Redundancy control method and device of vehicle controller

Abstract

The invention provides a redundancy control method and device for a vehicle controller, the redundancy control method is applied to a backup controller capable of realizing a safety control function of the vehicle controller, and the backup controller is any controller selected from controllers arranged in a vehicle and used for guaranteeing the safety of the vehicle. The redundancy control method comprises the steps that in response to the fact that the vehicle controller is detected to be in a failure state, control operation corresponding to a safety control function is executed, and the vehicle controller and the accelerator pedal sensor are connected to an accelerator pedal sensor of a vehicle in parallel and belong to the same CAN communication network. Acquiring a pedal signal acquired by an accelerator pedal sensor and a power signal of a vehicle power system; and based on the pedal signal and the power signal, a safety limiting torque value is determined and sent to a vehicle power system, so that the vehicle power system controls the vehicle to conduct limp running based on the safety limiting torque value. According to the method, the reliability, the stability and the applicability of redundancy control when the vehicle controller fails are improved.

Description

Technical Field

[0001] This application relates to the field of vehicle control technology, and in particular to a redundancy control method and apparatus for a vehicle controller. Background Technology

[0002] In existing methods for redundant control of the vehicle control unit (VCU) in the event of failure, backup control is mainly achieved through redundancy design at different levels. For example, setting up independent redundant hardware controllers, deploying redundant control modules in the system-on-a-chip of the vehicle controller, and designing fault-tolerant control methods at the actuator level of the vehicle controller.

[0003] Among these factors, setting up an independent redundant hardware controller incurs high hardware costs and involves complex system design, which reduces the reliability of redundant control. Deploying redundant control modules in a system-on-a-chip (SoC) places high demands on the chip's computing power, and if the entire chip fails, the redundancy will fail, reducing vehicle safety. Furthermore, designing fault-tolerant control methods at the actuator level cannot cope with the situation where the vehicle controller completely fails, which reduces the stability and applicability of redundant control. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a redundancy control method and apparatus for a vehicle controller. By selecting a backup controller that is connected in parallel with the vehicle controller to the accelerator pedal sensor and belongs to the same CAN communication network as the vehicle controller in the controller that ensures vehicle safety, when the vehicle controller is detected to be in a failure state, the backup controller is used to execute the control operation corresponding to the safety control function of the vehicle controller, and based on the acquired pedal signal and power signal, a safety limit torque value for protecting the vehicle power system is determined, so that the vehicle power system controls the vehicle to limp driving based on the safety limit torque value. This achieves the functional safety redundancy required for autonomous driving of the vehicle at a lower cost, and improves the reliability, stability and applicability of redundant control when the vehicle controller fails.

[0005] This application provides a redundancy control method for a vehicle controller. The redundancy control method is applied to a backup controller that can implement the safety control function of the vehicle controller. The backup controller is any controller selected from those installed in the vehicle to ensure vehicle safety. The backup controller is connected in parallel to the vehicle controller via the vehicle's accelerator pedal sensor and belongs to the same CAN communication network. The redundancy control method includes: In response to detecting that the vehicle controller is in a malfunction state, the control operation corresponding to the safety control function is executed, and the pedal signal collected by the accelerator pedal sensor and the power signal corresponding to the vehicle power system are acquired. Based on the pedal signal and the power signal, a safety limit torque value for protecting the vehicle power system is determined; The safety limit torque value is sent to the vehicle powertrain so that the vehicle powertrain controls the vehicle to perform limp driving based on the safety limit torque value.

[0006] Furthermore, before detecting a failure in the vehicle controller, the redundancy control method further includes: The system collects heartbeat frame signals and hardware signals corresponding to the vehicle controller in real time, detects whether there are node loss and / or signal timeout issues in the heartbeat frame signals, and detects whether the hardware signals indicate that the vehicle controller is faulty. In response to the detection of node loss and / or signal timeout in the heartbeat frame signal, and / or the detection of the hardware signal indicating that the vehicle controller is in failure, the vehicle controller is determined to be in a failure state.

[0007] Furthermore, the control operation corresponding to executing the security control function includes: The instrumentation equipment of the vehicle is controlled to send alarm signals to the outside, and the CAN communication network is used to send network wake-up signals to control the motor controller and current converter in the vehicle to remain in a wake-up state. In response to the motor controller and the current converter remaining in a wake-up state, the current converter is controlled to continuously perform voltage reduction operation, and the battery management system in the vehicle is controlled to maintain a high voltage state. The motor controller is used to obtain the corresponding operating status signal of the motor equipment in the vehicle. Based on the operating status signal, the motor is controlled to maintain normal operating status.

