A method of checking a signal, a controller and a vehicle

Abstract

The application provides a method for checking a signal, a controller and a vehicle, and relates to the technical field of data processing. In the method, in response to a first message sent by a target electronic control unit, whether the first message is checked is determined based on a first flag bit in the first message. This can flexibly enable or disable the checking process at the message level. After determining that the first message is checked, at least one first signal participating in the checking is screened out based on a second flag bit of each first signal in the first message. This does not perform the checking process on the remaining signals that are not selected by default, can realize the refinement from the message-level checking to the signal-level checking, and can avoid the one-size-fits-all checking process through the cooperative judgment of the two-level checking logic corresponding to the double-layer flag bits. That is, the checking can be enabled for key signals to ensure transmission reliability, and the checking can be disabled for non-key signals to save computing resources. Therefore, the method can meet the refined needs of different signals and reduce the waste of computing resources.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and more specifically, to a method, controller, and vehicle for verifying signals in the field of signal verification technology. Background Technology

[0002] In modern intelligent vehicle architecture, the Vehicle Control Unit (VCU), as the core decision-making unit, needs to verify the messages sent by multiple Electronic Control Units (ECUs) through the communication bus to ensure communication integrity.

[0003] In related technologies, the above verification process can involve verifying all messages sent by a certain ECU node, verifying all signals contained in a message, or not verifying any signal. However, a message may contain multiple signals, and the above verification process cannot meet the fine-grained requirements of different signals, and may also lead to a waste of computing resources.

[0004] Therefore, there is an urgent need for a method to verify signals in order to meet the fine-grained requirements of different signals during the verification process. Summary of the Invention

[0005] This application provides a method, controller, and vehicle for verifying signals, wherein the method can meet the fine-grained requirements of different signals during the verification process.

[0006] In a first aspect, a method for verifying signals is provided, the method being executed by a vehicle control unit, the method comprising: responding to a first message sent by a target electronic control unit; determining, based on a first flag bit in the first message, whether to verify the first message, the first flag bit indicating whether to verify the first message; if it is determined that the first message should be verified, determining, based on a second flag bit of each first signal in the first message, at least one first signal to be verified from a plurality of first signals, the second flag bit indicating whether to verify the corresponding first signal, the first signal being a data unit carried in the first message; and verifying the at least one first signal.

[0007] In the above technical solution, after the vehicle control unit receives the first message sent by the target electronic control unit, it determines whether to verify the entire first message, i.e., to verify each first signal in the first message, based on the first flag bit in the first message. This allows for flexible enabling or disabling of the verification process at the message level, avoiding invalid processing of messages that do not require verification and reducing redundant calculations by the vehicle control unit. After determining to verify the entire first message, it further filters out at least one first signal that needs to participate in the verification from multiple first signals based on the second flag bit of each first signal in the first message. By default, the verification process is not performed on the remaining unselected signals (i.e., signals other than at least one first signal), which enables the refinement of verification from the message level to the signal level. The above solution is no longer limited to the unified verification rules at the node level or message level in related technologies, but rather uses two levels (message level and signal level) verification logic corresponding to two layers of flag bits for collaborative judgment. This can accurately match the verification requirements of different first signals and avoid the resource waste caused by the one-size-fits-all verification method in related technologies. In other words, verification can be enabled for critical signals to ensure reliable transmission, while verification can be disabled for non-critical signals to save computing resources. Therefore, the above scheme can achieve independent verification control of individual signals within a message, meeting the refined requirements of different signals and reducing the waste of computing resources.

[0008] In conjunction with the first aspect, in some possible implementations, the method further includes: responding to a plurality of messages sent by the target electronic control unit, determining whether to verify the plurality of messages based on a third flag bit of the plurality of messages, the third flag bit being used to indicate whether to verify the plurality of messages, the plurality of messages including the first message; if it is determined that the plurality of messages should be verified, verifying each second signal in a second message, the second message being a message other than the first message among the plurality of messages.

[0009] In the above technical solution, the vehicle control unit responds to multiple messages sent by the target electronic control unit, and determines whether to perform overall verification on the group of messages based on the third flag bit of the multiple messages. This enables node-level (the level above the message level, targeting all messages sent by the target electronic control unit (a certain ECU node)) verification, improving verification efficiency in multiple message scenarios. These multiple messages include a first message, which contains multiple signals. Then, by combining the first and second flag bits, each second signal in the second message is verified, and at least one first signal in the first message is verified, while the remaining signals in the first message are not verified. That is, the above solution extends the node-level verification mechanism on the basis of the original two-level verification logic, complementing the signal-level fine-grained verification and message-level verification used in the first message, thus achieving three-level verification logic. This solution can adapt to fine-grained verification and batch verification modes based on the functional attributes and security levels of different messages, avoiding the problem that a single verification strategy cannot balance flexibility and efficiency. In other words, by using a three-level (node-level, message-level, and signal-level) verification logic corresponding to three layers of flags for collaborative judgment, the verification requirements of different messages and first signals can be accurately matched. This enables multi-dimensional verification management of ECU nodes (multiple messages), single messages, and multiple signals, improving the rationality and efficiency of monitoring communication integrity.

[0010] In conjunction with the first aspect and the above implementation methods, in some possible implementation methods, after verifying each of the second signals in the second message, the method further includes: determining whether the second message has experienced a first fault, the first fault being used to indicate that the second message is lost or has timed out or that the second signals in the second message are invalid; in the case that the second message has experienced the first fault, determining that each of the second signals in the second message will not be verified within a first preset time period.

[0011] In the above technical solution, after verifying each second signal in the second message, fault judgment and verification pause logic are added. Specifically, it determines whether the second message has experienced a first fault, which can promptly identify abnormal message states in vehicle communication. When the second message experiences a first fault, the verification of each second signal in the second message is paused for a first preset time period. This avoids automatically stopping redundant verification actions when the second message remains abnormal, preventing invalid calculations from consuming computing resources. At the same time, it avoids error accumulation or misjudgment caused by repeated verification of abnormal messages, improving the stability and rationality of the verification process.

[0012] In conjunction with the first aspect and the above implementation methods, in some possible implementation methods, after determining whether the second message has experienced a first fault, the method further includes: if the second message has experienced the first fault, determining a target fault code matching the first fault from a verification survey table, the verification survey table being used to define debouncing parameters corresponding to each fault code, the debouncing parameters being timer parameters used to prevent erroneous output of fault codes; obtaining the target debouncing parameter corresponding to the target fault code from the verification survey table; if the actual timer parameter corresponding to the second message experiencing the first fault exceeds the debouncing parameter, determining that each second signal in the second message will not be verified within a first preset duration.

