Air suspension height, damping and stiffness collaborative control method and system

Abstract

This invention discloses a method and system for coordinated control of air suspension height, damping, and stiffness, belonging to the field of vehicle chassis control. To address the problems of actuators such as valves, pumps, and damping valves still being erroneously driven and lacking hardware-level isolation when the main controller experiences software overrun or output anomalies, and the unreliability of arbitration authorization and switching under redundant architecture, which easily leads to sudden changes in control quantities, this invention achieves the following: the main controller and backup controller perform parallel computation; the main safety core unit and backup safety core unit arbitrate authorization tokens and ownership handshakes based on health information and instruction consistency verification; outputs independent group enable and group selection signals according to actuator channel groups; and a hardware-gated isolation multiplexer implements fail-safe output and smooth switching timing for disable holding, selection switching, enable recovery, and ramp limiting. This achieves the technical effects of reliable isolation and disconnection during faults, avoiding contention and erroneous switching, and improving switching smoothness.

Description

Technical Field

[0001] This invention relates to the field of vehicle chassis control, and more particularly to a method and system for the coordinated control of air suspension height, damping and stiffness. Background Technology

[0002] Closed-loop air suspension systems adjust vehicle height through components such as air springs, air tanks, compressors, and intake and exhaust valves. They utilize closed-loop control, incorporating pressure, vehicle height, vehicle acceleration, and vehicle operating signals to improve vehicle passability, comfort, and handling stability. In recent years, to achieve higher overall performance, air suspension control has evolved from single-objective height control to multi-objective coordinated control of height, damping, and stiffness. For damping, continuously variable damping valves are commonly used, adjusted via duty cycle or current. For stiffness, different stiffness levels can be achieved through switching the effective volume of the air springs, connecting valve control, or pressure strategies. Correspondingly, the control architecture has evolved from distributed control to integrating multiple control functions onto a single control platform. Furthermore, with increasing functional safety requirements, dual-controller redundancy and safety monitoring mechanisms have been introduced.

[0003] However, existing technologies still have the following shortcomings, affecting the achievement of fail-safety and smoothness of coordinated control in closed air suspension systems:

[0004] 1. When control functions such as height, damping, and stiffness are integrated into the same controller, the actuator may be continuously or incorrectly driven when the main controller experiences software malfunction, task abnormality, or output abnormality. There is a lack of a reliable hardware-level isolation or cut-off mechanism for the outputs of valves, pumps, and damping valves.

[0005] 2. In a dual-controller redundant architecture, parallel computing between the primary and backup controllers can easily lead to output arbitration and switching issues. The lack of a secure arbitration and output authorization mechanism to reliably determine the health status of the primary and backup controllers, the running status of critical tasks, and output consistency may result in contention, incorrect switching, or untimely switching.

[0006] 3. When completing the primary / backup switchover, if there is a lack of timing control that first enters fail-safe mode before switching and then authorizing, as well as smooth takeover strategies such as maintaining window and ramp limit, it is easy to cause sudden changes in height, damping and stiffness control values, resulting in body posture impact and reducing comfort and handling performance.

[0007] Therefore, there is a need for a dual-controller redundant closed air suspension height, damping and stiffness coordinated control method and system that can overcome the shortcomings of the existing technology. Summary of the Invention

[0008] One objective of this invention is to propose a method for the coordinated control of air suspension height, damping, and stiffness. This addresses the shortcomings of existing technologies that integrate height, damping, and stiffness control functions onto a single control platform. These technologies address the issue that when the main controller experiences software malfunctions, task errors, or output anomalies, the actuators may still be erroneously driven, and there is a lack of hardware-level isolation and disconnection mechanisms. Furthermore, the dual-controller redundant architecture lacks a reliable arbitration and authorization mechanism to determine the health status of the main and backup controllers, the operational status of critical tasks, and output consistency, which can easily lead to incorrect switching, contention, and untimely switching. Additionally, the switching process lacks a timing control mechanism that prioritizes failure safety before switching and re-authorization. To address the issue of abrupt changes in control quantities caused by control and smooth takeover strategies, this invention proposes a method where the main controller and backup controller perform parallel computation of height control, damping control, and stiffness control to generate main and backup control instruction sets. The main and backup safety core units generate health information and perform instruction consistency verification. Combined with authorization tokens and ownership handshakes, independent group enable and group selection signals are generated for each actuator channel group. A hardware gating isolation unit then implements output gating isolation and routing. During main / backup switching, a smooth switching sequence is executed for the corresponding channel groups, including disable holding, selection switching, enable recovery, and ramp limiting. This invention offers the technical advantages of hardware-level output cutoff and failure-safe state during faults, non-contention between main and backup authorizations and controllable switching, and smooth and safe maintenance of height, damping, and stiffness collaborative control under redundant switching.

[0009] This invention provides a method for coordinated control of air suspension height, damping, and stiffness, comprising:

[0010] S1. Collect suspension sensor signals and vehicle operation signals to form vehicle status data;

[0011] S2. Input the vehicle status data into the main controller and the backup controller respectively, and calculate the height control, damping control and stiffness control in parallel to obtain the main control instruction set and the backup control instruction set, which both include control instructions corresponding to the height actuator channel group, damping actuator channel group and stiffness actuator channel group respectively.

[0012] S3. The main safety core unit generates main health information, and the backup safety core unit generates backup health information. Based on the arbitration basis including the main health information, backup health information, and the consistency verification results of the main control instruction set and the backup control instruction set, an arbitration authorization result is generated, including group enable signals and group selection signals corresponding to each actuator channel group, which are independent of each other.

[0013] S4. The hardware gating isolation unit performs gating isolation on each actuator channel group according to the group enable signal and the group selection signal, and selects the output between the main control instruction set and the backup control instruction set. When the group enable signal is disabled, the corresponding actuator channel group enters the preset fail-safe output state. When the group enable signal is enabled, the corresponding control instruction in the main control instruction set or the backup control instruction set is output according to the group selection signal.

[0014] S5. When the group selection signal of any actuator channel group is switched from selecting the main controller to selecting the backup controller, a smooth switching sequence is executed for the actuator channel group, including the sequential execution of the disable holding stage, the selection signal switching stage, the enable recovery stage, and the ramp limiting stage, so that the output of the actuator channel group smoothly transitions to the corresponding control command in the backup control command set.

[0015] Optionally, S1 includes:

[0016] The system collects signals from the vehicle height sensor, air spring pressure sensor, vehicle acceleration sensor, and vehicle operation signals, including vehicle speed, steering wheel angle, and lateral acceleration.

[0017] Each of the acquired signals is filtered to obtain a filtered signal, and the filtering process includes low-pass filtering;

[0018] The validity of the filtered signal is verified to obtain the validity verification result. The validity verification includes amplitude range verification, rate of change verification and communication timeout verification.

