Dual gateway redundancy control system and method

Abstract

This application belongs to the field of vehicle gateway technology and discloses a dual-gateway redundancy control system and method. This application obtains the main operating status and main heartbeat signal of the main gateway through a fault diagnosis module, then determines the fault level based on the main operating status and main heartbeat status, and then issues a main gateway fault command to the gateway coordination control module based on the fault level. The gateway coordination control module then controls the main gateway status and the redundant gateway status based on the main gateway fault command. This application can accurately determine in real time whether the main gateway has failed. If so, it determines the fault level of the main gateway and issues a main gateway fault command to the gateway coordination control module based on the fault level. When the main gateway fails, the gateway coordination control module can control the status of the main gateway and the redundant gateway, enabling timely switching from the failed main gateway to the normal redundant gateway, thereby ensuring the continuity of signal interaction between core modules.

Description

Technical Field

[0001] This application relates to the field of vehicle gateway technology, and in particular to a dual-gateway redundant control system and method. Background Technology

[0002] Currently, gateway systems in autonomous drive drive-by-wire chassis (especially L4 level intelligent commercial vehicles) generally have the following shortcomings: most adopt a single gateway architecture design, which only uses a single gateway to realize message routing and signal forwarding of multiple network segments (CAN1, CAN2, CAN6, etc.). Once the gateway fails (such as communication interruption or hardware failure), it will directly lead to the interruption of signal interaction between core modules such as dual controllers, autonomous driving unit, braking / steering system, etc., triggering the exit of intelligent driving function or loss of vehicle control, which cannot meet the stringent requirements of L4 level autonomous driving for network redundancy. Summary of the Invention

[0003] The main purpose of this application is to provide a dual-gateway redundancy control system and method, which aims to solve the technical problem of how to ensure the continuity of signal interaction between core modules when a single gateway fails.

[0004] To achieve the above objectives, this application provides a dual-gateway redundancy control system, which includes: a main gateway, a redundant gateway, a gateway collaborative control module, and a fault diagnosis module. The fault diagnosis module is used to obtain the main operating status and main heartbeat signal of the main gateway; The fault diagnosis module is also used to determine the fault level based on the main working state and the main heartbeat state; The fault diagnosis module is also used to issue a main gateway fault command to the gateway collaborative control module according to the fault level; The gateway collaborative control module is used to control the main gateway status of the main gateway and the redundant gateway status of the redundant gateway based on the main gateway fault command.

[0005] Optionally, the fault diagnosis module is further configured to determine the fault level as a minor fault when the main working state is a single-segment routing delay state or the main heartbeat state is a momentary heartbeat loss. The fault diagnosis module is also used to determine the fault level as a serious fault when the main heartbeat state is that multiple network segments lose heartbeat signals simultaneously and the loss duration is longer than a preset duration.

[0006] Optionally, the main gateway fault instruction includes: a main gateway minor fault instruction; The gateway collaborative control module is also used to send a self-healing command to the main gateway when it receives a minor fault command from the main gateway. The main gateway is used to restart the network segment route corresponding to the single network segment route delay state upon receiving the self-healing instruction. The gateway collaborative control module is also used to control the redundant gateway to remain in standby mode.

[0007] Optionally, the main gateway fault instruction further includes: a main gateway critical fault instruction; The gateway collaborative control module is also used to issue a main gateway isolation command to the main gateway when it receives a serious fault command from the main gateway, so as to make the main gateway state of the main gateway set to a stopped state; The gateway coordination control module is also used to send a redundant gateway activation command to the redundant gateway so that the redundant gateway state of the redundant gateway switches from standby state to normal working state.

[0008] Optionally, the gateway coordination control module is further configured to detect the updated main gateway status and the updated redundant gateway status after controlling the main gateway status of the main gateway and the redundant gateway status of the redundant gateway. The gateway collaborative control module is also used to control the main gateway to enter the normal working state and control the redundant gateway to enter the standby state when the updated main gateway state is in the fault recovery state and the updated redundant gateway state is in the normal working state or the fault state. The gateway collaborative control module is further configured to send a network fault signal to the dual controllers when the updated primary gateway status is faulty and the updated redundant gateway status is faulty, so that the dual controllers can control the operating status of the vehicle to be controlled.

[0009] Optionally, the dual-gateway redundancy control system further includes: an intelligent arbitration module; The intelligent arbitration module is used to detect whether the same signal is transmitted simultaneously in different network segments during the routing process of the main gateway or the redundant gateway. The intelligent arbitration module is also used to determine the signal priority of the same signal based on a preset priority rule when the same signal is detected to be transmitted simultaneously in different network segments. The intelligent arbitration module is also used to select a target signal from the same signals according to the signal priority, and forward the target signal to the target network segment through the main gateway or the redundant gateway.

[0010] Optionally, the intelligent arbitration module is further configured to select a target signal with a higher priority than a preset priority from the same signals when the signal priorities are different. The intelligent arbitration module is also used to determine the arrival time of the same signal to the main gateway or the redundant gateway when the signals have the same priority. The intelligent arbitration module is also used to select a target signal from the same signals based on the arrival time.

