Automobile controller distributed multi-node data and state synchronization method and system
By using a distributed multi-node data and state synchronization method, the problems of inconsistent states and switching delays in automotive control systems after node failures are solved, achieving fast and reliable control switching and data consistency, and improving the robustness and safety of the system.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- GAC COMPONENT CO LTD
- Filing Date
- 2026-04-01
- Publication Date
- 2026-06-12
Smart Images
Figure CN122194804A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of automotive control technology, specifically to a method and system for synchronizing distributed multi-node data and status of automotive controllers. Background Technology
[0002] With the accelerated development of automotive intelligence and electrification, the number of electronic loads in the vehicle body has surged, including actuators such as seat adjustment motors, air conditioning blowers, and chassis solenoid valves. To achieve complex functions such as multi-directional seat linkage and zonal air conditioning control, multiple actuators need to work together with high precision. For example, when adjusting the seat forward and backward, it must avoid the steering wheel and center console in real time. Existing technologies mainly adopt two types of architectures: centralized control relies on a central control unit (CCU) to issue unified commands, but there is a risk of single point of failure, where a CCU failure will paralyze the entire system; poor scalability, adding new nodes requires modifying the CCU software or even upgrading the hardware; and high cost, with CCU hardware and long-distance wiring harnesses significantly increasing system costs. Although fully distributed control eliminates the central node and avoids single point of failure, the lack of a coordination mechanism causes new problems: independent decision-making by each node can easily lead to conflicting actions, such as collisions between the seat and the steering wheel; network latency or packet loss can cause inconsistent states, increasing the risk of misjudgment; and recovery of failed nodes is difficult to synchronize quickly due to the lack of historical data. The following critical flaws exist: Failure to take over control after primary node failure: Backup nodes cannot directly take over control due to inconsistencies between their real-time status and that of the primary node; Excessive switching latency: The backup node takes more than 500ms to reconstruct its state machine, which cannot meet the requirements of real-time scenarios such as emergency collision avoidance; Historical data gaps: When a failed node comes back online, the lack of key historical state snapshots of the primary node, such as transaction log indexes stored in EEPROM, leads to data misalignment.
[0003] Existing solutions cannot simultaneously achieve high reliability, millisecond-level switching, and strong state consistency. The single-point bottleneck of the CCU in a centralized architecture restricts system robustness, while the lack of a state synchronization mechanism in a distributed architecture makes it difficult to achieve precise cross-node collaboration. Summary of the Invention
[0004] One of the objectives of this invention is to provide a distributed multi-node data and status synchronization method for automotive controllers, which solves the problems of inconsistency between the current status of the backup node and the master node after the failure of the existing control node, resulting in the inability to take over control normally, high takeover delay, and inability to align after takeover.
[0005] To achieve the above-mentioned objectives, the technical solution adopted by the present invention is as follows: A distributed multi-node data and state synchronization method for automotive controllers includes the following steps: S1. Full-node data synchronization input and hierarchical storage: All nodes synchronously receive external sensor data and internal control commands via the vehicle bus. Each node updates data in real time and stores it in RAM to drive the state machine in real time. Key status data includes timestamps and status hash values. Key status data is stored in EEPROM memory according to preset event thresholds or fixed period T1. S2, State machine consistency maintenance: Each node independently runs the control strategy state machine based on the same input data stream stored in each node in S1; Each time a state transition is completed, the node generates a verification packet containing a timestamp, transaction log index, and state hash value; S3. Real-time status verification and synchronization: Each node broadcasts a verification packet via periodic heartbeats; If the receiving node detects that the difference between its own state hash value H1 and the check packet hash value H2 exceeds the threshold δ, it requests complete state data from the source node of the check packet; it reconstructs the local state machine based on the latest timestamp check packet and completes state synchronization within a fixed period T. S4. Master-Slave Control Output Management: After being elected as the master node controller, the hardware switching circuit is activated to output control commands to the actuators; for slave node controllers, the control signal output terminal is set to a high impedance state, and the internal state machine continues to simulate operation but does not output; S5. Switchover in case of master node failure: When a slave node fails to receive a verification packet from the master node within N consecutive heartbeat cycles, an election protocol is triggered to select a new master node based on the node priority ID and the maximum transaction log index. The new master node removes the high-impedance state at the output end, takes over the control command output, and activates output enable within <3 heartbeat cycles. S6. Faulty node synchronization recovery: After the faulty node comes back online, it sends a data request containing the last valid timestamp to the current master node and receives the corresponding time point EEPROM snapshot data packet returned by the master node; it rebuilds the local state machine based on the snapshot; it switches to the real-time data stream and updates to the latest state within a fixed period T, with strong data consistency and strong state consistency.
