Redundant backup method of multi-domain controller system, multi-domain controller system and vehicle

Abstract

The invention relates to the technical field of software control, and particularly provides a redundant backup method of a multi-domain controller system, the multi-domain controller system and a vehicle, and the redundant backup method of the multi-domain controller system is realized based on the multi-domain controller system comprising a master domain controller and a slave domain controller. The redundant backup method of the multi-domain controller system comprises the following steps: firstly, checking a double-line detection signal sent by a main domain controller by a slave domain controller, and then controlling the slave domain controller to execute a corresponding action according to a checking result of the double-line detection signal; therefore, the slave domain controller is controlled to execute corresponding actions according to a double-line detection signal verification result of the master domain controller, function takeover and load balancing task allocation can be quickly and reliably carried out when the master domain controller breaks down, and key functions of the vehicle-mounted controller can be recovered autonomously, quickly and stably after the vehicle-mounted controller breaks down. The stability and the operation efficiency of the multi-domain controller system are improved, and the safety quality, the reliability and the emergency risk coping capacity of the whole vehicle are improved.

Description

Technical Field

[0001] This invention relates to the field of software control technology, and in particular to a redundancy backup method for a multi-domain controller system, a multi-domain controller system, and a vehicle. Background Technology

[0002] Currently, most automotive embedded controllers integrate the control units of various automotive components into several domain controllers, achieving a distributed intelligent control architecture solution of "multi-domain collaboration and cross-domain integration". Due to the large number of automotive domain controllers, the important module control processing tasks are still concentrated on the main domain controller with the highest computing power to ensure the timeliness of task processing.

[0003] However, embedded domain controller systems often require uninterrupted operation, and the complex environment during vehicle operation necessitates handling various interferences. Systemic damage to the domain controller system will lead to domain controller failure, causing serious safety issues. Therefore, existing domain controller systems suffer from poor stability. Summary of the Invention

[0004] This invention aims to at least solve one of the technical problems existing in related technologies. Therefore, the object of this invention is to provide a redundancy backup method for a multi-domain controller system, a multi-domain controller system, and a vehicle.

[0005] This invention proposes a redundancy backup method for a multi-domain controller system, the multi-domain controller system including a master domain controller and slave domain controllers, the method comprising: the slave domain controller verifying a two-wire detection signal sent by the master domain controller; and controlling the slave domain controller to perform corresponding actions based on the verification result of the two-wire detection signal.

[0006] The redundancy backup method for a multi-domain controller system according to embodiments of the present invention is based on a multi-domain controller system, which includes a master domain controller and slave domain controllers. The redundancy backup method first involves the slave domain controller verifying the dual-line detection signal sent by the master domain controller, and then controlling the slave domain controller to perform corresponding actions based on the verification result of the dual-line detection signal. This allows for rapid and reliable function takeover and load balancing task allocation when the master domain controller fails, enabling the vehicle controller to autonomously, quickly, and smoothly recover critical functions after a failure. This helps improve the stability and operating efficiency of the multi-domain controller system, thereby enhancing the overall vehicle safety, reliability, and ability to respond to sudden risks.

[0007] In addition, the redundancy backup method for a multi-domain controller system according to embodiments of the present invention may also have the following additional technical features: Furthermore, controlling the slave domain controller to perform corresponding actions based on the verification result of the dual-line detection signal includes: when the verification result is normal, the slave domain controller suspends the backup task; or when the verification result is abnormal, the slave domain controller wakes up the backup task and takes over the work of the primary domain controller; thus, the backup slave domain controller can seamlessly take over when the primary domain controller fails, realizing uninterrupted cross-domain redundancy, thereby ensuring the stability and operating efficiency of the multi-domain controller system.

[0008] Furthermore, the abnormal verification result includes: reading the duty cycle and pulse period of the PWM pulse signal from the chip register of the domain controller; verifying the differential decoding sequence according to the duty cycle and the pulse period; when the differential decoding sequence is abnormal, collecting and verifying the heartbeat data packet; when the heartbeat data packet is abnormal, the verification result is abnormal; that is, the verification result is only determined to be abnormal when both the differential decoding sequence and the heartbeat data packet are abnormal, so as to effectively verify the abnormal situation of the dual-line detection signal, thereby facilitating the subsequent wake-up of the backup task from the domain controller and take over the work of the primary domain controller.

[0009] Furthermore, the verification result being normal includes: reading the duty cycle and pulse period of the PWM pulse signal from the chip register of the domain controller; verifying the differential decoding sequence based on the duty cycle and the pulse period; when the differential decoding sequence is normal, the verification result is normal; that is, when the differential decoding sequence is normal, the verification result can be determined to be normal, thereby effectively verifying the normality of the dual-line detection signal, thus facilitating the subsequent suspension of the backup task from the domain controller.

[0010] Furthermore, the verification result being normal includes: reading the duty cycle and pulse period of the PWM pulse signal from the chip register of the domain controller; verifying the differential decoding sequence based on the duty cycle and pulse period; when the differential decoding sequence is abnormal, collecting and verifying the heartbeat data packet; when the heartbeat data packet is normal, determining that the verification result is normal; that is, when the differential decoding sequence is abnormal but the heartbeat data packet is normal, the verification result can be determined to be normal, which can effectively verify the normality of the dual-line detection signal, thereby facilitating the subsequent suspension of the backup task from the domain controller.

[0011] Furthermore, the process of the slave domain controller waking up the backup task and taking over the work of the master domain controller includes: allocating the processing core of the slave domain controller according to the backup task; and controlling the operation of the functional modules of the multi-domain controller system according to the backup task allocation result of the processing core. This enables the slave domain controller to wake up the backup task and take over the work of the master domain controller. By introducing a load task reallocation scheduler to balance the single-core load of the controller, the probability of the system being suspended and reset due to excessive single-core load can be reduced.