[0008] Furthermore, the pedal signal includes a first pedal voltage signal and a second pedal voltage signal; the power signal includes the available power signal corresponding to the power battery in the vehicle power system and the speed signal corresponding to the motor in the vehicle power system.

[0009] Furthermore, determining the safety limiting torque value for protecting the vehicle powertrain based on the pedal signal and the power signal includes: Based on the first voltage value corresponding to the first pedal voltage signal and the second voltage value corresponding to the second pedal voltage signal, the accelerator pedal opening value is determined, and the requested torque value corresponding to the accelerator pedal opening value is determined. The limiting torque value corresponding to the speed signal is determined by using a preset speed-torque correspondence. Based on the available power signal and the rotational speed signal, a safe torque value is determined; Based on the requested torque value, the limited torque value, and the safe torque value, a safe limited torque value for protecting the vehicle powertrain is determined.

[0010] Furthermore, determining the accelerator pedal opening value based on the first voltage value corresponding to the first pedal voltage signal and the second voltage value corresponding to the second pedal voltage signal, and determining the requested torque value corresponding to the accelerator pedal opening value, includes: Determine the first voltage value corresponding to the first pedal voltage signal and the second voltage value corresponding to the second pedal voltage signal; A target voltage value is determined between the first voltage value and the second voltage value, and an accelerator pedal opening value is determined based on the target voltage value and a preset reference voltage value. The requested torque value corresponding to the accelerator pedal opening value is determined by using a preset pedal torque correspondence.

[0011] Furthermore, determining the safety limit torque value for protecting the vehicle powertrain based on the requested torque value, the limit torque value, and the safe torque value includes: A target torque value is determined from the requested torque value, the limited torque value, and the safe torque value; By using a preset torque change rate threshold to limit the rate of change of the target torque value, a safety limit torque value for protecting the vehicle's powertrain is determined.

[0012] This application embodiment also provides a redundant control device for a vehicle controller, the redundant control device comprising: The control takeover module is used to execute control operations corresponding to the safety control function in response to the detection that the vehicle controller is in a malfunctioning state, and to acquire the pedal signal collected by the accelerator pedal sensor and the power signal corresponding to the vehicle power system. A torque limiting module is used to determine a safety limiting torque value for protecting the vehicle's power system based on the pedal signal and the power signal. A torque transmission module is used to send the safety limit torque value to the vehicle power system so that the vehicle power system controls the vehicle to perform limp driving based on the safety limit torque value.

[0013] Furthermore, the redundancy control device also includes a signal detection module, which is used for: The system collects heartbeat frame signals and hardware signals corresponding to the vehicle controller in real time, detects whether there are node loss and / or signal timeout issues in the heartbeat frame signals, and detects whether the hardware signals indicate that the vehicle controller is faulty. In response to the detection of node loss and / or signal timeout in the heartbeat frame signal, and / or the detection of the hardware signal indicating that the vehicle controller is in failure, the vehicle controller is determined to be in a failure state.

[0014] Furthermore, when the control takeover module is used to execute control operations corresponding to the safety control function, the control takeover module is used to: The instrumentation equipment of the vehicle is controlled to send alarm signals to the outside, and the CAN communication network is used to send network wake-up signals to control the motor controller and current converter in the vehicle to remain in a wake-up state. In response to the motor controller and the current converter remaining in a wake-up state, the current converter is controlled to continuously perform voltage reduction operation, and the battery management system in the vehicle is controlled to maintain a high voltage state. The motor controller is used to obtain the corresponding operating status signal of the motor equipment in the vehicle. Based on the operating status signal, the motor is controlled to maintain normal operating status.

[0015] Furthermore, the pedal signal includes a first pedal voltage signal and a second pedal voltage signal; the power signal includes the available power signal corresponding to the power battery in the vehicle power system and the speed signal corresponding to the motor in the vehicle power system.

[0016] Furthermore, when determining a safety limit torque value for protecting the vehicle powertrain based on the pedal signal and the power signal, the torque limiting module is used to: Based on the first voltage value corresponding to the first pedal voltage signal and the second voltage value corresponding to the second pedal voltage signal, the accelerator pedal opening value is determined, and the requested torque value corresponding to the accelerator pedal opening value is determined. The limiting torque value corresponding to the speed signal is determined by using a preset speed-torque correspondence. Based on the available power signal and the rotational speed signal, a safe torque value is determined; Based on the requested torque value, the limited torque value, and the safe torque value, a safe limited torque value for protecting the vehicle powertrain is determined.