[0013] In the above technical solution, after determining that the second message has a first fault, a target fault code matching the first fault is determined from the verification survey table. This allows for rapid fault type identification. Furthermore, the target debouncing parameters corresponding to the target fault code are obtained from the verification survey table. This allows for the configuration of specific anti-false alarm judgment conditions for different fault types, improving the accuracy of fault identification. The actual timer parameters are compared with the target debouncing parameters, and the verification pause operation is only performed when the actual time exceeds a set threshold. This effectively filters out false faults caused by transient interference and avoids erroneous verification pauses due to abnormal fluctuations. Therefore, this solution improves the reliability and stability of fault judgment, reduces functional abnormalities caused by false triggers, and optimizes the execution logic of the vehicle control unit.

[0014] In conjunction with the first aspect and the above implementation, in some possible implementations, before determining at least one first signal participating in the verification from multiple first signals based on the second flag bits of each first signal in the first message, the method further includes: determining whether the second flag bits of each first signal are null; and if the second flag bits of each first signal are not null, determining the at least one first signal from multiple first signals based on the second flag bits of each first signal in the first message.

[0015] In the above technical solution, before determining the verification range of the first signal through the second flag bit, a step is added to determine whether the second flag bit is null. This can detect abnormalities in the second flag bit in advance, avoiding verification logic confusion or misjudgment due to null flag bits. After confirming that the second flag bits of each first signal are not null, at least one first signal participating in the verification is then selected based on the second flag bits. This ensures the normal execution of the verification logic and guarantees the accuracy and reliability of signal selection. The above solution supplements the validity verification step of the second flag bit, which can improve the pre-process of signal-level verification of the first message, ensure the accuracy of verification and selection of the first signal, and indirectly optimize the verification efficiency of the vehicle control unit.

[0016] In conjunction with the first aspect and the above implementation, in some possible implementations, the method further includes: for any one of the plurality of first signals, if the second flag bit of the first signal is null, obtaining the default flag bit of the first signal; and determining, based on the default flag bit, whether the first signal belongs to the at least one first signal.

[0017] In the above technical solution, when the second flag bit of any first signal is detected to be null, the default flag bit of that first signal is obtained. This provides reliable fallback logic for scenarios where the second flag bit is missing. Based on the default flag bit, it is determined whether the first signal falls within the verification range. This avoids problems such as verification process interruption or inability to properly filter signals due to null flag bits. The above solution ensures that the verification logic can operate stably even under abnormal configurations, improving the overall compatibility and robustness of the solution. Furthermore, using the default flag bit to maintain the continuity of the verification strategy maximizes communication integrity.

[0018] In conjunction with the first aspect and the above implementation, in some possible implementations, before verifying the at least one first signal, the method further includes: obtaining an enabling condition for the at least one first signal, the enabling condition being a triggering condition for verifying the at least one first signal; and verifying the at least one first signal when the vehicle meets the enabling condition.

[0019] In the above technical solution, before performing verification on at least one first signal, the enabling condition of at least one first signal is obtained. This provides a clear triggering basis for signal-level verification. When the vehicle meets the enabling condition, the verification operation is performed. This allows the verification process to accurately match the actual operating state of the vehicle, avoiding invalid verification under unsuitable conditions. The above solution refines the verification triggering logic to the signal level, effectively distinguishing the verification timing of different signals and reducing unnecessary computational overhead. Simultaneously, the combined use of enabling conditions and flag bits enhances the flexibility and targeting of verification control, ensuring a more reasonable and reliable verification process.

[0020] In conjunction with the first aspect and the above implementation methods, in some possible implementation methods, the first message is a message sent by the target electronic control unit through the first communication channel. Obtaining the enable condition of the at least one first signal includes: determining a target communication channel that matches the first communication channel from a verification survey table, wherein the verification survey table is also used to define the enable condition of the first signal transmitted on the corresponding communication channel; determining a target first signal that matches the at least one first signal one by one from a plurality of first signals corresponding to the target communication channel in the verification survey table; and determining the enable condition corresponding to the target first signal as the enable condition of the at least one first signal.

[0021] In the above technical solution, the target communication channel is determined from the verification survey table based on the first communication channel used to send the first message. This allows for unified management of enabling conditions based on a standardized configuration table, improving configuration efficiency and accuracy. Furthermore, by searching for a target first signal that matches the signal to be verified one-to-one among multiple first signals corresponding to the target communication channel, the specific enabling conditions for each first signal can be accurately located. This avoids verification logic errors caused by confusion between the communication channel and the first signal. Determining the enabling condition corresponding to the target first signal as the final enabling condition achieves precise binding of the communication channel and the first signal in two dimensions, making the triggering of the verification process more closely aligned with actual transmission scenarios.

[0022] Secondly, a device for verifying signals is provided, which is installed in a vehicle control unit. The device includes: a determining module, configured to: in response to a first message sent by a target electronic control unit, determine whether to verify the first message based on a first flag bit in the first message, the first flag bit indicating whether to verify the first message; if it is determined that the first message should be verified, determine at least one first signal to be verified from a plurality of first signals based on a second flag bit of each first signal in the first message, the second flag bit indicating whether to verify the corresponding first signal, the first signal being a data unit carried in the first message; and a verification module, configured to verify the at least one first signal.

[0023] In conjunction with the second aspect, in some possible implementations, the determining module is further configured to: in response to multiple messages sent by the target electronic control unit, determine whether to verify the multiple messages based on a third flag bit of the multiple messages, the third flag bit being used to indicate whether to verify the multiple messages, the multiple messages including the first message; the verification module is further configured to, if it is determined that the multiple messages should be verified, verify each second signal in a second message, the second message being a message other than the first message among the multiple messages.

[0024] In conjunction with the second aspect and the above implementation methods, in some possible implementation methods, after verifying each of the second signals in the second message, the determining module is further configured to: determine whether the second message has experienced a first fault, the first fault being used to indicate that the second message is lost or has timed out or that the second signal in the second message is invalid; and in the case that the second message has experienced the first fault, determine that each of the second signals in the second message will not be verified within a first preset time period.

[0025] In conjunction with the second aspect and the above implementation methods, in some possible implementation methods, after determining whether the second message has experienced a first fault, the determining module is further configured to: in the case that the second message has experienced the first fault, determine a target fault code matching the first fault from a verification survey table, the verification survey table being used to define debouncing parameters corresponding to each fault code, the debouncing parameters being timer parameters used to prevent erroneous output of fault codes; obtain the target debouncing parameter corresponding to the target fault code from the verification survey table; and in the case that the actual timer parameter corresponding to the second message experiencing the first fault exceeds the debouncing parameter, determine that each of the second signals in the second message will not be verified within a first preset duration.

[0026] In conjunction with the second aspect and the above implementation, in some possible implementations, before determining at least one first signal to be verified from a plurality of first signals based on the second flag bits of each first signal in the first message, the determining module is further configured to determine whether the second flag bits of each first signal are null; if the second flag bits of each first signal are not null, the at least one first signal is determined from a plurality of first signals based on the second flag bits of each first signal in the first message.