[0011] Optionally, the gateway collaborative control module is used to send self-test commands to the main gateway and the redundant gateway respectively when a power-ready signal is received, so that the main gateway and the redundant gateway can feed back the self-test results; The gateway collaborative control module is also used to control the main gateway to enter the working state and control the redundant gateway to enter the standby state when the self-test result is that the self-test is passed. The fault diagnosis module is also used to acquire the main working status and main heartbeat signal of the main gateway when the main gateway enters the working state and the redundant gateway enters the standby state.

[0012] Optionally, the gateway collaborative control module is used to send a routing stop command to the main gateway or the redundant gateway when it receives a system power-down signal, and to send a gateway power-down ready signal back to the dual controllers and dual redundant power supplies, so that the dual redundant power supplies cut off power supply in a preset order.

[0013] Furthermore, to achieve the above objectives, this application also provides a dual-gateway redundancy control method, which is applied to the dual-gateway redundancy control system described above. The method includes the following steps: The fault diagnosis module acquires the main operating status and main heartbeat signal of the main gateway; The fault diagnosis module determines the fault level based on the main working state and the main heartbeat state; The fault diagnosis module issues a main gateway fault command to the gateway collaborative control module according to the fault level. The gateway collaborative control module controls the main gateway status of the main gateway and the redundant gateway status of the redundant gateway based on the main gateway fault command.

[0014] In this application, the dual-gateway redundancy control system includes: a main gateway, redundant gateways, a gateway collaborative control module, and a fault diagnosis module. This application obtains the main operating status and main heartbeat signal of the main gateway through the fault diagnosis module, then determines the fault level based on the main operating status and main heartbeat signal, and then issues a main gateway fault command to the gateway collaborative control module based on the fault level. The gateway collaborative control module then controls the main gateway status of the main gateway and the redundant gateway status of the redundant gateway based on the main gateway fault command. This application, through the fault diagnosis module determining the fault level based on the main operating status and main heartbeat signal of the main gateway, can accurately determine in real time whether the main gateway has failed. If so, it determines the fault level of the main gateway and issues a main gateway fault command to the gateway collaborative control module based on the fault level. When the main gateway fails, the gateway collaborative control module can control the status of the main gateway and the redundant gateway, enabling timely switching from the failed main gateway to the normal redundant gateway, thereby ensuring the continuity of signal interaction between core modules. Attached Figure Description

[0015] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a structural block diagram of the first embodiment of the dual-gateway redundancy control system of this application; Figure 2 This is a control principle diagram of an embodiment of the dual-gateway redundancy control system of this application; Figure 3 This is a schematic diagram of the control flow of an embodiment of the dual-gateway redundancy control system of this application; Figure 4 This is a structural block diagram of the second embodiment of the dual-gateway redundancy control system of this application; Figure 5 This is a flowchart illustrating the first embodiment of the dual-gateway redundancy control method of this application.

[0018] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0019] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0020] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0021] The main solution of this application embodiment is: the dual-gateway redundant control system includes: a main gateway, a redundant gateway, a gateway collaborative control module, and a fault diagnosis module; The fault diagnosis module is used to obtain the main operating status and main heartbeat signal of the main gateway; The fault diagnosis module is also used to determine the fault level based on the main working state and the main heartbeat state; The fault diagnosis module is also used to issue a main gateway fault command to the gateway collaborative control module according to the fault level; The gateway collaborative control module is used to control the main gateway status of the main gateway and the redundant gateway status of the redundant gateway based on the main gateway fault command.

[0022] Currently, gateway systems in autonomous drive drive-by-wire chassis (especially L4 level intelligent commercial vehicles) generally have the following shortcomings: most adopt a single gateway architecture design, which only uses a single gateway to realize message routing and signal forwarding of multiple network segments (CAN1, CAN2, CAN6, etc.). Once the gateway fails (such as communication interruption or hardware failure), it will directly lead to the interruption of signal interaction between core modules such as dual controllers, autonomous driving unit, braking / steering system, etc., triggering the exit of intelligent driving function or loss of vehicle control, which cannot meet the stringent requirements of L4 level autonomous driving for network redundancy.

[0023] In this application, the dual-gateway redundancy control system includes: a main gateway, redundant gateways, a gateway collaborative control module, and a fault diagnosis module. This application obtains the main operating status and main heartbeat signal of the main gateway through the fault diagnosis module, then determines the fault level based on the main operating status and main heartbeat signal, and then issues a main gateway fault command to the gateway collaborative control module based on the fault level. The gateway collaborative control module then controls the main gateway status of the main gateway and the redundant gateway status of the redundant gateway based on the main gateway fault command. This application, through the fault diagnosis module determining the fault level based on the main operating status and main heartbeat signal of the main gateway, can accurately determine in real time whether the main gateway has failed. If so, it determines the fault level of the main gateway and issues a main gateway fault command to the gateway collaborative control module based on the fault level. When the main gateway fails, the gateway collaborative control module can control the status of the main gateway and the redundant gateway, enabling timely switching from the failed main gateway to the normal redundant gateway, thereby ensuring the continuity of signal interaction between core modules.