[0019] When the validity check result indicates that the corresponding filtered signal is valid, the filtered signal is output as a valid signal. When the validity check result indicates that the corresponding filtered signal is invalid, the filtered signal is replaced with the corresponding valid signal at the previous moment or an estimated signal estimated from other valid signals.

[0020] Vehicle status data is calculated based on each valid signal. The vehicle status data includes vehicle height, vehicle height change rate, and vehicle operating status parameters.

[0021] Optionally, S2 includes:

[0022] Within the same control cycle, vehicle status data is input to the main controller and the backup controller respectively;

[0023] The main controller performs height control calculations based on the vehicle status data to generate the height control instructions. The height control instructions include pump control instructions and valve control instructions for height adjustment. The height control calculations include determining the height adjustment amount based on the deviation between the vehicle height and the target vehicle height, and generating the pump control instructions and valve control instructions after limiting the amplitude and rate of change of the height adjustment amount.

[0024] The main controller performs damping control calculations based on the vehicle state data to generate the damping control command. The damping control command is a drive duty cycle command of a continuously variable damping valve. The damping control calculation includes determining the target damping level based on the vehicle body acceleration and vehicle operating state parameters, and converting the target damping level into the drive duty cycle command through a mapping relationship.

[0025] The main controller performs stiffness control calculations based on the vehicle state data to generate stiffness control commands. The stiffness control commands include valve control commands for stiffness adjustment. The stiffness control calculations include determining a target stiffness level based on lateral acceleration signals and steering wheel angle signals, and converting the target stiffness level into the valve control commands.

[0026] The backup controller uses the same input data, control cycle, and mapping relationship as the main controller to perform height control calculation, damping control calculation, and stiffness control calculation in parallel, generating a backup control instruction set corresponding to the main control instruction set.

[0027] The height control command, the damping control command, and the stiffness control command are respectively encapsulated into the main control command set and the backup control command set.

[0028] Optionally, S3 includes:

[0029] Within each arbitration cycle, the primary security core unit monitors the operating status of the primary controller to generate primary health information, and the backup security core unit monitors the operating status of the backup controller and generates backup health information. The operating status includes control task cycle status, watchdog status, memory self-test status, power status, and communication status. The primary security core unit generates a primary authorization token based on the primary health information, and the backup security core unit generates a backup authorization token based on the backup health information. Both the primary and backup authorization tokens include a controller identifier, a sequence count value, and a cyclic redundancy check value. The primary and backup security core units exchange the primary and backup authorization tokens through a secure communication interface, and verify the received authorization tokens based on the sequence count value and the cyclic redundancy check value. Verification is performed to obtain the authorization token verification result. The main security core unit and the backup security core unit perform consistency verification based on the main control instruction set and the backup control instruction set to obtain the consistency verification result. This includes calculating the corresponding differences for the height control instruction, damping control instruction, and stiffness control instruction in the main control instruction set and the backup control instruction set, and comparing them with the corresponding tolerance thresholds. When any difference exceeds the corresponding tolerance threshold, the inconsistency count value is updated. When the inconsistency count value reaches the inconsistency determination threshold, the consistency verification result is determined to be inconsistent. The main security core unit and the backup security core unit perform ownership handshake based on the authorization token verification result to ensure that only one controller is authorized as the output source of the same actuator channel group within the same arbitration cycle.

[0030] When the ownership handshake fails or a conflicting authorization is detected for the same actuator channel group, the group enable signal corresponding to that actuator channel group is determined to be disabled. The main security core unit and the backup security core unit generate the arbitration authorization result based on the authorization token verification result, the main health information, the backup health information, the consistency verification result, and the ownership handshake result. When the authorization token verification result is passed, the main health information indicates that the main controller is normal, the consistency verification result is consistent, and the ownership handshake result indicates that the main controller has ownership of the corresponding actuator channel group, the arbitration authorization result is generated such that the group enable signals corresponding to the height actuator channel group, the damping actuator channel group, and the stiffness actuator channel group are all enabled, and the group selection signals all select the main controller.

[0031] When the main health information indicates that the main controller is abnormal, or the consistency verification result is inconsistent, or the ownership handshake result indicates that the standby controller owns at least one actuator channel group, the arbitration authorization result is generated such that the group enable signal corresponding to the damping actuator channel group is enabled and the group selection signal selects the standby controller, and the arbitration authorization result is generated such that the group enable signal corresponding to the unauthorized actuator channel group is prohibited.

[0032] Furthermore, the primary security core unit and the backup security core unit independently generate candidate arbitration authorization results based on the same arbitration criteria, and exchange the candidate arbitration authorization results through the security communication interface. When the candidate arbitration authorization results are inconsistent on any actuator channel group, the group enable signal corresponding to that actuator channel group is determined to be disabled.

[0033] Furthermore, the arbitration basis also includes the instruction and readback consistency determination result. The instruction and readback consistency determination result includes matching and verifying at least one control instruction in the main control instruction set and the backup control instruction set with the corresponding actuator readback signal. When the matching and verification fails and the duration reaches the preset determination time, the group enable signal of the corresponding actuator channel group is determined to be prohibited.

[0034] Optionally, S4 includes:

[0035] The hardware gated isolation unit is a multiplexer; it obtains the arbitration authorization result and parses the arbitration authorization result into the height group enable signal and height group selection signal corresponding to the height actuator channel group, the damping group enable signal and damping group selection signal corresponding to the damping actuator channel group, and the stiffness group enable signal and stiffness group selection signal corresponding to the stiffness actuator channel group.

[0036] The height group enable signal, height group selection signal, damping group enable signal, damping group selection signal, stiffness group enable signal, and stiffness group selection signal are respectively input to the multiplexer; when the group enable signal corresponding to any actuator channel group is disabled, the multiplexer is controlled to put the actuator channel group into a fail-safe output state. The fail-safe output state is to cut off the output of the actuator channel group or to output a safety hold output to the actuator channel group. The safety hold output is a preset safety output or the most recent valid output; when the group enable signal corresponding to any actuator channel group is enabled and the actuator channel group... When the corresponding group selection signal selects the main controller, the multiplexer is controlled to output the control command corresponding to the actuator channel group from the main control command set to the actuator channel group; when the group enable signal corresponding to any actuator channel group is enabled and the group selection signal corresponding to the actuator channel group selects the backup controller, the multiplexer is controlled to output the control command corresponding to the actuator channel group from the backup control command set to the actuator channel group; based on the output of the multiplexer to the height actuator channel group, the damping actuator channel group, and the stiffness actuator channel group, a gated actuator command set is formed;

[0037] Furthermore, the group enable signal of the multiplexer requires the fulfillment of a periodic enable pulse condition. The periodic enable pulse is output by at least one of the main safety core unit and the backup safety core unit. When the periodic enable pulse is missing within a preset timeout period, the multiplexer forces the corresponding actuator channel group to enter the fail-safe output state.

