Central gateway and regional controller cross bus communication dispatch and emergency handling method

Abstract

This invention discloses a method for cross-bus communication scheduling and emergency response between a central gateway and a regional controller, comprising the following steps: Step 1, data acquisition; Step 2, virtual deterministic channel mapping and control plane construction; Step 3, health quantification calculation and abnormal event identification; Step 4, hardware coupling and linkage control triggered by anomalies; Step 5, observable output of degradation actions and evidence retention. This invention achieves standardized modeling of cross-bus messages through a unified message level vector, establishes a virtual deterministic channel to achieve unified orchestration of all types of vehicle buses, directly incorporates the underlying network physical state into the decision-making closed loop, and can quickly link and execute critical flow protection and non-critical flow control in case of anomalies. At the same time, it constructs standardized observable representations and tamper-proof evidence chains, solving the pain points of insufficient determinism, lack of abnormal linkage, and poor evidentiaryness in existing technologies, and meeting the core requirements of automotive-grade functional safety and mass production implementation.

Description

Technical Field

[0001] This invention relates to the field of intelligent vehicle technology, specifically to a method for cross-bus communication scheduling and emergency response between a central gateway and a regional controller. Background Technology

[0002] As automotive electronic and electrical architecture evolves from a distributed model to a centralized computing and regional control architecture, the vehicle communication network has transformed from a traditional system with a limited number of static CAN messages to a hybrid in-vehicle network coexisting with multiple protocols such as CAN / CAN-FD, LIN, Ethernet, TSN, and diagnostic links. New-generation central gateways, central computing platforms, and regional controller chips are gradually integrating network acceleration, security encryption / decryption, and multi-bus convergence capabilities. Mass production challenges have shifted from basic message forwarding capabilities to ensuring deterministic transmission of critical control flows in hybrid bus scenarios, coordinated control of network anomalies and functional degradation, and end-to-end observable and verifiable compliance support. Existing related technical solutions can be categorized into three types, but all suffer from limitations in meeting the aforementioned mass production requirements: 1. The first category belongs to general vehicle gateways, vehicle middleware or message routing solutions. Its focus is on protocol adaptation, message forwarding or function integration. This type of solution can usually complete basic forwarding, but it lacks unified modeling for latency budget, packet loss tolerance, authentication requirements and key control flow retention between different buses. 2. The second category is single-bus anomaly / attack detection solutions, such as detecting CAN identifier anomalies, format anomalies, reception time anomalies, authentication failures, or waveform fingerprint anomalies. These solutions can detect local faults, but cannot link anomaly identification with message orchestration strategies, gateway hardware resources, and function degradation actions in cross-bus scenarios. 3. The third category is TSN or deterministic network scheduling schemes, which focus on time slots, priorities and clock synchronization on the Ethernet link side. They do not cover the large number of existing CAN / LIN buses, diagnostic links and internal hardware resources of the regional controller in the vehicle. They lack a unified message description, health measurement and standardized external output mechanism. It is difficult to cover the full-scenario mass production needs of the whole vehicle central combined with regional architecture by relying on scheduling within a single protocol. Summary of the Invention

[0003] The purpose of this invention is to provide a method for cross-bus communication scheduling and emergency response between a central gateway and a regional controller, so as to solve the problems mentioned in the background art.

