A control system for a vehicle

Abstract

The application provides a control system of a vehicle, the control system comprising a vehicle master input channel and an execution module, the control system further comprising a local slave input channel, a remote slave input channel and a heterogeneous arbitration and management module, the heterogeneous arbitration and management module being configured to determine a health state of the vehicle master input channel at a preset time interval, generate a backup channel activation instruction and send the backup channel activation instruction to the local slave input channel or the remote slave input channel if it is determined that the vehicle master input channel is invalid, so that the local slave input channel or the remote slave input channel is switched to an activation mode; and the heterogeneous arbitration and management module generating a second control signal or a third control signal based on a slave control instruction obtained from an input port corresponding to the local slave input channel or the remote slave input channel, so as to control a corresponding execution module.

Description

Technical Field

[0001] This application relates to the field of vehicle technology, and more specifically, to a vehicle control system. Background Technology

[0002] With the rapid development of automotive electronics technology, modern vehicles are generally equipped with single-screen intelligent vehicle infotainment systems. These systems integrate multiple functions such as navigation, entertainment, and vehicle control, and some physical function buttons are gradually being replaced by in-screen soft switches. In terms of vehicle interaction control, voice recognition technology has become one of the mainstream human-vehicle interaction methods. Existing solutions integrate the voice control module into the main vehicle infotainment system, using natural language processing algorithms to parse user commands and convert them into corresponding control signals. When the main system experiences performance degradation but can still maintain basic operation, the voice control function usually still works normally. However, when the main vehicle infotainment system completely freezes, due to the strong coupling between the voice interaction module and the main system, users cannot control basic functions such as air conditioning, lights, and child locks on doors and windows via voice or other interactive methods. Summary of the Invention

[0003] The purpose of this application is to provide a vehicle control system to solve the technical problem in existing vehicle control technologies where users cannot control the vehicle through interactive methods such as voice when the main vehicle system is stuck.

[0004] In a first aspect, the present invention provides a vehicle control system. The control system includes a vehicle main input channel and an execution module. The control system also includes a local slave input channel, a remote slave input channel, and a heterogeneous arbitration and management module. When the vehicle is running normally, the vehicle main input channel generates a main control command based on the received interactive operation. The heterogeneous arbitration and management module generates a first control signal according to the main control command to control the corresponding execution module. The heterogeneous arbitration and management module is used to determine the health status of the vehicle main input channel according to a preset time interval. If it is determined that the vehicle main input channel is faulty, a backup channel activation command is generated and sent to the local slave input channel or the remote slave input channel to switch the local slave input channel or the remote slave input channel to the activation mode. The heterogeneous arbitration and management module generates a second or third control signal based on the control commands obtained from the input ports corresponding to the local or remote input channels, in order to control the corresponding execution module.

[0005] In an optional implementation, the heterogeneous arbitration and management module includes: The status assessment and arbitration submodule is configured to receive the ready status signals reported by the local input channel and the remote input channel, and select the available backup channel based on a preset priority strategy. The signal routing and switching execution submodule is configured to generate a switching command based on the health status of the vehicle's main input channel to achieve the switching of the vehicle's control channel. The switching command includes a backup channel activation command.

[0006] In an optional implementation, the heterogeneous arbitration and management module further includes a heartbeat monitoring submodule, which is configured to periodically send heartbeat query messages to the vehicle main input channel via a communication link independent of the vehicle main bus, and determine that the vehicle main input channel has failed if no valid response is received within N consecutive query cycles.

[0007] In an optional implementation, the heterogeneous arbitration and management module further includes an independent feedback submodule, which is configured to drive an audio-visual prompt device independent of the vehicle’s main audio system to output a confirmation signal after the signal routing and switching execution submodule completes the control channel switching.

[0008] In an optional implementation, the heartbeat monitoring submodule periodically sends heartbeat query messages with rolling counters and CRC checks to the vehicle's main input channel via the CANFD bus.

[0009] In an optional implementation, the heartbeat monitoring submodule periodically sends PWM-formatted heartbeat query messages to the vehicle's main input channel via a hard-wired digital signal line.

[0010] In an optional implementation, the local input channel includes an independent microphone array, and the heterogeneous arbitration and management module includes a dedicated AI voice processing chip, wherein... A dedicated AI voice processing chip is used to run offline keyword recognition firmware, independent of the vehicle's main SoC. The independent microphone array is physically isolated from the microphone of the vehicle's main input channel and performs voice acquisition by being controlled by an analog switch activated by the backup channel.