[0012] Furthermore, before the slave domain controller verifies the dual-line detection signal sent by the master domain controller, the process further includes: the master domain controller generating a duty cycle sequence using incremental encoding; generating a PWM pulse signal according to a preset period and the duty cycle sequence; and the master domain controller sending the PWM pulse signal and a heartbeat data message to the slave domain controller. Thus, within the detection signal transmission process, an incremental duty cycle encoding mechanism is added to the PWM signal detection, where the signal duty cycle linearly increases or decreases with time in each period, causing the PWM signal to exhibit a periodically changing waveform, avoiding misjudgment of results due to external electromagnetic interference with a single waveform. Simultaneously, a CAN heartbeat data message detection mechanism is also added, that is, periodically acquiring the heartbeat data message sent by the master domain controller, forming a dual-line synchronous detection combining the PWM signal and the CAN message, ensuring the reliability of the fault detection results.

[0013] Furthermore, before the slave domain controller verifies the dual-line detection signal sent by the master domain controller, the process further includes: initializing the master domain controller and the slave domain controller, and initializing each functional module in the multi-domain controller system; thereby initializing the master domain controller, slave domain controller, and each functional module in the multi-domain controller system before verification, avoiding the impact of residual data on subsequent verification and control, and thus ensuring the stability and operating efficiency of the multi-domain controller system.

[0014] To address the aforementioned problems, this invention also proposes a multi-domain controller system, comprising: a master domain controller for sending a two-line detection signal; a slave domain controller connected to the master domain controller for verifying the two-line detection signal sent by the master domain controller and controlling the execution of corresponding actions based on the verification result of the two-line detection signal; and functional modules connected to the master domain controller and the slave domain controller respectively for executing control commands issued by the master domain controller or the slave domain controller.

[0015] The multi-domain controller system according to an embodiment of the present invention includes a master domain controller, slave domain controllers, and functional modules. The multi-domain controller system is used to implement the redundancy backup method of the multi-domain controller system in the above embodiment of the present invention. First, the slave domain controller verifies the dual-line detection signal sent by the master domain controller, and then controls the slave domain controller to perform corresponding actions based on the verification result of the dual-line detection signal. In this way, the slave domain controller is controlled to perform corresponding actions based on the verification result of the dual-line detection signal of the master domain controller, so that when the master domain controller fails, functional takeover and load balancing task allocation can be performed quickly and reliably. This enables the vehicle controller to autonomously, quickly, and smoothly restore critical functions after a failure, which helps to improve the stability and operating efficiency of the multi-domain controller system, thereby improving the safety quality, reliability, and ability to respond to sudden risks of the entire vehicle.

[0016] To address the aforementioned problems, the present invention also proposes a vehicle, such as the multi-domain controller system described in the above embodiments of the present invention.

[0017] The vehicle according to embodiments of the present invention includes a multi-domain controller system as described in the above embodiments of the present invention. The multi-domain controller system includes a master domain controller and slave domain controllers. The multi-domain controller system is used to implement the redundancy backup method of the multi-domain controller system according to the above embodiments of the present invention. First, the slave domain controller verifies the dual-line detection signal sent by the master domain controller. Then, based on the verification result of the dual-line detection signal, the slave domain controller is controlled to perform corresponding actions. In this way, the slave domain controller is controlled to perform corresponding actions based on the verification result of the dual-line detection signal of the master domain controller, so that when the master domain controller fails, function takeover and load balancing task allocation can be performed quickly and reliably. This enables the vehicle controller to autonomously, quickly, and smoothly restore critical functions after a failure, which helps to improve the stability and operating efficiency of the multi-domain controller system, thereby improving the safety quality, reliability, and ability to respond to sudden risks of the entire vehicle.

[0018] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0019] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, in which: Figure 1 This is a diagram illustrating dual-partition backup in related technologies; Figure 2 This is a diagram illustrating remote server backup in related technologies; Figure 3 This is a structural block diagram of a multi-domain controller system according to an embodiment of the present invention; Figure 4 This is a schematic diagram of the architecture of a multi-domain controller system according to a specific embodiment of the present invention; Figure 5 This is a schematic diagram of the master-slave domain controller task scheduling in the normal operation state of a multi-domain controller system according to a specific embodiment of the present invention; Figure 6 This is a schematic diagram of the master-slave domain controller task allocation and scheduling in an abnormal operating state of a multi-domain controller system according to a specific embodiment of the present invention; Figure 7 This is a flowchart of a redundancy backup method for a multi-domain controller system according to an embodiment of the present invention; Figure 8 This is a flowchart of a redundancy backup method for a multi-domain controller system according to a specific embodiment of the present invention; Figure 9This is a flowchart illustrating how a master domain controller sends a PWM signal of a specific waveform and a heartbeat data message in CAN format according to a specific embodiment of the present invention. Figure 10 This is a flowchart illustrating how a domain controller detects PWM signals in real time and performs anomaly verification according to a specific embodiment of the present invention. Figure 11 This is a flowchart illustrating how a slave domain controller wakes up the master control task image and takes over the work of the master domain controller, according to a specific embodiment of the present invention. Figure 12 This is a structural block diagram of a vehicle according to an embodiment of the present invention.

[0020] Figure label: 100 - Multi-domain controller system; 110 - Master domain controller; 120 - Slave domain controller; 130 - Functional module; 200 - Vehicle. Detailed Implementation

[0021] The embodiments of the present invention are described in detail below. The embodiments described with reference to the accompanying drawings are exemplary. The embodiments of the present invention are described in detail below.

[0022] Currently, in the field of embedded vehicle controllers, related technologies integrate the control units of various vehicle components into several domain controllers, realizing a distributed intelligent control architecture solution of "multi-domain collaboration and cross-domain integration." Due to the large number of vehicle domain controllers, critical module control processing tasks are still concentrated on the main domain controller with the highest computing power to ensure timely task processing. However, embedded domain controller systems often need to operate continuously, and the environment during driving is complex, requiring them to withstand various interference challenges. Systemic damage to the domain controller system will lead to domain controller failure, causing serious safety issues. Therefore, a reliable functional redundancy backup scheme is needed to ensure stable system operation.

