Vehicle control method and system and vehicle

Abstract

The invention belongs to the technical field of vehicle control, and relates to a vehicle control method and system and a vehicle, the method comprises the following steps: after the vehicle is powered on, acquiring a key state signal and a signal state of a previous synchronization moment stored in a controller in the vehicle control system as state snapshot information; judging whether the state snapshot information of each controller is consistent or not; if yes, the vehicle control system recovers the system state based on the stored state snapshot information; if not, analyzing the inconsistent key state signal as a target signal, and detecting whether the signal state of the target signal is abnormal based on a signal health monitoring mechanism; and if monitoring that the state of the target signal is abnormal, controlling the target signal to exit or isolate the target signal by each controller, and maintaining the operation of the vehicle control system. According to the method and the device, the state snapshot information is synchronously acquired, and when consistency verification fails, the state of the target signal is monitored, and the target signal is timely exited or isolated, so that the abnormal self-healing and safe operation of the distributed system are realized.

Description

Technical Field

[0001] This application relates to the field of vehicle control technology, and in particular to a vehicle control method and system, and a vehicle. Background Technology

[0002] As automotive electronic and electrical architecture evolves towards a distributed and networked approach, each controller in a vehicle needs to coordinate and perform complex functions while independently maintaining its status information. Its state synchronization and fault tolerance capabilities directly impact the reliability and safety of the entire vehicle. Currently, under real-world conditions such as power transients and non-standard power-on / off cycles, inconsistencies in the states of different controllers often lead to functional abnormalities, severely affecting user experience and driving safety.

[0003] In existing technologies, vehicle electronic systems typically rely on each controller to independently maintain state information, and this state is maintained through memory (such as EEPROM, Electrically Erasable Programmable Read-Only Memory). When the system hibernates or restarts, each controller performs initialization and logical judgments based on its locally stored state.

[0004] However, in the above-mentioned technologies, due to the differences in the timing of state writing and reading of each controller, in scenarios such as rapid power cycling, it is very easy to cause a split in the perception of the same physical state among the controllers, which may lead to the triggering of error function protection or the execution of abnormal operations, ultimately resulting in overall system malfunction, decreased reliability, and safety hazards to users. Summary of the Invention

[0005] This application addresses, to at least some extent, one of the technical problems in the related art.

[0006] Therefore, this application aims to provide a vehicle control method and system, and a vehicle, which prevents state perception splits by synchronously acquiring state snapshot information and writing it in real time; by monitoring signal health, it promptly adopts adaptive exit strategies or signal isolation strategies to maintain system operation in abnormal states, providing dual protection for the vehicle, and restoring the system to normal state when used in the next stage. This fundamentally solves the lack of state synchronization and fault-tolerant recovery mechanisms in distributed systems under power transient conditions, enabling the system to actively maintain or recover to a safe state, and significantly improving the system's security and robustness.

[0007] To achieve the above objectives, in a first aspect, this application provides a vehicle control method, comprising: After the vehicle is powered on, the key state signals and signal states of the previous synchronization moment stored in the controller of the vehicle control system are obtained as state snapshot information. Determine whether the state snapshot information of each controller is consistent; If they match, the vehicle control system restores the system state based on the stored state snapshot information; If there is a discrepancy, the key state signal of the discrepancy is parsed as the target signal, and the signal state of the target signal is detected as abnormal based on the signal health monitoring mechanism. If the abnormal state of the target signal is detected, each of the controllers controls the target signal to exit or isolate the target signal to maintain the operation of the vehicle control system.

[0008] In this embodiment, by introducing a distributed snapshot mechanism and signal fault-tolerant processing, an architectural upgrade from a passive "problem-fix" approach to a proactive "prevention-fault-tolerance" approach is achieved. By acquiring the state snapshot information stored in the controller at the previous synchronization moment after the vehicle is powered on, state perception splits caused by power transients or asynchronous storage are prevented at the source. When the state snapshot information is inconsistent, the inconsistent key state signals are parsed as target signals, and a signal health monitoring mechanism determines whether the target signal state is abnormal. If the target signal state is abnormal, the controllers are controlled to exit or isolate the target signal, enabling the system to maintain basic functionality or a safe state under abnormal operating conditions, effectively avoiding functional lock-up or logical abnormal loops.

[0009] In conjunction with the first aspect, in some implementations of the first aspect, the vehicle control system's body domain controller is configured as the master controller, and the other controllers are configured as participating controllers; the method for the controllers in the vehicle control system to take a state snapshot of the previous synchronization time includes: Vehicle status detection is performed through the vehicle body domain controller; When the vehicle state meets the first synchronization trigger condition, the snapshot information of the state to be synchronized is sent to the participating controller and the body domain controller in the vehicle control system. The vehicle domain controller and the participating controllers write the state snapshot information to be synchronized into the memory corresponding to the vehicle domain controller and each of the participating controllers in real time, and store the generated state identifier in the memory.

[0010] In this embodiment of the application, when the vehicle state meets the first synchronization trigger condition, each controller is made to be in a state that can respond to the synchronization command. By sending the state snapshot information to be synchronized to the participating controller and the body domain controller in the vehicle control system, it is ensured that all relevant controllers can achieve synchronous real-time writing within a unified time window, thereby fundamentally solving the problem of asynchronous state writing of each controller in the memory and providing reliable data for state consistency verification after subsequent system restart.

[0011] In conjunction with the first aspect, some implementations of the first aspect include methods for establishing a signal health monitoring mechanism, such as: Real-time monitoring of the signal status of the target signal; Determine whether the target signal triggering condition is valid; Determine whether the duration of the target signal exceeds a first preset time; Determine whether the signal state of the target signal is consistent with the signal state of other related signals; If the target signal is determined to be triggered effectively, the duration does not exceed the first preset time, and the signal state of the target signal is consistent with that of other associated signals, then the target signal state is normal; if the target signal is determined to be triggered ineffectively, or the duration exceeds the first preset time, or the signal state of the target signal is inconsistent with that of other associated signals, then the target signal state is abnormal.

[0012] In this embodiment, by constructing a three-dimensional collaborative diagnostic mechanism of triggering conditions, duration, and associated states, a systematic and refined assessment of the health status of the target signal is achieved, thereby preventing source triggering errors, signal stickiness, and logical association errors, improving the accuracy and real-time performance of the system in identifying abnormal states, and providing a reliable basis for subsequent decision-making.

[0013] In conjunction with the first aspect, in certain implementations of the first aspect, the method for maintaining the operation of the vehicle control system when the signal state of the target signal is abnormal includes: The task of monitoring the response of the corresponding controller to the target signal; When the signal state of the target signal is abnormal, each controller executes an adaptive exit strategy to invalidate the target signal and terminate the response task of the target signal, thereby exiting the continuous abnormal state of the vehicle control system. If the abnormal state of the vehicle control system continues, each controller will execute a signal isolation strategy to isolate the target signal, terminate the response task of the target signal, and maintain the operation of the vehicle control system.

[0014] In the embodiments of this application, when the target signal state is abnormal, each controller executes an adaptive exit strategy to invalidate the target signal and terminate the target signal response task, thereby exiting the continuous abnormal state in a timely manner, enabling the system to recover its basic functions on its own in the abnormal state; in the case of failure of the adaptive exit strategy, the signal isolation strategy can effectively block the propagation path of the abnormal signal, prevent the spread of local faults from causing systemic functional avalanche, and improve the system's safety and reliability.