[0004] To achieve the above objectives, the present invention provides the following technical solution: a method for cross-bus communication scheduling and emergency response between a central gateway and a regional controller, comprising the following steps: Step 1, data acquisition; Step 2, virtual deterministic channel mapping and control plane construction; Step 3, quantitative calculation of health metrics and identification of abnormal events; Step 4, hardware coupling and linkage control for abnormal triggering; Step 5, observable output of degradation actions and evidence retention. In step one above, messages to be forwarded from different vehicle buses are collected, and each message and message group in the messages to be forwarded are standardized into a message level vector in a unified format. Network physical state data of the vehicle hybrid bus network is collected periodically to construct a real-time updated network physical state vector. The message level vector includes the message's security level, deadline, transmission constraints, and external status identifier. The network physical state data includes ingress queue backlog, egress queue backlog, transmission service latency, CAN arbitration loss count, TSN clock skew, error frame ratio, authentication failure count, link switching count, packet loss rate, retransmission rate, backup path liveness status, and network acceleration engine congestion status. In step two above, a virtual deterministic channel mapping relationship is established across different vehicle buses based on the message level vector, and a channel control plane object corresponding to the virtual deterministic channel mapping relationship is generated. The virtual deterministic channel mapping relationship includes the ingress queue, egress queue, transmission priority, TSN gated time slot, CAN arbitration quota, authentication strategy, replication strategy, network acceleration path, and backup path corresponding to the message. In step three above, a network health score is calculated based on the network physical state vector, and abnormal events in the vehicle network are identified based on the network physical state data. The health score is calculated based on a normalized weighted sum of two or more of the following: queue backlog, transmission service delay, CAN arbitration loss count, TSN clock skew, packet loss rate, retransmission rate, and authentication failure count. In step four above, when an abnormal event in the vehicle network is detected, a linkage control action strongly coupled with the underlying resources of the vehicle network is executed. When the abnormality continues to reach a preset threshold, a safety degradation action is executed. The linkage control action includes updating the TSN gating table, adjusting the inbound queue quota, adjusting the outbound queue quota, increasing the priority of critical control flows, copying critical control flows to redundant paths, limiting the sending cycle of non-critical flows, switching network acceleration paths, performing pre-failure migration, preventing non-critical flows from encroaching on critical channel resources, limiting diagnostic bandwidth, sending a restricted operation request to the upper-level controller, sending a comfort function shutdown request to the vehicle controller, and a driver assistance level downgrade request. The safety degradation action is executed in the following order: critical control flows are retained, important state flows are retained, non-critical flows are compressed, and non-critical flows are suspended. In step five above, when executing the linkage control action and the security degradation action, standardized degradation characterization information is output to the preset external interface to generate an immutable evidence digest that is protected by security and corresponds to the current channel configuration, network status, and linkage action.

[0005] In step one, the vehicle bus includes CAN, CAN-FD, LIN, Ethernet, TSN, diagnostic link, and vehicle internal interconnection interface.

[0006] In step one, the transmission constraints include packet loss tolerance, authentication requirements, and redundancy requirements, while the external status identifiers include external degradation reason code identifiers, status bitmap identifiers, and policy version identifiers.

[0007] In step two, the virtual deterministic channel is used to provide a fixed reservation queue, fixed time slot, priority boosting resources, and redundant path resources for critical control flow under preset maximum latency, maximum jitter, packet loss limit, and authentication constraints.

[0008] Before activation, the channel table, gating table, and abnormal linkage policy corresponding to the virtual deterministic channel must undergo consistency and security verification. This verification checks the consistency between the current policy version, authentication policy version, security software version, OTA status, and hardware topology identifier. For channel policy packages from local storage, OTA upgrades, and cloud distribution, the verification checks the digital signature, version number, and compatible hardware topology identifier. Only after the verification passes can the corresponding channel table and linkage policy be enabled. The channel policy package includes a channel table, gating table, replication policy, migration policy, and version summary.

[0009] In step two, the channel control plane object includes a channel table identifier, a health threshold version number, a redundant path policy identifier, a migration rule identifier, and an external degradation reason code identifier.

[0010] The channel control plane object can be queried, subscribed to, compared in version, and replayed in anomaly through the upper-layer operating system, virtualization layer, SDK, middleware, and diagnostic services, so that it can be called by upper-layer applications, verification tools, and operation and maintenance tools.

[0011] In step three, abnormal events include critical queue congestion, duplicate message anomalies, authentication failure, backup link failure, abnormal retransmission, clock drift exceeding the threshold, and insufficient egress bandwidth.

[0012] In step four, the critical control flow includes braking-related messages, steering-related messages, power-related messages, and chassis-related messages; the non-critical flow includes logs, entertainment, comfort services, and non-real-time diagnostic messages.

[0013] In step five, the standardized degradation characterization information includes a standardized reason code corresponding to the current action, a health status bitmap, a channel table identifier, and a policy version number; the preset external interfaces include the vehicle CAN bus, vehicle CAN-FD bus, Ethernet diagnostic channel, UDS diagnostic service, HMI human-machine interface, upper-layer operating system interface, virtualization layer interface, SDK interface, and middleware interface; the evidence digest is signed and protected for integrity by a hardware security module and a trusted execution environment to ensure immutability.