[0038] Optionally, S5 includes:

[0039] The gated actuator instruction set and arbitration authorization result are obtained. When the arbitration authorization result indicates that the group selection signal of the damping actuator channel group changes from selecting the main controller to selecting the backup controller, a hierarchical takeover is triggered to switch from the main controller to the backup controller. In the hierarchical takeover, a smooth switching sequence is executed for each actuator channel group in the order of the damping actuator channel group, the stiffness actuator channel group, and the height actuator channel group. The smooth switching sequence for the current actuator channel group includes: recording the output value corresponding to the gated actuator instruction set before the actuator channel group enters the fail-safe output state as the hold output value.

[0040] The group enable signal corresponding to the actuator channel group is controlled to be disabled and maintained for a preset holding time, so that the hardware gating isolation unit outputs the holding output value or the preset safety output to the actuator channel group during the holding time;

[0041] After the holding time ends, the group selection signal corresponding to the actuator channel group is switched to select the backup controller, and the group enable signal corresponding to the actuator channel group is controlled to be enabled, so that the hardware gating isolation unit outputs the target output value corresponding to the backup control instruction set to the actuator channel group;

[0042] A ramp limit is applied to the output of the actuator channel group during a continuous control cycle, so that the output of the actuator channel group approaches the target output value cycle by cycle from the maintained output value in a manner that does not exceed the preset maximum rate of change, until the output of the actuator channel group reaches the target output value;

[0043] After completing the ramp limit of the current actuator channel group, the output of the actuator channel group is used as the input condition for the smooth switching timing of the next actuator channel group and the smooth switching timing of the next actuator channel group is entered to obtain the final actuator instruction set.

[0044] On the other hand, the present invention also provides a dual-controller redundant closed air suspension height, damping and stiffness coordinated control system, comprising:

[0045] The acquisition unit is used to collect suspension sensor signals and vehicle operation signals to form vehicle status data;

[0046] The main controller and the backup controller are used to receive the vehicle status data and perform parallel calculations of height control, damping control and stiffness control to obtain the main control instruction set and the backup control instruction set, and each includes control instructions corresponding to the height actuator channel group, damping actuator channel group and stiffness actuator channel group respectively.

[0047] The primary security core unit and the backup security core unit are used to generate primary health information and backup health information, and generate arbitration authorization results based on the arbitration basis including the primary health information, the backup health information, and the consistency verification results of the primary control instruction set and the backup control instruction set;

[0048] The hardware gating isolation unit is used to gating and isolating each actuator channel group according to the group enable signal and the group selection signal, and to select the output between the main control instruction set and the backup control instruction set. When the group enable signal is disabled, the corresponding actuator channel group enters a preset fail-safe output state. When the group enable signal is enabled, the corresponding control instruction in the main control instruction set or the backup control instruction set is output according to the group selection signal. When the group selection signal of any actuator channel group switches from selecting the main controller to selecting the backup controller, a smooth switching sequence is executed according to the disable holding phase, the selection signal switching phase, the enable recovery phase, and the ramp limit phase, so that the output of the actuator channel group smoothly transitions to the corresponding control instruction in the backup control instruction set.

[0049] The beneficial effects of this invention are:

[0050] 1. The main safety core unit and the backup safety core unit arbitrate and authorize based on health information, instruction consistency verification, authorization tokens and ownership handshake. The hardware gating isolation unit implements gating isolation for the outputs of valves, pumps and damping valves. When abnormal or conflicting authorization is detected, the corresponding actuator channel group can be forced into the fail-safe output state. This realizes hardware-level cutoff and fail-safe for the output channel, avoiding the risk of erroneous drive caused by the main controller running away or output abnormality.

[0051] 2. The arbitration authorization result adopts independent group enable signals and group selection signals for each actuator channel group, and supports output consistency determination and conflict handling under master-slave parallel computing. This ensures that only one controller is allowed to obtain output source authorization in the same actuator channel group within the same arbitration cycle, reducing the risks of contention, incorrect switching and untimely switching under the dual-controller redundancy architecture, and improving the reliability and feasibility of redundant control.

[0052] 3. During the switchover between primary and backup, the target actuator channel group is subjected to a smooth switching sequence of disable hold, select switch, enable recovery, and ramp limit. It can also implement graded takeover according to the priority of damping, stiffness, and height, so that the output gradually approaches the target value from the hold value, suppressing sudden changes in height, damping, and stiffness control, thereby reducing vehicle body attitude impact and taking into account both handling stability and comfort. Attached Figure Description

[0053] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0054] Figure 1 This is a flowchart of a method for coordinated control of air suspension height, damping, and stiffness proposed in this invention;

[0055] Figure 2 This is a flowchart of the smooth switching timing in step S5 of the present invention. Detailed Implementation

[0056] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0057] refer to Figure 1 A method for coordinated control of air suspension height, damping, and stiffness, comprising:

[0058] S1. Collect suspension sensor signals and vehicle operation signals to form vehicle status data;

[0059] S2. Input the vehicle status data into the main controller and the backup controller respectively, and calculate the height control, damping control and stiffness control in parallel to obtain the main control instruction set and the backup control instruction set, which both include control instructions corresponding to the height actuator channel group, damping actuator channel group and stiffness actuator channel group respectively.

[0060] S3. The main safety core unit generates main health information, and the backup safety core unit generates backup health information. Based on the arbitration basis including the main health information, backup health information, and the consistency verification results of the main control instruction set and the backup control instruction set, an arbitration authorization result is generated, including group enable signals and group selection signals corresponding to each actuator channel group, which are independent of each other.

[0061] S4. The hardware gating isolation unit performs gating isolation on each actuator channel group according to the group enable signal and the group selection signal, and selects the output between the main control instruction set and the backup control instruction set. When the group enable signal is disabled, the corresponding actuator channel group enters the preset fail-safe output state. When the group enable signal is enabled, the corresponding control instruction in the main control instruction set or the backup control instruction set is output according to the group selection signal.

[0062] S5. When the group selection signal of any actuator channel group is switched from selecting the main controller to selecting the backup controller, a smooth switching sequence is executed for the actuator channel group, including the sequential execution of the disable holding stage, the selection signal switching stage, the enable recovery stage, and the ramp limiting stage, so that the output of the actuator channel group smoothly transitions to the corresponding control command in the backup control command set.

[0063] In this specific embodiment, S1 includes:

[0064] The suspension sensor signals and vehicle operation signals are synchronously collected according to the control cycle to form vehicle status data. The suspension sensor signals include vehicle height sensor signals at each wheel position. Air spring pressure sensor signal and vehicle acceleration sensor signals Vehicle operation signals include vehicle speed signals. Steering wheel angle signal and lateral acceleration signal subscript Represents the wheel position index and the set of values ​​is All signals are based on the sampling period. The processing link is entered once every 10ms, and a communication timestamp is carried for timeout determination.