[0023] Figure 1 This is a diagram illustrating dual-partition backup in related technologies. For example... Figure 1 As shown, a common functional backup scheme in related technologies is a dual-partition software backup based on the vehicle ECU (Electronic Control Unit) storage structure. This scheme backs up the original task image to two partitions in a common storage area: under normal circumstances, the system runs the primary partition image; if an anomaly occurs, the backup partition image is switched to ensure normal system operation. However, this scheme has the following limitations: 1) Single point of failure risk. If any domain controller fails, the dual-partition data may be corrupted, the backup function will fail, and the entire vehicle system will be paralyzed.

[0024] 2) Insufficient utilization of distributed architecture. Important functions are concentrated on a single controller, failing to leverage the advantages of a multi-domain distributed intelligent architecture, resulting in low resource utilization and significant redundancy and waste.

[0025] In the automotive embedded systems field, dual-partition local backup solutions are commonly used to implement OTA (Over-the-Air Technology) upgrades. During the operation of partition A, the software upgrade is initiated, the upgrade program flashes data to partition B, and after the upgrade is complete, the software switches to the next partition. However, the two images are not identical, and maintaining multiple identical images leads to significant Flash resource consumption. Furthermore, because this dual-partition backup solution relies on hardware and storage media, external monitoring platforms are required to take over and handle situations where hardware failure or redundancy failure occurs.

[0026] Figure 2 This is a diagram illustrating remote server backup in related technologies. For example... Figure 2 As shown, with the maturity of computer networks and related technologies, remote server-based functional backup has become a common solution in the internet field. The basic idea is to periodically or in real-time copy the functional images, configuration files, and operating logs from the local control system to storage media located in a cloud data center. When local functions are damaged or hardware fails, the system quickly pulls the latest backup image from the remote server, achieving "disaster recovery." However, this solution has not been widely adopted in the automotive embedded systems field, mainly due to the following factors: Mobile link instability. Factors such as base station handover and signal obstruction during high-speed vehicle travel lead to packet loss, bandwidth fluctuations, and unstable system recovery speeds.

[0027] Server maintenance costs. Setting up servers requires significant capital investment and manpower for maintenance, making it difficult to keep pace with the rapid product cycle iterations in the automotive industry, resulting in excessively high maintenance costs.

[0028] Network-based server registration solutions establish a network connection and restore faulty units by performing backup data verification methods such as CRC (Cyclic Redundancy Check). However, network anomalies frequently occur due to issues such as high-speed vehicle traffic or lack of coverage in the driving area, preventing normal data transmission and reducing the real-time performance of backup and recovery. Furthermore, server maintenance costs are high, making solutions that maintain dedicated servers for intermittent occurrences unsuitable.

[0029] Related technologies also provide a distributed domain controller architecture that effectively breaks free from the constraints of traditional dual-partition local backup and remote server backup. This architecture achieves system function backup through mutual status monitoring between domain controllers, allowing slave domain controllers to take over functions when the primary domain controller fails, without relying on remote network connections. The distributed control system in these technologies employs various methods, such as hardware interrupts and software handshakes, to provide secure and reliable backup switching strategies, thereby improving the security and reliability of various functions within the system. However, most system backup controllers suffer from problems such as wasted computing resources during hibernation, load imbalance after wake-up, and data synchronization lag during operation, easily leading to resource waste and system malfunctions.

[0030] To address the aforementioned problems in related technologies, embodiments of the present invention provide a redundancy backup method for a multi-domain controller system, a multi-domain controller system, and a vehicle, as described below. Figures 3-12 A redundancy backup method for a multi-domain controller system, a multi-domain controller system, and a vehicle are described according to embodiments of the present invention.

[0031] Since the redundancy backup method of the multi-domain controller system in this embodiment of the invention is based on the implementation of this embodiment, the multi-domain controller system will be described first to facilitate a better understanding of the redundancy backup method of the multi-domain controller system.

[0032] Figure 3 This is a structural block diagram of a multi-domain controller system according to an embodiment of the present invention. Figure 3 As shown, a multi-domain controller system 100 according to an embodiment of the present invention includes: a master domain controller 110 for sending a two-wire detection signal; a slave domain controller 120 connected to the master domain controller for verifying the two-wire detection signal sent by the master domain controller and controlling the execution of corresponding actions based on the verification result of the two-wire detection signal; and a functional module 130 connected to the master domain controller and the slave domain controller respectively for executing control commands issued by the master domain controller or the slave domain controller.

[0033] Figure 4 This is a schematic diagram of the architecture of a multi-domain controller system according to a specific embodiment of the present invention. Figure 4 As shown, in a specific embodiment, this multi-domain controller system makes full use of the wiring harness layout of each functional module within the system and the hardware configuration of the distributed domain controller. Figure 4 The master domain controller control, acquisition control, execution control, power supply module, and slave domain controller all belong to the above-mentioned functional module 130.

[0034] In a specific embodiment, regarding the allocation of control functions for vehicle components, this multi-domain controller system enables independent collaborative operation between the master domain controller and the slave domain controllers. The master and slave domain controllers each control their subordinate controls, achieving signal acquisition, execution control, and power supply control functions for different control components through the vehicle wiring harness. The controls are functionally categorized into three types: acquisition controls, execution controls, and power supply controls. Acquisition controls include elements related to driver intent input, such as wiper switches, light switches, door lock switches, and start buttons; execution controls include actuators for vehicle behavior, such as door control motors, light controls, wiper motors, and instrument displays; and power supply controls include key power modules such as backup power, left front electronic control, distribution box, and battery manager.

[0035] In a specific embodiment, for critical controls, the multi-domain controller system employs hard-wired multiplexing technology, connecting them simultaneously to the I / O expansion ports of both the master and slave domain controllers. Hard-wired multiplexing not only ensures millisecond-level rapid switching in the event of a controller failure, maintaining the continuity of system operation, but also reduces wiring costs by sharing the same wiring harness. Non-critical body components, such as the driver's seat motor, window motor, passenger seat motor, and air conditioning compressor, are connected to the I / O expansion ports of their respective domain controllers. This allocation method aims to balance the workload of each domain controller while ensuring functional integrity, preventing a single controller from triggering computing or power bottlenecks due to handling too many non-critical tasks. By rationally allocating secondary controls across different domains, the system can retain sufficient computing resources when each domain takes over critical functions, thereby improving overall response speed and reducing the risk of system reset due to excessive load.