[0017] Furthermore, when the torque limiting module determines the accelerator pedal opening value and the requested torque value corresponding to the accelerator pedal opening value based on the first voltage value corresponding to the first pedal voltage signal and the second voltage value corresponding to the second pedal voltage signal, the torque limiting module is used to: Determine the first voltage value corresponding to the first pedal voltage signal and the second voltage value corresponding to the second pedal voltage signal; A target voltage value is determined between the first voltage value and the second voltage value, and an accelerator pedal opening value is determined based on the target voltage value and a preset reference voltage value. The requested torque value corresponding to the accelerator pedal opening value is determined by using a preset pedal torque correspondence.

[0018] Furthermore, when the torque limiting module determines a safe limiting torque value for protecting the vehicle powertrain based on the requested torque value, the limited torque value, and the safe torque value, the torque limiting module is used to: A target torque value is determined from the requested torque value, the limited torque value, and the safe torque value; By using a preset torque change rate threshold to limit the rate of change of the target torque value, a safety limit torque value for protecting the vehicle's powertrain is determined.

[0019] This application also provides an electronic device, including: a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, the steps of the redundant control method of the vehicle controller described above are performed.

[0020] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, performs the steps of the redundancy control method for a vehicle controller as described above.

[0021] This application provides a redundancy control method and apparatus for a vehicle controller. The redundancy control method is applied to a backup controller that can implement the safety control function of the vehicle controller. The backup controller is any controller selected from those installed in the vehicle to ensure vehicle safety. The backup controller is connected in parallel to the vehicle controller via the vehicle's accelerator pedal sensor and belongs to the same CAN communication network. The redundancy control method includes: in response to detecting a failure state of the vehicle controller, executing a control operation corresponding to the safety control function, and acquiring a pedal signal collected by the accelerator pedal sensor and a power signal corresponding to the vehicle's powertrain; determining a safety limit torque value for protecting the vehicle's powertrain based on the pedal signal and the power signal; and sending the safety limit torque value to the vehicle's powertrain so that the vehicle's powertrain controls the vehicle to perform limp driving based on the safety limit torque value.

[0022] Compared with existing technologies such as setting up independent redundant hardware controllers, deploying redundant control modules in the system-on-a-chip of the vehicle controller, and designing fault-tolerant control methods at the actuator level of the vehicle controller, this method selects a backup controller in the controller that is connected in parallel to the vehicle controller to the accelerator pedal sensor and belongs to the same CAN communication network. When the vehicle controller is detected to be in a failure state, the backup controller executes the control operation corresponding to the safety control function of the vehicle controller. Based on the acquired pedal signal and power signal, it determines the safety limit torque value for protecting the vehicle power system, so that the vehicle power system controls the vehicle to limp driving based on the safety limit torque value. This achieves the functional safety redundancy required for autonomous driving at a lower cost and improves the reliability, stability, and applicability of redundant control when the vehicle controller fails.

[0023] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0024] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a schematic diagram of the connection relationship of a backup controller provided in an embodiment of this application; Figure 2 One of the flowcharts for a redundant control method for a vehicle controller provided in an embodiment of this application; Figure 3 A second flowchart illustrating a redundant control method for a vehicle controller provided in an embodiment of this application; Figure 4 This is one of the structural schematic diagrams of a redundant control device for a vehicle controller provided in an embodiment of this application; Figure 5 A second schematic diagram of the structure of a redundant control device for a vehicle controller provided in an embodiment of this application; Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. Based on the embodiments of this application, every other embodiment obtained by those skilled in the art without inventive effort falls within the scope of protection of this application.

[0027] Research has found that existing methods for redundant control of the Vehicle Control Unit (VCU) in the event of failure mainly achieve backup control through different levels of redundancy design. For example, setting up independent redundant hardware controllers, deploying redundant control modules in the system-on-a-chip of the vehicle controller, and designing fault-tolerant control methods at the actuator level of the vehicle controller.

[0028] Among these factors, setting up an independent redundant hardware controller incurs high hardware costs and involves complex system design, which reduces the reliability of redundant control. Deploying redundant control modules in a system-on-a-chip (SoC) places high demands on the chip's computing power, and if the entire chip fails, the redundancy will fail, reducing vehicle safety. Furthermore, designing fault-tolerant control methods at the actuator level cannot cope with the situation where the vehicle controller completely fails, which reduces the stability and applicability of redundant control.