[0065] For each acquired signal, a first-order low-pass filter is first performed to suppress high-frequency noise and ensure that the inputs of the main controller and the backup controller are consistent. The filtered signal is denoted as... The original sampled value is denoted as Discrete sampling number is denoted as The filter coefficients are denoted as And take The filter is updated periodically according to the following rules and will be updated periodically. The filtered output at time step is stored as a state variable in the buffer:

[0066] ;

[0067] After filtering, a validity check is performed on each filtered signal, and the validity check result is output. The validity check consists of amplitude range check, rate of change check, and communication timeout check. Specifically, the amplitude range of the vehicle height signal is limited to 0mm to 200mm, and the rate of change is limited to no more than 500mm per second; the amplitude range of the air spring pressure signal is limited to 0kPa to 2000kPa, and the rate of change is limited to no more than 200kPa per second; the amplitude range of the vehicle acceleration signal is limited to... to And the rate of change is limited to no more than 100% per second. The amplitude range of the vehicle speed signal is limited to to And the rate of change is limited to no more than 100% per second. The amplitude range of the steering wheel angle signal is limited to: to And the rate of change is limited to no more than 100% per second. The amplitude range of the lateral acceleration signal is limited to to And the rate of change is limited to no more than 100% per second. The communication timeout check is determined by the difference between the current processing time and the latest timestamp of the signal, and the timeout threshold is 50ms. If any check fails, the signal is determined to be invalid.

[0068] When the validity check result indicates that a certain filtered signal is valid, the filtered signal is written into the valid signal buffer as the valid signal for that channel and output externally. When the validity check result indicates that the filtered signal is invalid, the filtered signal is replaced with the corresponding valid signal buffer value from the previous moment and output externally. Furthermore, if the buffer has not yet been formed during the first control cycle after the system is powered on, the vehicle height signal is estimated and replaced by the air spring pressure signal, and a linear estimation model is established for each wheel position. The model parameters are taken from the reference pressure. The reference height corresponding to 600 kPa The value is 120mm, and the relative pressure is specified. For every 100 kPa increase, the relative height... The height increases by 12mm, and for every 100kPa decrease in pressure, the height is relatively... Reduce by 12mm, and at the same time, when the vehicle acceleration signal, vehicle speed signal, steering wheel angle signal and lateral acceleration signal are not buffered, use 0 as the initial replacement value to ensure output determinism;

[0069] Vehicle status data is calculated based on each valid signal and output to the main controller and backup controller, including vehicle height. The arithmetic mean of the valid vehicle height signals at the four wheel positions is used to calculate the vehicle height change rate. The difference in vehicle height between two adjacent control cycles divided by the sampling cycle The vehicle operating status parameters are obtained from the vehicle speed. Steering wheel angle With lateral acceleration Directly constitute and and It is encapsulated together as vehicle status data.

[0070] In this specific embodiment, S2 includes:

[0071] In Same sampling period Internal execution and Take 10ms, and simultaneously send vehicle status data to the main controller and backup controller within the same control cycle to trigger parallel calculation. The vehicle status data includes vehicle height. Vehicle height change rate Speed Steering wheel angle lateral acceleration With vehicle acceleration And includes the air spring pressure at each wheel position. and subscript Indicates the wheel position index; the main controller sets the target vehicle height value. Used as input to calculate height deviation ,when The original value of the height adjustment amount. Set to 0mm, when When using a proportional-integral structure to generate And the proportional gain is taken Integral gain is taken The integral state is adjusted according to each cycle. Accumulate and freeze when the height adjustment reaches the amplitude limit to suppress integral saturation, then... Applying amplitude and rate of change limits yields the height adjustment amount used to generate actuator commands. The upper limit of amplitude Take 30mm as the maximum rate of change. Pick The rate of change limit and amplitude limit are implemented according to the following deterministic recursive rules to achieve the output of the previous control cycle. Store it in the cache as a state variable:

[0072] ;

[0073] in This represents the discrete control cycle number. Indicates that you will input Limit to the lower limit and upper limit Limiting operators between;

[0074] The main controller is based on Generate height control commands and break them down into pump control commands. With height valve control command ,in Indicates whether the pump is off or on. This indicates the duty cycle of the inflation valve drive and its value range is... to This indicates the duty cycle of the vent valve drive and its value range is [value range missing]. to ,when season ,when season ,when season , To maintain the current state of the high-efficiency actuator channel group;

[0075] The main controller is based on and To generate damping control commands, first calculate... and with threshold The target damping level is obtained by comparison. ,in Pick , Pick Pick Pick and in When Increase by one level but not exceeding 4, and then use a fixed mapping relationship to... Convert the drive duty cycle command to a continuously variable damping valve The mapping table is determined as , and will The data is simultaneously sent to each continuous variable damping valve channel within the damping actuator channel group to ensure consistency within the group.

[0076] The main controller is based on and To generate stiffness control commands, first calculate... and and with lateral acceleration threshold , and corner threshold The target stiffness level is obtained by comparison. , among which when and Time to take ,when or Time to take In other cases, take Then, through a fixed mapping relationship, Convert to stiffness control valve drive duty cycle command The mapping table is determined as A deterministic switching is made from large to small corresponding to the effective volume of the air spring;

[0077] The backup controller uses the same input data and control cycle as the main controller. Threshold set The mapping table is used to perform the height control calculation, damping control calculation, and stiffness control calculation in parallel to generate a backup control instruction set;

[0078] The main controller will send height control commands. Damping control commands With stiffness control commands The main control instruction set is encapsulated separately for the height actuator channel group, damping actuator channel group and stiffness actuator channel group and output to the subsequent arbitration and gating isolation processing. At the same time, the backup controller is encapsulated in the same way to form a backup control instruction set and output to the subsequent arbitration and gating isolation processing.

[0079] In this specific embodiment, S3 includes:

[0080] Arbitration cycle Execute and Within 10ms, the main security core unit and the backup security core unit monitor the operating status of the corresponding controllers in each arbitration cycle to generate health information. The operating status includes control task cycle status, watchdog status, memory self-test status, power status, and communication status. The control task cycle status is monitored by the heartbeat count reported by the controller to the security core unit, and the anomaly is determined by the loss of two consecutive heartbeats. The watchdog status uses a window watchdog and the anomaly is determined by window timeout or premature watchdog feeding. The memory self-test status performs a full self-test at power-on and performs a segmented verification of the program area every 100ms during operation, and the anomaly is determined by verification failure. The power status is determined by the power supply voltage being lower than 9V or higher than 16V. The communication status is determined by the security communication interface not receiving a valid frame from the other end within 50ms or three consecutive frame verification failures.