[0036] In a specific embodiment, the hardware structure of the multi-domain controller system includes, in addition to the core MCU (Microcontroller Unit), the master domain controller and slave domain controllers are equipped with resources such as ICU (I / O control unit), EEPROM (non-volatile memory), watchdog timer, LIN (Local Interconnect Network) and CAN (Controller Area Network). The watchdog timer monitors the program's running status and triggers a system reset when a task lockout occurs, restoring the system to normal operation. The LIN and CAN buses handle data exchange between domain controllers. The CAN bus not only transmits regular control messages but also sends heartbeat and backup data messages, synchronizing critical data for important controls on both the master and slave domain controllers. The EEROM is power-loss resistant and stores important information and backup data in the domain controllers, ensuring normal functionality after a system failure. The master domain controller is equipped with an RS8912 voltage comparator chip, using a push-pull output structure to directly drive the load. It is controlled by the ICU in the MCU and sends a special PWM fault detection signal to the slave domain controllers through configuration registers. The slave domain controllers are equipped with an LM2901 independent voltage comparator chip to receive and collect PWM detection signals. The collected signal values ​​are stored in a register buffer and read by the slave domain controllers through the ICU for fault status judgment and processing.

[0037] In a specific embodiment, the software architecture of this multi-domain controller system employs a multi-core processor structure for both the master and slave domain controllers, allowing each computing core to operate independently. Due to the limited load capacity of the MCU, the system schedules and switches various tasks related to data acquisition, execution control, and power supply processing for different vehicle body controls based on a task list and time-slice rotation strategy.

[0038] Figure 5 This is a schematic diagram illustrating the master-slave domain controller task scheduling during normal operation of a multi-domain controller system according to a specific embodiment of the present invention. Figure 5 As shown, in a specific embodiment, under normal operating conditions, the main domain controller undertakes the scheduling and execution of critical tasks, completes the acquisition of various switch signals, the execution of control modules, and the power supply control of important modules; the same critical task images as the main domain controller are backed up and saved from the domain controller. These task images are in a suspended state during normal system operation to avoid conflicts in control commands on the bus.

[0039] Figure 6 This is a schematic diagram illustrating the task allocation and scheduling of master and slave domain controllers in an abnormal operating state of a multi-domain controller system according to a specific embodiment of the present invention. Figure 6As shown in the specific embodiment, when a system crashes due to a functional anomaly, the control of critical tasks is switched from the primary domain controller to the secondary domain controller. At this time, the images of critical tasks in the suspended queue are transferred to the ready queue, and the secondary domain controller scheduler reallocates processing cores and task time slices. Multiple cores process control tasks in parallel, ensuring that the system's data acquisition, control, power supply, and other safety-related functions resume normal operation.

[0040] Figure 7 This is a flowchart of a redundancy backup method for a multi-domain controller system according to an embodiment of the present invention. Figure 7 As shown, a redundancy backup method for a multi-domain controller system according to an embodiment of the present invention is implemented based on the multi-domain controller system 100 in the above embodiment of the present invention. The redundancy backup method for the multi-domain controller system includes the following steps: Step S1: Verify the two-wire detection signal sent by the primary domain controller from the domain controller.

[0041] In a specific embodiment, the domain controller verifies the two-wire detection signal sent by the master domain controller. Specifically, the domain controller performs anomaly verification on the two-wire detection signal sent by the master domain controller. The two-wire detection signal includes, but is not limited to, PWM (Pulse Width Modulation) signals with specific waveforms and CAN-formatted heartbeat data messages.

[0042] Specifically, according to the redundancy backup method of the multi-domain controller system according to the embodiments of the present invention, the dual-line detection signal sent by the primary domain controller is verified from the domain controller, so as to facilitate the subsequent execution of corresponding control actions based on the verification results.

[0043] Step S2: Control the domain controller to perform corresponding actions based on the verification results of the dual-line detection signal.

[0044] In a specific embodiment, the slave domain controller is controlled to perform corresponding actions based on the verification result of the dual-line detection signal. Specifically, for example, when the verification result is normal, the slave domain controller suspends the backup task; when the verification result is abnormal, the slave domain controller wakes up the backup task and takes over the work of the primary domain controller.

[0045] Specifically, according to the redundancy backup method of the multi-domain controller system according to the embodiments of the present invention, the corresponding actions are controlled by the domain controller based on the verification results of the dual-line detection signal, thereby ensuring that the multi-domain controller system has good stability.

[0046] Therefore, the redundancy backup method for a multi-domain controller system according to embodiments of the present invention is based on a multi-domain controller system, which includes a master domain controller and slave domain controllers. The redundancy backup method first involves the slave domain controller verifying the dual-line detection signal sent by the master domain controller, and then controlling the slave domain controller to perform corresponding actions based on the verification result of the dual-line detection signal. In this way, the slave domain controller is controlled to perform corresponding actions based on the verification result of the dual-line detection signal of the master domain controller, so that when the master domain controller fails, function takeover and load balancing task allocation can be performed quickly and reliably. This enables the vehicle controller to autonomously, quickly, and smoothly restore critical functions after a failure, which helps to improve the stability and operating efficiency of the multi-domain controller system, thereby improving the safety quality, reliability, and ability to respond to sudden risks of the entire vehicle.

[0047] In one embodiment of the present invention, step S2 controls the slave domain controller to perform corresponding actions based on the verification result of the dual-line detection signal, including: when the verification result is normal, the slave domain controller suspends the backup task; or when the verification result is abnormal, the slave domain controller wakes up the backup task and takes over the work of the master domain controller.

[0048] In a specific embodiment, when the verification result of the dual-line detection signal is normal, the backup task is suspended from the domain controller; when the verification result of the dual-line detection signal is abnormal, the backup task is woken up from the domain controller and takes over the work of the primary domain controller. Specifically, when a fault is detected, the primary control task image is woken up from the domain controller and takes over the work of the primary domain controller.