[0006] Furthermore, the update frequency f of the real-time data of each node is greater than 100Hz, and the real-time data of each node is stored in the RAM layer. Critical status data is stored in EEPROM after any of the following conditions are triggered: The state change exceeds a preset threshold t; Fixed storage period T≤5s, balancing practicality and lifespan.
[0007] Furthermore, in S3, the synchronization trigger condition is that the difference in state hash value δ > 5%, to avoid errors in the executor under the node.
[0008] Furthermore, the synchronization process includes: requesting a complete state data packet from the source node, reconstructing the local state machine based on the timestamp and transaction log index in the data packet; completing state synchronization within a certain time and broadcasting an acknowledgment signal to reduce synchronization errors.
[0009] Furthermore, in S4, a new master node is elected, with priority arranged in ascending order of node ID. The transaction log index must meet the continuity verification, and the node with the maximum index value is selected. The new master node is released from the high-impedance state within <3 heartbeat cycles to improve real-time performance.
[0010] Furthermore, the transaction log index includes generating a monotonically increasing integer sequence number ID during each state machine transition and calculating the latest index value for the current node. Compared to the previous index value The difference ;like If continuous, then record the fault count; otherwise, record the fault count. ;when At that time, a full node state snapshot comparison is triggered to detect faults.
[0011] Furthermore, historical snapshots include the last consistent EEPROM storage packet and timestamp before the failure; When supplementing real-time data, an incremental compensation algorithm is used: ,in For state values, For timestamps, The compensation period is <50ms, used for post-fault synchronization.
[0012] As a preferred option, the heartbeat cycle N > 3, which balances reliability and real-time performance.
[0013] The second objective of this invention is to provide an automotive control system that solves the problems of difficult takeover and slow recovery after a failure of the control node in existing automotive control systems.
[0014] To achieve the above-mentioned objectives, the technical solution adopted by the present invention is as follows: The automotive controller system applies the data and status synchronization method described above, including: Multiple control nodes, each node including a dual-memory architecture: SRAM chip and non-volatile FRAM; Silent control circuit: Tri-state gate logic devices are connected to the actuator interface; High-speed bus: CANFD bus or automotive Ethernet; Status verification module: Hardware-accelerated SHA-256 hash calculation unit, which can quickly recover from failures and resynchronize status with high consistency.
[0015] Preferably, the silent control circuit includes a tri-state gate logic device. The enable terminal EN of the tri-state gate logic device is connected to the master-slave status flag register. When EN=0, the output terminal is in a high impedance state, and when EN=1, a control signal is output. There is no delay in state switching.
[0016] The beneficial effects of this invention are as follows: (1) The distributed multi-node data and state synchronization method of the automobile controller adopts an architecture of multi-node synchronous input data stream and each node independently maintaining the same control strategy state machine. Combined with a hierarchical storage mechanism to ensure the persistence of real-time state, it not only eliminates the single point of failure risk of traditional centralized control and avoids the problem of the whole system paralysis caused by the failure of the central controller, but also solves the problem of inconsistent state of multiple nodes caused by network delay and packet loss in pure distributed architecture. It avoids the risk of physical interference of actuators and action conflict caused by state mismatch from the root, and greatly improves the overall robustness of the automobile electronic control system.
[0017] (2) The distributed multi-node data and state synchronization method of the automobile controller has a master-slave state control output logic. Only the master node activates the control output, while the slave node keeps the output silent and continuously runs the internal state machine synchronously. This not only retains the high scalability of the distributed architecture, but also allows the addition of actuator nodes to be completed by simply connecting to the vehicle bus. There is no need to modify the existing core control logic or upgrade the central hardware, which solves the pain points of the traditional centralized architecture, such as the difficulty of expansion and the high cost of transformation. Furthermore, it achieves unified output coordination, which completely avoids the action conflict problem caused by the independent decision-making of pure distributed multi-nodes.