[0024] Based on this, the embodiments of this application provide a dual-gateway redundant control system, referring to... Figure 1 , Figure 1 This is a structural block diagram of the first embodiment of the dual-gateway redundancy control system of this application.

[0025] In this embodiment, the dual-gateway redundancy control system includes: a main gateway, a redundant gateway, a gateway collaborative control module, and a fault diagnosis module; Understandably, referring to Figure 2 , Figure 2 This is a control principle diagram of an embodiment of the dual-gateway redundancy control system of this application. Figure 2 As shown, the system includes a main gateway, redundant gateways, a gateway collaborative control module, a fault diagnosis module, multi-segment buses (CAN1, CAN2, CAN6, etc.), and redundant vehicle loads (dual controllers, dual autonomous driving units). Driving Unit (ADU), etc., including the main gateway and redundant gateway: both have identical hardware configurations, identical message routing rules and signal forwarding logic, and both are connected to all network segments of the vehicle (CAN1, CAN2, CAN6, etc.), supporting bidirectional signal routing between multiple network segments; only one gateway is in working state at any given time, while the other is in standby state to avoid signal conflicts; Gateway coordination control module: connected to the two gateways via hardwire + CAN bus, collects the working status, heartbeat signal, and routing logs of the main / redundant gateway in real time, performs switching control, fault diagnosis, and coordination command issuance, and communicates with the dual VCUs and dual redundant power supplies through the CAN1 / CAN2 dual redundant bus to achieve full-link redundancy coordination; Fault diagnosis module: has built-in logic for heartbeat signal monitoring, network segment communication status detection, and routing fault identification, supports fault level determination (minor faults: instantaneous heartbeat loss, single network segment routing delay; severe faults: continuous heartbeat loss, multi-network segment interruption, hardware failure), and outputs fault type and timestamp.

[0026] In the specific implementation, the main gateway and redundant gateways are connected to multiple network segments such as CAN1 / CAN2 / CAN6 in parallel. The gateway collaborative control module is connected to the dual gateways and dual vehicle control units (VCUs) respectively. The fault diagnosis module collects status data across gateways.

[0027] The fault diagnosis module is used to obtain the main operating status and main heartbeat signal of the main gateway; Furthermore, in this embodiment, the gateway collaborative control module is used to issue self-test commands to the main gateway and the redundant gateway respectively when a power-ready signal is received, so that the main gateway and the redundant gateway can feed back self-test results; the gateway collaborative control module is also used to control the main gateway to enter the working state and control the redundant gateway to enter the standby state when the self-test result is that the self-test is passed; the fault diagnosis module is also used to acquire the main working state and main heartbeat signal of the main gateway when the main gateway enters the working state and the redundant gateway enters the standby state.

[0028] It should be understood that the vehicle high-voltage power-on triggering occurs when the user triggers the vehicle's high-voltage power-on via a one-button start or remote start command. After the dual redundant power supplies complete power supply initialization, they send a power-ready signal to the gateway collaborative control module. The dual gateways perform self-tests and matching: upon receiving the power-ready signal, the gateway collaborative control module simultaneously sends self-test commands to both the primary gateway and the redundant gateway. Both perform self-tests on hardware (chips, communication interfaces), routing rules, and network segment connection status. Upon successful self-tests, they return a gateway-ready signal and their own ID. The primary / backup role allocation occurs when the self-test result is successful; by default, the gateway collaborative control module assigns the primary gateway to the working state and the redundant gateway to the standby state. The system issues a routing rule synchronization command to ensure that the routing logic of both is completely consistent. The main gateway starts routing packets for all network segments, while the redundant gateway only listens to network segment signals and does not actively forward them. The heartbeat mechanism is activated: the main gateway sends a heartbeat signal to all network segments at a cycle of 10ms (encoded cyclically from 1 to 15), while the redundant gateway receives and verifies the heartbeat from the main gateway. The redundant gateway synchronously sends its own heartbeat signal (encoding rule consistent with the main gateway), and the main gateway and the gateway collaborative control module listen for both signals. The entire link status is synchronized: the gateway collaborative control module synchronizes the initialization status of the two gateways to the dual VCUs via the CAN bus, clarifying the working role of the main gateway and laying the foundation for subsequent collaborative control.

[0029] Understandably, message routing and arbitration: the main gateway implements multi-segment message routing according to preset rules (such as routing the ADU braking request of CAN2 to the dual VCU of CAN1, and routing the shift signal of CAN6 to the SCU of CAN1); the intelligent arbitration module prioritizes the multi-segment transmission requests of the same signal (intelligent driving safety signal > control signal > status signal) to avoid signal conflicts, and the frame loss tolerance reaches 10 cycles.

