtained from the first functional controller. Based on the performance data of the functional controller, it is determined whether the first functional controller meets the control abnormality conditions. This enables the prediction of whether the first functional controller will fail in advance through performance data. If a failure exists, the failure is isolated and switched in real time to ensure the implementation of the first function.

[0152] In some embodiments, the external devices of the first functional controller include a target external device and a backup external device. This embodiment also includes:

[0153] When the target external device of the first function controller meets the preset abnormal conditions, the first function controller is controlled to use the backup external device.

[0154] In this context, the external devices of the first functional controller refer to devices connected to the first functional controller and used to assist the first functional controller in its normal operation to achieve specific functions. These devices can be configured according to actual conditions; for example, the external devices can be a power supply and / or a communication bus. The power supply provides power to the first functional controller, and the functional controller acquires input data and outputs processed data through the communication bus. The type of communication bus can be configured according to actual conditions; for example, the communication bus can be at least one of LLN bus, Ethernet bus, CAN bus, and CANFD bus. This embodiment does not impose any limitations on this.

[0155] The target external device and the backup external device are the same type of external device. For example, when the external device is a power supply, the target external device is the target power supply and the backup external device is the backup power supply. Or, when the external device is a communication bus, the target external device is the communication bus and the backup external device is the backup communication bus.

[0156] When the external device is a power supply, power redundancy is achieved; when the external device is a communication bus, communication redundancy is achieved. This realizes three redundancy architectures: power redundancy, communication redundancy, and control redundancy, ensuring sufficient backup of the control system. When any hardware fails, the function of the first functional controller can still be guaranteed through another redundant hardware, further ensuring the availability and reliability of the control system.

[0157] The target external device and the backup external device are redundant. Typically, the function controller uses the target external device, and when the target external device meets preset abnormal conditions, it controls the first function controller to use the backup external device. For example, when the target power supply meets preset abnormal conditions, the first function controller is controlled to use the backup power supply, meaning the backup power supply powers the first function controller. Similarly, when the target communication bus meets preset abnormal conditions, the first function controller is controlled to use the backup communication bus to acquire input data and output processed data.

[0158] Preset anomaly conditions are used to indicate that an anomaly exists in the target external device. Specifically, they can be used to indicate that the target external device is about to malfunction or is malfunctioning. When preset anomaly conditions are used to indicate that the target external device is about to malfunction, the fault can be predicted before it occurs, thereby further ensuring that the function of the control system is not affected and further guaranteeing the availability and reliability of the control system.

[0159] In this embodiment, a backup external device is provided. When the target external device of the first functional controller meets the preset abnormal conditions, the first functional controller is controlled to use the backup external device. This ensures that the backup external device can be used when the target external device malfunctions, thereby guaranteeing the normal operation of the first functional controller and further ensuring the availability and reliability of the control system in which the first functional controller is located.

[0160] In some embodiments, the method for determining whether the target external device meets the preset abnormal conditions can be set according to the actual situation, and this embodiment does not limit it. For example, the process of determining whether the target external device meets the preset abnormal conditions may include:

[0161] Obtain electrical data of the target power supply and / or load data of the first functional controller from the first functional controller;

[0162] Based on the electrical data of the target power source, determine whether the target power source meets the preset abnormal conditions; and / or,

[0163] Based on the load data, determine whether the target communication bus meets the preset abnormal conditions.

[0164] When the external device includes a power supply and a communication bus, the preset abnormal conditions may include a first preset abnormal condition and a second preset abnormal condition, determining whether the target power supply meets the first preset abnormal condition and whether the target communication bus meets the second preset abnormal condition.

[0165] Optionally, electrical data refers to data used to indicate the power supply characteristics of the target power source, which can be set according to event conditions. For example, electrical data may include at least one of the power, voltage, and temperature of the target power source.

[0166] When the external device is a power supply, the target power supply can be determined to meet the preset abnormal conditions when at least one of the following is outside the preset range: the rate of decrease of the target power supply's charge, voltage, and temperature. Alternatively, the charge of the target power supply can be analyzed using a large language model (AI), and the target power supply can be determined to meet the preset abnormal conditions based on the analysis results. This embodiment does not limit this.

[0167] Optionally, when the external device is a communication bus, it can be determined that the target communication bus meets the preset abnormal conditions when the input data cannot be obtained through the target communication bus or other devices cannot obtain the data processed by the first function controller from the first function controller through the target communication bus. Alternatively, the communication data can be analyzed by a large language model (AI), and the target communication bus can be determined to meet the preset abnormal conditions based on the analysis results. This embodiment does not limit this.