[0029] Based on this, this application provides a redundancy control method for a vehicle controller. By selecting a backup controller that is connected in parallel to the accelerator pedal sensor and belongs to the same CAN communication network as the vehicle controller in the controller that ensures vehicle safety, when the vehicle controller is detected to be in a failure state, the backup controller is used to execute the control operation corresponding to the safety control function of the vehicle controller. Based on the acquired pedal signal and power signal, a safety limit torque value for protecting the vehicle power system is determined, so that the vehicle power system controls the vehicle to limp driving based on the safety limit torque value. This achieves the functional safety redundancy required for autonomous driving at a lower cost, and improves the reliability, stability and applicability of redundant control when the vehicle controller fails.

[0030] The redundancy control method for vehicle controllers provided in this application is typically applied to backup controllers that can implement the safety control functions of vehicle controllers.

[0031] The backup controller is any controller selected from the controllers installed in the vehicle to ensure vehicle safety; for example, the backup controller includes, but is not limited to, any one of the controllers in the vehicle such as the battery management system controller, motor controller, chassis domain controller, and central domain controller.

[0032] Here, the backup controller usually has idle computing resources. The backup controller has the basic safety functions corresponding to the vehicle controller pre-installed. When the vehicle controller is normal, the basic safety functions of the backup controller will be in a "standby" state.

[0033] For details, please refer to Figure 1 , Figure 1 This is a schematic diagram illustrating the connection relationship of a backup controller provided in an embodiment of this application. Figure 1 As shown, the backup controller 10 and the vehicle controller 20 are connected in parallel to the accelerator pedal sensor 30 of the vehicle, and the backup controller 10 and the vehicle controller 20 belong to the same CAN communication network 40.

[0034] The backup controller is connected to the accelerator pedal sensor to ensure that the driver's acceleration intention can still be reliably obtained after the vehicle controller fails. The backup controller belongs to the same CAN communication network as the vehicle controller to monitor the status of the vehicle controller and communicate with other controllers in the vehicle.

[0035] Please see Figure 2 , Figure 2 This is one of the flowcharts for a redundant control method for a vehicle controller provided in an embodiment of this application. For example... Figure 2 As shown in the embodiments of this application, the redundancy control method for vehicle controllers is typically applied to applications such as... Figure 1 The backup controller shown, wherein the redundancy control method includes: S101. In response to detecting that the vehicle controller is in a malfunction state, execute the control operation corresponding to the safety control function, and acquire the pedal signal collected by the accelerator pedal sensor and the power signal corresponding to the vehicle power system.

[0036] In this embodiment, the pedal signal includes a first pedal voltage signal and a second pedal voltage signal; the power signal includes the available power signal corresponding to the power battery in the vehicle power system and the rotational speed signal corresponding to the motor in the vehicle power system.

[0037] Here, the first pedal voltage signal and the second pedal voltage signal are two analog voltage signals with a specific ratio or verification relationship output by the accelerator pedal sensor, used to achieve signal redundancy and fault diagnosis; the available power signal is the maximum instantaneous power value that the current power battery can safely output, reported by the battery management system; and the speed signal is the current actual speed value of the motor reported by the motor controller.

[0038] In this step, when the vehicle controller is detected to be in a failed state, the backup controller immediately activates the backup safety control function and takes over the control of the vehicle controller.

[0039] Among them, the control operations corresponding to the safety control function are used to maintain the basic power-on and power-off logic of the vehicle and prevent the vehicle from suddenly losing power; the pedal signal collected by the accelerator pedal sensor and the power signal corresponding to the vehicle power system are acquired to replace the failed vehicle controller in response to the driver's needs and to perform power and torque protection for the power system.

[0040] In one possible implementation of this application, in specific implementation, the step of executing the control operation corresponding to the security control function in step S101 may include: S1011. Control the vehicle's instrumentation to send alarm signals to the outside and use the CAN communication network to send network wake-up signals to control the motor controller and current converter in the vehicle to remain in a wake-up state.

[0041] In this step, the instrumentation of the vehicle sends an alarm signal to the outside to trigger a command to display a specific fault message, so as to remind the driver to go to the repair center immediately; and uses the CAN communication network to send a network wake-up signal, while keeping the motor controller and current converter in the vehicle in a wake-up state, preventing the network from going into sleep mode and waking up specific nodes.

[0042] Here, the current converter may include a DC / DC converter, namely, an on-board DC converter, which is responsible for converting the high voltage of the power battery into low voltage to power the vehicle's low voltage electrical system and controller.