[0081] The main security core unit encodes the above monitoring results into main health information and generates a main authorization token accordingly. The backup security core unit encodes the above monitoring results into backup health information and generates backup authorization tokens accordingly. ,in and All include controller identifiers Sequence count value and cyclic redundancy check value Controller Identifier Fixed as and Fixed as Sequence count value A 16-bit unsigned counter that increments by 1 in each arbitration cycle and rewinds modulo 65536, with a cyclic redundancy check value. use The algorithm and the generator polynomial are Initial value The input and output are not inverted and the output is not XORed.

[0082] The primary and backup security core units exchange information via a secure communication interface. and Each received token undergoes token verification to obtain an authorization token verification result. The token verification includes... Consistency check and sequence count value The incremental verification is performed under the condition that the difference between the previous valid sequence count value stored at the receiving end and the current received sequence count value does not exceed 1 and there is no backtracking.

[0083] Within the same arbitration cycle, the primary security core unit and the backup security core unit perform consistency checks based on the primary control instruction set and the backup control instruction set, respectively, to obtain the consistency check results. The primary control instruction set includes the primary pump control instructions. Main height valve control command and Main damping control command and principal stiffness control commands The backup control instruction set includes backup pump control instructions. Altitude valve control command and Damping control commands and stiffness control commands ,in and It is a binary instruction and its value set is , and It is a duty cycle instruction and its value range is to The consistency check compares duty cycle instructions by absolute difference with tolerance thresholds and binary instructions by equality comparison:

[0084] ;

[0085] in The symbol represents the instruction difference used for consistency checks. This indicates the absolute value operation. This indicates the duty cycle instruction being verified in the main control instruction set. Indicates the presence of control command set and Same type of duty cycle instruction, and and Take in this step or one of the;

[0086] The tolerance threshold is configured according to the actuator channel group. For use in the high-speed actuator channel group and For use in the damping actuator channel group , For use in stiffness actuator channel groups When any duty cycle instruction satisfies Or binary instructions satisfy The inconsistency count value of the corresponding actuator channel group will be displayed at that time. Increment by 1 when all verified instructions in the group meet the tolerance requirements. Clear to zero, among which The actuator channel group identifier and the set of values ​​is Corresponding to the height actuator channel group, damping actuator channel group, and stiffness actuator channel group respectively, when Reaching the inconsistency determination threshold and If the value is 3, the consistency check result of this group is determined to be inconsistent.

[0087] The arbitration basis also includes the consistency determination result between the instruction and the readback. The consistency determination result is obtained by the safety core unit by matching and verifying the actuator readback signal with the control instruction before gate control. The readback signal of the height actuator channel group includes the pump current readback. Valve drive readback The readback signal of the damping actuator channel group includes the damping valve current readback. The readback signal of the stiffness actuator channel group includes the stiffness valve drive readback. The matching and validation rules are determined as follows: Time requirements And when Time requirements ,when Time requirements And when Time requirements ,when Time requirements And when Time requirements ,when Time requirements And when Time requirements ,when Time requirements And when Time requirements When any matching check fails, the readback inconsistency timer for the corresponding actuator channel group will be activated. Accumulate over the arbitration period and apply it when the match verification passes. Reset to zero, when Reaching the preset judgment time and The enable signal for this group is set to be disabled after 100ms.

[0088] The primary and backup security core units perform an ownership handshake, provided the authorization token verification is successful, to ensure that only one controller is authorized as the output source for the same actuator channel group within the same arbitration cycle. The ownership handshake is implemented using ownership declaration frames for each group, and each ownership declaration frame contains the channel group identifier. , declare owner Sequence count value Cyclic Redundancy Check Value Ownership declaration The set of values ​​is These represent the selection of the primary controller and the selection of the backup controller, respectively. The handshake determination rule determines that the primary security core unit and the backup security core unit are in the same sequence count value. The following are given for the same channel group If the frames are completely identical and both parties declare that the frame verification is successful, the handshake is considered successful; otherwise, the handshake is considered to have failed and the group enable signal corresponding to the channel group is set to disabled.

[0089] The primary security core unit and the backup security core unit independently generate candidate arbitration authorization results based on the same arbitration criteria. The candidate arbitration authorization results include a height group enable signal. With height group selection signal Damping group enable signal With damping group selection signal Stiffness group enable signal With stiffness group selection signal ,in The set of values ​​is And 0 indicates prohibition, 1 indicates permission. The set of values ​​is Furthermore, 0 indicates the selection of the primary controller, and 1 indicates the selection of the backup controller. The generation rule for the candidate arbitration authorization result is determined as follows: when the authorization token verification passes, the primary health information indicates that the primary controller is normal, the consistency verification results of each channel group are consistent, the consistency judgment results of the instructions and readbacks of each channel group are consistent, and the ownership handshake result indicates that the primary controller owns the corresponding actuator channel group, then... When the master health information indicates an abnormality in the master controller, or the consistency check result of any channel group is inconsistent, or the ownership handshake result indicates that the standby controller owns at least one actuator channel group, then... And at the same time This causes the height actuator channel group and the stiffness actuator channel group to enter a disabled state and wait for the subsequent channel group-level takeover process to resume;

[0090] The main security core unit and the backup security core unit exchange candidate arbitration authorization results through a secure communication interface and perform consistency comparison. When the candidate arbitration authorization results are inconsistent in the group selection signal or group enable signal on any actuator channel group, the final group enable signal corresponding to that actuator channel group is determined to be prohibited and this prohibited state is maintained for at least 3 arbitration cycles to avoid jitter. The final arbitration authorization result is directly determined by the consistent candidate arbitration authorization result or by the above-mentioned inconsistency handling rules.

[0091] In this specific embodiment, S4 includes:

[0092] Hardware-gated isolation unit in each arbitration cycle Internal execution and The hardware gated isolation unit adopts a multiplexer structure that is independent of each actuator channel group and is arranged in series with the actuator drive stage. This ensures that any control command from the main controller and the backup controller must pass through the hardware gated isolation unit to reach the height actuator channel group, damping actuator channel group and stiffness actuator channel group.