[0015] In conjunction with the first aspect, in some implementations of the first aspect, the method for implementing the adaptive exit strategy includes: Obtain the target signal type, system context, and current persistent state of the target signal; Generate exit conditions based on the target signal type and the system context; Determine whether the current continuous state of the target signal meets the exit conditions; If the conditions are met, the target signal is invalid, and the vehicle control system exits the continuous abnormal state; if the conditions are not met, the status of the target signal is continuously monitored, and no exit operation is performed.

[0016] In this embodiment, the exit conditions of the target signal are dynamically determined by the target signal type and system context, which realizes the precision and intelligence of the exit strategy. This ensures that the exit operation is triggered only when the exit conditions are strictly met, avoiding premature or erroneous exit from interfering with normal functions, thereby improving the system's pertinence and reliability in handling abnormal signal problems.

[0017] In conjunction with the first aspect, in certain implementations of the first aspect, the method for implementing the signal isolation strategy includes: Based on the system context and the current persistent state of the target signal, each controller selects and performs at least one of the following operations: logical isolation, source suppression, and communication filtering, to isolate the target signal and eliminate its impact on the vehicle control system. After the vehicle control system continues to operate, the controller generates and stores fault codes for isolated events.

[0018] In this embodiment, in the event of an adaptive exit strategy failure, a signal isolation strategy is implemented to ensure the normal operation of basic system functions or maintain a safe state. Based on the current persistent state of the target signal, one or more operations from logic isolation, source suppression, and communication filtering are specifically employed to precisely block fault propagation. By forcibly entering and maintaining a degraded operation mode, system availability is preserved to the greatest extent possible. Furthermore, the recording and reporting of high-priority fault codes facilitates in-depth offline diagnostics, significantly improving system security and reliability.

[0019] In conjunction with the first aspect, in some implementations of the first aspect, the vehicle control method further includes: Real-time monitoring of the vehicle control system status; When the vehicle control system restarts or the second synchronization trigger condition is met, the controller is again controlled to obtain the state snapshot information of the previous synchronization moment; The state snapshot information is subjected to consistency verification and repair to form consistent state snapshot information; System state recovery is achieved based on the consistent state snapshot information.

[0020] In this embodiment, by monitoring the vehicle control system status in real time, when the vehicle control system restarts or meets the second synchronization trigger condition, the vehicle control system obtains the status snapshot information of the previous synchronization moment again, and performs consistency verification and repair on the status snapshot information to ensure the consistency of the status snapshot information. Based on the consistent status snapshot information, the system status is restored, ensuring the smooth recovery of functions. This safety mechanism design meets the ASIL level requirements and significantly improves the reliability of the system.

[0021] In conjunction with the first aspect, in certain implementations of the first aspect, the method for performing consistency verification and repair on the state snapshot information includes: Determine whether the state snapshot information obtained by each controller at the previous synchronization time is consistent; If they are consistent, the consistency check of the state snapshot information passes; if they are inconsistent, the vehicle control system overwrites or corrects the erroneous signal state according to preset rules to form consistent state snapshot information.

[0022] In this embodiment, by determining whether the state snapshot information acquired by each controller at the previous synchronization moment is consistent, changes in the state snapshot information stored in the controller are excluded before the vehicle control system restarts or the second synchronization trigger condition is met. When the state snapshot information is inconsistent, the vehicle control system overwrites or corrects the erroneous signal state according to preset rules to form consistent state snapshot information, thereby solving the problem of state perception split, unifying system perception from the source, and ensuring that the system can safely and reliably exit the previous vehicle control system operation mode through confirmation and recovery processes, completely restoring a consistent and stable normal operation state, significantly improving the system's self-healing capability and overall functional safety level under non-standard operating conditions such as power transients.

[0023] Secondly, this application provides a vehicle control system, including: The data acquisition module is used to acquire the state snapshot information of the previous synchronization moment and the signal status of the target signal; The first judgment module is used to determine whether the state snapshot information of each controller is consistent; The second judgment module is used to determine whether the signal state of the target signal is abnormal when the state snapshot information is inconsistent. The control module is used to establish a signal health monitoring mechanism when the status snapshot information is inconsistent; and to control the target signal to exit or isolate the target signal when the signal status is abnormal, so as to maintain the operation of the vehicle control system.

[0024] In this embodiment, the vehicle control system first obtains the state snapshot information of the previous synchronization moment through the data acquisition module, and then judges whether the state snapshot information is consistent through the first judgment module to determine whether there is a state perception split in the vehicle control system state. After the judgment is completed, the second judgment module judges whether the signal state of the target signal is abnormal. When the signal state of the target signal is abnormal, the control module controls the target signal to exit or isolates the target signal, effectively blocking the abnormal cycle of system function, solving problems such as signal stickiness, and improving the reliability and safety of system use.

[0025] Thirdly, this application provides a vehicle, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it causes the processor to implement the vehicle control method described in the first aspect above; or the vehicle control system described in the second aspect above.

[0026] As can be seen from the above technical solutions, additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0027] Figure 1 This is a schematic flowchart of a vehicle control method according to an embodiment of this application; Figure 2 This is a schematic flowchart illustrating the method for the controller in the vehicle control system of this application to take a state snapshot of the previous synchronization moment; Figure 3 This is a flowchart illustrating a method for detecting whether the system status meets the first synchronization triggering condition according to an embodiment of this application. Figure 4 This is a flowchart illustrating a method for determining whether the state snapshot information of each controller is consistent according to an embodiment of this application. Figure 5 This is a schematic flowchart of a method for establishing a signal health monitoring mechanism according to an embodiment of this application; Figure 6 This is a schematic flowchart of a method for maintaining the operation of a vehicle control system under abnormal signal conditions of a target signal, according to an embodiment of this application. Figure 7 This is a flowchart illustrating a method for implementing an adaptive exit strategy according to an embodiment of this application; Figure 8 This is a flowchart illustrating a method for determining whether an adaptive exit strategy is successful according to an embodiment of this application. Figure 9 This is a schematic flowchart illustrating a method for implementing a signal isolation strategy according to an embodiment of this application; Figure 10A schematic flowchart of a vehicle control system state recovery method according to an embodiment of this application; Figure 11 A method for consistency verification and repair of state snapshot information according to embodiments of this application Flowchart; Figure 12 This is a schematic diagram of the architecture of a vehicle electronic system fault-tolerant control system according to an embodiment of this application.

[0028] In the above figures: 100, Fault-tolerant control system for vehicle electronic system; 101, Data acquisition module; 102, First judgment module; 103, Second judgment module; 104, Control module. Detailed Implementation

[0029] To make the technical problems, technical solutions, and beneficial effects to be solved by this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and are not intended to limit the scope of this application.

[0030] The prefixes such as "first" and "second" used in this application embodiment are merely for distinguishing different descriptive objects and do not limit the position, order, priority, quantity, or content of the described objects. The use of ordinal numbers and other prefixes used to distinguish descriptive objects in this application embodiment does not constitute a limitation on the described objects. The description of the described objects is given in the claims or the context of the embodiments, and should not constitute unnecessary restrictions due to the use of such prefixes. Furthermore, in the description of this embodiment, unless otherwise stated, "multiple" means two or more.

