A method for handling MCU synchronization failure of a dual-redundant EPS

Abstract

This invention provides a method for handling MCU synchronization failures in a dual-redundant EPS system, relating to the field of automotive chassis steering system technology. It includes: timing synchronization and token preemption at the start of a safe time slice; the MCU holding the write token writes control instructions to the peripheral register, then directly reads back the physical hardware value of the register and packages it into a mirrored data frame; the MCU without the token independently calculates the theoretical expected value and performs consistency verification with the received physical readback value; if the deviation exceeds a threshold or communication times out, the drive output is forcibly cut off via a hardware pin. This invention is based on a dual-MCU architecture, utilizing a time slice and atomic token mechanism to manage mutually exclusive write permissions for safety-critical registers, eliminating the risk of dual-write race conditions. The monitored object is located at the hardware physical value at the end of the execution link, effectively covering random hardware failures such as register bit flips, filling monitoring blind spots, and meeting ASIL D safety level requirements.

Description

Technical Field

[0001] This invention relates to the field of functional safety control technology for vehicle electric power steering (EPS) controllers, and in particular to a method for handling MCU synchronization failure in dual redundant EPS. Background Technology

[0002] Electric power steering (EPS) is a key component of the braking system of new energy vehicles, which directly affects the steering accuracy and driving stability of the vehicle. The highest safety level ASIL D specified in the international standard ISO 26262 clearly requires that the system should still avoid unexpected risks when facing two-point failure.

[0003] The EPS (Electric Power Steering) systems of new energy vehicles initially widely adopted a single MCU (Microcontroller Unit) architecture. However, the traditional EPS single MCU architecture cannot self-diagnose random hardware failures (such as register bit flips or SRAM parity errors), leading to unexpected steering torque and violating the ISO 26262 ASIL D two-point failure requirement. To address the safety deficiencies of the single MCU architecture, the industry has gradually developed EPS systems with a dual MCU architecture (main control MCU + monitoring MCU). The main control MCU is responsible for the core power steering target calculation and control command output, while the monitoring MCU undertakes fault monitoring and safety assurance functions to improve the system's fault identification and fault tolerance capabilities. However, traditional monitoring strategies have the following core defects: 1. There are monitoring blind spots. Traditional solutions often rely on "comparison of calculation results," where the monitoring MCU independently calculates the target and compares it with the target calculated by the main MCU. However, if the main MCU calculates correctly, but the actual output PWM waveform is incorrect due to PWM register bit flipping, dead-time register abnormalities, or DMA write errors, traditional monitoring cannot identify it.

[0004] 2. Uncertain fault response time. In traditional dual-MCU architectures, monitoring tasks are typically run as a cyclic task within the operating system (OS). If a high-priority interrupt storm or deadlock occurs on the main MCU, the monitoring task may be delayed, causing the fault response time to exceed the fault tolerance time interval (FTTI).

[0005] 3. There is a risk of dual write race. In some dual-MCU architecture designs, both MCUs can access critical actuators (such as Gate Drivers). The lack of a strict time mutual exclusion mechanism can easily lead to unreproducible timing conflict failures. Summary of the Invention

[0006] The purpose of this invention is to address the shortcomings of existing technologies by proposing a method for handling synchronous failures of a dual-redundant EPS MCU. This method utilizes time-slice and token mechanisms to mutually exclude the takeover of safety-critical control resources, and combines mirror readback and consistency verification to achieve rapid detection of random faults and safety degradation. It is applicable to ISO 26262 ASIL D level.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: A method for handling MCU synchronous failure in a dual-redundant EPS includes two microcontrollers (MCUs), namely MCUA and MCUB. The two share access permissions or monitoring paths to safety critical resources (SCRs) and exchange data through high-speed shared memory (or a secure communication interface).

[0008] MCUA is the main controller, using Infineon TC3xx (Lockstep core, responsible for the main control algorithm); The MCUB monitoring / co-controller, using the NXP S32K334, is responsible for independent monitoring and redundancy verification.

[0009] The two are connected via an SPI bus (10Mbps baud rate) or inter-chip shared memory (IPC).

[0010] MCUA and MCUB each have an independent Safe Out GPIO pin; configure the actuator interface by connecting the Enable pin of the three-phase inverter pre-driver chip (Gate Driver) to the node after the GPIO output of MCUA and MCUB via wired-AND logic; pulling the GPIO low by either microcontroller MCU will disconnect the drive. The Gate Driver is only enabled when both pins are high; pulling it low by either microcontroller MCU will immediately disable the drive.

[0011] Includes the following steps: S1: Configure key parameters and initialize tokens and communication protocols; S11: Configure key parameters; S111: Set the PWM carrier frequency to 20kHz; this corresponds to the PWM period T. pwm The duration is 50µs.

[0012] PWM stands for Pulse Width Modulation, which controls the voltage / current of an actuator by adjusting the duty cycle of a pulse signal. It is the core signal form for motor drives.

[0013] PWM period T pwmIt is the time of one complete high-low level cycle of the PWM signal.