[0043] S1012. In response to the motor controller and the current converter remaining in a wake-up state, the current converter is controlled to continuously perform voltage reduction operation, and the battery management system in the vehicle is controlled to maintain a high voltage state. The motor controller is used to obtain the corresponding operating status signal of the motor equipment in the vehicle.

[0044] Here, the current converter transforms the high-voltage DC power from the power battery into a stable DC power supply required by the vehicle's low-voltage electrical system. In a failover scenario, the backup controller forces the current converter to remain operational to prevent it from shutting down due to misjudging network hibernation, thereby ensuring the power supply safety of all low-voltage electrical equipment, including the backup controller itself, instruments, and sensors. This is the fundamental premise for the vehicle's maintenance control logic.

[0045] The backup controller sends specific instructions to the battery management system via CAN communication, requesting the battery management system to keep the main high-voltage relay of the power battery closed, and to keep the main relay of the power battery closed.

[0046] S1013. Based on the working status signal, control the motor equipment to maintain normal working status.

[0047] In this step, the operating status signal of the motor equipment is continuously monitored, and the operating parameters of the motor equipment are adjusted to keep the motor equipment in normal working condition.

[0048] Optional, please refer to Figure 3 , Figure 3 This is a second flowchart illustrating a redundant control method for a vehicle controller provided in an embodiment of this application. Figure 3 As shown in the figure, the redundancy control method for the vehicle controller provided in this application embodiment further includes, before step S101: S104. Real-time acquisition of the heartbeat frame signal and hardware signal corresponding to the vehicle controller, detection of whether there are node loss and / or signal timeout problems in the heartbeat frame signal, and detection of whether the hardware signal indicates that the vehicle controller is faulty.

[0049] Here, the heartbeat frame signal is a standard data frame that the vehicle controller periodically broadcasts on the CAN communication network to indicate its own liveness status. The backup controller determines whether its communication is normal by whether it can receive this signal on time. The hardware signal refers to the level or digital signal that directly indicates that the vehicle controller hardware may fail, and can directly indicate whether the vehicle controller is in a failed or normal state.

[0050] Among them, node loss means that the communication node corresponding to the vehicle controller in the CAN communication network disappears; signal timeout means that the expected heartbeat frame signal is not received within the preset time window.

[0051] S105. In response to detecting a node loss and / or signal timeout in the heartbeat frame signal, and / or detecting that the hardware signal indicates that the vehicle controller is in a failure state, determine that the vehicle controller is in a failure state.

[0052] This step defines the fusion logic for failure determination. Failure determination can be triggered if any or both problems occur at the communication level (abnormal heartbeat frames) and the hardware level (fault signals), thereby improving the reliability of detection.

[0053] S102. Based on the pedal signal and the power signal, determine the safety limiting torque value for protecting the vehicle power system.

[0054] In one possible implementation of this application, step S102 may include: S1021. Based on the first voltage value corresponding to the first pedal voltage signal and the second voltage value corresponding to the second pedal voltage signal, determine the accelerator pedal opening value and determine the requested torque value corresponding to the accelerator pedal opening value.

[0055] In one possible implementation of this application, step S1021 may include: S10211. Determine the first voltage value corresponding to the first pedal voltage signal and the second voltage value corresponding to the second pedal voltage signal.

[0056] In this step, the first voltage value corresponding to the first pedal voltage signal and the second voltage value corresponding to the second pedal voltage signal are determined by using the preset conversion relationship between voltage signal and voltage value.

[0057] S10212. Determine a target voltage value from the first voltage value and the second voltage value, and determine the accelerator pedal opening value based on the target voltage value and a preset reference voltage value.

[0058] Here, the target voltage value is the minimum of the first voltage value and the second voltage value.

[0059] The accelerator pedal opening value is a quantitative representation of the driver's acceleration intention, usually a percentage from 0% to 100%; the preset reference voltage value refers to the known voltage reference value corresponding to the accelerator pedal at idle (0% opening) and fully open (100% opening) positions.

[0060] In this embodiment of the application, the accelerator pedal opening value is determined by the following formula.

[0061] .

[0062] in, Indicates the accelerator pedal opening value (0%-100%). Indicates the target voltage value; This indicates the preset reference voltage value; This indicates the preset scaling factor.

[0063] S10213. Determine the requested torque value corresponding to the accelerator pedal opening value using a preset pedal torque correspondence.