[0049] Specifically, according to the redundancy backup method of the multi-domain controller system according to the embodiments of the present invention, when the verification result of the dual-line detection signal is normal, the backup task is suspended from the domain controller; when the verification result of the dual-line detection signal is abnormal, the backup task is woken up from the domain controller and takes over the work of the primary domain controller. In this way, the backup domain controller can seamlessly take over when the primary domain controller fails, realizing uninterrupted cross-domain redundancy, thereby ensuring the stability and operating efficiency of the multi-domain controller system.

[0050] In one embodiment of the present invention, the verification result is abnormal, including: reading the duty cycle and pulse period of the PWM pulse signal in the chip register from the domain controller; verifying the differential decoding sequence according to the duty cycle and pulse period; when the differential decoding sequence is abnormal, collecting and verifying the heartbeat data packet; when the heartbeat data packet is abnormal, the verification result is abnormal.

[0051] In a specific embodiment, the duty cycle and pulse period of the PWM pulse signal are read from the chip register by the domain controller. Then, the differential decoding sequence is verified based on the duty cycle and pulse period. When the differential decoding sequence is abnormal, heartbeat data packets are collected and verified. When the heartbeat data packets are abnormal, the verification result is determined to be abnormal. Specifically, for example, the domain controller reads the PWM signal value from the 2901 chip register, obtains the timestamps of the rising and falling edges of the signal from the domain controller, calculates the duty cycle periodically by the ratio of the time difference to the signal period and records it. Based on the sequence composed of the obtained duty cycles, differential decoding is performed, and the decoding sequence is verified to be abnormal. If an abnormality is found, heartbeat data packets are collected through the CAN channel. If it is determined that the heartbeat signal acquisition is abnormal, the verification result is determined to be abnormal, and the system abnormal state and start time are recorded.

[0052] Specifically, according to the redundancy backup method of the multi-domain controller system of the present invention, the duty cycle and pulse period of the PWM pulse signal in the chip register of the domain controller are read from the domain controller. Then, the differential decoding sequence is verified according to the duty cycle and pulse period. When the differential decoding sequence is abnormal, the heartbeat data packet is collected and verified. When the heartbeat data packet is abnormal, the verification result is determined to be abnormal. That is, the verification result is determined to be abnormal only when both the differential decoding sequence and the heartbeat data packet are abnormal. This can effectively verify the abnormal situation of the dual-line detection signal, thereby facilitating the subsequent wake-up of the backup task from the domain controller and take over the work of the master domain controller.

[0053] In one embodiment of the present invention, a normal verification result includes: reading the duty cycle and pulse period of the PWM pulse signal from the chip register of the domain controller; verifying the differential decoding sequence based on the duty cycle and pulse period; and verifying the verification result when the differential decoding sequence is normal.

[0054] In a specific embodiment, the duty cycle and pulse period of the PWM pulse signal are read from the chip register by the domain controller. Then, the differential decoding sequence is verified based on the duty cycle and pulse period. When the differential decoding sequence is normal, the verification result is determined to be normal. Specifically, for example, the domain controller reads the PWM signal value from the 2901 chip register, obtains the timestamps of the rising and falling edges of the signal from the domain controller, calculates the duty cycle periodically by the ratio of the time difference to the signal period and records it. Based on the sequence composed of the obtained duty cycles, differential decoding is performed. When the verification decoding sequence is normal, the verification result is determined to be normal, and the normal operating status and duration of the system are recorded.

[0055] Specifically, according to the redundancy backup method of the multi-domain controller system of the present invention, the duty cycle and pulse period of the PWM pulse signal in the chip register of the domain controller are read, and then the differential decoding sequence is verified according to the duty cycle and pulse period. When the differential decoding sequence is normal, the verification result is determined to be normal. That is, when the differential decoding sequence is normal, the verification result can be determined to be normal. This can effectively verify the normality of the dual-line detection signal, thereby facilitating the subsequent suspension of the backup task from the domain controller.

[0056] In one embodiment of the present invention, a normal verification result includes: reading the duty cycle and pulse period of the PWM pulse signal from the chip register of the domain controller; verifying the differential decoding sequence based on the duty cycle and pulse period; if the differential decoding sequence is abnormal, collecting and verifying the heartbeat data packet; if the heartbeat data packet is normal, determining that the verification result is normal.

[0057] In a specific embodiment, the duty cycle and pulse period of the PWM pulse signal are read from the chip register by the domain controller. Then, the differential decoding sequence is verified based on the duty cycle and pulse period. When the differential decoding sequence is abnormal, heartbeat data packets are collected and verified. When the heartbeat data packets are normal, the verification result is determined to be normal. Specifically, for example, the domain controller reads the PWM signal value from the 2901 chip register, obtains the timestamps of the rising and falling edges of the signal from the domain controller, calculates the duty cycle periodically by the ratio of the time difference to the signal period, and records it. Based on the sequence composed of the obtained duty cycles, differential decoding is performed, and the decoding sequence is verified to be abnormal. If an abnormality is found, heartbeat data packets are collected through the CAN channel. When it is determined that the heartbeat signal acquisition is positive, the verification result is determined to be normal, and the normal operating status and duration of the system are recorded.

[0058] Specifically, according to the redundancy backup method of the multi-domain controller system of the present invention, the duty cycle and pulse period of the PWM pulse signal in the chip register of the domain controller are read, and then the differential decoding sequence is verified according to the duty cycle and pulse period. When the differential decoding sequence is abnormal, the heartbeat data packet is collected and verified. When the heartbeat data packet is normal, the verification result is determined to be normal. That is, when the differential decoding sequence is abnormal but the heartbeat data packet is normal, the verification result can be determined to be normal. This can effectively verify the normality of the dual-line detection signal, thereby facilitating the subsequent suspension of the backup task from the domain controller.

[0059] In one embodiment of the present invention, waking up a backup task from a domain controller and taking over the work of the primary domain controller includes: allocating processing cores of the secondary domain controller according to the backup task; and controlling the operation of functional modules of the multi-domain controller system according to the backup task allocation result of the processing cores.