[0018] (3) In this distributed multi-node data and status synchronization method for automotive controllers, all nodes maintain the latest consistent state based on the same source input and historical data in advance. When the master node fails and switches, the new master node only needs to switch the output enable to complete the takeover. This solves the core defects of the prior art, such as the inconsistency between the backup node state and the master node, the lack of historical data and the inability to align, and the large delay in switching and reconstruction. It achieves seamless and imperceptible transition of the master fault, and the switching delay can be controlled within 3 heartbeat cycles, ensuring control continuity and greatly improving the safety and reliability of automotive electronic control. Attached Figure Description
[0019] Figure 1 The operation logic diagram of the distributed multi-node system for automotive controllers provided by this invention; Figure 2 The node timing interaction diagram of the distributed multi-node system for automotive controllers provided by the present invention; Figure 3 The background technology provided for this invention is a node data synchronization logic diagram. Detailed Implementation
[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments in the application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.
[0021] Example 1 like Figures 1-2 As shown, this embodiment discloses a distributed multi-node data and state synchronization method for an automotive controller, including the following steps: S1. Full-node data synchronization input and hierarchical storage: All nodes synchronously receive external sensor data and internal control commands through the vehicle bus. The data sources include external CAN bus data and internal API local data. External CAN bus data receives external sensor data and external control commands transmitted from the vehicle bus. Internal API local data provides local control data generated by the nodes themselves. All input data is synchronously output to all control nodes, and the status data processed by the nodes is sent back to the external CAN bus data, forming a complete data flow closed loop. Each node updates data in real time and stores it in RAM or EEPROM to drive the state machine in real time. The state machine is a mathematical control model composed of states (the behavior pattern of the device at a specific moment), events (inputs that trigger state changes, such as a user pressing a button or sensor signal), and transitions (rules governing state changes when events are triggered). It collects all input data from the data source step by step. The hierarchical storage and distribution includes a real-time data path: all real-time updated data is stored in RAM for high-speed access to drive the state machine in real time. After storage is completed, the real-time data is output to the state machine. And critical state path: Critical state data that meets the triggering conditions are stored in EEPROM for persistent saving. After storage, the persistent state data is output to the internal data link of the node. Key status data includes timestamps and status hash values. Key status data is stored in EEPROM memory according to preset event thresholds or fixed period T1. S2, State machine consistency maintenance: Each node independently runs the control strategy state machine based on the same input data stream stored in each node in S1; After each state transition is completed, the node generates a verification packet containing a timestamp, transaction log index, and state hash value; specifically, after receiving real-time driving data from RAM, the state machine executes the following process: Complete the data-driven state machine update and advance a full state transition; After the state transition is completed, the corresponding control strategy is generated and the generated control strategy is output to the control strategy output stage on the right. S3. Real-time status verification and synchronization: Each node broadcasts a verification packet via periodic heartbeats. Lightweight signal packets broadcast periodically by each node at fixed time intervals are used for liveness detection, state synchronization, and fault determination. The node receiving the verification packet determines the fault of the node that sent the verification packet by the absence of the signal. If the receiving node detects that the difference between its own state hash value H1 and the check packet hash value H2 exceeds the threshold δ, it requests complete state data from the source node of the check packet; it reconstructs the local state machine based on the latest timestamp check packet and completes state synchronization within a fixed period T. S4. Master-Slave Control Output Management: Once a node is elected as the master node controller, it activates the hardware switching circuit and outputs control commands to the actuator. Nodes that are not selected are slave nodes. For slave node controllers, the control signal output terminal is set to a high impedance state, and the internal state machine continues to simulate operation but does not output anything. S5. Switchover in case of master node failure: When a slave node fails to receive a verification packet from the master node within N consecutive heartbeat cycles, an election protocol is triggered to select a new master node based on the node priority ID and the maximum transaction log index. The new master node removes the high-impedance state at the output end, takes over the control command output, and activates output enable within <3 heartbeat cycles. S6. Faulty node synchronization recovery: After the faulty node comes back online, it sends a data request containing the last valid timestamp to the current master node, and receives the corresponding time point EEPROM snapshot data packet returned by the master node; it rebuilds the local state machine based on the snapshot; it switches to the real-time data stream and updates to the latest state within a fixed period T.
[0022] Furthermore, the update frequency f of the real-time data of each node is greater than 100Hz, and the real-time data of each node is stored in the RAM layer. Critical status data is stored in EEPROM after any of the following conditions are triggered: When the state change exceeds the preset threshold t, it refers to the amount of change of the execution component. Specifically, for example, in the seat welcome mode, the seat moves from 0mm to 200mm. It is stored once every 10mm movement. This can only avoid frequent writing and shorten the life of EEPROM. Capturing key state transitions combined with the time period T constitutes a double guarantee, taking into account both real-time performance and the life of storage. A fixed storage period T≤5s is used to avoid high-speed writes while meeting fault requirements.