[0014] S112: Define a safety time slice; Set the safety time slice STS=K*T pwm Where K is a positive integer (usually set to 5), T pwm The value is determined by the PWM carrier frequency, which is 50µs.

[0015] The Safety Time Slice (STS) serves as the time base for dual MCU collaboration and is the smallest time unit for dual MCU collaborative operation.

[0016] The EPS control cycle is divided into several fixed-length safe time slices (STS).

[0017] S113: Configure the set of monitoring registers (SCRs); The monitoring register (SCR) set includes, but is not limited to, the PWM compare register, the dead time register, the bridge arm output enable register, and the ADC trigger configuration register.

[0018] The PWM comparator registers include the A-phase PWM register (duty cycle register), the B-phase PWM register, and the C-phase PWM register, which are used to store the duty cycle configuration values ​​of the A, B, and C phase PWM signals, respectively. The dead time register stores the time configuration value of the conduction gap between the upper and lower bridge arms of the PWM signal to prevent the switching transistors of the upper and lower bridge arms in the three-phase inverter from being turned on at the same time and causing a short circuit. The bridge arm output enable register is used to control the output enable and disable of each bridge arm in a three-phase inverter, and to control whether the PWM signal is allowed to be output.

[0019] The ADC trigger configuration register is used to set the trigger conditions of the ADC to ensure that sampling is synchronized with the PWM output.

[0020] The Monitoring Register (SCR) set is the core control register group that requires close monitoring.

[0021] S114: Set the verification threshold, error counter, and fault confirmation threshold; Verification thresholds include the minor deviation threshold Threshold Static and the severe failure threshold Threshold Safety; these are used to determine whether the deviation between the actual value and the theoretical value of the register is within a safe range. The error counter is initially set to 0 and records the cumulative number of verification exceptions for fault confirmation.

[0022] Configure a fault confirmation threshold. Set the fault confirmation threshold to M. If the number of consecutive abnormalities reaches this threshold within a period, it is determined to be a fault.

[0023] S12: Initialize token and communication protocol; S121: Initialize the atomic token state machine; Set the globally shared variable Token State, which can only be modified via atomic instructions (LDREX / STREX); Token State includes TOKEN A WRITE (status code 0x5A): MCUA has write permission, MCUB only performs verification.

[0024] TOKEN B WRITE (status code 0xA5): MCUB has write permissions, MCUA only performs verification.

[0025] TOKEN HANDOVER (status code 0xCC): Handover transition state, prohibiting either party from writing.

[0026] TOKEN LOCKED (status code 0xFF): Fault-locked state, write is prohibited, triggering a security action.

[0027] An atomic token state machine is a logical unit that controls the state transition of a token through atomic operations. Token State is a global variable that identifies the current write permission holder and is used to avoid conflicts caused by simultaneous writes from two MCUs. The global shared variable, Token State, is initially set to the handover transition state of TOKEN HANDOVER.

[0028] S122: Initialize the image data frame protocol; Mirrored data frames are a standardized data frame format used to transmit physical readback values ​​of registers, ensuring data integrity and verifiability. The structure of a mirrored data frame is a dedicated SPI / IPC communication frame, guaranteeing the integrity of data transmission and preventing tampering. The mirrored data frame structure includes fields and length; Fields include Frame ID, Rolling counter (0~15), Timestamp of sampling time, Physical readback value of A-phase PWM register Reg PhA Val, Physical readback value of B-phase PWM register Reg PhB Val, Physical readback value of C-phase PWM register Reg PhC Val, Physical readback value of dead zone register, and Frame checksum and CRC, etc. For different fields, the length of the Frame ID is 4 bits, the length of the Rollingcounter is 4 bits, the length of the Timestamp of the sampling time is 8 bits, the length of the physical readback value of the A-phase PWM register Reg PhA Val, the physical readback value of the B-phase PWM register Reg PhB Val, and the physical readback value of the C-phase PWM register Reg PhC Val are all 16 bits, and the length of the physical readback value of the dead zone register, as well as the length of the frame check and CRC, are all 8 bits. Configure the initial value of the rolling counter to 0. The rolling counter is a counter that increments synchronously with the data frame to prevent data replay and loss.

[0029] S2: Timing synchronization and token preemption arbitration; Two microcontrollers (MCUs) are hard synchronized. During normal operation, MCUA holds the write token. When MCUA fails and enters the security degradation mode, the write token is preempted. At the beginning of each security time slice (STS), the write token is preempted according to the preset schedule table. S21: The two microcontrollers (MCUs) are hard synchronized via hardware timers or PWM center alignment interrupts, with the synchronization error controlled within ±1µs. The hardware timer includes the eTimer high-precision timer module, which is used to generate synchronous trigger signals and timing. PWM center-aligned interrupt is a method of synchronizing the interrupt trigger time with the center of the PWM cycle.