[0027] In conjunction with the second aspect and the above implementation, in some possible implementations, the device further includes: an acquisition module, configured to acquire a default flag bit of the first signal for any of the plurality of first signals when the second flag bit of the first signal is empty; the determination module is further configured to determine whether the first signal belongs to the at least one first signal based on the default flag bit.

[0028] In conjunction with the second aspect and the above implementation, in some possible implementations, before verifying the at least one first signal, the acquisition module is further configured to acquire the enabling condition of the at least one first signal, the enabling condition being a triggering condition for verifying the at least one first signal; and the verification module is further configured to verify the at least one first signal when the vehicle meets the enabling condition.

[0029] In conjunction with the second aspect and the above implementation methods, in some possible implementation methods, the first message is a message sent by the target electronic control unit through the first communication channel. The acquisition module is specifically used to determine the target communication channel that matches the first communication channel from the verification survey table. The verification survey table is also used to define the enabling conditions of the first signal transmitted on the corresponding communication channel. The determining module is specifically used to: determine the target first signal that matches the at least one first signal one by one from the multiple first signals corresponding to the target communication channel in the verification survey table; and determine the enabling condition corresponding to the target first signal as the enabling condition of the at least one first signal.

[0030] Thirdly, a controller is provided, including a storage module and a processing module. The storage module is used to store executable program code, and the processing module is used to call and run the executable program code from the storage module, causing the controller to execute the methods in the first aspect or any possible implementation of the first aspect.

[0031] Fourthly, a vehicle is provided, including a memory and a processor. The memory is used to store executable program code, and the processor is used to call and run the executable program code from the memory, causing the vehicle to perform the methods described in the first aspect or any possible implementation thereof. Attached Figure Description

[0032] Figure 1 This is a schematic diagram of a verification signal scenario provided in an embodiment of this application; Figure 2 This is a schematic flowchart illustrating a method for verifying signals provided in an embodiment of this application; Figure 3 This is a schematic flowchart of another method for verifying signals provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of a device for verifying signals provided in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of a controller provided in an embodiment of this application; Figure 6 This is a schematic diagram of the structure of a vehicle provided in an embodiment of this application. Detailed Implementation

[0033] The technical solutions in this application will be clearly and thoroughly described below with reference to the accompanying drawings. In the description of the embodiments of this application, unless otherwise stated, " / " means "or," for example, A / B can mean A or B. "And / or" in the text is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Furthermore, in the description of the embodiments of this application, "multiple" refers to two or more than two.

[0034] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature.

[0035] In modern intelligent vehicle architecture, the vehicle control unit (VCU) serves as the core decision-making unit. It needs to monitor various messages sent by multiple electronic control units (ECUs) through the communication bus and verify the signals in the messages to ensure communication integrity.

[0036] Figure 1 This is a schematic diagram of a verification signal scenario provided in an embodiment of this application. The following will be combined with... Figure 1 Describe the specific process by which the vehicle control unit verifies the signals in the messages sent by the electronic control unit.

[0037] For example, such as Figure 1 As shown, vehicle A includes a vehicle control unit and multiple electronic control units, including a first electronic control unit, a second electronic control unit, and a third electronic control unit. The following section specifically describes the process by which the vehicle control unit verifies the signals in the messages sent by the electronic control units, using the first electronic control unit as an example (which can be referred to as the BMS control unit).

[0038] Specifically, the VCU can receive battery status messages sent from the BMS control unit, perform cyclic redundancy checks on the remaining charge and voltage of the power battery in the battery status messages, and determine whether these data have been erroneous during the communication process.

[0039] Once it's confirmed that no errors occurred during communication, the VCU determines the maximum permissible discharge power of the battery based on this data, driving intent, and vehicle status. Subsequently, the VCU sends a power request message containing the target power to the BMS control unit, requesting the battery to discharge at the target power. This target power is less than the maximum discharge power. Upon receiving the power request message, the BMS control unit performs a secondary verification based on the battery's current temperature and health parameters to determine if the target power is within the battery's safe operating range. If the target power is within the safe operating range, the BMS control unit controls the battery to discharge at the target power.

[0040] Upon determining that errors have occurred during communication, the VCU immediately initiates diagnostic mechanisms. Specifically, the VCU discards the currently erroneous battery status message and uses the valid battery status message stored in the previous cycle. Simultaneously, the VCU sends diagnostic fault codes via the communication bus to illuminate the malfunction indicator light on the vehicle's dashboard, alerting the vehicle occupant to a communication anomaly. Alternatively, it may simultaneously limit the maximum vehicle speed.

[0041] In related technologies, the aforementioned verification process can involve verifying all messages sent by a single ECU node, verifying all messages sent by multiple ECU nodes, verifying all signals contained in a single message, or not verifying any signal. However, a message may contain multiple signals, and these signals may have different verification requirements. The aforementioned verification process cannot meet the refined requirements of different signals. Under the limitations of the verification strategies in related technologies, if some signals do not need verification, but the vehicle control unit still verifies them, it will result in a waste of computational resources.

[0042] To address the aforementioned issues, this application proposes a signal verification method that considers the differences in verification requirements among various signals during the verification process, thereby satisfying the refined requirements of different signals. Specific implementation steps are as follows. Figure 2 .

[0043] Figure 2 This is a schematic flowchart of a method for verifying signals provided in an embodiment of this application.

[0044] It should be understood that the method for verifying signals provided in the embodiments of this application can be applied to, for example... Figure 1 The vehicle control unit shown in the diagram, specifically, applies this verification signal method to a target module within the vehicle control unit, which processes data communicating with the vehicle control unit. Optionally, this target module is a Basic Software (BSW) module.

[0045] For example, such as Figure 2 As shown, the method 200 includes the following steps 201 to 203.

[0046] Step 201: In response to the first message sent by the target electronic control unit, determine whether to verify the first message based on the first flag bit in the first message, wherein the first flag bit is used to indicate whether to verify the first message.

[0047] It should be understood that the first flag bit mentioned above is used to indicate whether to verify the first message. Specifically, the first flag bit is used to indicate that the first message is verified, that is, all the first signals in the first message are verified; or, the first flag bit is used to indicate that the verification of the first message is prohibited, that is, each of the first signals in the first message is not verified.

[0048] For step 201 above, the first flag bit can be specifically understood as a flag bit used to indicate whether the first message participates in the communication protection mechanism (is protected). Specifically, the participation of the first message in the communication protection mechanism means that during communication, the receiver (which may be a vehicle control unit) will verify all first signals in the first message to determine whether the signal content has been tampered with or lost (verifying the integrity, accuracy, and timeliness of the signal content, etc.), and if the signal content is tampered with or lost, the receiver will immediately perform fault-safe processing.