[0031] The technical solutions of the embodiments of this application will be described below with reference to the accompanying drawings. In the description of the embodiments of this application, unless otherwise stated, " / " means "or," for example, A / B can mean A or B; the term "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone.

[0032] In the embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0033] In the field of modern intelligent vehicles, vehicles primarily employ a distributed electronic architecture. The various functional controllers within the vehicle's electronic system operate independently yet collaboratively to achieve more complex vehicle functions and a superior performance experience. However, while this distributed electronic architecture enhances flexibility and scalability, it also presents challenges in areas such as state synchronization. Especially when vehicles experience transient power conditions such as non-standard power cycles, momentary power outages, and rapid wake-ups, the independent differences in state writing timing and asynchronous state reading times among controllers can easily lead to state perception splits. This means that different controllers may have inconsistent perceptions of the same system state, resulting in the triggering of incorrect logical branches after a system restart, creating a functionally abnormal loop.

[0034] This mismatch in state not only affects user experience but also directly threatens vehicle functional safety. For example, in the scenario of electric tailgate control, if the Body Control Module (BCM) and the Passive Entry Passive Start (PEPS) system do not synchronize their stored values ​​for "driver's lock state" and "tailgate state," the system may trigger or remain in the "key protection" state at the wrong time, leading to abnormal opening and closing of the tailgate, or even damage to the mechanical structure of the tailgate, seriously affecting the personal safety of the user. At the same time, when the target signal in the distributed electronic system experiences a cognitive split in the system state, the target signal may remain valid and unable to exit normally, causing a chain of functional abnormalities, causing the system to fall into a continuous error loop. In severe cases, this may lead to exhaustion of system resources, communication blockage, or even a cascading failure of the entire vehicle's electronic system.

[0035] In recent years, vehicle control methods and devices, as well as a monitoring method and system for a vehicle domain controller system, have been commonly used in the field of vehicle control technology.

[0036] In vehicle control methods and devices, the improvement method for the vehicle electronic system controller mainly involves writing the fault code generated in the current driving cycle into the electrically erasable programmable read-only memory (EEPROM) when a power-down signal is received from the body control module (BCM) during the current driving cycle. If a power-on signal is received from the BCM during the fault code writing process, the current fault code writing is stopped, and the power-on initialization process is executed instead. This avoids delaying the vehicle's power-on due to waiting for the fault code writing to be completed, solves systemic problems caused by transient changes in vehicle power supply, promptly responds to changes in user operating intentions, and improves power-on response efficiency.

[0037] In the above scheme for setting the control logic of the vehicle electronic system controller, the improvement method of the vehicle controller is mainly to start multiple monitoring modules to periodically scan and judge the key status information of the domain controller when the vehicle is powered on. When an abnormal state is detected, the storage module is triggered to record a snapshot of information within a preset time range before the fault time, and at the same time, an abnormal prompt is issued to the driver, so as to realize the timely detection, recording and early warning of abnormal operation of the domain controller system.

[0038] In applying the above scheme to the control logic of the vehicle controller, the vehicle electronic system still has the following problems: Single-task response limitations: It only addresses the interruption and recovery strategy for a single task during power-on / off transitions, failing to solve the consistency problem of synchronizing critical information among multiple controllers in a distributed system, and cannot be applied to other architectures of vehicle electronic systems.

[0039] Fault-intolerant management method: When the system enters an erroneous functional branch due to inconsistencies in state or other issues, or when the target signal becomes sticky, no specific recovery capability is provided. It can only record and issue warnings, but cannot prevent abnormal functional loops, does not solve the urgent problems that need to be solved by the vehicle, and cannot guarantee the use of the basic functions of the vehicle's electronic system. Limitations of domain controller monitoring: Monitoring focuses on the health of a single domain controller node, making it impossible to perceive and resolve status issues across multiple controller nodes in real time. The system may still enter incorrect branches due to inconsistent perceptions of the status of multiple controllers, affecting normal system operation. Furthermore, logging and alerting only occur after a fault has occurred, and the status of each controller cannot be proactively synchronized and saved.

[0040] In summary, the vehicle electronic system controller settings in related technologies cannot effectively solve the mechanism for establishing, maintaining and restoring state consistency among multiple distributed controllers, and also lack the ability to intervene in the system in real time when using these split states.

[0041] Based on the above application scenarios, this application provides a vehicle control method.

[0042] Figure 1 This is a schematic flowchart illustrating a vehicle control method provided in the first aspect of this application. The method is applied to a distributed vehicle control system and includes the following steps.

[0043] S1. After the vehicle is powered on, the key state signals and signal states stored in the controller of the vehicle control system at the previous synchronization moment are obtained as state snapshot information.

[0044] Specifically, by acquiring the state snapshot information of the previous synchronization moment, it means that at the same preset moment, all the state information of each controller in the system is completely recorded and saved to reflect the consistency of the vehicle control system state (such as door lock and tailgate position) at the preset moment, which is convenient for subsequent comparison and recovery.

[0045] It should be noted that vehicle power-on is the most common and typical scenario for system restart. During the process of a vehicle going from power-off to power-on, almost all controller hardware will experience power-off and power-on cycles, which is a complete global reset.

[0046] Reference Figure 2 In the vehicle control system, the body domain controller is configured as the master controller, and other controllers are configured as participating controllers. The method for the controllers in the vehicle control system to take a state snapshot of the previous synchronization moment is as follows.

[0047] S11. Vehicle status detection is performed through the vehicle body domain controller.

[0048] S12. When the vehicle status meets the first synchronization trigger condition, the snapshot information of the status to be synchronized is sent to the participating controller and the body domain controller in the vehicle control system.

[0049] Specifically, the first synchronization trigger condition refers to the system detecting a critical state change or entering a low-power mode. The state snapshot information to be synchronized refers to the state snapshot information before the critical state change or entering the low-power mode.

[0050] Critical state changes refer to one or more of the following situations detected by the system: a change in key position, locking / unlocking of any door, opening of the hood, change in the opening / closing state of the tailgate, change in the state of the charging port cover, or the vehicle being in the parking gear. Low-power mode is triggered by state transitions explicitly defined by the vehicle network management protocol. It refers to a state in which the controllers and bus network in the system suspend primary functions to save energy, but can still be awakened by specific events. When the vehicle status meets the first synchronization trigger condition, each controller can respond to the synchronization command and broadcast a high-priority global status synchronization command frame through the main controller of the electronic system (such as the body domain controller BCM) to ensure that all relevant participating controllers receive the command at almost the same time.

[0051] Reference Figure 3 The method for detecting whether the system status meets the first synchronization trigger condition is as follows.

[0052] S121. Real-time monitoring of vehicle physical status information and network management information.

[0053] Specifically, physical status information includes key position, hood opening / closing status, door lock / closed status, tailgate opening / closing status, charging port cover status, and vehicle gear position. Network management information includes the transmission status or frequency of network management messages, bus activity indicators, etc.

[0054] S122. Determine whether the physical status information and network management information have changed.