[0030] In the specific implementation, the fault diagnosis module collects the working status (routing status, CPU load) and network segment communication status (bit error rate, signal delay) of the primary / redundant gateway every 10ms, and verifies the continuity and encoding consistency of the heartbeat signal every 50ms (the specific value can be calibrated). The gateway coordination control module synchronously receives status feedback from the dual VCUs and dual redundant power supplies to ensure end-to-end coordination. Redundant gateway monitoring backup: The redundant gateway in standby mode monitors all network segment signals in real time and synchronously caches the routing logs and key signals (such as ADU commands and VCU feedback) of the primary gateway to ensure rapid takeover in case of primary gateway failure without reloading routing rules.

[0031] The fault diagnosis module is also used to determine the fault level based on the main working state and the main heartbeat state; Furthermore, in this example, the fault diagnosis module is also used to determine the fault level as a minor fault when the main working state is a single network segment routing delay state or the main heartbeat state is an instantaneous heartbeat loss; the fault diagnosis module is also used to determine the fault level as a serious fault when the main heartbeat state is that multiple network segments simultaneously lose heartbeat signals and the loss duration is greater than a preset duration.

[0032] It should be understood that if the fault diagnosis module detects that the main gateway's primary operating state is single-segment routing delay or momentary heartbeat loss (momentary ≤ 3 cycles (specific value can be calibrated)), the fault level is determined to be a minor fault. If the fault diagnosis module loses heartbeats simultaneously in CAN1, CAN2, and CAN6 segments during the primary heartbeat state, and the loss duration lasts for 5 cycles (50ms (specific value can be calibrated)), and the count check confirms no error triggering, or if communication interruption in 3 or more segments exceeds 30ms (specific value can be calibrated), then the main gateway hardware fails (e.g., no power supply, chip failure) and cannot respond to any commands. This embodiment uses a dual determination of multi-segment heartbeats + count check to reduce the false handover rate, reduce handover delay, and avoid control signal interruption or abrupt changes.

[0033] The fault diagnosis module is also used to issue a main gateway fault command to the gateway collaborative control module according to the fault level; In the specific implementation, when the fault level is a minor fault, the fault diagnosis module issues a minor fault instruction to the gateway collaborative control module; when the fault level is a serious fault, the fault diagnosis module issues a serious fault instruction to the gateway collaborative control module.

[0034] The gateway collaborative control module is used to control the main gateway status of the main gateway and the redundant gateway status of the redundant gateway based on the main gateway fault command.

[0035] Furthermore, in this example, the main gateway fault instruction includes: a main gateway minor fault instruction; the gateway coordination control module is also used to issue a self-healing instruction to the main gateway upon receiving the main gateway minor fault instruction; the main gateway is used to restart the network segment route corresponding to the single network segment routing delay state upon receiving the self-healing instruction; the gateway coordination control module is also used to control the redundant gateway state of the redundant gateway to remain in standby state.

[0036] Understandably, when the gateway collaborative control module receives a minor fault instruction from the main gateway, it immediately sends a self-healing instruction to the main gateway. The main gateway automatically restarts the corresponding delayed network segment routing, while the redundant gateway remains in standby mode and does not trigger a switchover, thus avoiding affecting the operation of the entire vehicle.

[0037] Furthermore, in this example, the main gateway fault instruction also includes: a main gateway critical fault instruction; the gateway coordination control module is further configured to, upon receiving the main gateway critical fault instruction, issue a main gateway isolation instruction to the main gateway so that the main gateway state of the main gateway is in a stopped state; the gateway coordination control module is further configured to send a redundant gateway activation instruction to the redundant gateway so that the redundant gateway state of the redundant gateway switches from a standby state to a normal working state.

[0038] It should be understood that after the fault diagnosis module detects a serious fault, it immediately sends a serious fault command to the main gateway to the gateway collaborative control module, along with the fault type and timestamp. After receiving the command, the gateway collaborative control module sends a main gateway isolation command to the main gateway within 10ms. The main gateway then stops routing on all network segments to prevent the fault from spreading.

[0039] Understandably, the gateway coordination control module also sends a redundant gateway activation command to the redundant gateway, which switches from standby to working state. Based on the cached routing logs and real-time monitored network segment signals, it starts routing all network segment packets in a short time, achieving seamless takeover and reducing overall switching latency.

[0040] In its implementation, the gateway collaborative control module sends a gateway switching completion signal to the dual VCUs and dual redundant power supplies via dual CAN buses. Upon receiving this signal, the dual VCUs synchronously adjust their control strategies within 50ms (the specific value can be calibrated) to ensure that the intelligent driving commands match the gateway routing status, preventing command loss. Upon receiving this signal, the dual redundant power supplies maintain stable power supply to the core loads (dual gateways and dual VCUs), preventing voltage fluctuations during the switching process. This embodiment achieves full-link redundancy collaboration between the gateway, VCU, and power supply, seamlessly linking gateway switching with the vehicle's redundant system, preventing system disconnection and improving the overall reliability of the redundant architecture. Fault reporting and logging: The gateway collaborative control module sends fault alarms to the remote management platform via the dedicated intelligent driving TBOX, including information such as fault type, switching time, and vehicle location. Simultaneously, the main gateway and redundant gateways locally record routing logs and heartbeat signal data for 10 seconds (the specific value can be calibrated) before and after the fault, facilitating subsequent troubleshooting. The tiered fault handling strategy and self-healing mechanism in this embodiment ensure that minor faults do not affect operation, while serious faults guarantee safe parking, improving vehicle operational continuity and reducing the probability of unplanned downtime.