[0030] S22: Dual microcontroller (MCU) preemption of write token; At the start of each Security Time Slice (STS) (T0), both microcontrollers (MCUs) synchronously interrupt and read the globally shared variable, Token State. If the token state is in the transitional state of TOKEN HANDOVER, they will preempt the write token through atomic operations according to the preset schedule table, gaining write access to the SCR set of monitoring registers. After one MCU successfully preempts, it updates its token state to write state, indicating that the MCU has write access to the current Security Time STS. That is, if MCUA successfully preempts, its token state is updated to TOKEN A WRITE, with status code 0x5A; otherwise, the same applies.

[0031] A preset read time limit is set. If the time taken to read the global shared variable token state exceeds the read time limit, it is determined as a read timeout and fault handling is initiated immediately. The read time limit is ≤10µs. If the preemption fails, fault handling is initiated immediately.

[0032] The scheduling table clearly defines the rules for MCU preemption of tokens: during normal operation, MCUA preempts the write token, while in security degradation mode, MCUB preempts the write token.

[0033] S3: Controlled write; The microcontroller (MCU) holding the write token executes the FOC control algorithm to obtain the theoretical values ​​that should be configured in each register in the monitoring register (SCR) set. Before writing, it performs two checks to ensure that the token state of the MCU is still in the write state to prevent race conditions caused by accidental token switching. If it is still in the write state, the theoretical values ​​that should be configured in each register are written to the monitoring register (SCR) set within the first 20% time window of the safety time slice (STS). If the write operation is not completed within the first 20% time window of the safety time slice (STS), it is determined to be a write timeout and fault handling is triggered.

[0034] The FOC control algorithm is based on the current and rotation angle data collected by sensors to calculate the configuration of the monitoring register (SCR) set that needs to be written in the current cycle.

[0035] S4: Physical mirror readback; After writing is complete, the microcontroller (MCU) holding the write token directly reads the hardware values ​​of the peripheral registers via the bus. It then fills the read hardware values ​​into the following data frame structure: Frame ID (4 bits), Rolling counter (current value, incremented by 1), timestamp (8 bits, recording the time of the readback operation), A-phase register readback value (Reg PhA Val), B-phase register readback value (Reg PhB Val), C-phase register readback value (Reg PhC Val) (three-phase PWM register readback values, 16 bits each), and dead-zone register readback value (8 bits). An 8-bit cyclic redundancy check (CRC) algorithm is used to calculate the frame checksum and CRC (8 bits) to verify whether errors occurred during data frame transmission. Finally, DMA is used to send the complete mirrored data frame to another microcontroller (MCU) via the SPI / IPC high-speed interface. DMA is a general-purpose software read method, directly accessing memory.

[0036] Peripheral registers include registers in the monitor register set. The hardware value of the peripheral register is the actual value stored in the register in the monitor register set, ensuring that the true state of the register is obtained.

[0037] S5: Calculate the independent expected value; Within the same safe time slice (STS), the microcontroller (MCU) without a write token collects current and rotation angle data through independent sensors. Based on the same control law as the FOC control algorithm of the microcontroller with a write token, it independently calculates the register value that should theoretically be written in this cycle, denoted as Exp Val.

[0038] The control law is the proportional-integral mathematical relationship followed in the FOC control algorithm, as well as the entire calculation process from the target torque to the PWM duty cycle.

[0039] Furthermore, the calculation code of the FOC control algorithm of MCUB is heterogeneous with that of MCUA (implemented using different optimization levels or algorithms), and the calculation code of MCUB should be heterogeneous with that of MCUA to ensure that the calculation logic of the two MCUs is independent in order to prevent common cause failure.

[0040] S6: Consistency check; S61: Verify the mirrored data frame; When a microcontroller (MCU) without a write token receives a mirrored data frame, it first checks the frame checksum (CRC) and the rolling counter. If the check fails, the error counter increments by 1. S62: Verification passed, calculate the deviation Diff; If the verification passes, calculate the deviation Diff. The deviation is obtained by calculating Diff=Abs(Reg PhX Val-Exp Val), where Reg PhX Val is the physical readback value of each register in the mirrored data frame; Exp Val is the register value that should be written in this cycle, independently calculated by the microcontroller MCU that does not hold a write token.

[0041] S63: Determine the grade based on the deviation (Diff); The levels include Level 1 (normal), Level 2 (minor deviation), and Level 3 (serious failure); Compare the deviation Diff with the minor deviation threshold Threshold Static and the severe failure threshold Threshold Safety; If the deviation Diff is less than the slight deviation threshold Threshold Static, it is judged as Level 1 (normal); the error counter is cleared.

[0042] If the minor deviation threshold Threshold Static ≤ Deviation Diff ≤ Severe failure threshold ThresholdSafety, it is judged as Level 2 (minor deviation), triggering the error counter to increment by 1, and continuing to monitor the status of the next cycle.

[0043] If the deviation Diff > the critical failure threshold Threshold Safety, it is judged as Level 3 (critical failure); synchronization is immediately triggered and fault handling begins. S64: If the error counter exceeds the fault confirmation threshold and accumulates to more than M times within N cycles, then the minor deviation will be upgraded to a serious failure.