[0093] The hardware gated isolation unit obtains the arbitration authorization result and parses it to obtain the height group enable signal. With height group selection signal Damping group enable signal With damping group selection signal Stiffness group enable signal With stiffness group selection signal ,in , , And 0 indicates prohibition, 1 indicates permission. Furthermore, 0 indicates the selection of the main controller, and 1 indicates the selection of the standby controller;

[0094] The hardware gated isolation unit simultaneously receives physical signal lines from both the main control command set and the backup control command set, among which the command lines of the high-efficiency actuator channel group include pump control commands. and and height valve control commands and The command lines of the damping actuator channel group include the damping valve duty cycle command. and The instruction lines of the stiffness actuator channel group include stiffness valve duty cycle instructions. and ,in and and The range of values ​​is to ;

[0095] To satisfy the requirement that the group enable signal "allow" must meet the condition of a periodic enable pulse, the hardware gating isolation unit sets up an enable pulse watchdog and receives periodic enable pulses output by at least one of the main security core unit and the backup security core unit. ,in The period is equal to Furthermore, the pulse high-level width is set to 1ms to enable the pulse watchdog for detection. The rising edge is the refresh condition and the timeout period continues without a refresh. Forced output pulse valid flag The timeout period Take 30ms, and define the effective group enable signal for each actuator channel group as follows:

[0096] ;

[0097] in Indicates actuator channel group The effective group enable signal, Indicates actuator channel group The group enable signal and corresponding to or This indicates that the pulse output of the watchdog timer is valid, and 1 indicates that... Internal detection of valid Rising edge, 0 indicates timeout missing, symbol This represents the logical AND operation;

[0098] The hardware gating isolation unit uses a fixed logic of "selecting the path first and then gating" to implement the output for each actuator channel group. Specifically, when... Group selection signal The corresponding 2-to-1 multiplexer selects one of the main control command and the backup control command as the routing command for that group and outputs it to the corresponding driver stage. The system forces the group to enter a preset fail-safe output state, and the fail-safe output state is taken as the preset safe output and generated by a hardware constant. The preset safe output is defined in the height actuator channel group as To achieve pump shutdown and inlet / outlet valve closure, a preset safety output is defined in the damping actuator channel group. To ensure the continuously variable damping valve operates at a moderate damping level, a preset safety output is defined in the stiffness actuator channel group. To ensure that the stiffness regulating valve maintains its maximum effective volume;

[0099] The hardware gating isolation unit, in its electrical implementation, uses PWM gating to drive the enable pin for duty cycle-type instructions to achieve group isolation, and in... When the drive enable pin is pulled low, the PWM output is switched to a fixed level or fixed duty cycle corresponding to the preset safe output. Thus, even if the main controller or backup controller outputs abnormally, is stuck at a high level, or continuously outputs a duty cycle, the hardware gating isolation unit can still force isolation and fail-safe output of the channel group.

[0100] The hardware gating isolation unit defines the output obtained through the above routing and gating as the gated pump control command. Height valve control command after gate control and Damping valve control command after gating and the stiffness valve control command after gating and will As the output of the actuator instruction set after gating.

[0101] In this specific embodiment, S5 includes:

[0102] To control the cycle Execute and Get 10ms to obtain the gated actuator instruction set. and the arbitration authorization result ,in This indicates the pump control command after gating, with 1 indicating on and 0 indicating off. The duty cycle instruction after gating and its value range is to , The group enable signal is 1 for permission and 0 for disallowing. The group selection signal is 0, where 0 indicates the selection of the main controller and 1 indicates the selection of the standby controller.

[0103] The damping group selection signal from the previous control cycle is stored internally. Read the damping group selection signal during the current control cycle. When satisfied and When the time is determined, the hierarchical takeover is triggered to switch from the main controller to the backup controller and the smooth switching state machine is started. The hierarchical takeover is executed in a fixed order of damping actuator channel group, stiffness actuator channel group, and height actuator channel group, and only one actuator channel group is allowed to be in the "enable recovery stage and ramp limit stage" at the same time.

[0104] Upon entering the staged takeover phase, the current outputs of the three actuator channel groups are written to the corresponding safety hold output registers to form hold output values, where the hold output value of the damping actuator channel group is denoted as... The stiffness actuator channel group maintains the output value as . The height actuator channel group maintains the output value as . The safety hold output register is initialized to a preset safety output when the system is powered on, and the preset safety output is consistent with... The output state remains consistent with the failure safety output state, thus keeping the output as the preset safe output while the output value is not refreshed;

[0105] For the disabled hold phase of each actuator channel group, the group enable signal of that actuator channel group is disabled and held for the hold period. and Take 20ms. During the holding time, the hardware gating isolation unit outputs the holding output value in the safety holding output register to the actuator channel group and prohibits the routing update of the group, thereby fixing the output of the actuator channel group at the holding output value at the switching start phase.

[0106] During the selection signal switching phase of each actuator channel group, while the actuator channel group is still in the group enable signal disabled state, the group selection signal of the actuator channel group is switched to select the backup controller and maintained for one control cycle to ensure stable routing and avoid the transient of switching propagating to the actuator.

[0107] For each actuator channel group's enable / restore phase, the group enable signal of that actuator channel group is restored to allow, and the corresponding target output value in the backup control instruction set is read as the target output value of that actuator channel group. The target output value of the damping actuator channel group is denoted as... The target output value of the stiffness actuator channel group is denoted as The target output value of the height actuator channel group is determined by Determined by mutual exclusion rules The mutual exclusion rule is when Time to take ,when and Time to take , ,when and Time to take This ensures that the height valve control commands are mutually exclusive and that the pump control commands are consistent with the inflation valve commands;

[0108] For the ramp limiting phase of each actuator channel group, a maximum rate of change limit is applied to the duty cycle output of that actuator channel group, and the output self-holds the value, approximating the target output value cycle by cycle. The ramp limiting adopts a uniform discrete update rule:

[0109] ;

[0110] in Indicates the current control cycle The ramp limits the output duty cycle. Indicates the previous control cycle The ramp limits the output duty cycle and initially takes the hold output value of this channel group. This indicates the target output duty cycle corresponding to this channel group. This indicates the preset maximum rate of change for the channel group, and the unit is... Indicates the control cycle and the unit is Indicates that you will input Limit to the lower limit and upper limit Limiting operators between;

[0111] The maximum rate of change Take from the damping actuator channel group And order correspond and correspond Take from the stiffness actuator channel group And order correspond and correspond In the height actuator channel group respectively for and Apply slope constraints and take the maximum rate of change. And in each control cycle according to The result is to update the pump control command as follows If and only if otherwise This ensures that the pump control commands are consistent with the duty cycle of the inflation valve;

[0112] The difference between the output of this channel group and the target output shall not exceed Furthermore, the condition for completing the ramp limit is that two consecutive control cycles are met. After completing the ramp limit of the current actuator channel group, the output value of the actuator channel group is written to the safety holding output register as the input condition for the disabled holding phase of the next actuator channel group, and the smooth switching sequence of the next actuator channel group is entered. This process continues until the smooth switching of the damping actuator channel group, stiffness actuator channel group, and height actuator channel group is completed in sequence, and the final actuator instruction set is output. .