[0064] Here, the preset pedal torque correspondence may include a lookup table or function that maps the accelerator pedal opening value to the torque value requested by the driver, and is usually designed as a curve that meets the driving performance requirements.

[0065] The requested torque value is a driving torque value that reflects the driver's desired torque, obtained by looking up a table based on the accelerator pedal opening value.

[0066] S1022. Determine the limiting torque value corresponding to the speed signal using a preset speed-torque correspondence.

[0067] Here, the speed-torque correspondence is used to describe the characteristic curve (external characteristic curve) of the maximum allowable torque that the motor can output at different speeds, and is used to protect the motor from overload and overspeed.

[0068] For example, limiting the torque value can restrict the vehicle speed to a preset speed range.

[0069] S1023. Determine the safe torque value based on the available power signal and the speed signal.

[0070] Here, the safe torque value is the theoretical torque limit calculated based on the current available power of the battery and the motor speed, which does not exceed the battery's output capacity.

[0071] In this embodiment, the safe torque value is determined by the following formula.

[0072] .

[0073] in, Indicates the safe torque value; This indicates the available power value corresponding to the available power signal; This indicates the rotational speed value corresponding to the rotational speed signal; This indicates the preset safety torque coefficient (e.g., 1 / 9550).

[0074] S1024. Based on the requested torque value, the limited torque value, and the safe torque value, determine a safe limited torque value for protecting the vehicle powertrain.

[0075] In one possible implementation of this application, step S1024 may include: S10241. Determine a target torque value from the requested torque value, the limited torque value, and the safe torque value.

[0076] In this embodiment of the application, the target torque value is the minimum value among the requested torque value, the limited torque value, and the safe torque value.

[0077] S10242. The target torque value is limited by a preset torque change rate threshold to determine a safety limit torque value for protecting the vehicle power system.

[0078] Here, the preset torque change rate threshold is a set maximum allowable change in torque per second. Limiting the change rate of the target torque value is to filter the target torque value to smooth out the slope of the rise or fall of the target torque value.

[0079] Among them, the safety limit torque value is the final output of a smooth and safe torque command after minimum value selection and rate of change limitation.

[0080] S103. The safety limit torque value is sent to the vehicle power system so that the vehicle power system controls the vehicle to perform limp driving based on the safety limit torque value.

[0081] Here, limp driving is a degraded operating mode after a vehicle failure. In limp driving mode, the vehicle's power is strictly limited to a low level, and the vehicle is only allowed to travel at a low speed to a safe location or repair station. It is an important safety backup function.

[0082] The redundant control method for a vehicle controller provided in this application selects a backup controller that is connected in parallel to the accelerator pedal sensor and belongs to the same CAN communication network as the vehicle controller in the controller that ensures vehicle safety. When the vehicle controller is detected to be in a failure state, the backup controller executes the control operation corresponding to the safety control function of the vehicle controller. Based on the acquired pedal signal and power signal, a safety limit torque value for protecting the vehicle power system is determined, so that the vehicle power system controls the vehicle to limp driving based on the safety limit torque value. This achieves the functional safety redundancy required for autonomous driving at a lower cost and improves the reliability, stability and applicability of redundant control when the vehicle controller fails.

[0083] Please see Figure 4 , Figure 5 , Figure 4 This is one of the structural schematic diagrams of a redundant control device for a vehicle controller provided in an embodiment of this application. Figure 5 This is a second schematic diagram of the structure of a redundant control device for a vehicle controller provided in an embodiment of this application. Figure 4 As shown, the redundancy control device 400 includes: The control takeover module 410 is used to execute the control operation corresponding to the safety control function in response to the detection that the vehicle controller is in a malfunctioning state, and to acquire the pedal signal collected by the accelerator pedal sensor and the power signal corresponding to the vehicle power system. The torque limiting module 420 is used to determine a safety limiting torque value for protecting the vehicle power system based on the pedal signal and the power signal. The torque transmission module 430 is used to send the safety limit torque value to the vehicle power system so that the vehicle power system controls the vehicle to perform limp driving based on the safety limit torque value.

[0084] Furthermore, such as Figure 5 As shown, the redundancy control device 400 further includes a signal detection module 440, which is used for: The system collects heartbeat frame signals and hardware signals corresponding to the vehicle controller in real time, detects whether there are node loss and / or signal timeout issues in the heartbeat frame signals, and detects whether the hardware signals indicate that the vehicle controller is faulty. In response to the detection of node loss and / or signal timeout in the heartbeat frame signal, and / or the detection of the hardware signal indicating that the vehicle controller is in failure, the vehicle controller is determined to be in a failure state.