[0011] In an optional implementation, the remote input channel includes a standalone vehicle communication module, and the heterogeneous arbitration and management module includes a lightweight protocol stack MCU, wherein... The independent vehicle communication module integrates a dual-mode radio frequency unit of BLE5.0 and Wi-Fi6, and its power supply, clock source and baseband processor are physically isolated from the vehicle's main T-Box module; The lightweight protocol stack MCU is used to run the encrypted direct authentication protocol, supporting the establishment of a point-to-point secure tunnel with authorized mobile terminal APP; The instruction parsing unit of the lightweight protocol stack MCU is configured to directly map the JSON format control instructions issued by the APP into CAN / LIN messages that conform to the vehicle network protocol.

[0012] In an optional implementation, the signal routing and switching execution submodule includes at least a solid-state relay array. The solid-state relay array controls the on / off state of the relays based on a received backup channel activation command, thereby enabling the switching of the vehicle's control channels. The switching command includes the backup channel activation command.

[0013] In an optional implementation, the independent feedback submodule includes at least one independent LED indicator and an independent buzzer.

[0014] This application provides a vehicle control system, which includes a main input channel and an execution module. The control system also includes a local slave input channel, a remote slave input channel, and a heterogeneous arbitration and management module. When the vehicle is operating normally, the main input channel generates a main control command based on received interactive operations. The heterogeneous arbitration and management module generates a first control signal based on the main control command to control the corresponding execution module. The heterogeneous arbitration and management module determines the health status of the main input channel at preset time intervals. If the main input channel is determined to be faulty, a backup channel activation command is generated and sent to the local or remote slave input channel, switching the local or remote slave input channel to activation mode. The heterogeneous arbitration and management module generates a second or third control signal based on slave control commands obtained from the corresponding input ports of the local or remote slave input channels to control the corresponding execution modules. By using a backup control channel isolated from the main vehicle control channel, it ensures that even in the extreme case of the main vehicle control system being "brain dead," users can still directly control basic functions via voice or mobile phone, thereby ensuring vehicle safety. Attached Figure Description

[0015] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a schematic diagram of the structure of a vehicle control system provided in an embodiment of this application. Detailed Implementation

[0017] With the rapid development of automotive intelligence and connectivity, integrated central control screens (hereinafter referred to as "single screens") have become the core interactive carrier of intelligent cockpits. They integrate the control of vehicle functions such as driving modes, vehicle performance adjustment, intelligent driving settings, door child safety locks, window locks, air conditioning, headlights, sunroof, seat massage / heating, car refrigerator, entertainment system, and even automatic transmission gears through touch and voice control.

[0018] This design eliminates a large number of physical buttons, enhancing the technological feel and simplicity of the interior. However, when the main vehicle system experiences a software bug, third-party application conflict, system update failure, or main chip overheating / crashing, causing the screen to "freeze" and become unresponsive, the aforementioned complete control path is severed. Users will completely lose control of basic vehicle functions through the screen, such as adjusting the air conditioning, defrosting, turning lights on and off, and even shifting gears. This can cause panic and safety hazards in specific driving scenarios (such as fogged windows in rainy weather or a sudden screen freeze or blackout while using intelligent driving on the highway). Attempting to restore the system by restarting the vehicle is time-consuming and inconvenient to operate while driving. Users' concerns about "the entire vehicle losing control when the screen freezes" will reduce their trust in the reliability of new energy intelligent vehicle technologies, thereby affecting product reputation and market acceptance.

[0019] Some models retain a few physical buttons next to the screen or behind the steering wheel. This increases hardware costs, interior design complexity, and detracts from the overall aesthetics of the cabin. Some models implement a "watchdog" or dual-system approach at the software level: setting up monitoring processes within the main system or using a hypervisor to virtualize and run dual systems. However, when the fault originates from the hardware driver layer, kernel, or the chip itself, such software-level redundancy may completely fail. Furthermore, complex virtualization solutions are expensive and still share underlying hardware resources, failing to achieve true heterogeneity and independence.

[0020] Based on this, this application provides a vehicle control system that solves the problem that when the main vehicle system is completely frozen, users cannot control basic safety functions through voice or other interactive methods in existing vehicle redundant control technologies.

[0021] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0022] Example 1 Figure 1 This is a schematic diagram of a vehicle control system provided in an embodiment of this application. Figure 1 As shown in the illustration, an embodiment of this application provides a vehicle control system, which includes at least a vehicle main input channel, a local slave input channel, a remote slave input channel, a heterogeneous arbitration and management module, and an execution module. The heterogeneous arbitration and management module includes a main control module, an AI voice processing chip, and a lightweight protocol stack MCU.