[0113] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

[0114] This invention employs an algorithmic combination of "parallel computing with primary and backup, security core arbitration authorization, hardware gating isolation, and smooth switching timing" to form a targeted action chain for the aforementioned technical problem: the primary controller and backup controller generate height, damping, and stiffness control instruction sets in parallel within the same control cycle; the primary and backup security core units generate independent group enable and group selection signals for actuator channel groups based on arbitration criteria such as health information and instruction consistency verification; the hardware gating isolation unit performs hardware-level routing and gating isolation for output channels such as valves, pumps, and damping valves accordingly; when enable is disabled, the corresponding channel group is forcibly cut off or kept in a preset failure-safe output state, thereby achieving "hardware-level isolation cutoff" in cases of primary controller failure, task abnormality, or output abnormality, and avoiding output contention and erroneous driving in the redundant system through independent authorization of each channel group.

[0115] This invention improves the algorithm structure around redundancy arbitration and takeover smoothness: First, it introduces an authorization token and ownership handshake mechanism, allowing only one controller to obtain output source authorization for the same actuator channel group within the same arbitration cycle, and directly disabling the corresponding channel group when the handshake fails or there is a conflict authorization, thereby reducing the risk of erroneous switching and contention from a mechanism perspective; Second, it proposes a hierarchical takeover strategy by domain or by actuator channel group, and adopts a timing control of "first disable holding, then switch selection, then restore enable, and then ramp limit" during the switching process, so that the output approaches the backup control target value from the held value with a limited rate of change cycle by cycle, thereby suppressing abrupt changes in height, damping, and stiffness control quantities, and improving the smoothness of cooperative control under redundant switching conditions while satisfying failure safety.

Claims

1. A method for coordinated control of air suspension height, damping, and stiffness, characterized in that, include: S1. Collect suspension sensor signals and vehicle operation signals to form vehicle status data; S2. Input the vehicle status data into the main controller and the backup controller respectively, and calculate the height control, damping control and stiffness control in parallel to obtain the main control instruction set and the backup control instruction set, which both include control instructions corresponding to the height actuator channel group, damping actuator channel group and stiffness actuator channel group respectively. S3. The main safety core unit generates main health information, and the backup safety core unit generates backup health information. Based on the arbitration basis including the main health information, backup health information, and the consistency verification results of the main control instruction set and the backup control instruction set, an arbitration authorization result is generated, including group enable signals and group selection signals corresponding to each actuator channel group, which are independent of each other. S4. The hardware gating isolation unit performs gating isolation on each actuator channel group according to the group enable signal and the group selection signal, and selects the output between the main control instruction set and the backup control instruction set. When the group enable signal is disabled, the corresponding actuator channel group enters the preset fail-safe output state. When the group enable signal is enabled, the corresponding control instruction in the main control instruction set or the backup control instruction set is output according to the group selection signal. S5. When the group selection signal of any actuator channel group is switched from selecting the main controller to selecting the backup controller, a smooth switching sequence is executed for the actuator channel group, including the sequential execution of the disable holding stage, the selection signal switching stage, the enable recovery stage, and the ramp limiting stage, so that the output of the actuator channel group smoothly transitions to the corresponding control command in the backup control command set.

2. The method for coordinated control of air suspension height, damping, and stiffness according to claim 1, characterized in that, S1 includes: The system collects signals from the vehicle height sensor, air spring pressure sensor, vehicle acceleration sensor, and vehicle operation signals, including vehicle speed, steering wheel angle, and lateral acceleration. Each of the acquired signals is filtered to obtain a filtered signal, and the filtering process includes low-pass filtering; The validity of the filtered signal is verified to obtain the validity verification result. The validity verification includes amplitude range verification, rate of change verification and communication timeout verification. When the validity check result indicates that the corresponding filtered signal is valid, the filtered signal is output as a valid signal. When the validity check result indicates that the corresponding filtered signal is invalid, the filtered signal is replaced with the corresponding valid signal at the previous moment or an estimated signal estimated from other valid signals. Vehicle status data is calculated based on each valid signal. The vehicle status data includes vehicle height, vehicle height change rate, and vehicle operating status parameters.

3. The method for coordinated control of air suspension height, damping, and stiffness according to claim 1, characterized in that, S2 include: Within the same control cycle, vehicle status data is input to the main controller and the backup controller respectively; The main controller performs height control calculations based on the vehicle status data to generate the height control instructions. The height control instructions include pump control instructions and valve control instructions for height adjustment. The height control calculations include determining the height adjustment amount based on the deviation between the vehicle height and the target vehicle height, and generating the pump control instructions and valve control instructions after limiting the amplitude and rate of change of the height adjustment amount. The main controller performs damping control calculations based on the vehicle state data to generate the damping control command. The damping control command is a drive duty cycle command of a continuously variable damping valve. The damping control calculation includes determining the target damping level based on the vehicle body acceleration and vehicle operating state parameters, and converting the target damping level into the drive duty cycle command through a mapping relationship. The main controller performs stiffness control calculations based on the vehicle state data to generate stiffness control commands. The stiffness control commands include valve control commands for stiffness adjustment. The stiffness control calculations include determining a target stiffness level based on lateral acceleration signals and steering wheel angle signals, and converting the target stiffness level into the valve control commands. The backup controller uses the same input data, control cycle, and mapping relationship as the main controller to perform height control calculation, damping control calculation, and stiffness control calculation in parallel, generating a backup control instruction set corresponding to the main control instruction set. The height control command, the damping control command, and the stiffness control command are respectively encapsulated into the main control command set and the backup control command set.

4. The method for coordinated control of air suspension height, damping, and stiffness according to claim 1, characterized in that, S3 includes: Within each arbitration cycle, the primary security core unit monitors the operating status of the primary controller to generate primary health information, and the backup security core unit monitors the operating status of the backup controller and generates backup health information. The operating status includes control task cycle status, watchdog status, memory self-test status, power status, and communication status. The primary security core unit generates a primary authorization token based on the primary health information, and the backup security core unit generates a backup authorization token based on the backup health information. Both the primary and backup authorization tokens include a controller identifier, a sequence count value, and a cyclic redundancy check value. The primary and backup security core units exchange the primary and backup authorization tokens through a secure communication interface, and verify the received authorization tokens based on the sequence count value and the cyclic redundancy check value. Verification is performed to obtain the authorization token verification result. The main security core unit and the backup security core unit perform consistency verification based on the main control instruction set and the backup control instruction set to obtain the consistency verification result. This includes calculating the corresponding differences for the height control instruction, damping control instruction, and stiffness control instruction in the main control instruction set and the backup control instruction set, and comparing them with the corresponding tolerance thresholds. When any difference exceeds the corresponding tolerance threshold, the inconsistency count value is updated. When the inconsistency count value reaches the inconsistency determination threshold, the consistency verification result is determined to be inconsistent. The main security core unit and the backup security core unit perform ownership handshake based on the authorization token verification result to ensure that only one controller is authorized as the output source of the same actuator channel group within the same arbitration cycle. When the ownership handshake fails or a conflicting authorization is detected for the same actuator channel group, the group enable signal corresponding to that actuator channel group is determined to be disabled. The main security core unit and the backup security core unit generate the arbitration authorization result based on the authorization token verification result, the main health information, the backup health information, the consistency verification result, and the ownership handshake result. When the authorization token verification result is passed, the main health information indicates that the main controller is normal, the consistency verification result is consistent, and the ownership handshake result indicates that the main controller has ownership of the corresponding actuator channel group, the arbitration authorization result is generated such that the group enable signals corresponding to the height actuator channel group, the damping actuator channel group, and the stiffness actuator channel group are all enabled, and the group selection signals all select the main controller. When the master health information indicates that the master controller is abnormal, or the consistency verification result is inconsistent, or the ownership handshake result indicates that the standby controller owns at least one actuator channel group, an arbitration authorization result is generated that at least enables the group enable signal corresponding to the damping actuator channel group and selects the standby controller by the group selection signal, and an arbitration authorization result is generated that disables the group enable signal corresponding to the unauthorized actuator channel group.