[0023] Preferably, in S3, the synchronization trigger condition is that the difference in the state hash value δ > 5%. When it is found that the difference in the actual actions is too large, synchronization is performed to avoid errors in the execution.
[0024] Furthermore, the synchronization process includes: requesting a complete state data packet from the source node; reconstructing the local state machine based on the timestamp and transaction log index in the data packet; completing state synchronization within a certain time and broadcasting an acknowledgment signal; reconstructing historical states through backtracking, timestamps, and log indexes to achieve closed-loop verification and reduce state synchronization errors.
[0025] Furthermore, in S4, a new master node is elected, with priority arranged in ascending order of node ID. The transaction log index must meet the continuity verification, and the node with the maximum index value is selected. The new master node is released from high-impedance state within <3 heartbeat cycles. Each controller has a unique built-in ID number stored in read-only memory that cannot be modified. Nodes with discontinuous daily indexes are disqualified from election. The activated new master node completes the process within <3 heartbeat cycles, taking over control signal output and broadcasting master node switchover announcements to improve real-time performance.
[0026] Furthermore, the transaction log index includes generating a monotonically increasing integer sequence number ID during each state machine transition and calculating the latest index value for the current node. Compared to the previous index value The difference ;like If continuous, then record the fault count; otherwise, record the fault count. ;when When this happens, a full node state snapshot comparison is triggered to detect faults and prevent node splitting.
[0027] Furthermore, the historical snapshot contains the last consistent EEPROM storage packet and timestamp before the failure, which is used for state synchronization after the failure. When supplementing real-time data, an incremental compensation algorithm is used: ,in For state values, For timestamps, The compensation period is <50ms.
[0028] Preferably, the heartbeat cycle N > 3, which balances reliability and real-time performance.
[0029] Taking the synchronized adjustment of the driver and passenger seats as an example: After the driver moves the driver's seat forward, the passenger seat needs to synchronize its state. The master node is the driver's seat controller ID, which is 101; the slave node is the passenger seat controller ID, which is 102. When the driver presses the move-forward button, the master node broadcasts a command via CAN. The slave node receives the command, initializes its state machine, moves the passenger seat to the target position, increments the synchronization log index, and broadcasts a heartbeat. When the slave node malfunctions, it calculates the hash difference. When δ > 5%, it triggers a synchronization request. The master node responds with a data packet, performs state reconstruction, executes the slave node's response, rolls back the state, and forces alignment to catch up to the target position in real time. Once the catch-up is complete, the fault is eliminated, the slave node broadcasts the change, and the master node records the state, thus completing the synchronization.
[0030] Example 2 This embodiment also discloses an automotive controller system, which applies methods such as data and state synchronization, including: Multiple control nodes, each node including a dual storage architecture: SRAM chip and non-volatile FRAM, the nodes include automotive functional components such as driver's seat controller, passenger's seat controller, and skylight controller; Silent control circuit: Tri-state gate logic devices are connected to the actuator interface; High-speed bus: CANFD bus or automotive Ethernet; Status verification module: Hardware-accelerated SHA-256 hash calculation unit, strong data consistency, all nodes receive data input equally, ensuring data consistency across all nodes, enabling real-time master-slave switching with no delay in automatic data and status synchronization, strong status consistency, nodes recover from historical data upon re-coming online, and quickly synchronize to the latest status based on the latest real-time data.
[0031] Furthermore, the silent control circuit includes a tri-state gate logic device. The enable terminal EN of the tri-state gate logic device is connected to the master-slave status flag register. When EN=0, the output terminal is in a high impedance state, and when EN=1, a control signal is output. The state switching response is fast.
[0032] Based on the disclosure and teachings of the foregoing specification, those skilled in the art can make changes and modifications to the above embodiments. Therefore, the present invention is not limited to the specific embodiments disclosed and described above, and any modifications and changes to the present invention should also fall within the protection scope of the claims of the present invention. Furthermore, although some specific terms are used in this specification, these terms are only for convenience of explanation and do not constitute any limitation on the present invention.