[0044] S7: Release and hand over the token; Before the end of the Safety Time Slice (STS), a preset time margin is set. Within the time window from the preset time margin to the end of the STS, the microcontroller (MCU) holding the write token changes the token state to TOKENHANDOVER. If the token state is not changed by the end of the STS, it will not be released after the timeout. The monitoring party of the microcontroller (MCU) that does not hold the write token will determine it as a deadlock and trigger a synchronization cutoff.

[0045] S8: Troubleshooting; S81: Perform synchronous disconnection; MCUA and MCUB each have an independent Safe Out GPIO pin. These two Safe Out GPIO pins are connected in series in the Enable pin loop of the three-phase inverter pre-driver chip GateDriver via an external wired-AND circuit or an independent dual-channel MOSFET. In response to any MCU detecting a critical failure, token read / write timeout, or other issues, a request instruction is sent to pull its own Safe Out GPIO pin low. This hardware disconnects the Enable pin of the three-phase inverter pre-driver chip GateDriver, forcibly shutting down power output within a hardware propagation delay (<1µs).

[0046] This invention does not rely on the response speed of software interrupts, but instead uses direct hardware connection to improve the fault response speed from milliseconds (ms) to microseconds (µs), providing a great redundancy for steering safety under high-speed autonomous driving (L3+).

[0047] S82: Security degradation triggers a security state; Illuminate the "Steering System Fault" red light on the dashboard and record the diagnostic code DTC0x5432 (SafetyMonitorMismatch). Reset the hardware driver module using the MCUA software.

[0048] Diagnostic codes are standardized codes used to identify fault types. DTC0x5432 represents a safety monitoring mismatch.

[0049] Compared with the prior art, the beneficial effects of the present invention are as follows: (1) The present invention not only covers CPU calculation errors, but also peripheral register flips, bus transmission errors, DMA write errors and other faults caused by random hardware failures, with a fault diagnosis coverage rate of >99%. (2) The present invention achieves microsecond-level response, improving the fault response speed from milliseconds (ms) to microseconds (µs), providing great redundancy for steering safety under high-speed autonomous driving (L3+). Microsecond-level synchronous cutoff locks fault detection and response within a single or double time slice, realizing microsecond-level deterministic safety cutoff that does not rely on OS scheduling. (3) The present invention uses a time-to-token mutual exclusion mechanism to divide the control cycle into safe time slices, and uses atomic tokens to force the mutual exclusion write permissions of the two MCUs to key registers, eliminating the risk of dual write race. (4) The monitoring object of the present invention is down to the physical readback value of the hardware register, rather than the application layer calculation result, filling the monitoring blind spot of hardware failure in the execution link. (5) This invention does not require the addition of expensive external FPGA or dedicated ASIC. It can be implemented using only the existing timers, shared memory and atomic instructions of automotive MCU. The software purity is high and the cost is low. Attached Figure Description

[0050] Figure 1 This is a flowchart of the steps in the MCU synchronization failure handling method of dual redundant EPS according to the present invention; Figure 2 This is a flowchart of a method for handling MCU synchronization failure in a dual-redundant EPS according to the present invention; Figure 3 This is a schematic diagram of the hardware connection structure of a dual-redundant EPS MCU synchronization failure handling method according to the present invention. Detailed Implementation

[0051] To provide a further understanding of the purpose, structure, features, and functions of the present invention, detailed descriptions are provided below with reference to specific embodiments.

[0052] like Figure 1 , Figure 2 and Figure 3 A method for handling MCU synchronization failure in a dual-redundant EPS system includes two microcontrollers (MCUs), namely MCUA and MCUB. The two MCUs share access permissions or monitoring paths to safety-critical hardware resources and exchange data. Includes the following steps: S1: Configure key parameters and initialize tokens and communication protocols; Key parameters include: PWM carrier frequency, safety time slice, monitoring register set, verification threshold, error counter, and fault confirmation threshold; S2: Timing synchronization and token preemption arbitration; Two microcontrollers (MCUs) are hard synchronized. During normal operation, MCUA holds the write token. When MCUA fails and enters the security degradation mode, the write token is preempted. At the beginning of each security time slice, the write token is preempted according to the preset schedule. S3: Controlled write; The microcontroller (MCU) holding the write token executes the FOC control algorithm to obtain the theoretical values ​​that each register in the SCR set should be configured with; and writes them into the SCR set. S4: Physical mirror readback; After the write operation is complete, the microcontroller MCU holding the write token directly reads the hardware value of the peripheral register, fills the mirror data frame with the read hardware value according to the mirror data frame structure, and sends the complete mirror data frame to another microcontroller MCU. S5: Calculate the independent expected value; Microcontrollers (MCUs) that do not hold a write token independently calculate the register values ​​that should theoretically be written in this cycle within the same safe time slice; S6: Consistency check; Verify the mirrored data frame and calculate the deviation. Determine the level based on the deviation and trigger fault handling based on the level. S7: Release and hand over the token; Change the token state to a handover transition state before the end of the security time slice; S8: Troubleshooting; Perform a synchronous disconnection and enter a security degradation trigger security state.