[0049] Optionally, the communication protection mechanism is an end-to-end (E2E) communication protection mechanism.

[0050] Optionally, fault-safe handling includes signal content degradation, fault reporting, and function restriction. Signal content degradation refers to discarding the currently erroneous signal content and using the valid signal content from the previous cycle, a default safe value, or a failure replacement value for calculation, to prevent the vehicle system from crashing due to abnormal signal content. Fault reporting refers to sending diagnostic fault codes via the communication bus to alert the vehicle user to a communication anomaly. Function restriction refers to limiting relevant functions in the vehicle based on the severity of the fault.

[0051] In some embodiments, determining whether to verify the first message based on the first flag bit in the first message in step 201 includes: determining to verify the first message when the first flag bit is a first value, the first value being used to indicate that the first message is being verified; and determining to prohibit verification of the first message when the first flag bit is a second value, the first value being different from the second value, the second value being used to indicate that the first message is being prohibited from being verified.

[0052] Optionally, the first value is 1 and the second value is 0.

[0053] In some embodiments, before determining whether to verify the first message based on the first flag bit in the first message in step 201, the method 200 further includes: determining whether the value of the first flag bit is a valid value; the determination of whether to verify the first message based on the first flag bit in step 201 includes: if the value of the first flag bit is determined to be a valid value, determining whether to verify the first message based on the first flag bit in the first message.

[0054] It should be understood that the above valid value either indicates that the first message is to be verified or that verification of the first message is prohibited. Optionally, the valid value may be a fifth value or a sixth value, wherein the fifth value is different from the sixth value, the fifth value is used to indicate that the first message is to be verified, and the sixth value is used to indicate that verification of the first message is prohibited.

[0055] In some embodiments, the method 200 further includes: if it is determined that the value of the first flag bit is not a valid value, not performing the step of determining whether to verify the first message based on the first flag bit in the first message.

[0056] Step 202: If it is determined that the first message needs to be verified, at least one first signal to be verified is determined from multiple first signals based on the second flag bit of each first signal in the first message. The second flag bit is used to indicate whether to verify the corresponding first signal. The first signal is the data unit carried in the first message.

[0057] The aforementioned first signal is the smallest valid data unit carried in the first message and is a component of the first message. The first message serves as a transmission carrier, used to carry and transmit the first signal. The first signal is sent and received through the first message; the two have a relationship of inclusion and being included, carrying and being carried. The first signal is used to characterize specific information such as the vehicle's operating status, control commands, or sensor data. Multiple first signals are encapsulated within the same first message.

[0058] Regarding step 202 above, the second flag bit can be specifically understood as a flag bit used to indicate whether the corresponding first signal participates in the communication protection mechanism. Wherein, the first signal participating in the communication protection mechanism means that during communication, the receiver (which may be the vehicle control unit) will verify the first signal to determine whether the signal content has been tampered with or lost. If the signal content has been tampered with or lost, the receiver will immediately perform fault safety processing.

[0059] It should be understood that step 202 described above describes that after determining that each first signal in the first message is to be verified (i.e., analyzing the verification requirements at the message level), at least one first signal is determined to participate in the verification. Then there are other signals that do not participate in the verification. That is, the method 200 allows individual first signals to not participate in the verification process (i.e., analyzing the verification requirements at the signal level).

[0060] It should also be understood that the second flag bit mentioned above is used to indicate whether to verify the corresponding first signal, specifically: the second flag bit is used to indicate whether to verify the corresponding first signal; or, the second flag bit is used to indicate whether to prohibit the verification of the corresponding first signal.

[0061] In some embodiments, step 202, which determines at least one first signal to participate in the verification from a plurality of first signals based on the second flag bit of each first signal in the first message, includes: determining the first signal corresponding to the second flag bit being a third value among the plurality of first signals as at least one first signal to participate in the verification, wherein the third value is used to indicate the first signal corresponding to the verification.

[0062] It should be understood that when the second flag bit of the first signal is a fourth value, it indicates that verification of the first signal is prohibited, and the first signal does not belong to at least one first signal participating in the verification. The third value is different from the fourth value. Optionally, the third value is 1 and the fourth value is 0.

[0063] Step 203: Verify the at least one first signal.

[0064] It should be understood that in step 203 above, the at least one first signal is verified, and by default, the remaining signals among the multiple first signals other than the at least one first signal are not verified.

[0065] In some embodiments, before step 203, the method includes: obtaining the verification priority of each of the at least one first signal, the verification priority being used to indicate the order in which the corresponding first signal is verified; and step 203 includes: verifying the at least one first signal based on the verification priority of each of the first signals.

[0066] In the above technical solution, when verifying at least one first signal, the first signal with higher priority can be verified first, followed by the first signal with lower priority. This can avoid delays in verifying critical signals when verification resources are scarce.

[0067] In one possible implementation, before determining at least one first signal to be verified from multiple first signals based on the second flag bits of each first signal in the first message in step 202, the method 200 further includes: determining whether the second flag bits of each first signal are null; and if the second flag bits of each first signal are not null, determining the at least one first signal from multiple first signals based on the second flag bits of each first signal in the first message.

[0068] It should be understood that during communication, communication data is easily subject to malicious attacks or tampering, or communication link failures may occur, resulting in the second flag bit being empty. An empty second flag bit means that the second flag bit is filled with an invalid value or left unfilled (empty). This invalid value is a value that neither indicates the first signal corresponding to the verification nor indicates the first signal corresponding to the prohibition of verification.

[0069] In the above technical solution, before determining the verification range of the first signal through the second flag bit, a step is added to determine whether the second flag bit is null. This can detect abnormalities in the second flag bit in advance, avoiding verification logic confusion or misjudgment due to null flag bits. After confirming that the second flag bits of each first signal are not null, at least one first signal participating in the verification is then selected based on the second flag bits. This ensures the normal execution of the verification logic and guarantees the accuracy and reliability of signal selection. The above solution supplements the validity verification step of the second flag bit, which can improve the pre-process of signal-level verification of the first message, ensure the accuracy of verification and selection of the first signal, and indirectly optimize the verification efficiency of the vehicle control unit.

[0070] In one possible implementation, the method 200 further includes: for any one of the plurality of first signals, if the second flag bit of the first signal is empty, obtaining the default flag bit of the first signal; and determining whether the first signal belongs to the at least one first signal based on the default flag bit.

[0071] It should be understood that the default flag bit mentioned above is either the third or fourth value. In actual communication, to better ensure communication integrity, the default flag bit can be set to the third value.

[0072] It should also be understood that the first and third flag bits may be null. When the first or third flag bit is null, the default flag bit can still be obtained, which will not be elaborated here.