[0023] When the vehicle is running normally, the vehicle's main input channel generates a main control command based on the received interactive operation. The heterogeneous arbitration and management module generates a first control signal according to the main control command to control the corresponding execution module.

[0024] The heterogeneous arbitration and management module is used to determine the health status of the vehicle's main input channel at preset time intervals. If the main input channel is determined to be faulty, a backup channel activation command is generated and sent to the local slave input channel or the remote slave input channel, so that the local slave input channel or the remote slave input channel switches to the activation mode.

[0025] The heterogeneous arbitration and management module generates a second or third control signal based on the control commands obtained from the input ports corresponding to the local or remote input channels, and controls the corresponding execution module.

[0026] In one feasible implementation, a dedicated AI voice processing chip is used to run offline keyword recognition firmware, independent of the vehicle's main SoC. Local input channels include independent microphone arrays, which are physically isolated from the vehicle's main microphone, or their paths are switched via analog switches controlled by a heterogeneous arbitration and management module.

[0027] In one feasible implementation, the remote input channel includes a standalone vehicle communication module. This standalone vehicle communication module integrates a dual-mode BLE5.0 and Wi-Fi6 radio frequency unit, and its power supply, clock source, and baseband processor are physically isolated from the vehicle's main T-Box module. A lightweight protocol stack MCU is used to run an encrypted direct-connect authentication protocol, supporting the establishment of a point-to-point secure tunnel with an authorized mobile terminal APP. The instruction parsing unit of the lightweight protocol stack MCU is configured to directly map JSON-formatted control commands issued by the APP into CAN / LIN messages conforming to the vehicle network protocol.

[0028] In one feasible implementation, the heterogeneous arbitration and management module includes a status assessment and arbitration submodule, a signal routing and switching execution submodule, a heartbeat monitoring submodule, and an independent feedback submodule.

[0029] The status assessment and arbitration submodule is configured to receive the readiness status signals reported by the local input channel and the remote input channel, and select the available backup channel based on a preset priority strategy.

[0030] The signal routing and switching execution submodule is configured to generate switching instructions based on the health status of the vehicle's main input channel to achieve the switching of the vehicle's control channels. The switching instructions include a backup channel activation instruction.

[0031] The heartbeat monitoring submodule is configured to periodically send heartbeat query messages to the vehicle main input channel via a communication link independent of the vehicle main bus, and determine that the vehicle main input channel has failed if no valid response is received within N consecutive query cycles. Preferably, N can be an integer greater than or equal to 3.

[0032] The independent feedback submodule is configured to drive an audio-visual prompt device, independent of the vehicle’s main audio system, to output a confirmation signal after the signal routing and switching execution submodule has completed the channel switching.

[0033] Specifically, the heartbeat monitoring submodule here periodically sends heartbeat query messages with rolling counters and CRC checks to the vehicle's main input channel via the CANFD bus.

[0034] The heterogeneous arbitration and management module can also periodically send PWM format heartbeat query messages to the vehicle's main input channel via hard-wired digital signal lines.

[0035] In another feasible embodiment, the signal routing and switching execution submodule includes at least a solid-state relay array. The solid-state relay array performs relay on / off control based on the received backup channel activation command to realize the switching of the vehicle's control channel. The switching command includes the backup channel activation command.

[0036] The independent feedback submodule here may include at least one independent LED indicator and an independent buzzer. The independent LED indicator is mounted on the top of the instrument panel. The independent buzzer is connected to the local audio amplifier circuit of the input channel, and its trigger signal is sent by the heterogeneous arbitration and management module via the I²C bus.

[0037] Understandably, two user interaction channels, independent of the main vehicle system in terms of physical hardware, communication links, and control logic, can be set up, one based on offline voice recognition using a local dedicated AI chip and the other on remote control via direct connection to a mobile terminal. Secondly, a decentralized, intelligent heterogeneous arbitration and management module was designed. This module does not rely on a single decision-making unit and achieves collaborative management and fault response for the three control channels through comprehensive heartbeat monitoring, status assessment, automatic switching, and signal routing.

[0038] In a specific embodiment, after the vehicle is powered on, the three channels can operate in parallel. Among them, the vehicle's main input channel is responsible for processing control requests for basic safety functions such as air conditioning, windows, and lights initiated by the user through its interactive interface (such as voice or touch screen) under normal circumstances.

[0039] The local input channel consists of an independent hardware module, including an independent microphone array, offline speech recognition firmware, and an independent actuator driver interface. It continuously listens for specific offline wake words and predefined keyword commands.

[0040] The remote input channel consists of an independent communication module on the vehicle (supporting BLE and WiFi) and a dedicated application on the user's mobile terminal, establishing a point-to-point direct communication connection.