[0060] In a specific embodiment, the processing cores of the domain controller are first allocated according to the backup task, and then the functional modules of the multi-domain controller system are controlled to work according to the backup task allocation results of the processing cores. Specifically, for example, after the task image completes initialization, a task stack area is created, EEPROM data is read, and then the domain controller takes over and reallocates the system cores to which each task belongs according to the new task, balancing the task load among the system cores. After the backup controller completes the task reallocation, it controls each functional module to perform its respective work, completing the functional takeover.

[0061] Specifically, according to the redundancy backup method of the multi-domain controller system according to the embodiments of the present invention, the processing core of the slave domain controller is first allocated according to the backup task, and then the functional modules of the multi-domain controller system are controlled to work according to the backup task allocation result of the processing core. In this way, the slave domain controller can wake up the backup task and take over the work of the master domain controller. By introducing a load task reallocation scheduler to balance the single core load of the controller, the probability of the system being suspended and reset due to excessive single core load can be reduced.

[0062] In one embodiment of the present invention, before the slave domain controller verifies the dual-line detection signal sent by the master domain controller, the method further includes: the master domain controller generating a duty cycle sequence using incremental encoding; generating a PWM pulse signal according to a preset period and duty cycle sequence; and the master domain controller sending the PWM pulse signal and heartbeat data message to the slave domain controller.

[0063] In a specific embodiment, before the slave domain controller verifies the dual-wire detection signal sent by the master domain controller, the master domain controller generates a duty cycle sequence using incremental encoding. Then, it generates a PWM pulse signal according to a preset period and duty cycle sequence. Next, the master domain controller sends the PWM pulse signal and heartbeat data message to the slave domain controller. Specifically, for example, the master domain controller first generates a specific duty cycle sequence using incremental encoding. Then, the master domain controller writes the duty cycle sequence into the 8912 chip register one by one according to a specific period. The 8912 chip drives the generation of a characteristic waveform PWM signal, which is then sent from the master domain controller. Simultaneously, the master domain controller sends heartbeat data information via CAN message.

[0064] Specifically, according to the redundancy backup method of the multi-domain controller system of the present invention, before the domain controller verifies the dual-line detection signal sent by the master domain controller, the master domain controller generates a duty cycle sequence using incremental encoding, and then generates a PWM pulse signal according to a preset period and duty cycle sequence. Next, the master domain controller sends the PWM pulse signal and heartbeat data message to the slave domain controller. Thus, within the detection signal transmission process, an incremental duty cycle encoding mechanism is added to the PWM signal detection. In each cycle, the signal duty cycle increases or decreases linearly with time, causing the PWM signal to exhibit a periodically changing waveform, avoiding misjudgment of results due to external electromagnetic interference on a single waveform. Simultaneously, a CAN heartbeat data message detection mechanism is also added, that is, the heartbeat data message sent by the master domain controller is periodically acquired, forming a dual-line synchronous detection combining the PWM signal and the CAN message, ensuring the reliability of the fault detection results.

[0065] In one embodiment of the present invention, before the domain controller verifies the dual-line detection signal sent by the master domain controller, the method further includes: initializing the master domain controller and the slave domain controller, and each functional module in the multi-domain controller system entering the initialization state.

[0066] In a specific embodiment, before the slave domain controller verifies the dual-wire detection signal sent by the master domain controller, the master domain controller and slave domain controllers initialize, and all functional modules in the multi-domain controller system enter the initialization state. Specifically, the multi-domain controller system enters the reset and power-on state, the master domain controller and slave domain controllers synchronously complete the initialization of the domain's CPU (Central Processing Unit), and all control tasks enter the initialization state.

[0067] Specifically, according to the redundancy backup method of the multi-domain controller system according to the embodiments of the present invention, before the domain controller verifies the dual-line detection signal sent by the master domain controller, the master domain controller and the slave domain controller are initialized and each functional module in the multi-domain controller system enters the initialization state; in this way, the master domain controller, the slave domain controller and each functional module in the multi-domain controller system are initialized before verification, so as to avoid the impact of residual data on subsequent verification and control, thereby ensuring the stability and operating efficiency of the multi-domain controller system.

[0068] The following describes the redundancy backup method for the multi-domain controller system of the present invention in further detail with reference to a specific embodiment. In this specific embodiment, a redundancy backup method for a multi-domain controller system is provided, which is also based on the multi-domain controller system 100 in the above embodiments of the present invention.

[0069] Figure 8 This is a flowchart of a redundancy backup method for a multi-domain controller system according to a specific embodiment of the present invention. Figure 8 As shown in this specific embodiment, the specific steps of the redundancy backup method for the multi-domain controller system are as follows: Step S01: The multi-domain controller system enters the reset and power-on state. The master domain controller and slave domain controllers synchronously complete the initialization of the CPU within the domain, and each control task enters the initialization state.

[0070] Step S02: The master domain controller sends a PWM signal with a specific waveform and a heartbeat data message in CAN format.

[0071] Step S03: Detect the PWM signal from the domain controller in real time and perform anomaly verification.

[0072] Step S04: If the PWM signal verification result is normal, proceed to step S06; if the PWM signal verification result is abnormal, proceed to step S05.

[0073] Step S05: Collect CAN format heartbeat data packets from the domain controller. If the data can be collected normally, it is determined that the main domain controller is working normally, and proceed to step S06. If the data is abnormal, it is determined that the main domain controller is malfunctioning, and proceed to step S07.

[0074] Step S06: Suspend the domain controller task and proceed to step S02.

[0075] Step S07: Wake up the primary control task mirror from the domain controller and take over the primary domain controller's work.

[0076] In this specific embodiment, within the signal transmission process in step S02, an incremental duty cycle encoding mechanism is added to the PWM signal detection. The signal duty cycle increases or decreases linearly with time in each cycle, causing the PWM signal to exhibit a special waveform with periodic changes, thus avoiding misjudgment of results caused by external electromagnetic interference to a single waveform. In addition, a detection mechanism for CAN format heartbeat data messages is also added, that is, the heartbeat data messages sent by the master domain controller are periodically acquired, forming a dual-line synchronous detection combining PWM signals and CAN messages, ensuring the reliability of fault detection results.