[0014] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention achieves standardized modeling of cross-bus messages through a unified message level vector, establishes a virtual deterministic channel to achieve unified orchestration of all types of vehicle buses, directly incorporates the underlying network physical state into the decision-making closed loop, and can quickly link and execute critical flow protection and non-critical flow control in case of anomalies. At the same time, it constructs a standardized observable representation and an immutable evidence chain, solving the pain points of insufficient determinism, lack of anomaly linkage, and poor probative value in existing technologies, and meeting the core requirements of automotive-grade functional safety and mass production implementation. Attached Figure Description

[0015] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a schematic diagram of the system architecture for an experimental example of the present invention; Figure 3 This diagram illustrates the relationship between message level and security degradation. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] Please see the appendix Figure 1 -Appendix Figure 3 The present invention provides an embodiment of a method for cross-bus communication scheduling and emergency response between a central gateway and a regional controller, comprising the following steps: Step 1, data acquisition; Step 2, virtual deterministic channel mapping and control plane construction; Step 3, health measurement calculation and abnormal event identification; Step 4, hardware coupling linkage control for abnormal triggering; Step 5, observable output of degradation actions and evidence retention. In step one above, messages to be forwarded from different vehicle buses are collected. Each message and message group in the messages to be forwarded is standardized into a message level vector of a unified format. Network physical state data of the vehicle hybrid bus network is periodically collected to construct a real-time updated network physical state vector. The vehicle buses include CAN, CAN-FD, LIN, Ethernet, TSN, diagnostic links, and vehicle internal interconnection interfaces. The message level vector includes the message's security level, deadline, transmission constraints, and external status identifier. Transmission constraints include packet loss tolerance, authentication requirements, and redundancy requirements. External status identifiers include external degradation reason code identifiers, status bitmap identifiers, and policy version identifiers. Network physical state data includes ingress queue backlog, egress queue backlog, transmission service latency, CAN arbitration loss count, TSN clock skew, error frame ratio, authentication failure count, link switching count, packet loss rate, retransmission rate, backup path liveness status, and network acceleration engine congestion status. In step two above, a virtual deterministic channel mapping relationship is established across different vehicle buses based on the message level vector, generating a channel control plane object corresponding to the virtual deterministic channel mapping relationship. The virtual deterministic channel mapping relationship includes the message's ingress queue, egress queue, transmission priority, TSN gated time slot, CAN arbitration quota, authentication policy, replication policy, network acceleration path, and backup path. The channel control plane object includes a channel table identifier, health threshold version number, redundant path policy identifier, migration rule identifier, and external degradation reason code identifier. The channel control plane object can be queried, subscribed to, version compared, and anomaly replayed through the upper-layer operating system, virtualization layer, SDK, middleware, and diagnostic services, providing data for upper-layer applications, verification tools, and maintenance personnel. Tool Invocation; Virtual deterministic channels are used to provide fixed reserved queues, fixed time slots, priority boosting resources, and redundant path resources for critical control flows under preset maximum latency, maximum jitter, packet loss limit, and authentication constraints. Before activation, the channel table, gating table, and abnormal linkage policy corresponding to the virtual deterministic channel must undergo consistency and security verification. This verification checks the consistency between the current policy version, authentication policy version, security software version, OTA status, and hardware topology identifier. For channel policy packages from local storage, OTA upgrades, and cloud distribution, the digital signature, version number, and adapted hardware topology identifier are verified. Only after the verification passes can the corresponding channel table and linkage policy be enabled. The channel policy package includes a channel table, gating table, replication policy, migration policy, and version summary. In step three above, a network health score is calculated based on the network physical state vector, and abnormal events in the vehicular network are identified based on the network physical state data. The health score is calculated based on the normalized weighted sum of queue backlog, transmission service delay, CAN arbitration loss count, TSN clock skew, packet loss rate, retransmission rate, and authentication failure count. Abnormal events include critical queue congestion, duplicate message anomalies, authentication failure, backup link failure, abnormal retransmission, clock drift exceeding the threshold, and insufficient egress bandwidth. In step four above, when an abnormal event is detected in the vehicle network, a linkage control action strongly coupled with the underlying resources of the vehicle network is executed. When the abnormality continues to reach a preset threshold, a safety degradation action is executed. The linkage control action includes updating the TSN gating table, adjusting the inbound queue quota, adjusting the outbound queue quota, increasing the priority of critical control flows, copying critical control flows to redundant paths, limiting the sending cycle of non-critical flows, switching network acceleration paths, performing pre-failure migration, preventing non-critical flows from encroaching on critical channel resources, limiting diagnostic bandwidth, sending a restricted operation request to the upper-level controller, sending a comfort function shutdown request to the vehicle controller, and a driver assistance level downgrade request. The safety degradation action is executed in the following order: critical control flows are retained, important state flows are retained, non-critical flows are compressed, and non-critical flows are paused. Critical control flows include braking-related messages, steering-related messages, power-related messages, and chassis-related messages. Non-critical flows include logs, entertainment, comfort services, and non-real-time diagnostic messages. In step five above, when executing the linkage control action and the security degradation action, standardized degradation characterization information is output to the preset external interface to generate an immutable evidence digest that is protected by security and corresponds to the current channel configuration, network status, and linkage action. The standardized degradation characterization information includes a standardized reason code, health status bitmap, channel table identifier, and policy version number corresponding to the current action. The preset external interfaces include the vehicle CAN bus, vehicle CAN-FD bus, Ethernet diagnostic channel, UDS diagnostic service, HMI human-machine interface, upper-layer operating system interface, virtualization layer interface, SDK interface, and middleware interface. The evidence digest is signed and protected for integrity by the hardware security module and trusted execution environment to achieve immutability.