[0041] Furthermore, in this example, the gateway coordination control module is also used to detect the updated main gateway state and the updated redundant gateway state after controlling the main gateway state of the main gateway and the redundant gateway state of the redundant gateway; the gateway coordination control module is also used to control the main gateway to enter the normal working state and control the redundant gateway to enter the standby state when the updated main gateway state is in a fault recovery state and the updated redundant gateway state is in a normal working state or a fault state; the gateway coordination control module is also used to send a network fault signal to the dual controllers when the updated main gateway state is in a fault state and the updated redundant gateway state is in a fault state, so that the dual controllers can control the operating state of the vehicle to be controlled.

[0042] Understandably, after controlling the status of the primary gateway and the redundant gateway using the methods described above, the updated status of the primary gateway and the updated status of the redundant gateway can be detected after a period of time. If the updated status of the primary gateway is a fault recovery state (e.g., recovery after a momentary power outage), and the redundant gateway is detected to be in normal working or faulty state, the redundant gateway automatically enters standby state, the primary gateway enters normal working state, and synchronizes the latest routing log of the redundant gateway, waiting to take over upon the next power-on switchover or when the redundant gateway fails.

[0043] It should be understood that if a serious fault occurs in the redundant gateway during operation, the gateway coordination control module will immediately detect the status of the primary gateway: if the primary gateway is fault-free, the redundancy switch will be triggered within 30ms (the specific value can be calibrated), and the primary gateway will be reactivated to the "working state"; if the updated primary gateway status is faulty and the updated redundant gateway status is also faulty, a network fault signal will be sent to the dual VCUs, and the dual VCUs will control the vehicle to execute torque limiting, speed limiting, and nearby safe parking strategies.

[0044] In the specific implementation, refer to Figure 3 , Figure 3 This is a schematic diagram of the control flow of an embodiment of the dual-gateway redundancy control system of this application, as shown below. Figure 3 As shown, after the system powers on, both gateways perform self-tests and synchronize routing rules. If the self-test fails, an alarm is triggered and network routing is disabled. If the self-test passes, the primary gateway is assigned to work, while the redundant gateway remains in standby mode. The primary gateway routes, and the redundant gateway listens and interacts with a heartbeat. If a fault is detected, the fault level is determined. If the fault is minor, the primary gateway self-heals without switching over. If the fault is severe, the primary gateway is isolated, and the redundant gateway takes over (≤50ms). Dual VCUs / dual power supplies coordinate to respond, reporting faults and logging. If the redundant gateway is normal, it remains operational. If the redundant gateway malfunctions, it switches back to the primary gateway once it recovers; otherwise, it shuts down safely. If a power-down command is received, routing is stopped, the state is saved, and the system powers down.

[0045] In this embodiment, the dual-gateway redundancy control system includes a main gateway, redundant gateways, a gateway collaborative control module, and a fault diagnosis module. This application uses the fault diagnosis module to obtain the main operating status and main heartbeat signal of the main gateway, then determines the fault level based on the main operating status and main heartbeat signal, and then issues a main gateway fault command to the gateway collaborative control module based on the fault level. The gateway collaborative control module then controls the main gateway status of the main gateway and the redundant gateway status of the redundant gateway based on the main gateway fault command. This embodiment, by using the fault diagnosis module to determine the fault level based on the main operating status and main heartbeat signal of the main gateway, can accurately determine in real time whether the main gateway has failed. If so, it determines the fault level of the main gateway and then issues a main gateway fault command to the gateway collaborative control module based on the fault level. This allows the gateway collaborative control module to control the status of the main gateway and the redundant gateway when the main gateway fails, enabling timely switching from the failed main gateway to the normal redundant gateway, thereby ensuring the continuity of signal interaction between core modules.

[0046] Reference Figure 4 , Figure 4 This is a structural block diagram of the second embodiment of the dual-gateway redundancy control system of this application.

[0047] Based on the first embodiment described above, in this embodiment, the dual-gateway redundancy control system further includes: an intelligent arbitration module; Understandably, the intelligent arbitration module in this embodiment is embedded inside the gateway and integrates multi-segment signal priority determination logic. It arbitrates the transmission requests of the same signal in different network segments and prioritizes forwarding high-priority signals (such as ADU braking request > gear signal) to avoid signal conflicts and frame drops.