[0077] Figure 9 This is a flowchart illustrating how a master domain controller sends a PWM signal of a specific waveform and a heartbeat data message in CAN format, according to a specific embodiment of the present invention. Figure 9 As shown in this specific embodiment, the specific steps of step S02, where the master domain controller sends a PWM signal of a specific waveform and a heartbeat data message in CAN format, are as follows: Step S021: The primary domain controller uses incremental coding to generate a specific duty cycle sequence.

[0078] Step S022: The master domain controller writes the duty cycle sequence into the 8912 chip register one by one according to a specific period.

[0079] Step S023: The 8912 chip driver sends the PWM signal of the characteristic waveform from the main domain controller.

[0080] Step S024: The master domain controller sends heartbeat data information via CAN message.

[0081] In this specific embodiment, in step S03, the slave domain controller continuously detects the PWM signal sent by the master domain controller and determines the working status of the master domain controller in real time by verifying the detection result after differential decoding with the encrypted CAN message.

[0082] Figure 10 This is a flowchart illustrating how a domain controller can detect PWM signals in real time and perform anomaly checks according to a specific embodiment of the present invention. Figure 10 As shown in this specific embodiment, the specific steps of step S03, which involves real-time detection of the PWM signal from the domain controller and performance of anomaly verification, are as follows: Step S031: Read the PWM signal value from the 2901 chip register from the domain controller.

[0083] Step S032: Obtain the timestamps of the rising and falling edges of the signal from the domain controller, calculate the duty cycle cycle by cycle by the ratio of the time difference to the signal period, and record it.

[0084] Step S033: Perform differential decoding based on the sequence composed of the obtained duty cycles, and check whether the decoded sequence is abnormal. If an abnormality is found, proceed to step S034; if no abnormality is found, proceed to step S036.

[0085] Step S034: Collect heartbeat data messages via the CAN channel.

[0086] Step S035: Determine if there is an abnormality in the heartbeat signal acquisition. If there is an abnormality, proceed to step S036. If there is an abnormality, proceed to step S037.

[0087] Step S036: Record the normal operating status and duration of the system.

[0088] Step S037: Record the system's abnormal status and start time.

[0089] In this specific embodiment, when the domain controller detects an anomaly in the primary domain controller, it initiates the function takeover process in step S07. Considering the surge in system load after the takeover task, a load task reallocation scheduler is introduced in step S07 to balance the single-core load of the controller and reduce the probability of the system suspending and resetting due to excessive single-core load.

[0090] Figure 11 This is a flowchart illustrating how a slave domain controller wakes up the master control task image and takes over the work of the master domain controller, according to a specific embodiment of the present invention. Figure 11 As shown in this specific embodiment, the specific steps of step S07, which involves waking up the master control task image from the domain controller and taking over the work of the master domain controller, are as follows: Step S071: The task image completes initialization, creates the task stack area, and reads EEPROM data.

[0091] Step S072: Take over the domain controller and redistribute the system cores to which each task belongs based on the newly added tasks, thereby balancing the task load among the system cores.

[0092] Step S073: After the backup controller completes the task redistribution, it controls each functional module to perform its own work and completes the function takeover.

[0093] As can be seen in this specific embodiment, the redundancy backup method of the multi-domain controller system, through innovative fault detection methods, rapid and reliable function takeover, and intelligent load balancing task allocation, enables the vehicle controller to autonomously, quickly, and smoothly restore critical functions after a fault. This method significantly improves the overall vehicle safety, reliability, and ability to respond to sudden risks, providing solid technical support for achieving a higher level of vehicle functional safety.

[0094] Specifically, in this embodiment, the redundancy backup method of the multi-domain controller system achieves functional redundancy based on a distributed domain controller architecture. Sufficient and low-cost Flash resources are reserved within each domain controller to form local redundancy. When the primary controller fails, the backup slave domain controller can seamlessly take over, achieving uninterrupted cross-domain redundancy without relying on external networks or additional storage devices. In addition, through hardware and software collaborative hard-wired multiplexing, fault detection, and automatic switching mechanisms, accurate diagnosis and rapid self-recovery are achieved, significantly improving system robustness and reducing maintenance costs.

[0095] In summary, this specific embodiment of the multi-domain controller system's redundancy backup method innovatively proposes a hardware and software functional redundancy backup scheme based on a multi-domain distributed controller, addressing the limitations of dual-partition backup mechanisms and server backup schemes in the embedded control field. This method fully utilizes the computing, storage, and communication resources within the vehicle-mounted domain controller system, decentralizing redundant functions to the vehicle end, achieving an integrated closed loop of functional-level fault tolerance and data-level backup. It completely eliminates the high investment in dedicated hardware, dependence on external networks, and complexity of later maintenance inherent in traditional solutions. Compared with related technologies, this multi-domain controller system redundancy backup method has the following significant advantages: (1) Hardware and software functional redundancy architecture design. On the hardware side, the same vehicle wiring harness carries two independent hard-wired signals at the same time, so that the master and slave domain controllers can realize the acquisition and control of the vehicle body functional modules through the same wiring harness without additional wiring, saving costs; on the software side, the hardware watchdog, dual-wire heartbeat signal detection and inter-domain data synchronization are deeply integrated to realize rapid fault detection and stable system recovery, thereby improving the safety of the whole vehicle.

[0096] (2) Dual-wire heartbeat signal detection scheme. The redundancy backup method of this multi-domain controller system differs from the detection design of a single type of signal. It adopts dual-wire composite verification, that is, using incremental duty cycle encoded PWM signal to monitor cross-domain status in real time, reducing the impact of electromagnetic interference on the detection results while realizing rapid fault response; using CAN heartbeat data message signal as a redundant detection means to ensure the consistency of fault state performance and ensure the accuracy of detection results.