[0018] Experimental example: To verify the effectiveness of this invention, the following experiment was conducted: A system based on this invention was installed on a central gateway. Braking control messages were used as the critical flow, input via CAN-FD and forwarded to the TSN output link of the area controller. Log and entertainment messages were used as non-critical flows, and the non-critical and critical flows shared the same TSN physical exit. An abnormal operating condition was triggered by fault injection, including exit queue backlog, increased CAN arbitration loss count, and excessive TSN clock deviation. After detecting the abnormality, the system immediately performed a series of actions, including updating the TSN gating table, copying the braking control flow to a redundant path, and limiting the sending cycle of non-critical flows. Simultaneously, a standardized degradation reason code, health status bitmap, and channel table identifier were output, and an immutable evidence digest protected by the HSM hardware security module was generated. The experiment verified that under abnormal operating conditions, the method of this invention can ensure that the braking control messages always meet the preset latency, jitter, and zero packet loss requirements. The non-critical flow limiting action is precise and controllable, and the entire degradation process is observable and traceable, fully complying with the relevant requirements of automotive-grade functional safety, thus verifying the effectiveness of this invention.

[0019] Based on the above, the advantages of this invention are as follows: When used, by abstracting messages on different buses into message level vectors and incorporating external cause code identifiers into message objects, it is more suitable for the integrated architecture of the central gateway and the area controller compared to the scheme of processing them separately according to protocols; by directly writing physical network signals such as queue backlog, CAN arbitration loss count, TSN clock deviation, authentication failure, and backup link status into the control input, it is easier to reflect technical and engineering feasibility compared to abstract routing rules; by establishing a virtual deterministic channel and linking anomaly detection with critical flow retention, gating table adjustment, backup path switching, and safety degradation actions, it is closer to the actual needs of the whole vehicle.

[0020] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A method for scheduling and handling emergency communication between the central gateway and the regional controller across the bus, including the following steps: Step 1: Data acquisition; Step 2: Virtual deterministic channel mapping and control plane construction; Step 3: Measurement and calculation of health metrics and identification of abnormal events; Step 4: Hardware-coupled linkage control for abnormal triggering; Step 5: Observable output and evidence retention of degradation actions; Its characteristics are: In step one above, messages to be forwarded from different vehicle buses are collected, and each message and message group in the messages to be forwarded are standardized into a message level vector in a unified format. Network physical state data of the vehicle hybrid bus network is collected periodically to construct a real-time updated network physical state vector. The message level vector includes the message's security level, deadline, transmission constraints, and external status identifier. The network physical state data includes ingress queue backlog, egress queue backlog, transmission service latency, CAN arbitration loss count, TSN clock skew, error frame ratio, authentication failure count, link switching count, packet loss rate, retransmission rate, backup path liveness status, and network acceleration engine congestion status. In step two above, a virtual deterministic channel mapping relationship is established across different vehicle buses based on the message level vector, and a channel control plane object corresponding to the virtual deterministic channel mapping relationship is generated. The virtual deterministic channel mapping relationship includes the ingress queue, egress queue, transmission priority, TSN gated time slot, CAN arbitration quota, authentication strategy, replication strategy, network acceleration path, and backup path corresponding to the message. In step three above, a network health score is calculated based on the network physical state vector, and abnormal events in the vehicle network are identified based on the network physical state data. The health score is calculated based on a normalized weighted sum of two or more of the following: queue backlog, transmission service delay, CAN arbitration loss count, TSN clock skew, packet loss rate, retransmission rate, and authentication failure count. In step four above, when an abnormal event in the vehicle network is detected, a linkage control action strongly coupled with the underlying resources of the vehicle network is executed. When the abnormality continues to reach a preset threshold, a safety degradation action is executed. The linkage control action includes updating the TSN gating table, adjusting the inbound queue quota, adjusting the outbound queue quota, increasing the priority of critical control flows, copying critical control flows to redundant paths, limiting the sending cycle of non-critical flows, switching network acceleration paths, performing pre-failure migration, preventing non-critical flows from encroaching on critical channel resources, limiting diagnostic bandwidth, sending a restricted operation request to the upper-level controller, sending a comfort function shutdown request to the vehicle controller, and a driver assistance level downgrade request. The safety degradation action is executed in the following order: critical control flows are retained, important state flows are retained, non-critical flows are compressed, and non-critical flows are suspended. In step five above, when executing the linkage control action and the security degradation action, standardized degradation characterization information is output to the preset external interface to generate an immutable evidence digest that is protected by security and corresponds to the current channel configuration, network status, and linkage action.