[0041] The execution modules here can be controlled vehicle electronic control units (ECUs) within the vehicle, such as air conditioning controllers, window regulator modules, and body control modules (BCMs). They receive control signals (such as CAN messages) in a unified format from the heterogeneous arbitration and management module routing to perform corresponding operations.

[0042] The heterogeneous arbitration and management module continuously monitors the health status (heartbeat) of each channel, analyzes and evaluates faults, and automatically and seamlessly switches the perception, transmission, and execution of user commands to an available backup channel when the main channel fails. Simultaneously, it informs the user of the current control status through an independent feedback mechanism. With this architecture, even if the main vehicle interface is unresponsive, control commands issued via voice or mobile phone can still be perceived and reliably executed by the system, thus ensuring driving safety.

[0043] Example 2 In one embodiment of this application, the vehicle control channel includes input, processing, and execution channels. The vehicle main control channel is the primary interaction path during normal system operation and is integrated within the vehicle's main processing unit (SoC).

[0044] The vehicle's main control channel may include a main voice acquisition module, a main voice processing and recognition module, a main screen interaction module, and a main command parsing module.

[0045] The main voice acquisition module is connected to the vehicle-mounted multi-microphone array to acquire high signal-to-noise ratio raw multi-channel voice signals.

[0046] The main speech processing and recognition module runs on the advanced speech services of the main operating system (such as QNX). It utilizes the powerful computing capabilities of the main chip to perform complex environmental noise reduction, sound source localization, continuous speech recognition, and natural language understanding, converting speech into structured text or semantic intent. Its advantages lie in its high recognition rate and support for complex sentences and contextual understanding.

[0047] The main screen interaction module is responsible for rendering the graphical user interface (GUI) on the vehicle's large screen and receiving commands from touch or voice modules.

[0048] The main command parsing module maps semantic intent or touch commands into first control signals that conform to vehicle network protocols (such as CAN / LIN signals).

[0049] Specifically, in-vehicle multi-microphone arrays are typically placed near the A-pillar, roof, or steering wheel to simultaneously collect spatial sound field signals.

[0050] After the system user issues a voice command, the vehicle's multi-microphone array acquires and outputs multi-channel raw audio data. This audio data is transmitted in real time to the main processing chip (SoC) audio subsystem of the main vehicle infotainment system via a dedicated audio bus (such as an I²S or PDM interface).

[0051] After completing analog-to-digital conversion, front-end gain control, and basic anti-aliasing filtering, the audio subsystem sends the digitized speech stream to the main speech service module running on a real-time operating system (such as QNX). This module sequentially performs ambient noise suppression, sound source localization, endpoint detection, continuous speech recognition (ASR), and natural language understanding (NLU) to parse the raw speech stream into structured semantic intent (e.g., "adjust the driver's seat heating to level 2" or "turn on the hazard lights").

[0052] The semantic intent here is passed to the vehicle's GUI application logic layer, which performs intent verification and operation mapping based on the current human-machine interaction context (such as interface state, user preferences, and vehicle operating conditions). Subsequently, the main instruction parsing module converts the semantic intent into a first control signal conforming to the format of an in-vehicle network communication protocol (such as CANFD, LIN, or EthernetAVB) according to predefined vehicle function mapping rules. This signal can be a message frame with a standard ID, data field, and verification mechanism, containing the target actuator address, control action code, and necessary parameters.

[0053] Ultimately, the first control signal is transparently forwarded by the signal routing unit of the heterogeneous arbitration and management module and sent to the corresponding vehicle electronic control unit (ECU) to drive the air conditioning controller, body control module (BCM), seat control module and other components to perform corresponding physical actions.

[0054] In one feasible embodiment, the hardware configuration of the local slave control channel may include a separate, low-power dedicated AI voice processing chip, physically decoupled from the main SoC. This chip is directly connected to one or a set of dedicated backup microphones (which may be partially multiplexed with the main microphone array but physically isolated via analog switches) and directly connected to the vehicle network gateway or a specific ECU.

[0055] The dedicated AI voice processing chip here runs a fixed, streamlined voice recognition firmware. This firmware does not support natural language understanding and only contains a keyword list and corresponding command lookup table for basic vehicle functions (such as "air conditioning + temperature / mode", "window + open / close", "hazard lights"). The recognition mode is offline, low-power wake word and command word recognition.

[0056] Once the backup channel is activated, the dedicated AI voice processing chip can continuously monitor the audio stream. Upon detecting a preset wake-up word (such as "Xiao X"), it immediately enters command word recognition mode. After recognizing a valid command word such as "open the window," the chip's internal logic directly generates a predefined, simple second control signal (such as a specific CAN message) and sends it directly to the vehicle's network via its hardware interface.