[0097] (3) System Task Reassignment Scheduler Strategy. The redundancy backup method of this multi-domain controller system ensures the stability of the function after self-recovery by introducing a load-balanced task reassignment scheme. After taking over the master domain controller from the domain controller, the load of each core in the MCU is balanced by reassigning the computing cores to which each task belongs. This can cope with sudden increases in the amount of tasks and reduce the probability of software and hardware resets caused by excessive system load.

[0098] In summary, the redundancy backup method for a multi-domain controller system according to embodiments of the present invention is based on a multi-domain controller system, which includes a master domain controller and slave domain controllers. The redundancy backup method first involves the slave domain controller verifying the dual-line detection signal sent by the master domain controller, and then controlling the slave domain controller to perform corresponding actions based on the verification result of the dual-line detection signal. This allows for rapid and reliable function takeover and load balancing task allocation when the master domain controller fails, enabling the vehicle controller to autonomously, quickly, and smoothly recover critical functions after a failure. This helps improve the stability and operating efficiency of the multi-domain controller system, thereby enhancing the overall vehicle safety, reliability, and ability to respond to sudden risks.

[0099] Figure 12 This is a structural block diagram of a vehicle according to an embodiment of the present invention. Figure 12 As shown, a further embodiment of the present invention also discloses a vehicle 200, including a multi-domain controller system 100 as described in the above embodiments of the present invention.

[0100] It should be noted that the specific implementation of the vehicle 200 in this embodiment of the invention is similar to the specific implementation described in the redundancy backup method of the multi-domain controller system in the above embodiments of the invention. For details, please refer to the description of the redundancy backup method of the multi-domain controller system. In order to reduce redundancy, it will not be repeated here.

[0101] The vehicle 200 according to an embodiment of the present invention includes a multi-domain controller system 100 as described in the above embodiment of the present invention. The multi-domain controller system 100 includes a master domain controller 110 and a slave domain controller 120. The multi-domain controller system 100 is used to implement the redundancy backup method of the multi-domain controller system according to the above embodiment of the present invention. First, the slave domain controller verifies the dual-line detection signal sent by the master domain controller. Then, based on the verification result of the dual-line detection signal, the slave domain controller is controlled to perform corresponding actions. In this way, the slave domain controller is controlled to perform corresponding actions based on the verification result of the dual-line detection signal of the master domain controller, so that when the master domain controller fails, it can quickly and reliably take over functions and distribute load balancing tasks. This enables the vehicle controller to autonomously, quickly, and smoothly restore critical functions after a failure, which helps to improve the stability and operating efficiency of the multi-domain controller system, thereby improving the safety quality, reliability, and ability to respond to sudden risks of the entire vehicle.

[0102] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "illustrative embodiment," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example.

[0103] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

Claims

1. A redundancy backup method for a multi-domain controller system, characterized in that, The multi-domain controller system includes a master domain controller and slave domain controllers, and the method includes: The slave domain controller verifies the two-wire detection signal sent by the master domain controller; The domain controller is controlled to perform corresponding actions based on the verification result of the dual-line detection signal.

2. The redundancy backup method for a multi-domain controller system according to claim 1, characterized in that, The step of controlling the slave domain controller to perform corresponding actions based on the verification result of the dual-line detection signal includes: If the verification result is normal, the backup task is suspended from the domain controller; or When the verification result is abnormal, the slave domain controller wakes up the backup task and takes over the work of the primary domain controller.

3. The redundancy backup method for a multi-domain controller system according to claim 2, characterized in that, The abnormal verification results include: The duty cycle and pulse period of the PWM pulse signal are read from the chip register of the domain controller; Based on the duty cycle and the pulse period, a differential decoding sequence is verified; When the differential decoding sequence is abnormal, the heartbeat data packets are collected and verified; When the heartbeat data message is abnormal, the verification result is also abnormal.

4. The redundancy backup method for a multi-domain controller system according to claim 2, characterized in that, The verification result is normal, including: The duty cycle and pulse period of the PWM pulse signal are read from the chip register of the domain controller; Based on the duty cycle and the pulse period, a differential decoding sequence is verified; When the differential decoding sequence is normal, the verification result is normal.

5. The redundancy backup method for a multi-domain controller system according to claim 2, characterized in that, The verification result is normal, including: The duty cycle and pulse period of the PWM pulse signal are read from the chip register of the domain controller; Based on the duty cycle and the pulse period, a differential decoding sequence is verified; When the differential decoding sequence is abnormal, the heartbeat data packets are collected and verified; If the heartbeat data message is normal, the verification result is determined to be normal.

6. The redundancy backup method for a multi-domain controller system according to claim 2, characterized in that, The process of waking up the backup task from the domain controller and taking over the work of the primary domain controller includes: The processing cores of the slave domain controller are allocated according to the backup task; The system controls the operation of functional modules of the multi-domain controller system based on the backup task allocation results of the processing core.

7. The redundancy backup method for a multi-domain controller system according to claim 1, characterized in that, Before the slave domain controller verifies the two-wire detection signal sent by the master domain controller, the method further includes: The primary domain controller uses incremental encoding to generate a duty cycle sequence; PWM pulse signals are generated according to the preset period and the duty cycle sequence; The master domain controller sends PWM pulse signals and heartbeat data messages to the slave domain controller.

8. The redundancy backup method for a multi-domain controller system according to any one of claims 1-7, characterized in that, Before the slave domain controller verifies the two-wire detection signal sent by the master domain controller, the method further includes: The primary domain controller and the secondary domain controller are initialized, and each functional module in the multi-domain controller system enters the initialization state.

9. A multi-domain controller system, characterized in that, include: The primary domain controller is used to send dual-wire detection signals; The slave domain controller is connected to the master domain controller and is used to verify the two-wire detection signal sent by the master domain controller, and control the execution of corresponding actions based on the verification result of the two-wire detection signal. The functional modules are connected to the master domain controller and the slave domain controller respectively, and are used to execute control commands issued by the master domain controller or the slave domain controller.

10. A vehicle, characterized in that, include: The multi-domain controller system as described in claim 9.

Images