[0055] S123. If yes, then the system state satisfies the first synchronization trigger condition; if no, then the system state does not satisfy the first synchronization trigger condition.

[0056] Specifically, when the system detects one or more of the following situations: a change in key position, locking / unlocking of any door, opening of the hood, change in the opening / closing state of the tailgate, change in the state of the charging port cover, or the vehicle being in park, it determines that a critical state change has occurred. When, while detecting a change in physical state information, the system also detects that the network activity of the vehicle communication bus remains below a preset activity threshold, it determines that the system is about to enter a low-power mode.

[0057] For example, when the system detects that the key has been removed, all doors are closed, and the bus activity level remains below a preset activity threshold, it is determined that the system is about to enter a low-power state.

[0058] When the key is removed, it indicates that the driver has left or has no intention of operating the vehicle. At this time, the monitoring finds that all doors are closed and the vehicle is in a stationary state. However, there is still a possibility that the driver will operate the vehicle through the vehicle network. At this time, by monitoring the bus activity, it is found that the bus activity is continuously lower than the set activity threshold, indicating that each controller has completed the preparation work before hibernation, there is no longer any business message exchange, and the normal network activity has stopped. Therefore, it is determined that the system is about to enter the low power mode.

[0059] S13, the vehicle domain controller and participating controllers will write the state snapshot information to be synchronized into the memory of the vehicle domain controller and each participating controller in real time, and store the generated state identifier into the memory.

[0060] Specifically, when the vehicle control system detects a critical state change or enters a low-power mode, if it hasn't acquired the state snapshot information from the previous synchronization moment, the write timing and state read timing of the EEPROMs of each controller will be out of sync after the vehicle is powered on. This can easily lead to inconsistent state perception, causing the system to enter an incorrect logic branch after a restart. In this situation, by controlling the body domain controller and participating controllers according to the synchronization protocol, the state snapshot information to be synchronized is written to the corresponding memories of the body domain controller and each participating controller in real time. The data frame of the synchronization protocol includes: synchronization command ID, timestamp / sequence number, and identifiers of the state list to be synchronized, etc.

[0061] In other words, by forcibly sending a high-priority instruction, a controlled global synchronization window is established using the vehicle's existing network management process. This forces the originally random and distributed write operations to be aligned to a unified time frame. As a result, at the moment when the system is in a critical state change or low-power mode, all controllers store a system state snapshot in their memory that is content-associated, time-synchronized, and has the same batch of state identifiers. This ensures that when the vehicle is woken up again, each controller can start based on the same stored state, thereby preventing the system from entering an incorrect logic branch due to the split cognitive state of each controller, which would cause the system to malfunction.

[0062] Upon entering an error logic branch, the lack of a cleanup mechanism leads to signal sticking. Abnormal system states after entering this branch may also manifest as: function lock-up (e.g., the tailgate continuously attempts illegal actions), function loss (e.g., the tailgate cannot be opened normally), and system resource exhaustion (e.g., the bus is blocked by abnormal messages). It should be noted that when the bus is silent, there are no electrical signals in the system. At this time, the controller cannot communicate or write to the memory. Therefore, the write operation must be completed before the bus enters the silent state. The low-power mode includes the entire process from the system preparing to hibernate to the bus being silent and then to deep hibernation. Therefore, when the system state meets the low-power mode conditions, each controller can still send messages to perform distributed state snapshots when preparing to hibernate.

[0063] S2. Determine whether the state snapshot information of each controller is consistent.

[0064] Reference Figure 4 The method for determining whether the state snapshot information of each controller is consistent is as follows.

[0065] S21. Determine whether the status identifiers stored in each controller are consistent.

[0066] Specifically, the status identifier refers to the label of this snapshot. If the controller has this label, it proves that the snapshot was successful. Therefore, by comparing the status identifiers of each controller, we can find out if there are any missing status identifiers or if the status identifiers are different from those of other controllers, thereby determining whether the distributed state snapshot is complete.

[0067] S22. If they are inconsistent, then determine that the state snapshot information is inconsistent; if they are consistent, then determine whether the state snapshot information to be synchronized written by each controller is consistent.

[0068] By reading the status identifiers stored in the memory of each controller to determine whether the distributed status snapshot information is complete, only a small data point needs to be compared, instead of comparing all the status data stored in all controllers. This makes the verification cost low and the verification speed fast. The verification of the distributed cooperative operation structure can be achieved with minimal overhead, thereby improving the system reliability and efficiency.

[0069] S23. If they are consistent, the state snapshot information of each controller is consistent; if they are inconsistent, the state snapshot information of each controller is inconsistent.

[0070] Specifically, if the state identifiers of each controller are consistent, it means that each controller took state snapshots at the same time. Therefore, the consistency of the state snapshot information recorded in the memory of each controller is compared to check the consistency of the state snapshot information written in each controller.

[0071] S3. If they match, the vehicle control system restores the system state based on the stored state snapshot information.

[0072] Specifically, when the state snapshot information is consistent—that is, before a critical system state change or entry into a low-power mode—the state information written to the memory by each controller is reliable. This indicates that the states stored in the memories of each controller were recorded at the same logical moment, forming a historical baseline. The vehicle control system can restore the system state based on the stored state snapshot information.

[0073] S4. If there is a discrepancy, the key state signal of the discrepancy is analyzed as the target signal. The signal health monitoring mechanism is used to detect whether the signal state of the target signal is abnormal. If the abnormal state of the target signal is detected, each controller controls the target signal to exit or isolate the target signal to maintain the operation of the vehicle control system.

[0074] Specifically, when an abnormal signal status is detected, each controller exits or isolates the target signal, placing the vehicle control system in a degraded operational state. Due to inconsistent state perception, the system enters an erroneous logic branch after a restart, causing the vehicle control system to enter an abnormal state. This can lead to problems such as protection signal sticking, function lock-up, function loss, and system resource exhaustion, severely impacting normal vehicle operation. Therefore, it is necessary to control each controller to exit or isolate the target signal to ensure the system remains in a safe and operational state, maintaining the vehicle control system's operation.

[0075] For example, consider a component in a vehicle domain control system. When a protection signal is stuck, the logical condition for resetting the protection signal (such as the PKETrunkButtPressed keyless trunk case trigger signal) can never be met. The resetting condition for this protection signal might be "driver's door unlocked," but the Body Control Controller (BCM) considers "driver's door unlocked," while the PEPS (Power Control Panel for Power Controls) considers "driver's door still locked." Due to this discrepancy, the Power Control Panel (PSPS) determines the resetting condition is invalid. Thus, this protection signal is endlessly anticipated, becoming a continuous source of error, constantly driving subsequent logic in an erroneous direction.

[0076] In the case of functional lockout, after the sticky protection signal is received by the tailgate ECU, the tailgate ECU will continue to execute the protection logic, such as repeatedly trying to open and close to "ensure safety". That is, the tailgate will keep trying illegal actions, which may directly lead to overload, wear or even damage of mechanical parts, making it impossible for users to use normally and potentially causing property damage.

[0077] In the event of a loss of function, after entering an erroneous logic branch, the tailgate ECU may receive conflicting signals and determine that it is currently in a dangerous mode. This would lock all user operation interfaces and refuse to open the tailgate to prevent unpredictable dangers, making it impossible for the user to open the tailgate normally. In an emergency, this could pose a safety hazard.