[0053] Furthermore, step S1 specifically includes: S11: Configure key parameters; S111: Set the PWM carrier frequency to 20kHz, corresponding to a PWM period Tpwm of 50µs; S112: Define a safety time slice; Set the safety time slice STS=K*T pwm , where K is a positive integer; S113: Configure the set of monitoring registers (SCRs); The SCR set of monitoring registers includes the PWM compare register, dead time register, bridge arm output enable register, and ADC trigger configuration register; The PWM compare registers include the A-phase PWM register, the B-phase PWM register, and the C-phase PWM register; S114: Set the verification threshold, error counter, and fault confirmation threshold; The verification thresholds include the minor deviation threshold and the severe failure threshold; The error counter is initially set to 0; the fault confirmation threshold is set to M, and a fault is determined when the number of consecutive abnormalities reaching this threshold within a period is reached. S12: Initialize token and communication protocol; Set the global shared variable token state to a transitional state, which can only be modified via atomic instructions. S122: Initialize the image data frame protocol; The mirrored data frame structure is a dedicated SPI / IPC communication frame.

[0054] Furthermore, the globally shared variable token state includes: TOKEN A WRITE: MCUA has write permissions, MCUB only performs verification; TOKEN B WRITE: MCUB has write permissions, MCUA only performs verification; TOKEN HANDOVER: Handover transition state, prohibiting either party from writing to it; TOKEN LOCKED: Fault-locked state, write is prohibited, triggering a safety action; The mirrored data frame structure includes fields and length; The fields include Frame ID, Rolling counter, Timestamp of sampling time, Physical readback value of A-phase PWM register Reg PhA Val, Physical readback value of B-phase PWM register Reg PhBVal, Physical readback value of C-phase PWM register Reg PhC Val, Physical readback value of dead zone register, and Frame checksum CRC; the initial value of the Rolling counter is 0. The frame type identifier (Frame ID) and the rolling counter are both 4 bits long; the timestamp (timestamp), the physical readback value of the dead zone register, and the frame checksum and CRC are all 8 bits long; and the physical readback values ​​of the A-phase PWM register (Reg PhA Val), the B-phase PWM register (Reg PhB Val), and the C-phase PWM register (Reg PhC Val) are all 16 bits long.

[0055] Furthermore, step S2 includes: S21: Two microcontrollers (MCUs) are hard synchronized via hardware timer or PWM center alignment interrupt; S22: Dual microcontroller (MCU) preemption of write token; At the start of each Safety Time Slice (STS), the two microcontrollers (MCUs) synchronously interrupt and read the global shared variable Token State. If the token state is in a handover transition state, they will preempt the write token through atomic operations according to the preset scheduling table and obtain the write permission to the monitoring register (SCR) set. After one MCU successfully preempts the token, it will update the token state of the preempted MCU to the write state. A preset read time limit is set. If the time taken to read the globally shared variable token state exceeds the read time limit, it is determined to be a read timeout and immediately enters the fault handling stage. The scheduling table clearly defines the rules for MCU preemption of tokens: during normal operation, MCUA preempts the write token, while in security degradation mode, MCUB preempts the write token.

[0056] Furthermore, in step S3, before writing the theoretical values ​​that should be configured in each register, the token state of the microcontroller MCU is checked twice to see if it is still in the write state. If it is still in the write state, the theoretical values ​​that should be configured in each register are written into the monitoring register set within the first 20% time window of the safe time slice STS. If the write operation is not completed within the first 20% time window of the safe time slice STS, it is determined to be a write timeout and a fault is triggered.

[0057] Furthermore, step S6 includes: S61: Verify the mirrored data frame; When a microcontroller (MCU) without a write token receives a mirrored data frame, it first checks the frame checksum (CRC) and the rolling counter. If the check fails, the error counter is incremented by 1. S62: Verification passed, calculate the deviation Diff; If the verification passes, calculate the deviation Diff; the deviation Diff is obtained by the absolute value of the difference between the physical readback value of each register in the mirrored data frame and the register value that should be theoretically written in this cycle independently calculated by the microcontroller MCU that does not hold a write token. S63: Determine the grade based on the deviation (Diff); Compare the deviation Diff with the magnitudes of the slight deviation threshold and the severe failure threshold; If the deviation Diff is less than the slight deviation threshold, it is considered normal and the error counter is cleared. If the deviation threshold ≤ deviation Diff ≤ severe failure threshold, it is judged as a minor deviation, triggering the error counter to increment by 1, and the status is monitored for the next cycle. If the deviation Diff > the severe failure threshold, it is judged as a severe failure, and the synchronization is immediately cut off, and the fault handling process begins. S64: If the error counter exceeds the fault confirmation threshold and accumulates to more than M times within N cycles, then the minor deviation will be upgraded to a serious failure.

[0058] Furthermore, in step S7, a preset time margin is set before the end of the safe time slice STS. The microcontroller MCU holding the write token modifies the token state TokenState to the handover transition state within the time window from the preset time margin to the end of the safe time slice STS. If the token state is not modified by the end of the safe time slice STS, it will not be released after the timeout. The microcontroller MCU that does not hold the write token is determined to be deadlocked and triggers the synchronization cutoff.