[0073] In the above technical solution, when the second flag bit of any first signal is detected to be null, the default flag bit of that first signal is obtained. This provides reliable fallback logic for scenarios where the second flag bit is missing. Based on the default flag bit, it is determined whether the first signal falls within the verification range. This avoids problems such as verification process interruption or inability to properly filter signals due to null flag bits. The above solution ensures that the verification logic can operate stably even under abnormal configurations, improving the overall compatibility and robustness of the solution. Furthermore, using the default flag bit to maintain the continuity of the verification strategy maximizes communication integrity.

[0074] In some embodiments, determining whether the first signal belongs to the at least one first signal based on the default flag bit includes: determining that the first signal belongs to the at least one first signal when the default flag bit of the first signal is a third value; and determining that the first signal does not belong to the at least one first signal when the default flag bit of the first signal is a fourth value.

[0075] In one possible implementation, before step 203, the method 200 further includes: obtaining an enabling condition for the at least one first signal, the enabling condition being a triggering condition for verifying the at least one first signal; and verifying the at least one first signal when the vehicle meets the enabling condition.

[0076] It should be understood that in the above scheme, before verifying a certain first signal, the vehicle must meet the enabling conditions of that first signal. Furthermore, the enabling conditions for different first signals are different. The enabling conditions for each first signal are predefined before the actual communication process.

[0077] In the above technical solution, before performing verification on at least one first signal, the enabling condition of at least one first signal is obtained. This provides a clear triggering basis for signal-level verification. When the vehicle meets the enabling condition, the verification operation is performed. This allows the verification process to accurately match the actual operating state of the vehicle, avoiding invalid verification under unsuitable conditions. The above solution refines the verification triggering logic to the signal level, effectively distinguishing the verification timing of different signals and reducing unnecessary computational overhead. Simultaneously, the combined use of enabling conditions and flag bits enhances the flexibility and targeting of verification control, ensuring a more reasonable and reliable verification process.

[0078] For example, the first signal is a braking signal. The enabling condition for the braking signal includes the actual vehicle speed being greater than the first vehicle speed. Then, when the current vehicle speed is greater than the first vehicle speed, the received braking signal is verified.

[0079] It should be noted that each message can also have enable conditions. Specifically, before verifying the signals in a particular message, the vehicle must meet the enable conditions of that message. See the example below for details.

[0080] For example, the first message is a battery status message. The enabling condition of the battery status message includes that the actual remaining power of the power battery in the vehicle is less than the second power. When the current remaining power of the power battery is less than the second power, the various signals in the received battery status message are verified.

[0081] It's also important to note that the vehicle control unit has limited computing power. If all signals are verified while the vehicle is stationary or in normal driving mode, it will consume a significant amount of computing resources, potentially causing the vehicle system to slow down or lag. Therefore, verification of certain signals should only be performed under critical operating conditions.

[0082] For example, the risk of brake signal failure is extremely low when the vehicle is stationary, but extremely high when the vehicle is traveling at high speed. Therefore, the brake signal is verified when the vehicle's current speed is relatively high. Similarly, when the remaining battery power is sufficient, even if the battery status report occasionally malfunctions, the vehicle still has enough energy redundancy, and the risk is manageable. However, when the remaining battery power is low, the vehicle is in a low battery warning state, at which point the accuracy of the battery status report is crucial. If the battery voltage in the battery status report is incorrect, it could lead to over-discharge and damage to the battery. In other words, it is essential to ensure that the vehicle control unit can accurately grasp the true state of the battery and make the correct protection decisions at critical moments when the energy is about to be depleted. Therefore, when the current remaining battery power is low, all signals in the battery status report are verified.

[0083] In one possible implementation, the first message is a message sent by the target electronic control unit through a first communication channel. Obtaining the enable condition of the at least one first signal includes: determining a target communication channel that matches the first communication channel from a verification survey table, wherein the verification survey table is also used to define the enable condition of the first signal transmitted on the corresponding communication channel; determining a target first signal that matches the at least one first signal one by one from a plurality of first signals corresponding to the target communication channel in the verification survey table; and determining the enable condition corresponding to the target first signal as the enable condition of the at least one first signal.

[0084] It should be understood that in the above scheme, the enabling conditions of each first signal are predefined in the verification checklist before the actual communication process. Furthermore, the verification checklist includes the correspondence between each communication channel in the multiple communication channels corresponding to the target electronic control unit, each first signal in the multiple first signals transmitted on each communication channel, and the enabling conditions of each first signal.

[0085] The target electronic control unit can send messages to the vehicle control unit through any of multiple communication channels. For the same first signal, the enabling conditions differ depending on the communication channel used for transmission. When the same ECU node transmits the same signal / message on multiple communication channels, its enabling conditions are determined independently. That is, the enabling conditions for the first signal transmitted through the first communication channel are different from those for the first signal transmitted through the second communication channel.

[0086] In the above technical solution, the target communication channel is determined from the verification survey table based on the first communication channel used to send the first message. This allows for unified management of enabling conditions based on a standardized configuration table, improving configuration efficiency and accuracy. Furthermore, by searching for a target first signal that matches the signal to be verified one-to-one among multiple first signals corresponding to the target communication channel, the specific enabling conditions for each first signal can be accurately located. This avoids verification logic errors caused by confusion between the communication channel and the first signal. Determining the enabling condition corresponding to the target first signal as the final enabling condition achieves precise binding of the communication channel and the first signal in two dimensions, making the triggering of the verification process more closely aligned with actual transmission scenarios.

[0087] In some embodiments, before determining a target communication channel matching the first communication channel from the verification survey table, the method 200 further includes: receiving an update instruction sent by a first device, the update instruction being used to request an update to the verification survey table, the update instruction including update content; and performing differential updates to the content in the verification survey table based on the update content.

[0088] The above solution can modify various correspondences in the verification survey form in real time without interrupting the verification process, thus completing the configuration update. To a certain extent, it adapts to the verification requirements of vehicles under different operating conditions (such as idling, high speed, and fault repair).

[0089] Optionally, the first device is a host computer or a data diagnostic device.

[0090] Figure 3 This is a schematic flowchart illustrating another method for verifying signals provided in an embodiment of this application. The following will be combined with... Figure 3 right Figure 2 The methods described are further refined.

[0091] Step 301: In response to multiple messages sent by the target electronic control unit, determine whether to verify the multiple messages based on a third flag bit of the multiple messages. The third flag bit is used to indicate whether to verify the multiple messages, which include the first message. Step 302: If it is determined that the multiple messages should be verified, verify each second signal in a second message, which is a message other than the first message among the multiple messages.