[0078] When system resources are exhausted, after entering an error logic branch, the controller may continuously and frequently send error status report messages or request messages based on the current error state, causing congestion in the vehicle communication network, affecting the transmission of other critical control information, causing vehicle response delays, intermittent failure of some functions, and seriously affecting driving safety.

[0079] Reference Figure 5 ( Figure 6 change Figure 5 The method for establishing a signal health monitoring mechanism is as follows.

[0080] S41. Monitor the signal status of the target signal in real time.

[0081] Specifically, the criteria for determining the target signal are as follows: Safety / Functional Impact: The correctness of the signal is related to the normal execution of vehicle safety functions (such as door locking, braking, and power limiting) or core user experience functions (such as door and window control, and tailgate control). For example, when the signal is PKETrunkButtPressed, an abnormal PKETrunkButtPressed signal directly affects the safety protection logic of the power tailgate. Incorrect triggering will cause abnormal tailgate operation, so this signal is the target signal.

[0082] Cross-controller / cross-domain sharing: A signal is generated by one controller (sender), but is used as a key decision-making basis by at least one other controller (receiver). Its state needs to be consistent across multiple nodes to ensure normal system operation. For example, a signal generated by PEPS will be received by both BCM and tailgate ECU, and will make corresponding action decisions based on the signal. Therefore, this signal is the target signal.

[0083] State correlation and timeliness: If the generation, maintenance and exit of a signal strictly depend on the state of other systems (such as door lock state, power mode, etc.) and are usually temporary and conditionally maintained rather than permanent, then the signal is the target signal.

[0084] Risk of abnormal propagation: If a signal becomes "sticky" due to state asynchrony or logical error, that is, the signal remains valid or invalid, it will trigger a chain of functional abnormalities in the system, or even cause the system function to "avalanche". In this case, the signal is the target signal.

[0085] Based on the aforementioned criteria for judging the target signal, its effectiveness does not depend on whether it is successfully received at a single moment, but rather on the real-time changes in the states of other systems. Therefore, if the condition is checked only once upon signal triggering, the system cannot promptly detect changes in the control behavior of other controllers that depend on the signal during the signal's duration, potentially leading to signal stickiness and system malfunctions. Therefore, in conclusion, the main controller needs to continuously monitor the target signal.

[0086] S42. Determine whether the target signal triggering condition is valid.

[0087] Specifically, the triggering condition refers to checking whether the generation of the signal conforms to the predefined physical / logical constraints. That is, the generation of the target signal needs to be based on the measurable physical parameters of the vehicle and the internal state and logical relationship of the system to prevent the illegal triggering of the target signal or the generation of ghost signals.

[0088] For example, the vehicle's PEPS system sends a PKETrunkButtPressed signal (trunk button pressed), but logical constraints require that this signal can only be triggered when "vehicle speed is 0" and "key is authenticated inside the vehicle". When the system detects that the current vehicle speed is greater than 5 km / h, the trigger condition for this signal is invalid, regardless of whether any button action is detected. The system must ignore this signal to avoid accidentally opening the tailgate while driving.

[0089] S43. Determine whether the duration of the target signal exceeds the first preset time.

[0090] Specifically, check whether the activation duration of the target signal exceeds a reasonable range, that is, the maximum allowed duration threshold between when the target signal is triggered (activated) and when it is cleared (disabled) in its designed functional scenario.

[0091] By monitoring the duration of the target signal, it is possible to determine whether the monitored target signal disappears in time, thereby identifying whether there is signal stickiness in the system and preventing the target signal from continuously giving instructions and forming an erroneous excitation source, which would lead to abnormal loops in subsequent system functions.

[0092] For example, consider the PKETrunkButtPressed signal. This signal is designed to automatically reset to zero within 250ms after being sent. If the signal is not executed within 250ms, it may persist for several seconds or even longer, causing the exit condition to never be met, resulting in a sticky situation and causing the system to fall into an abnormal loop.

[0093] S44. Determine whether the signal state of the target signal is consistent with the signal state of other related signals.

[0094] Specifically, check whether the state of the signal contradicts that of other related signals, that is, check whether the logic of the signal contradicts the current value of other signals in the system that have causal, temporal, or mutual exclusion relationships.

[0095] For example, the PKETrunkButtPressed signal indicates that a trunk opening request is valid. If a "tailgate fully closed and locked" signal is also detected, it means that within the same processing cycle or a very short event window, the system reports that the tailgate is securely locked while simultaneously receiving a tailgate opening request. Since the request is not withdrawn in time during the continuous request period, it becomes an invalid request, and the action fails.

[0096] S45. If the target signal is determined to be triggered effectively, the duration does not exceed the first preset time, and the signal state of the target signal is consistent with that of other related signals, then the target signal state is normal; if the target signal is determined to be triggered ineffectively, or the duration exceeds the first preset time, or the signal state of the target signal is inconsistent with that of other related signals, then the target signal state is abnormal.

[0097] It should be noted that the triggering conditions, durations, and associated states of different target signals are all different. Specific state evaluation criteria need to be defined for each target signal according to the vehicle's functional specifications.

[0098] Reference Figure 6 In order to maintain basic functions or safety status when some components are abnormal or mismatched, the following method is used to maintain the operation of the vehicle control system when the signal status of the target signal is abnormal.

[0099] S41. Monitor the response task of the corresponding controller to the target signal.

[0100] S42. When the target signal is in an abnormal state, each controller executes an adaptive exit strategy to invalidate the target signal and terminate the target signal response task, thereby exiting the continuous abnormal state of the vehicle control system.

[0101] Specifically, when the target signal is in an abnormal state, the controller receiving the target signal cannot take action according to the normal settings. At this time, an adaptive exit strategy needs to be executed to process the target signal accordingly, invalidate the target signal, and terminate the target signal response task, so as to avoid the system being unable to maintain basic functions when some components are abnormal or the state is mismatched, which could cause safety problems.

[0102] Reference Figure 7 The method for implementing the adaptive exit strategy is as follows.

[0103] S421. Obtain the target signal type, system context, and current persistent state of the target signal.

[0104] Specifically, target signals can be categorized into safety target signals and non-safety target signals, with different duration conditions corresponding to different target signal types. For critical safety signals (such as brake signals), the duration conditions are relatively strict; for non-safety target signals (such as window position memory signals), the duration conditions are relatively lenient, for example, allowing slight timeouts, and allowing downgrading or silent ignoring after failure.

[0105] System context refers to the global environment and real-time state set of the vehicle's electronic system when the target signal is generated and takes effect. Specifically, it includes: the relevant states of other controllers, power modes and network states, time-series information, and user operation intentions.

[0106] Among them, the relevant states of other controllers are the basis for judging whether there is a logical contradiction in the target signal and for performing state recovery. For example, when judging the PKETrunkButtPressed signal, the relevant states of other controllers include the master lock state of the BCM and the tailgate opening and closing state of the tailgate ECU (Electronic Control Unit).

[0107] Power mode and network status refer to whether the system is in a power-on, power-off, sleep, or wake-up process, and whether network communication such as CAN / FlexRay (Controller Area Network / Next Generation Automotive Network Communication Protocol) is normal. Executing complex commands when the power mode or network status changes may fail or trigger a chain of problems, thus affecting system decision-making.