[0059] Furthermore, MCUA and MCUB each have an independent Safe Out GPIO pin; the two Safe Out GPIO pins are connected in series in the Enable pin circuit of the three-phase inverter pre-driver chip; Step S8 includes: S81: Perform synchronous disconnection; In response to any microcontroller (MCU) detecting a critical failure or token read / write timeout, a request instruction is sent to pull its own Safe Out GPIO pin low, and the hardware disables the Enable pin of the three-phase inverter pre-driver chip. S82: Security degradation triggers a security state; Illuminate the red "Steering System Fault" light on the dashboard and record the diagnostic code DTC0x5432; reset the MCUA hardware driver module.

[0060] Furthermore, the computational codes of the FOC control algorithms of MCUB and MCUA are heterogeneous; however, the control laws of the FOC control algorithms of MCUB and MCUA are the same.

[0061] Furthermore, MCUA is the main controller, using Infineon TC3xx, Lockstep core, and is responsible for the main control algorithm; MCUB is a monitoring / co-controller, using NXP S32K334, responsible for independent monitoring and redundancy verification; MCUA and MCUB are connected via SPI bus at a baud rate of 10Mbps or through inter-chip shared memory.

[0062] Example 1

[0063] A method for handling MCU synchronization failure in a dual-redundant EPS system includes: Step 101: Set up the hardware environment; Main controller: Infineon TC3xx (Lockstep core, as MCUA) is used to handle the main control algorithm.

[0064] Monitoring / Co-controller: NXP S32K334 (as MCUB) is used for independent monitoring and redundancy verification.

[0065] Communication link: The two are connected via SPI bus (10Mbps baud rate) or inter-chip shared memory (IPC).

[0066] Actuator interface: The three-phase inverter pre-driver chip (Gate Driver) has its Enable pin connected to the node after the GPIO output of MCUA and MCUB is passed through "wired-AND" logic; the drive can be cut off by pulling the GPIO low of either MCU.

[0067] Step 102: Configure key parameters; PWM carrier frequency: 20 kHz (period T) pwm = 50 µs); Safety time slice (Ts): defined as 5 PWM cycles, i.e., Ts = 250 µs.

[0068] 250µs is sufficient to complete one SPI data packet transmission (approximately 20µs) and verification calculation (approximately 5µs), and for EPS systems, a fault response delay of 250µs is acceptable.

[0069] Monitor register set (R): 1. FTM0_C0V (A-phase duty cycle); 2. FTM0_C1V (B-phase duty cycle); 3. FTM0_C2V (C-phase duty cycle); 4. FTM0_DEADTIME (Dead Time Configuration); 5. FTM0_OUTMASK (Output Mask / Enable Bit); Step 103: Run the process; In normal operation, proceed to the k-th time slice (Ts_k): Normal operation (in normal mode, according to the scheduling table, MCUA writes and MCUB verifies): 1. T=0µs: Time slice interrupt triggered. MCUA reads the status code Token_Flag and confirms the value as 0x5A (meaning A has write permission).

[0070] 2. T=10µs: MCUA runs the FOC algorithm, calculates the new duty cycle, and writes it to the FTM0_CnV register.

[0071] 3. T = 15µs: The MCUA immediately reads back the hardware values of 5 registers such as FTM0_CnV, packs them into the mirror data frame Mirror_A, and sends it to the MCUB via SPI.

[0072] 4. T = 50µs: The MCUB receives the mirror data frame Mirror_A. Meanwhile, the MCUB reads the register status of the MCUA via SPI or hardwiring (or maintains a set of shadow registers on the MCUB side and receives the calculation inputs of the MCUA for independent recalculation, depending on the hardware architecture; if the hardware does not support direct cross-chip register reading, the MCUB should independently calculate the "expected value" as Calculated_Expected_B based on the input data sent by the MCUA).

[0073] Preferably, the MCUB independently acquires sensor data and calculates the "expected register value" Calculated_Expected_B as a benchmark.

[0074] 5. T = 60µs: The MCUB calculates the deviation Diff: Diff = Abs(Mirror_A - Calculated_Expected_B). If Diff < Threshold, the consistency check passes.

[0075] 6. T = 240µs: As the time slice is about to end, the MCUA atomically modifies the status code Token_Flag to 0xCC (handover transition state, prohibiting any party from writing).

[0076] When a fault occurs (register bit flip), then: 1. T = 10µs: The MCUA writes the A-phase duty cycle 5000 (0x1388).

[0077] 2. T = 12µs: Affected by cosmic rays, the FTM0_C0V register undergoes a bit flip and becomes 21384 (0x5388, high bit flipped), which will cause the motor current to surge.

[0078] 3. T = 15µs: The MCUA reads back the A-phase register and reads the incorrect value 0x5388. The MCUA software does not detect it (if no self-check is performed) and directly sends 0x5388 to the MCUB.