Claims
1. A distributed multi-node data and state synchronization method for automotive controllers, characterized in that, Includes the following steps: S1. Full-node data synchronization input and hierarchical storage: All nodes synchronously receive external sensor data and internal control commands via the vehicle bus. Each node updates data in real time and stores it in RAM to drive the state machine in real time. Key status data includes timestamps and status hash values. Key status data is stored in EEPROM memory according to preset event thresholds or fixed period T1. S2, State machine consistency maintenance: Each node independently runs the control strategy state machine based on the same input data stream stored in each node in S1; Each time a state transition is completed, the node generates a verification packet containing a timestamp, transaction log index, and state hash value; S3. Real-time status verification and synchronization: Each node broadcasts a verification packet via periodic heartbeats; If the receiving node detects that the difference between its own state hash value H1 and the check packet hash value H2 exceeds the threshold δ, it requests complete state data from the source node of the check packet. The local state machine is reconstructed based on the latest timestamp verification packet, and state synchronization is completed within a fixed period T. S4. Master-Slave Control Output Management: After being elected as the master node controller, the hardware switching circuit is activated to output control commands to the actuators; for slave node controllers, the control signal output terminal is set to a high impedance state, and the internal state machine continues to simulate operation but does not output; S5. Switchover in case of master node failure: When a slave node fails to receive a verification packet from the master node within N consecutive heartbeat cycles, an election protocol is triggered to select a new master node based on the node priority ID and the maximum transaction log index. The new master node removes the high-impedance state at the output end, takes over the control command output, and activates output enable within <3 heartbeat cycles. S6. Faulty node synchronization recovery: After the faulty node comes back online, it sends a data request containing the last valid timestamp to the current master node, and receives the corresponding time point EEPROM snapshot data packet returned by the master node; it rebuilds the local state machine based on the snapshot; it switches to the real-time data stream and updates to the latest state within a fixed period T.
2. The distributed multi-node data and state synchronization method for automotive controllers according to claim 1, characterized in that: The update frequency f of the real-time data of each node is greater than 100Hz, and the real-time data of each node is stored in the RAM layer; Critical status data is stored in EEPROM after any of the following conditions are triggered: The state change exceeds a preset threshold t; Fixed storage period T≤5s.
3. The distributed multi-node data and state synchronization method for automotive controllers according to claim 2, characterized in that: In S3, the synchronization trigger condition is that the difference in state hash values δ > 5%.
4. The distributed multi-node data and state synchronization method for automotive controllers according to claim 3, characterized in that: The synchronization process includes: requesting a complete state data packet from the source node, reconstructing the local state machine based on the timestamp and transaction log index in the data packet, and completing state synchronization within a certain time and broadcasting an acknowledgment signal.
5. The distributed multi-node data and state synchronization method for automotive controllers according to claim 1, characterized in that: In S4, a new master node is elected, with priority arranged in ascending order of node ID. The transaction log index must meet the continuity verification, and the node with the maximum index value is selected. The new master node is released from the high-impedance state within <3 heartbeat cycles.
6. The distributed multi-node data and state synchronization method for automotive controllers according to claim 1, characterized in that: The transaction log index includes generating a monotonically increasing integer sequence number ID during each state machine transition and calculating the latest index value for the current node. Compared to the previous index value The difference ;like If continuous, then record the fault count; otherwise, record the fault count. ;when At that time, a full node state snapshot comparison is triggered.
7. The distributed multi-node data and state synchronization method for automotive controllers according to claim 6, characterized in that: Historical snapshots contain the last consistent EEPROM storage packet and timestamp before the failure; When supplementing real-time data, an incremental compensation algorithm is used: ,in For state values, For timestamps, The compensation period is <50ms.
8. The distributed multi-node data and state synchronization method for automotive controllers according to claim 1, characterized in that: Heart rate cycle N > 3.
9. An automotive controller system, employing the data and state synchronization method as described in any one of claims 1-7, characterized in that, include: Multiple control nodes, each node including a dual-memory architecture: SRAM chip and non-volatile FRAM; Silent control circuit: Tri-state gate logic devices are connected to the actuator interface; High-speed bus: CANFD bus or automotive Ethernet; Status verification module: Hardware-accelerated SHA-256 hash calculation unit.
10. The vehicle controller system according to claim 9, characterized in that: The silent control circuit includes a tri-state gate logic device. The enable terminal EN of the tri-state gate logic device is connected to the master-slave status flag register. When EN=0, the output terminal is in a high impedance state, and when EN=1, the output control signal is output.