[0168] In this embodiment, electrical data of the target power supply and / or load data of the first functional controller are obtained from the first functional controller. Based on the electrical data of the target power supply, it is determined whether the target power supply meets the preset abnormal conditions; and / or, based on the load data, it is determined whether the target communication bus meets the preset abnormal conditions. This enables real-time dynamic analysis of whether the target power supply and / or the target communication bus are abnormal based on electrical data and / or communication data, thereby enabling fault prediction before a fault occurs, and early isolation and real-time switching of faults, ensuring the realization of the functions of the first functional controller.

[0169] In some embodiments, this embodiment further includes: sending a second control instruction to a second function controller, the second control instruction being used to instruct the second function controller to delete the first function code so that computer resources in the second function controller can be freed up.

[0170] The explanation of the name, specific implementation method and corresponding beneficial effects of this embodiment can be referred to the above embodiment of the control system, and will not be repeated here.

[0171] As can be seen from the above, in this embodiment, the control system includes a first functional controller and a redundant controller. The redundant controller is used to migrate the first functional code in the first functional controller to the target controller when the first functional controller meets the control abnormality conditions, so that the target controller can run the first functional code to realize the function of the first functional controller. The target controller is a second functional controller or a redundant controller, so that when the first functional controller is abnormal, the function implemented by the functional controller can be realized by the target controller, thereby improving the reliability and availability of the control system.

[0172] Figure 6 This is a schematic diagram of the structure of a control device provided in an embodiment of this application. Please refer to... Figure 6 The control device may include a migration module 601, wherein:

[0173] The migration module 601 is used to migrate the first function code in the first function controller to the target controller when the first function controller meets the control abnormal conditions, so that the target controller can run the first function code to realize the function implemented by the first function controller. The target controller is a second function controller or a redundant controller.

[0174] The migration module 601 can execute all the steps in the embodiments corresponding to the above control method. For the specific implementation of these modules and more details, please refer to the corresponding method section. They will not be described in detail here.

[0175] This application also provides a computer-readable storage medium storing instructions that, when executed by a processor, configure the processor to perform the above-described control method.

[0176] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0177] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0178] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0179] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0180] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0181] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0182] Computer-readable media include both permanent and non-permanent, removable and non-removable media, which can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient media, such as modulated communication signals and carrier waves.

[0183] In some embodiments, this application also provides a controller having a computer program stored thereon, which, when executed by a processor, implements the steps in the embodiments of this application. Optionally, the controller may be the redundant controller described above.

[0184] In some embodiments, this application also provides a vehicle, including the controller, control system, or computing platform described in the embodiments of this application. In this embodiment, the vehicle may be a gasoline-powered vehicle, a plug-in hybrid electric vehicle, or a new energy vehicle, etc., and this application does not specifically limit it.

[0185] In some embodiments, this application also provides a computer program product, including a computer program or instructions, which, when executed by a processor, implement the steps in the embodiments of this application.

[0186] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more features. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0187] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0188] The embodiments, implementation methods, and related technical features of this application can be combined and substituted for each other without conflict.

[0189] The above are merely preferred embodiments of this application and are not intended to limit this application in any way. Any simple modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of this application without departing from the scope of the technical solution of this application shall still fall within the scope of the technical solution of this application.

Claims

1. A control system, characterized by, The first function controller and the redundant controller are provided. The redundant controller is configured to migrate the first function code in the first function controller to a target controller in the case that the first function controller meets a control abnormal condition, so that the target controller can run the first function code to realize the function of the first function controller. The target controller is a second function controller or the redundant controller.

2. The control system of claim 1, wherein, A first control data transmission channel is provided between the first function controller and the redundant controller, and the first control data transmission channel is configured to transmit a first control instruction of the redundant controller, the first control instruction being used to instruct the first function controller to migrate the first function code.

3. The control system of claim 2, wherein, The first control data transmission channel is configured to transmit first data from the redundant controller to the first function controller, the first data including the first control instruction.

4. The control system of claim 1, wherein, The first function controller is adapted to provide a second control data transmission channel between the first function controller and the target controller, and the second control data transmission channel is configured to transmit second data from the first function controller to the target controller, the second data including the first function code.

5. The control system of claim 4, wherein, The first function controller is adapted to provide a second control data transmission channel between the first function controller and the target controller, and the second control data transmission channel is configured to transmit second data from the first function controller to the target controller, the second data including the first function code.

6. The control system of any one of claims 1-5, wherein, A first communication data transmission channel is provided between the first function controller and the target controller, and the first communication data transmission channel is configured to transmit load data received by the first function controller, and the target controller is configured to run the first function code based on the load data.

7. The control system of claim 6, wherein, In the case that the target controller is the redundant controller, the first communication transmission channel is configured to transmit third data from the first function controller to the redundant controller, the third data including the load data.