[0079] 4. T = 60µs: The MCUB calculates that the expected value should be approximately 5000.

[0080] 5. T = 65µs: The MCUB compares and finds that the difference between 0x5388 and 5000 is huge.

[0081] 6. T=70µs: MCUB determines "register failure" and immediately pulls its GPIO pin connected to the Gate Driver low.

[0082] 7. Result: The fault was cut off within 70µs, and the motor had not yet generated enough torque to cause the vehicle to deviate (EPS mechanical response is typically in the millisecond range).

[0083] Example 2

[0084] The difference from Example 1 is that it also includes step 104: fault degradation strategy; Initial check: If the consistency check fails, the error counter Err_Cnt + 1.

[0085] Confirmation threshold: If the error counter Err_Cnt >= 2 (two consecutive time slices of abnormality, excluding occasional SPI interference), a safe state is triggered.

[0086] Perform safety-state actions: 1. Disable the Gate Driver via hardware.

[0087] 2. MCUA software reset hardware driver module (FOC module).

[0088] 3. Record DTC0x5432 (Safety Monitor Mismatch).

[0089] 4. Illuminate the red "Steering System Fault" light on the dashboard.

[0090] The present invention has been described by the above-described embodiments; however, these embodiments are merely examples for implementing the present invention. It must be noted that the disclosed embodiments do not limit the scope of the present invention. Conversely, any modifications and refinements made without departing from the spirit and scope of the present invention are within the scope of patent protection of the present invention.

Claims

1. A method for handling MCU synchronization failure in a dual-redundant EPS system, characterized in that: It includes two microcontrollers (MCUs), namely MCUA and MCUB. The two microcontrollers share access permissions or monitoring paths to safety-critical hardware resources and exchange data. Includes the following steps: S1: Configure key parameters and initialize tokens and communication protocols; Key parameters include: PWM carrier frequency, safety time slice, monitoring register set, verification threshold, error counter, and fault confirmation threshold; S2: Timing synchronization and token preemption arbitration; Two microcontrollers (MCUs) are hard synchronized, and at the beginning of each safe time slice, they preempt the write token according to a preset schedule. S3: Controlled write; The microcontroller (MCU) holding the write token executes the FOC control algorithm to obtain the theoretical values ​​that each register in the SCR set should be configured with; and writes them into the SCR set. S4: Physical mirror readback; After the write operation is complete, the microcontroller MCU holding the write token directly reads the hardware value of the peripheral register, fills the mirror data frame with the read hardware value according to the mirror data frame structure, and sends the complete mirror data frame to another microcontroller MCU. S5: Calculate the independent expected value; Microcontrollers (MCUs) that do not hold a write token independently calculate the register values ​​that should theoretically be written in this cycle within the same safe time slice; S6: Consistency check; Verify the mirrored data frame and calculate the deviation. Determine the level based on the deviation and whether to trigger fault handling based on whether the level is a severe failure. S7: Release and hand over the token; Change the token state to a handover transition state before the end of the security time slice; S8: Troubleshooting; Perform a synchronous disconnection and enter a security degradation mode to trigger a security state.

2. The MCU synchronization failure handling method for dual-redundant EPS as described in claim 1, characterized in that: Step S1 specifically includes: S11: Configure key parameters; S111: Set the PWM carrier frequency to 20kHz, corresponding to a PWM period Tpwm of 50µs; S112: Define the safety time slice; Set the safety time slice STS=K*T pwm , where K is a positive integer; S113: Configure the set of monitoring registers (SCRs); The SCR set of monitoring registers includes the PWM compare register, dead time register, bridge arm output enable register, and ADC trigger configuration register; The PWM compare registers include the A-phase PWM register, the B-phase PWM register, and the C-phase PWM register; S114: Set the verification threshold, error counter, and fault confirmation threshold; The verification thresholds include the minor deviation threshold and the severe failure threshold; The error counter is initially set to 0; the fault confirmation threshold is set to M, and a fault is determined when the number of consecutive abnormalities reaching this threshold within a period is reached. S12: Initialize token and communication protocol; Set the global shared variable token state to a transitional state, which can only be modified via atomic instructions. S122: Initialize the image data frame protocol; The mirrored data frame structure is a dedicated SPI / IPC communication frame.

3. The MCU synchronization failure handling method for dual-redundant EPS as described in claim 2, characterized in that: The globally shared variable token state includes: TOKEN A WRITE: MCUA has write permissions, MCUB only performs verification; TOKEN B WRITE: MCUB has write permissions, MCUA only performs verification; TOKEN HANDOVER: Handover transition state, prohibiting either party from writing to it; TOKEN LOCKED: Fault-locked state, write is prohibited, triggering a safety action; The mirrored data frame structure includes fields and length; The fields include Frame ID, Rolling counter, Timestamp of sampling time, Physical readback value of A-phase PWM register Reg PhA Val, Physical readback value of B-phase PWM register Reg PhBVal, Physical readback value of C-phase PWM register Reg PhC Val, Physical readback value of dead zone register, and Frame checksum CRC; the initial value of the Rolling counter is 0. The frame type identifier (Frame ID) and the rolling counter are both 4 bits long; the timestamp (timestamp), the physical readback value of the dead zone register, and the frame checksum and CRC are all 8 bits long; and the physical readback values ​​of the A-phase PWM register (Reg PhA Val), the B-phase PWM register (Reg PhB Val), and the C-phase PWM register (Reg PhC Val) are all 16 bits long.