[0108] Time series information refers to the duration of a signal and the sequence of related state changes. For different faults, the duration of the signal directly relates to the severity of the hazard; therefore, time series information is a key factor affecting strategy execution.

[0109] User operation intent refers to whether a new user instruction has appeared, and whether the new user instruction overwrites the previous protection logic. It determines the content and priority of the instruction that the system needs to respond to. Therefore, user operation intent is a key factor affecting policy execution.

[0110] By acquiring the current persistent state of the target signal, we can respond to the instantaneous dynamic changes in the target signal state during its persistence, thus ensuring the accuracy of the adaptive exit strategy execution.

[0111] S422. Generate exit conditions based on the target signal type and system context.

[0112] Specifically, the duration requirements for critical safety signals are relatively strict, while the duration requirements for non-safety target signals are relatively lenient. Within the system context, other control states determine the target state of the exit logic; if the target state contradicts the target signal, the condition is immediately met. For example, when the BCM target state is door unlock, the exit condition for the sticky PKETrunkButtPressed signal in PEPS changes from "exit after timeout" to "exit immediately."

[0113] The urgency of adaptive strategy execution is determined by power and network conditions. For example, if the system detects frequent power transients (non-standard power cycles), it may shorten the default timeout exit time of the signal or relax the synchronization window of the consistency check to clear uncertain signals more quickly and enter a safe state.

[0114] Time-series information determines the severity level of a fault, thus affecting the execution of exit actions; the longer the fault time series, the more severe the handling.

[0115] User operation intents are treated as the highest priority instructions and can directly override or reset exit conditions.

[0116] By dynamically calculating and generating exit conditions based on the target signal type and multiple parameters in the system context, the system can generate corresponding exit conditions for target signals under different conditions in different faults, thereby preventing signal sticking and protecting the normal operation of the system's basic functions.

[0117] S423. Determine whether the current continuous state of the target signal meets the exit conditions.

[0118] Specifically, the newly generated exit conditions are verified based on the current continuous state of the target signal to avoid premature action when the conditions are not met or invalid action when the conditions have expired, ensuring that the action is based on the latest and consistent state.

[0119] S424. If the conditions are met, the target signal is invalid, and the vehicle control system exits the continuous abnormal state; if the conditions are not met, the target signal status is continuously monitored, and the exit operation is not performed.

[0120] Specifically, if the current continuous state of the target signal meets the exit condition, an exit operation is performed on the target signal. At this time, the system resolves problems such as error loops and signal stickiness caused by the abnormality of the target signal, so that the basic functions of the system can operate normally, avoid mechanical actions that may cause personal injury or damage to components due to abnormal execution, and ensure user safety.

[0121] S43. If the abnormal state of the vehicle control system continues, each controller will execute a signal isolation strategy to isolate the target signal, terminate the response task of the target signal, and maintain the operation of the vehicle control system.

[0122] Specifically, scenarios where adaptive exit strategies fail include: exit strategy failure, signal "infinite loop" regeneration, and partial damage to the health monitoring mechanism. Exit strategy failure refers to an abnormality in the triggering conditions or actions of the adaptive exit strategy, preventing the correct execution of the exit operation. For example, a malfunction in the software module responsible for clearing the signal may prevent the clearing action from being performed, thus preventing the exit from exiting the abnormal loop.

[0123] Signal "dead loop" regeneration refers to a situation where, after a signal is successfully cleared and exited, it is mistakenly triggered again immediately or within a very short time due to unresolved issues such as inconsistencies in the underlying state, forming a "dead loop" of "exit-regeneration".

[0124] A partial impairment of the health monitoring mechanism means that the system detects that its ability to monitor the health of a certain signal may be interfered with or become unreliable. In this case, the system cannot obtain the current continuous state of the target signal, so it cannot determine whether the exit conditions are met, and the adaptive exit strategy fails to execute.

[0125] If the adaptive exit strategy fails, it means that the adaptive exit strategy has failed to solve the problem. At this time, the basic functions of the system are still in a state of failure. In this case, the signal isolation strategy is executed to ensure that the basic functions of the system are operating normally or to maintain a safe state.

[0126] Reference Figure 8 The method for determining whether the adaptive exit strategy is successful is as follows.

[0127] S431. Monitor the current continuous state of the target signal after performing the exit operation.

[0128] Specifically, check whether the target signal status has changed from "valid / activated" to "invalid / cleared".

[0129] S432. Continuously monitor the current status of the target signal within the first preset window time.

[0130] Specifically, after the target signal is cleared, the reappearance of the target signal is continuously monitored within an observation period (such as the next 1-3 system cycles or hundreds of milliseconds).

[0131] S433. If the target signal is detected to be triggered again after exiting, or to be triggered again within the first preset window time, the adaptive exit strategy is determined to have failed.

[0132] Specifically, if the target signal is detected to be triggered immediately after exiting or re-triggered within a preset time period, it indicates that the abnormal target signal is still valid and has not been cleared, and the adaptive exit strategy fails to execute.

[0133] Reference Figure 9 The method for implementing the signal isolation strategy is as follows.

[0134] S431. Based on the system context and the current persistent state of the target signal, each controller selects and performs at least one of the following operations: logical isolation, source suppression, and communication filtering, to isolate the target signal and eliminate its influence on the vehicle control system.

[0135] Specifically, logical isolation refers to marking the signal as "isolated" or "untrusted" at the software level. All subsequent decision-making logic that relies on this signal will temporarily ignore it and instead use a safe default value or rely on other consistent states for judgment.

[0136] Source suppression refers to the system sending a reset command or forced clearing request to the controller that generated the signal, attempting to resolve the abnormal signal process at its source. For example, when it is determined that the abnormality originates from a software or hardware fault within the sending controller, source suppression can be used to eradicate the fault.

[0137] Communication filtering refers to temporarily filtering out such signal packets from specific nodes at the gateway or network management level to prevent them from propagating across the vehicle network. For example, when an anomaly manifests as a network-level problem or the fault has a wide impact, logical isolation would require multiple modifications, which is inefficient. Therefore, communication filtering is chosen for isolation to ensure the normal operation of downstream controllers.

[0138] For example, during the vehicle's key protection period, the vehicle controller (BCM) mistakenly switches from locked to unlocked, causing the PKETrunkButtPressed signal to fail to clear in time. Subsequently, when the RKE (Remote Keyless Entry) unlock signal is triggered, it conflicts with the previous state of "keeping locked during key protection." The system mistakenly interprets this as the user pressing the tailgate button again, causing the tailgate to open abnormally. The isolation procedure for this PKETrunkButtPressed signal abnormality is as follows.

[0139] PEPS actively blocks this signal (i.e., it does not use it as a basis for function triggering).

[0140] Internally, the PKETrunkButtPressed signal is marked as "isolated" and prohibited from participating in subsequent logical judgments. Simultaneously, the system sends a "signal anomaly isolation event" log to the diagnostic module, recording the timestamp, signal ID, trigger condition, and reason for isolation.

[0141] This ensures that the system will not respond to PKETrunkButtPressed if the RKE signal is triggered again, thus preventing the tailgate from opening accidentally and ensuring functional safety.