[0092] It should be understood that the above Figure 3The scheme corresponding to claim 2, combined with claim 1, describes the following: In response to multiple messages (including a first message and a second message) sent by the target electronic control unit, based on the third flag bit of the multiple messages, it is determined whether to verify the multiple messages; if it is determined that the multiple messages should be verified, the first flag bit in the first message is checked to determine whether to verify the first message, and the first flag bit in the second message is checked to determine whether to verify the second message; if it is determined that the first message should be verified, based on the second flag bit of each first signal in the first message, at least one first signal participating in the verification is selected from the multiple first signals, and at least one first signal is verified; and if it is determined that the second message should be verified, at least one second signal participating in the verification can also be selected from the multiple second signals based on the second flag bit of each second signal in the second message (claim 2 of method 200 is described as an example where the second flag bit of each second signal indicates the second signal to be verified), and each second signal in the second message is verified.

[0093] For the above scheme, the third flag bit can be specifically understood as a flag bit used to indicate whether multiple messages sent by the target electronic control unit participate in the communication protection mechanism. Here, multiple messages participating in the communication protection mechanism means that during communication, the receiver (which can be the vehicle control unit) will verify each signal in each of the multiple messages to determine whether the signal content has been tampered with or lost. If the signal content has been tampered with or lost, the receiver will immediately perform fault-safe processing.

[0094] It should be understood that the third flag bit mentioned above is used to indicate whether to verify multiple messages. Specifically, the third flag bit is used to indicate that multiple messages are verified, that is, to verify each signal in each message of the multiple messages; or, the third flag bit is used to indicate that multiple messages are not verified, that is, to not verify each signal in the multiple messages.

[0095] It should be understood that the above scheme describes a process where, after determining that multiple messages (i.e., all messages sent by the target electronic control unit (ECU node)) need to be verified (i.e., analyzing node-level verification requirements), it is then determined individually whether to verify each message at the next lower level (e.g., the first message). After determining that each message (specifically, each signal within the message) needs to be verified (i.e., analyzing message-level verification requirements), at least one first signal participating in the verification, and the remaining signals not participating in the verification, are determined (i.e., analyzing signal-level verification requirements). In other words, verification requirements are analyzed layer by layer down. After determining that multiple messages need to be verified, it is allowed that individual messages do not participate in the verification process; after determining that a certain message needs to be verified, it is allowed that individual signals do not participate in the verification process.

[0096] The node-level verification process described above uses the electronic control unit (ECU) as the control object. It is used to uniformly enable or disable verification for all messages sent by a single ECU node, representing the coarsest-grained verification control method, enabling overall control over the communication behavior of the entire ECU. For example, it can verify multiple messages sent by a target ECU. The message-level verification process uses a single message as the control object, used to independently enable or disable verification for a specified message. Its control granularity is finer than the node-level process, allowing for separate verification strategies to be set for different messages within the same node, without being completely restricted by the unified rules at the node level. The signal-level verification process uses a single signal within a message as the control object, used to enable or disable verification for different signals within the same message. Its control granularity is the finest, capable of meeting differentiated verification needs within the same message.

[0097] That is, in response to multiple messages sent by the target electronic control unit, before determining whether to verify the multiple messages based on the third flag bit of the multiple messages, the method 200 includes: dividing the vehicle communication verification system into levels, determining the division range of node-level verification, message-level verification and signal-level verification, with the target electronic control unit (a certain electronic control unit) as the smallest division unit, used to uniformly verify and control all messages sent by the target electronic control unit as a whole and all signals contained therein; message-level verification with a single message as the smallest division unit, used to independently enable or disable the verification function of a single message, without affecting the verification status of other messages under the same ECU node; signal-level verification with a single signal as the smallest division unit, used to set verification strategies for different signals in the same message, the three forming a multi-level verification management system.

[0098] In the above technical solution, the vehicle control unit responds to multiple messages sent by the target electronic control unit, and determines whether to perform overall verification on the group of messages based on the third flag bit of the multiple messages. This enables node-level (the level above the message level, targeting all messages sent by the target electronic control unit (a certain ECU node)) verification, improving verification efficiency in multiple message scenarios. These multiple messages include a first message, which contains multiple signals. Then, by combining the first and second flag bits, each second signal in the second message is verified, and at least one first signal in the first message is verified, while the remaining signals in the first message are not verified. That is, the above solution extends the node-level verification mechanism on the basis of the original two-level verification logic, complementing the signal-level fine-grained verification and message-level verification used in the first message, thus achieving three-level verification logic. This solution can adapt to fine-grained verification and batch verification modes based on the functional attributes and security levels of different messages, avoiding the problem that a single verification strategy cannot balance flexibility and efficiency. In other words, by using a three-level (node-level, message-level, and signal-level) verification logic corresponding to three layers of flags for collaborative judgment, the verification requirements of different messages and first signals can be accurately matched. This enables multi-dimensional verification management of ECU nodes (multiple messages), single messages, and multiple signals, improving the rationality and efficiency of monitoring communication integrity.

[0099] In some embodiments, the plurality of messages are messages sent by the target electronic control unit through a fourth communication channel. Before determining whether to verify the plurality of messages based on a third flag bit of the plurality of messages, the method 200 further includes: determining whether a fourth flag bit is received when receiving the plurality of messages, the fourth flag bit being used to indicate verification of all messages transmitted through the fourth communication channel; and determining whether to verify the plurality of messages based on the third flag bit of the plurality of messages, including: if it is determined that a fourth flag bit has been received, determining whether to verify the plurality of messages based on the third flag bit of the plurality of messages.

[0100] It should be understood that the above-mentioned messages include more than just the aforementioned messages. The fourth flag bit can be regarded as the flag bit corresponding to the channel-level check. When the fourth flag bit is specifically the seventh value, it indicates that the check is performed on all messages transmitted through the corresponding fourth communication channel.

[0101] In some embodiments, the method 200 further includes: if it is determined that a fourth flag bit has not been received, not performing the step of determining whether to verify the plurality of messages based on the third flag bit of the plurality of messages. This means that if the fourth flag bit (i.e., not the seventh value) is not received, all messages and signals transmitted on the corresponding communication channel will not be included in the verification.

[0102] In some embodiments, the method 200 further includes: if it is determined that verification of the plurality of messages is prohibited, determining that verification of each second signal in the second message is prohibited, and determining that verification of each first signal in the first message is prohibited.

[0103] In one possible implementation, after verifying each of the second signals in the second message, the method 200 further includes: determining whether the second message has experienced a first fault, the first fault indicating that the second message is lost or has timed out or that the second signals in the second message are invalid; and in the case that the second message has experienced the first fault, determining that each of the second signals in the second message will not be verified within a first preset time period.

[0104] It should be understood that in the above scheme, the first fault can be regarded as a communication loss fault. Optionally, the first preset duration is 100 milliseconds. The first preset duration can be set to 100 milliseconds because it conforms to the conventional message cycle and fault debouncing rules in actual communication. It can avoid repeated verification caused by transient anomalies such as instantaneous interference and bus jitter, and will not miss real faults due to excessively long pause times. This first preset duration can achieve a balance between the stability of the vehicle system and the real-time nature of fault detection, adapts to the processing capabilities of the vehicle control unit, and is a reasonable and universal duration setting in verification scenarios.