8. The control system of claim 6, wherein, In the case that the target controller is the second function controller, the first communication transmission channel is configured to transmit data from the first function controller to the second function controller and transmit data from the second function controller to the first function controller.

9. The control system of claim 6, wherein, The first function controller is any one of a vehicle control controller, an intelligent driving controller, and a cockpit controller.

10. The control system of claim 9, wherein, The second function controller is one of the remaining two of the vehicle control controller, the intelligent driving controller, and the cockpit controller, except the first function controller.

11. The control system of claim 10, wherein, The first function controller is an intelligent driving controller, and the second function controller is a cockpit controller, or the first function controller is a cockpit controller, and the second function controller is an intelligent driving controller.

12. The control system of claim 9, wherein, The first function controller is a vehicle control controller, and the target controller is the redundant controller.

13. The control system of claim 6, wherein, In the case that the target controller is the second function controller, a third control data transmission channel is further provided between the second function controller and the redundant controller, and the third control data transmission channel is configured to transmit a second control instruction of the redundant controller, the second control instruction being used to instruct the second function controller to delete the first function code.

14. The control system of claim 13, wherein, The third control data transmission channel is configured to transmit a third control instruction of the redundant controller, and the third control instruction is configured to instruct to migrate a second function code in the second function controller to the first function controller. A second control data transmission channel between the first function controller and the second function controller is configured to transmit the second function code.

15. The control system of claim 1, wherein, The control abnormal condition is configured to indicate that the first function controller will fail or is failing.

16. The control system of claim 15, wherein, The control abnormal condition is determined based on performance data of the first function controller.

17. The control system of claim 1, wherein, The control system further comprises peripheral devices of the first function controller, the peripheral devices comprising a target peripheral device and a backup peripheral device, and the redundant controller is further configured to control the first function controller to use the backup peripheral device in a case where the target peripheral device of the first function controller meets a preset abnormal condition.

18. The control system of claim 17, wherein, The peripheral devices are power supplies and / or communication buses.

19. The control system of claim 18, wherein, The preset abnormal condition is determined based on electrical data of a target power supply and / or load data of the first function controller.

20. The control system of claim 17, wherein, The preset abnormal condition is configured to indicate that the peripheral devices will fail or are failing.

21. The control system of any one of claims 1-5, wherein, The control system is integrated on a computing platform.

22. A control method characterized by, Comprise: In a case where the first function controller meets a control abnormal condition, migrating a first function code in the first function controller to a target controller, so that the target controller can run the first function code to realize the function of the first function controller; The target controller is a second function controller or a redundant controller.

23. The control method according to claim 22, wherein The migrating the first function code in the first function controller to the target controller comprises: sending a first control instruction to the first function controller, and the first control instruction is configured to instruct the first function controller to migrate the first function code to the target controller.

24. The control method according to claim 22, wherein The method further comprises: determining whether the first function controller meets a control abnormal condition, and the control abnormal condition is configured to indicate that the first function controller will fail or is failing.

25. The control method according to claim 24, wherein The determining that the first function controller meets the control abnormal condition comprises: obtaining performance data of the first function controller from the first function controller; determining, based on the performance data of the first function controller, whether the first function controller meets the control abnormal condition.

26. The control method according to claim 22, wherein The peripheral devices of the first function controller comprise a target peripheral device and a backup peripheral device, and the method further comprises: controlling the first function controller to use the backup peripheral device in a case where the target peripheral device of the first function controller meets a preset abnormal condition.

27. The control method according to claim 26, wherein The peripheral devices are power supplies and / or communication buses.

28. The control method according to claim 27, wherein The method further comprises: obtaining electrical data of a target power supply and / or load data of the first function controller from the first function controller; determining, based on the electrical data of the target power supply, whether the target power supply meets the preset abnormal condition; and / or determining, based on the load data, whether a target communication bus meets the preset abnormal condition.

29. The control method according to claim 26, wherein The preset abnormal condition is used to indicate that the target external device will fail or is failing.

30. The control method of claim 22, wherein The method further comprises: sending a second control instruction to the second function controller, the second control instruction being used to instruct the second function controller to delete the first function code.

31. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program, which is executed by a processor, implements the steps of the method of any one of claims 22 to 30.

32. A controller having stored thereon a computer program, wherein The computer program, which is executed by a processor, implements the steps of the method of any one of claims 22 to 30.

33. A vehicle characterized by A controller as claimed in claim 32 or a control system as claimed in any one of claims 1 to 21.

34. A computer program product, characterised in that, A computer program or instructions, which, when executed by a processor, implement the steps of the method of any one of claims 22 to 30.

Images