[0085] Furthermore, when the control takeover module 410 is used to execute the control operation corresponding to the safety control function, the control takeover module 410 is used to: The instrumentation equipment of the vehicle is controlled to send alarm signals to the outside, and the CAN communication network is used to send network wake-up signals to control the motor controller and current converter in the vehicle to remain in a wake-up state. In response to the motor controller and the current converter remaining in a wake-up state, the current converter is controlled to continuously perform voltage reduction operation, and the battery management system in the vehicle is controlled to maintain a high voltage state. The motor controller is used to obtain the corresponding operating status signal of the motor equipment in the vehicle. Based on the operating status signal, the motor is controlled to maintain normal operating status.

[0086] Furthermore, the pedal signal includes a first pedal voltage signal and a second pedal voltage signal; the power signal includes the available power signal corresponding to the power battery in the vehicle power system and the speed signal corresponding to the motor in the vehicle power system.

[0087] Furthermore, when determining a safety limiting torque value for protecting the vehicle powertrain based on the pedal signal and the power signal, the torque limiting module 420 is used to: Based on the first voltage value corresponding to the first pedal voltage signal and the second voltage value corresponding to the second pedal voltage signal, the accelerator pedal opening value is determined, and the requested torque value corresponding to the accelerator pedal opening value is determined. The limiting torque value corresponding to the speed signal is determined by using a preset speed-torque correspondence. Based on the available power signal and the rotational speed signal, a safe torque value is determined; Based on the requested torque value, the limited torque value, and the safe torque value, a safe limited torque value for protecting the vehicle powertrain is determined.

[0088] Furthermore, when the torque limiting module 420 determines the accelerator pedal opening value and the requested torque value corresponding to the accelerator pedal opening value based on the first voltage value corresponding to the first pedal voltage signal and the second voltage value corresponding to the second pedal voltage signal, the torque limiting module 420 is used to: Determine the first voltage value corresponding to the first pedal voltage signal and the second voltage value corresponding to the second pedal voltage signal; A target voltage value is determined between the first voltage value and the second voltage value, and an accelerator pedal opening value is determined based on the target voltage value and a preset reference voltage value. The requested torque value corresponding to the accelerator pedal opening value is determined by using a preset pedal torque correspondence.

[0089] Furthermore, when determining a safe limiting torque value for protecting the vehicle powertrain based on the requested torque value, the limited torque value, and the safe torque value, the torque limiting module 420 is configured to: A target torque value is determined from the requested torque value, the limited torque value, and the safe torque value; By using a preset torque change rate threshold to limit the rate of change of the target torque value, a safety limit torque value for protecting the vehicle's powertrain is determined.

[0090] The redundant control device for a vehicle controller provided in this application selects a backup controller that is connected in parallel to the accelerator pedal sensor and belongs to the same CAN communication network as the vehicle controller in the controller that ensures vehicle safety. When the vehicle controller is detected to be in a failure state, the backup controller executes the control operation corresponding to the safety control function of the vehicle controller. Based on the acquired pedal signal and power signal, it determines the safety limit torque value for protecting the vehicle power system, so that the vehicle power system controls the vehicle to limp driving based on the safety limit torque value. This achieves the functional safety redundancy required for autonomous driving at a lower cost and improves the reliability, stability and applicability of redundant control when the vehicle controller fails.

[0091] Please see Figure 6 , Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 6 As shown, the electronic device 600 includes a processor 610, a memory 620, and a bus 630.

[0092] The memory 620 stores machine-readable instructions executable by the processor 610. When the electronic device 600 is running, the processor 610 and the memory 620 communicate via the bus 630. When the machine-readable instructions are executed by the processor 610, they can perform the operations described above. Figure 2 as well as Figure 3 The steps of the redundancy control method for the vehicle controller in the method embodiment shown are described in detail in the method embodiment, and will not be repeated here.

[0093] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can perform the above-described actions. Figure 2 as well as Figure 3 The steps of the redundancy control method for the vehicle controller in the method embodiment shown are described in detail in the method embodiment, and will not be repeated here.