[0048] The intelligent arbitration module is used to detect whether the same signal is transmitted simultaneously in different network segments during the routing process of the main gateway or the redundant gateway. It should be understood that when the system is powered on, the intelligent arbitration module loads the preset priority rules: first priority (safety signals: ADU braking request, emergency stop signal); second priority (control signals: VCU torque command, gear signal); third priority (status signals: battery SOC, motor temperature).

[0049] Understandably, during the routing process, the primary / redundant gateway monitors in real time whether the same signal is being transmitted simultaneously on different network segments (such as CAN2 and CAN6). If a conflict is detected, the arbitration mechanism is immediately triggered.

[0050] The intelligent arbitration module is also used to determine the signal priority of the same signal based on a preset priority rule when the same signal is detected to be transmitted simultaneously in different network segments. In its implementation, when the intelligent arbitration module detects the same signal being transmitted simultaneously on different network segments, it determines the signal priority of the same signal based on the aforementioned preset priority rules, including first priority, second priority, and third priority.

[0051] The intelligent arbitration module is also used to select a target signal from the same signals according to the signal priority, and forward the target signal to the target network segment through the main gateway or the redundant gateway.

[0052] Furthermore, in this embodiment, the intelligent arbitration module is also used to select a target signal with a higher priority than a preset priority from the same signals when the signal priorities are different; the intelligent arbitration module is also used to determine the arrival time of the same signal to the main gateway or the redundant gateway when the signal priorities are the same; the intelligent arbitration module is also used to select a target signal from the same signals based on the arrival time.

[0053] Understandably, priority determination and forwarding work as follows: The intelligent arbitration module selects target signals with higher priority than the preset priority according to preset priority rules for forwarding, discarding lower priority signals or delaying their forwarding; if the signals are of the same priority, i.e., the arrival time of the same signal to the main gateway or redundant gateway, the target signal is selected from the same signals based on the arrival time and forwarded according to the first-come-first-served principle, while recording the conflict log. Fault tolerance: If frame loss (≤10 cycles) is detected in a certain network segment, the intelligent arbitration module automatically extracts backup signals from other network segments to supplement the forwarding, ensuring the integrity of command transmission and improving fault tolerance. The intelligent arbitration algorithm resolves signal conflicts in multiple network segments, increases frame loss fault tolerance, reduces signal transmission error rate, and ensures accurate execution of intelligent driving commands.

[0054] Furthermore, in this embodiment, the gateway collaborative control module is used to send a routing stop command to the main gateway or the redundant gateway when it receives a system power-down signal, and to feed back a gateway power-down ready signal to the dual controllers and dual redundant power supplies, so that the dual redundant power supplies cut off power supply in a preset order.

[0055] It should be understood that the power-down command reception process involves the gateway collaborative control module receiving a system power-down command from the dual VCUs or detecting a key switch disconnection and initiating the power-down process. For routing stop and status synchronization, the gateway collaborative control module first issues a routing stop command, causing the primary / redundant gateway to stop forwarding all network segment packets. Then, it sends a "gateway power-down ready" signal back to the dual VCUs and dual redundant power supplies. For safe power-down, after receiving the signal, the dual redundant power supplies disconnect power to non-core loads first, followed by core loads. The dual gateways synchronously complete status saving (such as fault logs and routing rules), ultimately completing the power-down process.

[0056] In this embodiment, the dual-gateway redundancy control system further includes an intelligent arbitration module. During routing, the intelligent arbitration module detects whether the same signal is being transmitted simultaneously on different network segments by the main gateway or the redundant gateway. If the same signal is detected, its priority is determined based on a preset priority rule. Then, a target signal is selected from the same signals according to the priority and forwarded to the target network segment via the main gateway or the redundant gateway. This intelligent arbitration module, by detecting the simultaneous transmission of the same signal on different network segments, selects a target signal based on its priority and forwards it to the target network segment via the main gateway or the redundant gateway. This resolves multi-segment signal conflicts, increases frame loss tolerance, reduces signal transmission error rate, and ensures accurate execution of intelligent driving commands.

[0057] Reference Figure 5 , Figure 5 This is a flowchart illustrating the first embodiment of the dual-gateway redundancy control method of this application.

[0058] like Figure 5 As shown, the dual-gateway redundancy control method proposed in this application is applied to the above embodiments. The dual-gateway redundancy control method includes the following steps: Step S10: The fault diagnosis module acquires the main operating status and main heartbeat signal of the main gateway.

[0059] Understandably, the fault diagnosis module collects the working status (routing status, CPU load) and network segment communication status (bit error rate, signal delay) of the primary / redundant gateway every 10ms, and verifies the continuity and encoding consistency of the heartbeat signal every 50ms (specific value can be calibrated). The gateway coordination control module synchronously receives status feedback from dual VCUs and dual redundant power supplies to ensure end-to-end coordination. Redundant gateway monitoring backup: The redundant gateway in standby mode monitors all network segment signals in real time and synchronously caches the routing logs and key signals (such as ADU commands and VCU feedback) of the primary gateway to ensure rapid takeover in case of primary gateway failure without reloading routing rules.