4. The MCU synchronization failure handling method for dual-redundant EPS as described in claim 2, characterized in that: Step S2 includes: S21: Two microcontrollers (MCUs) are hard synchronized via hardware timer or PWM center alignment interrupt; S22: Dual microcontroller (MCU) preemption of write token; At the start of each Safety Time Slice (STS), the two microcontrollers (MCUs) synchronously interrupt and read the global shared variable Token State. If the token state is in a handover transition state, they will preempt the write token through atomic operations according to the preset scheduling table and obtain the write permission to the monitoring register (SCR) set. After one MCU successfully preempts the token, it will update the token state of the preempted MCU to the write state. A preset read time limit is set. If the time taken to read the globally shared variable token state exceeds the read time limit, it is determined to be a read timeout and immediately enters the fault handling stage. The scheduling table clearly defines the rules for MCU preemption of tokens: during normal operation, MCUA preempts the write token, while in security degradation mode, MCUB preempts the write token.

5. The MCU synchronization failure handling method for dual-redundant EPS as described in claim 4, characterized in that: In step S3, the theoretical values ​​to be configured in each register are written to the microcontroller MCU before the token state is checked twice to see if it is still in the write state. If it is still in the write state, the theoretical values ​​to be configured in each register are written to the monitoring register set within the first 20% time window of the safe time slice STS. If the write operation is not completed within the first 20% time window of the safe time slice STS, it is determined to be a write timeout and a fault is triggered.

6. The MCU synchronization failure handling method for dual-redundant EPS as described in claim 1, characterized in that: Step S6 includes: S61: Verify the mirrored data frame; When a microcontroller (MCU) without a write token receives a mirrored data frame, it first checks the frame checksum (CRC) and the rolling counter. If the check fails, the error counter is incremented by 1. S62: Verification passed, calculate the deviation Diff; If the verification passes, calculate the deviation Diff; the deviation Diff is obtained by the absolute value of the difference between the physical readback value of each register in the mirrored data frame and the register value that should be theoretically written in this cycle independently calculated by the microcontroller MCU that does not hold a write token. S63: Determine the grade based on the deviation (Diff); Compare the deviation Diff with the magnitudes of the slight deviation threshold and the severe failure threshold; If the deviation Diff is less than the slight deviation threshold, it is considered normal and the error counter is cleared. If the deviation threshold ≤ deviation Diff ≤ severe failure threshold, it is judged as a minor deviation, triggering the error counter to increment by 1, and the status is monitored for the next cycle. If the deviation Diff > the severe failure threshold, it is judged as a severe failure, and the synchronization is immediately cut off, and the fault handling process begins. S64: If the error counter exceeds the fault confirmation threshold and accumulates to more than M times within N cycles, then the minor deviation will be upgraded to a serious failure.

7. The MCU synchronization failure handling method for dual-redundant EPS as described in claim 2, characterized in that: Step S7 sets a preset time margin before the end of the security time slice STS. The microcontroller (MCU) holding the write token modifies the token state to the handover transition state within the time window from the preset time margin to the end of the security time slice STS. If the token state is not modified by the end of the safe time slice (STS), it will not be released after the timeout. The microcontroller (MCU) that does not hold the write token will be considered deadlocked and trigger a synchronization cutoff.

8. The MCU synchronization failure handling method for dual-redundant EPS as described in claim 5, characterized in that: MCUA and MCUB each have an independent Safe Out GPIO pin; the two Safe Out GPIO pins are connected in series in the Enable pin circuit of the three-phase inverter pre-driver chip; Step S8 includes: S81: Perform synchronous disconnection; In response to any microcontroller (MCU) detecting a critical failure or token read / write timeout, the request instruction pulls its own SafeOut GPIO pin low, and the hardware disconnects the Enable pin of the three-phase inverter pre-driver chip; S82: Security degradation triggers a security state; Illuminate the "Steering System Fault" red light on the dashboard and record the diagnostic code DTC0x5432; reset the MCUA hardware driver module.

9. The MCU synchronization failure handling method for dual-redundant EPS as described in claim 1, characterized in that: The computational codes of the FOC control algorithms of MCUB and MCUA are heterogeneous; the control laws of the FOC control algorithms of MCUB and MCUA are the same.

10. The MCU synchronization failure handling method for dual-redundant EPS as described in claim 1, characterized in that: MCUA is the main controller, using Infineon TC3xx and Lockstep core, and is responsible for the main control algorithm; MCUB is a monitoring / co-controller, using NXP S32K334, responsible for independent monitoring and redundancy verification; MCUA and MCUB are connected via SPI bus at a baud rate of 10Mbps or through inter-chip shared memory.

Images