[0094] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0095] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the shown or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0096] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0097] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0098] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0099] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The scope of protection of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A redundancy control method for a vehicle controller, characterized in that, The redundancy control method is applied to a backup controller that can implement the safety control function of the vehicle controller; wherein, the backup controller is any controller selected from the controllers installed in the vehicle to ensure vehicle safety, the backup controller is connected in parallel to the vehicle controller to the accelerator pedal sensor and belongs to the same CAN communication network, and the redundancy control method includes: In response to detecting that the vehicle controller is in a malfunction state, the control operation corresponding to the safety control function is executed, and the pedal signal collected by the accelerator pedal sensor and the power signal corresponding to the vehicle power system are acquired. Based on the pedal signal and the power signal, a safety limit torque value for protecting the vehicle power system is determined; The safety limit torque value is sent to the vehicle powertrain so that the vehicle powertrain controls the vehicle to perform limp driving based on the safety limit torque value.

2. The method according to claim 1, characterized in that, Before detecting a failure in the vehicle controller, the redundancy control method further includes: The system collects heartbeat frame signals and hardware signals corresponding to the vehicle controller in real time, detects whether there are node loss and / or signal timeout issues in the heartbeat frame signals, and detects whether the hardware signals indicate that the vehicle controller is faulty. In response to the detection of node loss and / or signal timeout in the heartbeat frame signal, and / or the detection of the hardware signal indicating that the vehicle controller is in failure, the vehicle controller is determined to be in a failure state.

3. The method according to claim 1, characterized in that, The control operations corresponding to executing the security control function include: The instrumentation equipment of the vehicle is controlled to send alarm signals to the outside, and the CAN communication network is used to send network wake-up signals to control the motor controller and current converter in the vehicle to remain in a wake-up state. In response to the motor controller and the current converter remaining in a wake-up state, the current converter is controlled to continuously perform voltage reduction operation, and the battery management system in the vehicle is controlled to maintain a high voltage state. The motor controller is used to obtain the corresponding operating status signal of the motor equipment in the vehicle. Based on the operating status signal, the motor is controlled to maintain normal operating status.

4. The method according to claim 1, characterized in that, The pedal signal includes a first pedal voltage signal and a second pedal voltage signal; the power signal includes the available power signal corresponding to the power battery in the vehicle power system and the speed signal corresponding to the motor in the vehicle power system.

5. The method according to claim 4, characterized in that, The step of determining a safety limiting torque value for protecting the vehicle powertrain based on the pedal signal and the power signal includes: Based on the first voltage value corresponding to the first pedal voltage signal and the second voltage value corresponding to the second pedal voltage signal, the accelerator pedal opening value is determined, and the requested torque value corresponding to the accelerator pedal opening value is determined. The limiting torque value corresponding to the speed signal is determined by using a preset speed-torque correspondence. Based on the available power signal and the rotational speed signal, a safe torque value is determined; Based on the requested torque value, the limited torque value, and the safe torque value, a safe limited torque value for protecting the vehicle powertrain is determined.

6. The method according to claim 5, characterized in that, The step of determining the accelerator pedal opening value and the requested torque value corresponding to the accelerator pedal opening value based on the first voltage value corresponding to the first pedal voltage signal and the second voltage value corresponding to the second pedal voltage signal includes: Determine the first voltage value corresponding to the first pedal voltage signal and the second voltage value corresponding to the second pedal voltage signal; A target voltage value is determined between the first voltage value and the second voltage value, and an accelerator pedal opening value is determined based on the target voltage value and a preset reference voltage value. The requested torque value corresponding to the accelerator pedal opening value is determined by using a preset pedal torque correspondence.

7. The method according to claim 5, characterized in that, The step of determining a safety limit torque value for protecting the vehicle powertrain based on the requested torque value, the limit torque value, and the safe torque value includes: A target torque value is determined from the requested torque value, the limited torque value, and the safe torque value; By using a preset torque change rate threshold to limit the rate of change of the target torque value, a safety limit torque value for protecting the vehicle's powertrain is determined.

8. A redundant control device for a vehicle controller, characterized in that, The redundancy control device includes: The control takeover module is used to execute control operations corresponding to the safety control function in response to the detection that the vehicle controller is in a malfunctioning state, and to acquire the pedal signal collected by the accelerator pedal sensor and the power signal corresponding to the vehicle power system. A torque limiting module is used to determine a safety limiting torque value for protecting the vehicle's power system based on the pedal signal and the power signal. A torque transmission module is used to send the safety limit torque value to the vehicle power system so that the vehicle power system controls the vehicle to perform limp driving based on the safety limit torque value.

9. An electronic device, characterized in that, include: The device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. The machine-readable instructions are executed by the processor to perform the steps of the redundancy control method of the vehicle controller as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the redundant control method for the vehicle controller as described in any one of claims 1 to 7.

Images