2. The method for cross-bus communication scheduling and emergency response between the central gateway and the regional controller according to claim 1, characterized in that: In step one, the vehicle bus includes CAN, CAN-FD, LIN, Ethernet, TSN, diagnostic link, and vehicle internal interconnection interface.

3. The method for cross-bus communication scheduling and emergency response between the central gateway and the regional controller according to claim 1, characterized in that: In step one, the transmission constraints include packet loss tolerance, authentication requirements, and redundancy requirements, while the external status identifiers include external degradation reason code identifiers, status bitmap identifiers, and policy version identifiers.

4. The method for cross-bus communication scheduling and emergency response between the central gateway and the regional controller according to claim 1, characterized in that: In step two, the virtual deterministic channel is used to provide a fixed reservation queue, fixed time slot, priority boosting resources, and redundant path resources for critical control flow under preset maximum latency, maximum jitter, packet loss limit, and authentication constraints.

5. The method for cross-bus communication scheduling and emergency response between the central gateway and the regional controller according to claim 4, characterized in that: Before activation, the channel table, gating table, and abnormal linkage policy corresponding to the virtual deterministic channel must undergo consistency and security verification. This verification checks the consistency between the current policy version, authentication policy version, security software version, OTA status, and hardware topology identifier. For channel policy packages from local storage, OTA upgrades, and cloud distribution, the verification checks the digital signature, version number, and compatible hardware topology identifier. Only after the verification passes can the corresponding channel table and linkage policy be enabled. The channel policy package includes a channel table, gating table, replication policy, migration policy, and version summary.

6. The method for cross-bus communication scheduling and emergency response between the central gateway and the regional controller according to claim 1, characterized in that: In step two, the channel control plane object includes a channel table identifier, a health threshold version number, a redundant path policy identifier, a migration rule identifier, and an external degradation reason code identifier.

7. The method for cross-bus communication scheduling and emergency response between the central gateway and the regional controller according to claim 6, characterized in that: The channel control plane object can be queried, subscribed to, compared in version, and replayed in anomaly through the upper-layer operating system, virtualization layer, SDK, middleware, and diagnostic services, so that it can be called by upper-layer applications, verification tools, and operation and maintenance tools.

8. The method for cross-bus communication scheduling and emergency response between the central gateway and the regional controller according to claim 1, characterized in that: In step three, abnormal events include critical queue congestion, duplicate message anomalies, authentication failure, backup link failure, abnormal retransmission, clock drift exceeding the threshold, and insufficient egress bandwidth.

9. The method for cross-bus communication scheduling and emergency response between the central gateway and the regional controller according to claim 1, characterized in that: In step four, the key control flow includes braking-related messages, steering-related messages, power-related messages, and chassis-related messages; Non-critical flows include logs, entertainment, comfort services, and non-real-time diagnostic messages.

10. The method for cross-bus communication scheduling and emergency response between the central gateway and the regional controller according to claim 1, characterized in that: In step five, the standardized degradation characterization information includes a standardized reason code corresponding to the current action, a health status bitmap, a channel table identifier, and a policy version number; the preset external interfaces include the vehicle CAN bus, vehicle CAN-FD bus, Ethernet diagnostic channel, UDS diagnostic service, HMI human-machine interface, upper-layer operating system interface, virtualization layer interface, SDK interface, and middleware interface; the evidence digest is signed and protected for integrity by a hardware security module and a trusted execution environment to ensure immutability.

Images