[0105] In the above technical solution, after verifying each second signal in the second message, fault judgment and verification pause logic are added. Specifically, it determines whether the second message has experienced a first fault, which can promptly identify abnormal message states in vehicle communication. When the second message experiences a first fault, the verification of each second signal in the second message is paused for a first preset time period. This avoids automatically stopping redundant verification actions when the second message remains abnormal, preventing invalid calculations from consuming computing resources. At the same time, it avoids error accumulation or misjudgment caused by repeated verification of abnormal messages, improving the stability and rationality of the verification process.

[0106] In some embodiments, the method 200 further includes: in the event of the first fault in the second message, determining that a portion of the second signal in the second message will not be verified for a first preset duration, wherein the verification priority of the portion of the second signal is lower than that of another portion of the second signal, and the second message includes the portion of the second signal and the other portion of the second signal.

[0107] In one possible implementation, after determining whether the second message has experienced a first fault, the method 200 further includes: if the second message has experienced the first fault, determining a target fault code matching the first fault from a verification survey table, the verification survey table defining debouncing parameters corresponding to each fault code, the debouncing parameters being timer parameters used to prevent erroneous output of fault codes; obtaining the target debouncing parameter corresponding to the target fault code from the verification survey table; if the actual timer parameter corresponding to the second message experiencing the first fault exceeds the debouncing parameter, determining that each second signal in the second message will not be verified within a first preset duration.

[0108] It should be understood that the above verification checklist also includes the correspondence between the fault codes corresponding to each second message failure and the debouncing parameters corresponding to the fault codes. Optionally, the timer parameter is a preset number of occurrences or a second preset duration, where the preset number of occurrences is the number of consecutive fault occurrences and the second preset duration is the total duration of consecutive fault occurrences.

[0109] In the above technical solution, after determining that the second message has a first fault, a target fault code matching the first fault is determined from the verification survey table. This allows for rapid fault type identification. Furthermore, the target debouncing parameters corresponding to the target fault code are obtained from the verification survey table. This allows for the configuration of specific anti-false alarm judgment conditions for different fault types, improving the accuracy of fault identification. The actual timer parameters are compared with the target debouncing parameters, and the verification pause operation is only performed when the actual time exceeds a set threshold. This effectively filters out false faults caused by transient interference and avoids erroneous verification pauses due to abnormal fluctuations. Therefore, this solution improves the reliability and stability of fault judgment, reduces functional abnormalities caused by false triggers, and optimizes the execution logic of the vehicle control unit.

[0110] Optionally, the fault code is represented by a target format, which is DFC_Fault Type_Name of the faulty signal / message / ECU node.

[0111] In some embodiments, the second message is a message sent by the target electronic control unit through a second communication channel. The method 200 further includes: in the case that the first fault occurs in the second message, determining whether the vehicle control unit receives a third message, the third message being the second message sent by the target electronic control unit through a third communication channel; in the case that the third message is to be verified, determining whether the third message has the first fault; in the case that the first fault occurs in the third message, determining that each of the second signals in the second message will not be verified within a first preset time period; and obtaining the target debouncing parameter corresponding to the target fault code from the verification survey table, including: in the case that the first fault does not occur in the third message, obtaining the target debouncing parameter corresponding to the target fault code from the verification survey table.

[0112] It should be understood that the above scheme describes a process of verifying the same message on other communication channels after a failure occurs in a message on a certain communication channel. If the verification results across multiple communication channels are consistent, the message is confirmed to have truly failed. After the verification process on other communication channels indicates that the message has not failed, a debouncing mechanism is used to further determine whether the misjudgment is due to channel interference.

[0113] Figure 4 This is a schematic diagram of the structure of a device for verifying signals provided in an embodiment of this application.

[0114] For example, the device is installed in the vehicle control unit, such as... Figure 4 As shown, the device 400 includes: Determine module 401, used for: In response to a first message sent by the target electronic control unit, a determination is made based on a first flag bit in the first message to determine whether to verify the first message, wherein the first flag bit is used to indicate whether to verify the first message; If it is determined that the first message needs to be verified, at least one first signal to be verified is determined from a plurality of first signals based on the second flag bit of each first signal in the first message. The second flag bit is used to indicate whether to verify the corresponding first signal. The first signal is a data unit carried in the first message. The verification module 402 is used to verify the at least one first signal.

[0115] Optionally, the determining module 401 is further configured to: in response to multiple messages sent by the target electronic control unit, determine whether to verify the multiple messages based on a third flag bit of the multiple messages, the third flag bit being used to indicate whether to verify the multiple messages, the multiple messages including the first message; the verification module is further configured to verify each second signal in a second message when it is determined that the multiple messages should be verified, the second message being a message other than the first message among the multiple messages.

[0116] Optionally, after verifying each of the second signals in the second message, the determining module 401 is further configured to: determine whether the second message has experienced a first fault, the first fault being used to indicate that the second message is lost or has timed out or that the second signals in the second message are invalid; and in the case that the second message has experienced the first fault, determine that each of the second signals in the second message will not be verified within a first preset time period.

[0117] Optionally, after determining whether the second message has experienced a first fault, the determining module 401 is further configured to: in the case that the second message has experienced the first fault, determine a target fault code matching the first fault from a verification survey table, the verification survey table being used to define debouncing parameters corresponding to each fault code, the debouncing parameters being timer parameters used to prevent erroneous output of fault codes; obtain the target debouncing parameter corresponding to the target fault code from the verification survey table; and in the case that the actual timer parameter corresponding to the second message experiencing the first fault exceeds the debouncing parameter, determine that each of the second signals in the second message will not be verified within a first preset duration.

[0118] Optionally, before determining at least one first signal to be verified from a plurality of first signals based on the second flag bits of each first signal in the first message, the determining module 401 is further configured to determine whether the second flag bits of each first signal are empty; if the second flag bits of each first signal are not empty, the at least one first signal is determined from a plurality of first signals based on the second flag bits of each first signal in the first message.

[0119] Optionally, the device 400 further includes: an acquisition module, configured to acquire a default flag bit of the first signal when the second flag bit of the first signal is empty for any of the plurality of first signals; the determination module 401 is further configured to determine whether the first signal belongs to the at least one first signal based on the default flag bit.

[0120] Optionally, before verifying the at least one first signal, the acquisition module is further configured to acquire the enabling condition of the at least one first signal, the enabling condition being a triggering condition for verifying the at least one first signal; and the verification module 402 is further configured to verify the at least one first signal when the vehicle meets the enabling condition.