[0060] Step S20: The fault diagnosis module determines the fault level based on the main working state and the main heartbeat state.

[0061] It should be understood that if the fault diagnosis module detects that the main gateway's primary operating state is single-segment routing delay or momentary heartbeat loss (momentary ≤ 3 cycles (specific value can be calibrated)), the fault level is determined to be a minor fault. If the fault diagnosis module loses heartbeats simultaneously in CAN1, CAN2, and CAN6 segments during the primary heartbeat state, and the loss duration lasts for 5 cycles (50ms (specific value can be calibrated)), and the count check confirms no error triggering, or if communication interruption in 3 or more segments exceeds 30ms (specific value can be calibrated), then the main gateway hardware fails (e.g., no power supply, chip failure) and cannot respond to any commands. This embodiment uses a dual determination of multi-segment heartbeats + count check to reduce the false handover rate, reduce handover delay, and avoid control signal interruption or abrupt changes.

[0062] Step S30: The fault diagnosis module issues a main gateway fault command to the gateway collaborative control module according to the fault level.

[0063] In the specific implementation, when the fault level is a minor fault, the fault diagnosis module issues a minor fault instruction to the gateway collaborative control module; when the fault level is a serious fault, the fault diagnosis module issues a serious fault instruction to the gateway collaborative control module.

[0064] Step S40: The gateway collaborative control module controls the main gateway status of the main gateway and the redundant gateway status of the redundant gateway based on the main gateway fault command.

[0065] Understandably, when the gateway collaborative control module receives a minor fault instruction from the main gateway, it immediately sends a self-healing instruction to the main gateway. The main gateway automatically restarts the corresponding delayed network segment routing, while the redundant gateway remains in standby mode and does not trigger a switchover, thus avoiding affecting the operation of the entire vehicle.

[0066] It should be understood that after the fault diagnosis module detects a serious fault, it immediately sends a serious fault command to the main gateway to the gateway collaborative control module, along with the fault type and timestamp. After receiving the command, the gateway collaborative control module sends a main gateway isolation command to the main gateway within 10ms. The main gateway then stops routing on all network segments to prevent the fault from spreading.

[0067] Understandably, the gateway coordination control module also sends a redundant gateway activation command to the redundant gateway, which switches from standby to working state. Based on the cached routing logs and real-time monitored network segment signals, it starts routing all network segment packets in a short time, achieving seamless takeover and reducing overall switching latency.

[0068] In its implementation, the gateway collaborative control module sends a gateway switching completion signal to the dual VCUs and dual redundant power supplies via dual CAN buses. Upon receiving this signal, the dual VCUs synchronously adjust their control strategies within 50ms (the specific value can be calibrated) to ensure that the intelligent driving commands match the gateway routing status, preventing command loss. Upon receiving this signal, the dual redundant power supplies maintain stable power supply to the core loads (dual gateways and dual VCUs), preventing voltage fluctuations during the switching process. This embodiment achieves full-link redundancy collaboration between the gateway, VCU, and power supply, seamlessly linking gateway switching with the vehicle's redundant system, preventing system disconnection and improving the overall reliability of the redundant architecture. Fault reporting and logging: The gateway collaborative control module sends fault alarms to the remote management platform via the dedicated intelligent driving TBOX, including information such as fault type, switching time, and vehicle location. Simultaneously, the main gateway and redundant gateways locally record routing logs and heartbeat signal data for 10 seconds (the specific value can be calibrated) before and after the fault, facilitating subsequent troubleshooting. The tiered fault handling strategy and self-healing mechanism in this embodiment ensure that minor faults do not affect operation, while serious faults guarantee safe parking, improving vehicle operational continuity and reducing the probability of unplanned downtime.

[0069] This embodiment uses a fault diagnosis module to determine the fault level based on the main working status and main heartbeat signal of the main gateway. It can accurately determine in real time whether the main gateway has failed. If so, it determines the fault level of the main gateway and then issues a main gateway fault command to the gateway collaborative control module based on the fault level. When the main gateway fails, the gateway collaborative control module can control the status of the main gateway and the redundant gateway, and can switch from the faulty main gateway to the normal redundant gateway in a timely manner, thereby ensuring the continuity of signal interaction between core modules.

[0070] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of this application. In practical applications, those skilled in the art can select some or all of it to achieve the purpose of this embodiment according to actual needs, and no restrictions are imposed here.

[0071] In addition, for technical details not described in detail in this embodiment, please refer to the dual gateway redundancy control system provided in any embodiment of this application, which will not be repeated here.

[0072] The above description is only a part of the embodiments of this application and does not limit the scope of protection of this application. All equivalent structural transformations made under the technical concept of this application and using the content of this application specification and drawings, or direct / indirect applications in other related technical fields, are included in the scope of protection of this application.