[0142] It should be noted that in practical applications, the three operations can be combined to form a deep defense, better isolate abnormal signals, and enable the system to maintain basic functions or a safe state even when some components are abnormal or mismatched.

[0143] S432. After the vehicle control system continues to operate, the controller generates and stores fault codes for isolated events.

[0144] Specifically, by generating and storing fault codes, a direct diagnostic entry point is provided for maintenance personnel, indicating the root cause of the fault and facilitating in-depth diagnosis even offline. Simultaneously, it enables traceability of complex fault scenarios, fixes the system context at the time of the isolated event, facilitates fault cause analysis, and improves system reliability and trustworthiness.

[0145] When a cognitive split occurs in the system state, signal exit conditions and timing are dynamically adjusted through signal fault tolerance processing, or persistent abnormal signals are isolated to prevent system function avalanche, ensuring that the system can maintain basic functions or a safe state even when state mismatch occurs. At this point, only the termination of the current error phenomenon is solved, temporarily shielding the harm, but the root cause of the error phenomenon is still not addressed, namely, the inconsistent perception of the shared state in the memory of each controller remains.

[0146] Reference Figure 10 The vehicle control methods also include the following vehicle control system state recovery methods.

[0147] S5. Monitor the status of the vehicle control system in real time.

[0148] S6. When the vehicle control system restarts or the second synchronization trigger condition is met, the controller is again controlled to obtain the state snapshot information of the previous synchronization moment.

[0149] Specifically, the second synchronization trigger condition refers to the state synchronization moment triggered by a specific event (such as key ignition or vehicle sleep). After the system finishes operating in its basic functional state, when the system restarts or a specific event is triggered, the control controller restores the system state to consistency through distributed state snapshots.

[0150] S7. Perform consistency verification and repair on the state snapshot information to form consistent state snapshot information.

[0151] Reference Figure 10 The method for performing consistency verification and repair on state snapshot information is as follows.

[0152] S71. Determine whether the state snapshot information obtained by each controller at the previous synchronization moment is consistent.

[0153] Specifically, by comparing the state snapshot information stored in each controller, it is determined whether the cognitive states of each controller are consistent. Since there may be hours or even days between the fulfillment of the first synchronization trigger condition and the current second synchronization trigger condition, there are many risks during the write-to-read period, which may lead to the corruption of the stored snapshot information and result in inconsistencies in the distributed state snapshot information of each controller.

[0154] S72. If consistent, the consistency check of the state snapshot information passes; if inconsistent, the vehicle control system covers or corrects the erroneous target signal state according to preset rules to form consistent state snapshot information.

[0155] Specifically, if the distributed state snapshots are consistent, it indicates that the state perceptions in the memory of each controller are consistent, and the system state can be uniformly restored according to the previously stored distributed state snapshots.

[0156] If the distributed state snapshots are inconsistent, the system enforces unified perception through state overriding according to preset rules. The preset rules are to use the snapshot value with the latest timestamp or the snapshot value of the functional master controller as the standard. In state overriding, "state" refers to the snapshot value with the latest timestamp and the snapshot value of the functional master controller; "overriding" means broadcasting the determined state value to all relevant controllers, controlling each relevant controller to use the state value, and overriding or correcting erroneous state values ​​in its internal nodes, thereby achieving forced unified perception.

[0157] S8. System state recovery is achieved based on consistent state snapshot information.

[0158] Specifically, after the system state is restored based on consistent state snapshot information, the vehicle control system will operate based on the correct state. Therefore, the vehicle control system exits the safety-degraded operating state that it entered before due to the adaptive exit strategy or signal isolation strategy, and the system resumes normal functional operation.

[0159] For example, when the power is off in a real vehicle and the key is inside the vehicle, the system will exhibit the following two fault phenomena when power is turned on again: false triggering of the key-lost protection and sticky protection signal.

[0160] When the first synchronization trigger condition is met, the tailgate is in the open state before hibernation, and the key is inside the vehicle. During hibernation, the tailgate is manually closed, but at this time, each controller has already entered or is about to enter hibernation. In the traditional method, the Body Control Module (BCM) adopts a "delayed write" strategy, meaning that each controller writes to the memory at different times, thus failing to store the new state "tailgate closed" into the EEPROM in a timely manner.

[0161] When the vehicle is powered on, the Body Control Module (BCM) reads the historical "tailgate open" state from the EEPROM, while the tailgate ECU's sensors detect a "tailgate closed" state in real time. Therefore, the system incorrectly determines that a "tailgate change from open to closed" has occurred. Combined with the "key inside the vehicle" trigger condition, it mistakenly triggers the key lock protection logic branch. Furthermore, with continuous power-off and power-on cycles, the BCM repeatedly requests to trigger the power tailgate key lock protection.

[0162] After entering the error protection logic branch, PEPS continuously sends the PKETrunkButtPressed protection signal. During this protection period, the Body Control Module (BCM) may issue an unlock command due to other logic or user operation, requesting PEPS to exit the power tailgate keyed state. However, because the system is already in a state of cognitive confusion or logical competition, PEPS fails to clear the signal normally within the 250ms window as designed, resulting in signal stickiness. The sticky signal continuously misleads the tailgate ECU, causing it to repeatedly attempt to execute protective actions, forming a malfunctioning loop.

[0163] By adopting the technical solution of this application, when the system meets the first preset condition, the EEPROM values ​​of the tailgate opening / closing status signal and the driver's side lock status signal are changed from delayed writing to immediate writing, so as to ensure that the snapshot status stored in the body controller BCM, PEPS and tailgate ECU are all "tailgate open" before the vehicle is powered on. Thus, after the vehicle is powered on, the understanding of the historical benchmark by each controller is consistent, avoiding misjudgment jumps.

[0164] By adopting a signal health monitoring mechanism, the system monitors in real time whether the signal triggering conditions are reasonable, whether the duration has exceeded the time limit, and whether the associated status contradicts the latest unlocking status of the Body Control Module (BCM). Once it is found that the driver's lock has been unlocked during the signal's validity period, i.e., the signal status is abnormal, the adaptive exit strategy is immediately triggered to forcibly clear the PKETrunkButtPressed signal, thereby allowing the system to break out of the current abnormal loop and maintain normal basic functions.

[0165] When the vehicle control system restarts or the second synchronization trigger condition is met, the controller obtains the state snapshot information of the previous synchronization moment by controlling the controller again. Consistency verification is performed by comparison. If inconsistency is found, the state values ​​of all relevant controllers are forcibly overwritten according to preset rules to achieve forced uniformity of cognition. As a result, after the state is restored to consistency, the logic that previously generated the erroneous signal completely disappears. The system can safely remove the degraded safe and operable state entered due to the adaptive exit strategy or signal isolation strategy, and the system resumes normal operation.