[0121] Optionally, the first message is a message sent by the target electronic control unit through the first communication channel. The acquisition module is specifically used to determine the target communication channel that matches the first communication channel from the verification survey table. The verification survey table is also used to define the enabling conditions of the first signal transmitted on the corresponding communication channel. The determining module 401 is specifically used to: determine the target first signal that matches the at least one first signal one by one from the multiple first signals corresponding to the target communication channel in the verification survey table; and determine the enabling condition corresponding to the target first signal as the enabling condition of the at least one first signal.

[0122] Figure 5 This is a schematic diagram of the structure of a controller provided in an embodiment of this application.

[0123] For example, such as Figure 5 As shown, the controller 500 includes a storage module 501 and a processing module 502. The storage module 501 stores executable program code 503, and the processing module 502 is used to call and execute the executable program code 503 to perform a method for verifying a signal.

[0124] Figure 6 This is a schematic diagram of the structure of a vehicle provided in an embodiment of this application.

[0125] For example, such as Figure 6 As shown, the vehicle 600 includes a memory 601 and a processor 602. The memory 601 stores executable program code 603, and the processor 602 is used to call and execute the executable program code 603 to perform a method for verifying a signal.

[0126] Furthermore, embodiments of this application also protect an apparatus that may include a memory and a processor, wherein the memory stores executable program code, and the processor is used to call and execute the executable program code to perform a method for verifying a signal provided in embodiments of this application.

[0127] This embodiment can divide the device into functional modules based on the above method example. For example, each module can correspond to a separate function, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware. It should be noted that the module division in this embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods.

[0128] When each functional module is divided according to its corresponding function, the device may further include a determination module, an acquisition module, and a verification module. It should be noted that all relevant content in the above method embodiments can be referenced in the functional descriptions of the corresponding functional modules, and will not be repeated here.

[0129] It should be understood that the apparatus provided in this embodiment is used to perform the above-described method for verifying a signal, and therefore can achieve the same effect as the above-described implementation method.

[0130] When using an integrated unit, the device may include a processing module and a storage module. When the device is applied to a vehicle, the processing module can be used to control and manage the vehicle's movements. The storage module can be used to support the vehicle in executing relevant executable program code.

[0131] The processing module may be a processor or a controller, which can implement or execute various exemplary logic blocks, modules, and circuits shown in conjunction with the disclosure of this application. The processor may also be a combination of functions that implement computing capabilities, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, etc., and the storage module may be a memory.

[0132] In addition, the apparatus provided in the embodiments of this application may specifically be a chip, component or module. The chip may include a connected processor and a memory. The memory is used to store instructions. When the processor calls and executes the instructions, the chip can execute a method for verifying signals provided in the above embodiments.

[0133] This embodiment also provides a computer-readable storage medium storing executable program code. When the executable program code is run on a computer, it causes the computer to perform the above-described related method steps to implement a method for verifying a signal provided in the above embodiment.

[0134] This embodiment also provides a computer program product that, when run on a computer, causes the computer to perform the aforementioned related steps to implement a method for verifying signals provided in the above embodiment.

[0135] In this embodiment, the device, computer-readable storage medium, computer program product, or chip are all used to execute the corresponding methods provided above. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods provided above, and will not be repeated here.

[0136] Through the above description of the embodiments, those skilled in the art will understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0137] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0138] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for verifying a signal, characterized in that, The method is executed by the vehicle control unit, and the method includes: In response to a first message sent by the target electronic control unit, a determination is made based on a first flag bit in the first message to determine whether to verify the first message, wherein the first flag bit is used to indicate whether to verify the first message; When it is determined that the first message needs to be verified, at least one first signal to participate in the verification is determined from multiple first signals based on the second flag bit of each first signal in the first message. The second flag bit is used to indicate whether to verify the corresponding first signal. The first signal is a data unit carried in the first message. The at least one first signal is verified.

2. The method according to claim 1, characterized in that, The method further includes: In response to multiple messages sent by the target electronic control unit, based on a third flag bit of the multiple messages, it is determined whether to verify the multiple messages, wherein the third flag bit is used to indicate whether to verify the multiple messages, and the multiple messages include the first message; If it is determined that the plurality of messages are to be verified, each of the second signals in the second message is verified, wherein the second message is a message other than the first message among the plurality of messages.

3. The method according to claim 2, characterized in that, After verifying each of the second signals in the second message, the method further includes: Determine whether the second message has experienced a first fault, wherein the first fault is used to indicate that the second message is lost or has timed out or that the second signal in the second message is invalid; In the event of the first fault occurring in the second message, it is determined that no verification of each second signal in the second message will be performed within a first preset time period.

4. The method according to claim 3, characterized in that, After determining whether the second message has experienced a first fault, the method further includes: In the event of the first fault occurring in the second message, a target fault code matching the first fault is determined from a verification survey table. The verification survey table is used to define debouncing parameters corresponding to each fault code. The debouncing parameters are timer parameters used to prevent erroneous output of fault codes. Obtain the target debouncing parameters corresponding to the target fault code from the verification survey table; If the actual timer parameter corresponding to the first fault in the second message exceeds the debouncing parameter, it is determined that no verification of each second signal in the second message will be performed within a first preset duration.

5. The method according to claim 1, characterized in that, Before determining at least one first signal participating in the verification from a plurality of first signals based on the second flag bits of each first signal in the first message, the method further includes: Determine whether the second flag bit of each first signal is empty; If the second flag bit of each first signal is not empty, the at least one first signal is determined from the plurality of first signals based on the second flag bit of each first signal in the first message.

6. The method according to claim 5, characterized in that, The method further includes: For any one of the plurality of first signals, if the second flag bit of the first signal is empty, the default flag bit of the first signal is obtained; Based on the default flag bit, determine whether the first signal belongs to the at least one first signal.

7. The method according to claim 1, characterized in that, Before verifying the at least one first signal, the method further includes: Obtain the enable condition of the at least one first signal, wherein the enable condition is a trigger condition for verifying the at least one first signal; If the vehicle meets the enabling conditions, the at least one first signal is verified.

8. The method according to claim 7, characterized in that, The first message is a message sent by the target electronic control unit through a first communication channel, and the enabling condition for acquiring the at least one first signal includes: The target communication channel that matches the first communication channel is determined from the verification survey table, and the verification survey table is also used to define the enable conditions of the first signal transmitted on the corresponding communication channel. From the plurality of first signals corresponding to the target communication channel in the verification survey table, determine the target first signal that matches the at least one first signal one by one; The enabling condition corresponding to the target first signal is determined as the enabling condition of the at least one first signal.

9. A controller, characterized in that, The controller includes: The storage module is used to store executable program code; A processing module is configured to call and run the executable program code from the storage module, causing the controller to perform the method as described in any one of claims 1 to 8.

10. A vehicle, characterized in that, The vehicles include: Memory, used to store executable program code; A processor for calling and running the executable program code from the memory, causing the vehicle to perform the method as described in any one of claims 1 to 8.

Images