Claims

1. A dual-gateway redundant control system, characterized in that, The dual-gateway redundancy control system includes: a main gateway, a redundant gateway, a gateway collaborative control module, and a fault diagnosis module. The fault diagnosis module is used to obtain the main operating status and main heartbeat signal of the main gateway; The fault diagnosis module is also used to determine the fault level based on the main working state and the main heartbeat state; The fault diagnosis module is also used to issue a main gateway fault command to the gateway collaborative control module according to the fault level; The gateway collaborative control module is used to control the main gateway status of the main gateway and the redundant gateway status of the redundant gateway based on the main gateway fault command.

2. The dual-gateway redundancy control system as described in claim 1, characterized in that, The fault diagnosis module is also used to determine the fault level as a minor fault when the main working state is a single network segment routing delay state or the main heartbeat state is an instantaneous heartbeat loss. The fault diagnosis module is also used to determine the fault level as a serious fault when the main heartbeat state is that multiple network segments lose heartbeat signals simultaneously and the loss duration is longer than a preset duration.

3. The dual-gateway redundancy control system as described in claim 2, characterized in that, The main gateway fault command includes: main gateway minor fault command; The gateway collaborative control module is also used to send a self-healing command to the main gateway when it receives a minor fault command from the main gateway. The main gateway is used to restart the network segment route corresponding to the single network segment route delay state upon receiving the self-healing instruction. The gateway collaborative control module is also used to control the redundant gateway status to remain in standby mode.

4. The dual-gateway redundancy control system as described in claim 2, characterized in that, The main gateway fault command also includes: main gateway critical fault command; The gateway collaborative control module is also used to issue a main gateway isolation command to the main gateway when it receives a serious fault command from the main gateway, so as to make the main gateway state of the main gateway set to a stopped state; The gateway coordination control module is also used to send a redundant gateway activation command to the redundant gateway, so that the redundant gateway state of the redundant gateway switches from standby state to normal working state.

5. The dual-gateway redundancy control system as described in claim 4, characterized in that, The gateway coordination control module is also used to detect the updated main gateway status and the updated redundant gateway status after controlling the main gateway status of the main gateway and the redundant gateway status of the redundant gateway. The gateway collaborative control module is also used to control the main gateway to enter the normal working state and control the redundant gateway to enter the standby state when the updated main gateway state is in the fault recovery state and the updated redundant gateway state is in the normal working state or the fault state. The gateway collaborative control module is further configured to send a network fault signal to the dual controllers when the updated primary gateway status is faulty and the updated redundant gateway status is faulty, so that the dual controllers can control the operating status of the vehicle to be controlled.

6. The dual-gateway redundancy control system as described in claim 1, characterized in that, The dual-gateway redundant control system also includes: an intelligent arbitration module; The intelligent arbitration module is used to detect whether the same signal is transmitted simultaneously in different network segments during the routing process of the main gateway or the redundant gateway. The intelligent arbitration module is also used to determine the signal priority of the same signal based on a preset priority rule when the same signal is detected to be transmitted simultaneously in different network segments. The intelligent arbitration module is also used to select a target signal from the same signals according to the signal priority, and forward the target signal to the target network segment through the main gateway or the redundant gateway.

7. The dual-gateway redundancy control system as described in claim 6, characterized in that, The intelligent arbitration module is also used to select a target signal with a higher priority than a preset priority from the same signals when the signal priorities are different. The intelligent arbitration module is also used to determine the arrival time of the same signal to the main gateway or the redundant gateway when the signals have the same priority. The intelligent arbitration module is also used to select a target signal from the same signals based on the arrival time.

8. The dual-gateway redundancy control system as described in any one of claims 1 to 7, characterized in that, The gateway collaborative control module is used to send self-test commands to the main gateway and the redundant gateway respectively when it receives a power-ready signal, so that the main gateway and the redundant gateway can feed back the self-test results. The gateway collaborative control module is also used to control the main gateway to enter the working state and control the redundant gateway to enter the standby state when the self-test result is that the self-test is passed. The fault diagnosis module is also used to acquire the main working status and main heartbeat signal of the main gateway when the main gateway enters the working state and the redundant gateway enters the standby state.

9. The dual-gateway redundancy control system as described in any one of claims 1 to 7, characterized in that, The gateway collaborative control module is used to send a routing stop command to the main gateway or the redundant gateway when it receives a system power-down signal, and to send a gateway power-down ready signal back to the dual controllers and dual redundant power supplies, so that the dual redundant power supplies will cut off power supply in a preset order.

10. A dual-gateway redundancy control method, characterized in that, The method is applied to the dual-gateway redundant control system according to any one of claims 1 to 9, and the method includes the following steps: The fault diagnosis module acquires the main operating status and main heartbeat signal of the main gateway; The fault diagnosis module determines the fault level based on the main working state and the main heartbeat state. The fault diagnosis module issues a main gateway fault command to the gateway collaborative control module according to the fault level. The gateway collaborative control module controls the main gateway status of the main gateway and the redundant gateway status of the redundant gateway based on the main gateway fault command.

Images