[0166] By capturing a snapshot of the state at the previous synchronization moment through the controller, key state signals and their snapshot information are obtained for state consistency verification. This ensures that the state entries in each controller are identical, preventing state perception splits caused by timing races from the outset. If the state consistency verification fails (i.e., the state snapshot information is inconsistent), the inconsistent key state signals are identified as target signals. Health monitoring of these target signals is performed to determine if their state is abnormal. If an abnormal signal state is detected, adaptive exit and signal isolation strategies are used to control the target signal's exit or isolation, effectively preventing abnormal system function cycles, resolving signal stickiness, and improving system reliability and safety. This allows the vehicle control system to enter a safety-degraded operating state to maintain its operation. Finally, when the second synchronization trigger condition is met, each controller again acquires state snapshot information. Through comparison and repair, consistent state snapshot information is formed, forcibly unifying the state perception of each controller. Ultimately, based on the consistent state snapshot information, the system state is fundamentally restored. By upgrading the traditional decentralized fault handling method to an integrated, intelligent active fault-tolerant system, the functional safety and operational robustness of the vehicle under extreme conditions such as power transients are significantly enhanced. The safety mechanism design that meets the requirements of ASIL (Automotive Safety Integrity Level) significantly improves the reliability of the distributed vehicle control system.

[0167] Secondly, this application provides a vehicle control system 100 applicable to vehicles.

[0168] The vehicle control system 100 includes: The data acquisition module 101 is used to acquire the state snapshot information of the previous synchronization moment and the signal status of the target signal.

[0169] The first judgment module 102 is used to determine whether the state snapshot information of each controller is consistent.

[0170] The second judgment module 103 is used to determine whether the signal state of the target signal is abnormal when the state snapshot information is inconsistent.

[0171] The control module 104 is used to establish a signal health monitoring mechanism when the status snapshot information is inconsistent; and to control the target signal to exit or isolate the target signal when the signal status is abnormal, so as to maintain the operation of the vehicle control system.

[0172] In this embodiment, the vehicle control system 100 first obtains the state snapshot information of the previous synchronization moment through the data acquisition module 101, and then judges whether the state snapshot information is consistent through the first judgment module 102 to determine whether there is a state perception split in the vehicle control system state. After the judgment is completed, the second judgment module 103 judges whether the signal state of the target signal is abnormal. When the signal state of the target signal is abnormal, the control module 104 controls the target signal to exit or isolate the target signal, effectively blocking the abnormal cycle of system function, solving problems such as signal stickiness, and improving the reliability and safety of system use.

[0173] Thirdly, embodiments of this application provide a vehicle.

[0174] For example, the vehicle includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, it enables the processor to implement the vehicle electronic system fault-tolerant control system described in the second aspect above.

[0175] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of this application.

Claims

1. A vehicle control method, applied to a distributed vehicle control system, characterized in that, The method includes: After the vehicle is powered on, the key state signals and signal states of the previous synchronization moment stored in the controller of the vehicle control system are obtained as state snapshot information. Determine whether the state snapshot information of each controller is consistent; If they match, the vehicle control system restores the system state based on the stored state snapshot information; If there is a discrepancy, the discrepancy in the key status signal is parsed as the target signal, and the signal status of the target signal is detected as abnormal based on the signal health monitoring mechanism. If the abnormality of the target signal status is detected, each controller controls the target signal to exit or isolate the target signal to maintain the operation of the vehicle control system.

2. The vehicle control method according to claim 1, characterized in that, In the vehicle control system, the body domain controller is configured as the master controller, and the other controllers are configured as participating controllers. The method for the controller in the vehicle control system to take a state snapshot of the previous synchronization time includes: Vehicle status detection is performed through the vehicle body domain controller; When the vehicle state meets the first synchronization trigger condition, the snapshot information of the state to be synchronized is sent to the participating controller and the body domain controller in the vehicle control system. The vehicle domain controller and the participating controllers write the state snapshot information to be synchronized into the memory corresponding to the vehicle domain controller and each of the participating controllers in real time, and store the generated state identifier in the memory.

3. The vehicle control method according to claim 1, characterized in that, Methods for establishing a signal health monitoring mechanism include: Real-time monitoring of the signal status of the target signal; Determine whether the triggering condition of the target signal is valid; Determine whether the duration of the target signal exceeds a first preset time; Determine whether the signal state of the target signal is consistent with the signal state of other related signals; If the target signal is determined to be triggered effectively, the duration does not exceed the first preset time, and the signal state of the target signal is consistent with that of other associated signals, then the target signal state is normal; if the target signal is determined to be triggered ineffectively, or the duration exceeds the first preset time, or the signal state of the target signal is inconsistent with that of other associated signals, then the target signal state is abnormal.

4. The vehicle control method according to claim 1, characterized in that, When the signal state of the target signal is abnormal, the method for maintaining the operation of the vehicle control system includes: The task of monitoring the response of the corresponding controller to the target signal; When the signal state of the target signal is abnormal, each controller executes an adaptive exit strategy to invalidate the target signal and terminate the response task of the target signal, thereby exiting the continuous abnormal state of the vehicle control system. If the abnormal state of the vehicle control system continues, each controller will execute a signal isolation strategy to isolate the target signal, terminate the response task of the target signal, and maintain the operation of the vehicle control system.

5. The vehicle control method according to claim 4, characterized in that, The method for implementing the adaptive exit strategy includes: Obtain the target signal type, system context, and current persistent state of the target signal; Generate exit conditions based on the target signal type and the system context; Determine whether the current continuous state of the target signal meets the exit conditions; If the conditions are met, the target signal is invalid, and the vehicle control system exits the continuous abnormal state; if the conditions are not met, the status of the target signal is continuously monitored, and no exit operation is performed.

6. The vehicle control method according to claim 5, characterized in that, The method for implementing the signal isolation strategy includes: Based on the system context and the current persistent state of the target signal, each controller selects and performs at least one of the following operations: logical isolation, source suppression, and communication filtering, to isolate the target signal and eliminate its impact on the vehicle control system. After the vehicle control system continues to operate, the controller generates and stores fault codes for isolated events.

7. The vehicle control method according to claim 1, characterized in that, The vehicle control method also includes: Real-time monitoring of the vehicle control system status; When the vehicle control system restarts or the second synchronization trigger condition is met, the controller is again controlled to obtain the state snapshot information of the previous synchronization moment; The state snapshot information is subjected to consistency verification and repair to form consistent state snapshot information; The system state is restored based on the consistent state snapshot information.

8. The vehicle control method according to claim 7, characterized in that, The method for performing consistency verification and repair on the state snapshot information includes: Determine whether the state snapshot information obtained by each controller at the previous synchronization time is consistent; If they are consistent, the consistency check of the state snapshot information passes; if they are inconsistent, the vehicle control system covers or corrects the erroneous target signal state according to preset rules to form the consistent state snapshot information.

9. A vehicle control system, characterized in that, include: The data acquisition module is used to acquire the state snapshot information of the previous synchronization moment and the signal status of the target signal; The first judgment module is used to determine whether the state snapshot information of each controller is consistent; The second judgment module is used to determine whether the signal state of the target signal is abnormal when the state snapshot information is inconsistent. The control module is used to establish a signal health monitoring mechanism when the status snapshot information is inconsistent; and to control the target signal to exit or isolate the target signal when the signal status is abnormal, so as to maintain the operation of the vehicle control system.

10. A vehicle, characterized in that, The vehicle includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it causes the processor to implement the vehicle control method of any one of claims 1 to 8; or the vehicle includes the vehicle control system of claim 9.

Images