5. The method for coordinated control of air suspension height, damping, and stiffness according to claim 1, characterized in that, S4 include: The hardware gating isolation unit is a multiplexer; Obtain the arbitration authorization result, and parse the arbitration authorization result into the height group enable signal and height group selection signal corresponding to the height actuator channel group, the damping group enable signal and damping group selection signal corresponding to the damping actuator channel group, and the stiffness group enable signal and stiffness group selection signal corresponding to the stiffness actuator channel group. The height group enable signal, height group selection signal, damping group enable signal, damping group selection signal, stiffness group enable signal, and stiffness group selection signal are respectively input to the multiplexer; when the group enable signal corresponding to any actuator channel group is disabled, the multiplexer is controlled to put the actuator channel group into a fail-safe output state. The fail-safe output state is to cut off the output of the actuator channel group or to output a safety hold output to the actuator channel group. The safety hold output is a preset safety output or the most recent valid output; when the group enable signal corresponding to any actuator channel group is enabled and the actuator channel group... When the corresponding group selection signal selects the main controller, the multiplexer is controlled to output the control command corresponding to the actuator channel group from the main control command set to the actuator channel group; when the group enable signal corresponding to any actuator channel group is enabled and the group selection signal corresponding to the actuator channel group selects the backup controller, the multiplexer is controlled to output the control command corresponding to the actuator channel group from the backup control command set to the actuator channel group; based on the output of the multiplexer to the height actuator channel group, the damping actuator channel group and the stiffness actuator channel group, a gated actuator command set is formed.

6. The method for coordinated control of air suspension height, damping, and stiffness according to claim 1, characterized in that, S5 include: The gated actuator instruction set and arbitration authorization result are obtained. When the arbitration authorization result indicates that the group selection signal of the damping actuator channel group changes from selecting the main controller to selecting the backup controller, a hierarchical takeover is triggered to switch from the main controller to the backup controller. In the hierarchical takeover, a smooth switching sequence is executed for each actuator channel group in the order of the damping actuator channel group, the stiffness actuator channel group, and the height actuator channel group. The smooth switching sequence for the current actuator channel group includes: recording the output value corresponding to the gated actuator instruction set before the actuator channel group enters the fail-safe output state as the hold output value. The group enable signal corresponding to the actuator channel group is controlled to be disabled and maintained for a preset holding time, so that the hardware gating isolation unit outputs the holding output value or the preset safety output to the actuator channel group during the holding time; After the holding time ends, the group selection signal corresponding to the actuator channel group is switched to select the backup controller, and the group enable signal corresponding to the actuator channel group is controlled to be enabled, so that the hardware gating isolation unit outputs the target output value corresponding to the backup control instruction set to the actuator channel group; A ramp limit is applied to the output of the actuator channel group during a continuous control cycle, so that the output of the actuator channel group approaches the target output value cycle by cycle from the maintained output value in a manner that does not exceed the preset maximum rate of change, until the output of the actuator channel group reaches the target output value; After completing the ramp limit of the current actuator channel group, the output of the actuator channel group is used as the input condition for the smooth switching timing of the next actuator channel group and the smooth switching timing of the next actuator channel group is entered to obtain the final actuator instruction set.

7. The method for coordinated control of air suspension height, damping, and stiffness according to claim 4, characterized in that, The primary security core unit and the backup security core unit independently generate candidate arbitration authorization results based on the same arbitration criteria, and exchange the candidate arbitration authorization results through the security communication interface. When the candidate arbitration authorization results are inconsistent on any actuator channel group, the group enable signal corresponding to that actuator channel group is determined to be disabled.

8. The method for coordinated control of air suspension height, damping, and stiffness according to claim 4, characterized in that, The arbitration basis also includes the instruction and readback consistency determination result. The instruction and readback consistency determination result includes matching and verifying at least one control instruction in the main control instruction set and the backup control instruction set with the corresponding actuator readback signal. When the matching and verification fails and the duration reaches the preset determination time, the group enable signal of the corresponding actuator channel group is determined to be prohibited.

9. The method for coordinated control of air suspension height, damping, and stiffness according to claim 5, characterized in that, The group enable signal of the multiplexer requires the periodic enable pulse condition to be met. The periodic enable pulse is output by at least one of the main safety core unit and the backup safety core unit. When the periodic enable pulse is missing within a preset timeout period, the multiplexer forces the corresponding actuator channel group to enter the fail-safe output state.

10. An air suspension height, damping, and stiffness coordinated control system, used to execute the air suspension height, damping, and stiffness coordinated control method according to any one of claims 1 to 9, comprising: The acquisition unit is used to collect suspension sensor signals and vehicle operation signals to form vehicle status data; The main controller and the backup controller are used to receive the vehicle status data and perform parallel calculations of height control, damping control and stiffness control to obtain the main control instruction set and the backup control instruction set, and each includes control instructions corresponding to the height actuator channel group, damping actuator channel group and stiffness actuator channel group respectively. The primary security core unit and the backup security core unit are used to generate primary health information and backup health information, and generate arbitration authorization results based on the arbitration basis including the primary health information, the backup health information, and the consistency verification results of the primary control instruction set and the backup control instruction set; The hardware gating isolation unit is used to gating and isolating each actuator channel group according to the group enable signal and the group selection signal, and to select the output between the main control instruction set and the backup control instruction set. When the group enable signal is disabled, the corresponding actuator channel group enters a preset fail-safe output state. When the group enable signal is enabled, the corresponding control instruction in the main control instruction set or the backup control instruction set is output according to the group selection signal. When the group selection signal of any actuator channel group switches from selecting the main controller to selecting the backup controller, a smooth switching sequence is executed according to the disable holding phase, the selection signal switching phase, the enable recovery phase, and the ramp limit phase, so that the output of the actuator channel group smoothly transitions to the corresponding control instruction in the backup control instruction set.

Images