[0057] This local input channel is completely independent of the main SoC, main operating system, and any high-level software services. Even if the main system crashes, its hardware and firmware can still work independently, achieving the deepest level of heterogeneity and ensuring the most basic security control capabilities.

[0058] In one feasible embodiment, the remote slave control channel may include a short-range wireless communication module (such as a Bluetooth Low Energy BLE 5.0 or Wi-Fi module) independent of the main system cellular communication module (T-Box), and its associated microcontroller (MCU).

[0059] A lightweight service can run on the microcontroller to maintain pairing and encrypted connection protocols with authorized mobile terminals (such as mobile apps).

[0060] Specifically, users can issue control commands via a mobile app (which has established a secure connection with the vehicle via Bluetooth or Wi-Fi). These commands bypass the vehicle's main infotainment system and are directly received and parsed by this independent wireless communication module and MCU, generating a third control signal and sending it to the in-vehicle network.

[0061] This channel provides a completely different control path based on mobile internet and external devices. Even if both the vehicle's main chip and the local voice chip fail simultaneously, this channel can still serve as a last resort.

[0062] In one feasible embodiment, the heterogeneous arbitration and management module can be integrated into a high-reliability functional partition of the vehicle gateway controller.

[0063] The heterogeneous arbitration and management module may also include a heartbeat monitoring unit, a channel switching unit, a signal routing unit, and a feedback control unit.

[0064] The heart rate monitoring unit here periodically (e.g., every second) sends query messages to the "health report service" of the main control channel. If no valid response is received within N consecutive cycles, the main channel is deemed to have failed.

[0065] The channel switching unit has a built-in priority strategy, such as prioritizing the local independent voice channel over the remote control channel. Once the heartbeat monitoring unit triggers a fault signal, this unit immediately sends an "activate" command to the highest priority available backup channel and sets it to the ready state.

[0066] The signal routing unit is used to transparently forward the first control signal from the main channel when the system is normal. When the backup channel is activated, the routing is switched, forwarding control commands from the backup channel (such as the second control signal) to the target actuator. Simultaneously, it blocks out-of-order or erroneous signals that may be generated by the main channel to prevent interference.

[0067] After switching to the backup channel, the feedback control unit activates an independent feedback path, such as controlling a buzzer or LED light that is separate from the main audio system, to inform the user that "the command has been received through the backup channel" with a specific sound and light pattern (such as a "beep"), thus solving the problem of lack of screen feedback under the backup channel.

[0068] In a specific embodiment, when the main screen freezes (main channel fails), the heartbeat monitoring unit can detect it within seconds. The channel switching unit instantly activates the local independent voice channel. At this time, the user says "Xiao X, open the window," and the independent voice chip recognizes it and generates a CAN signal. The signal routing unit accurately sends it to the window controller. Simultaneously, the feedback control unit triggers a buzzer to alert the user. The entire process can be completed quickly, allowing the user to achieve safety control in a virtually imperceptible way through a completely new and heterogeneous path, thereby directly bringing high availability, security, and a smooth user experience.

[0069] Example 3 In one specific embodiment, the vehicle is equipped with an integrated intelligent cockpit system (main unit) that controls basic safety functions such as air conditioning, four windows, sunroof, headlights and taillights, and hazard warning lights.

[0070] After the vehicle system powers on and initializes, the heterogeneous arbitration and management module (deployed within a separate body domain controller) begins operation. Its heartbeat monitoring submodule periodically sends query commands to the main vehicle unit module, the local independent voice channel module, and the remote control channel module via an independent CANFD bus. The main vehicle unit module, acting as the default channel, receives user commands through its existing voice assistant and touchscreen interface. Its output control signals are sent to each actuator via the signal routing submodule of the arbitration module (a set of solid-state relay arrays controlled by the arbitration module). The local independent voice channel module is a separate hardware box installed in the front of the vehicle's headliner, containing a dedicated AI voice chip, two omnidirectional microphones, and a FLASH memory storing the offline wake-up phrase "Xiao X Tongxue" and 20 preset keyword commands (such as "turn on the air conditioning," "close the left front window," and "turn on the hazard lights"). The remote control channel module is an independent communication gateway integrating BLE5.0 and Wi-Fi6 chips, fixed inside the vehicle's dashboard.

[0071] When a user is driving normally, they can say "turn on the air conditioning" through the main vehicle's voice assistant. The command is processed by the main vehicle system, which generates a control message. After being routed by the arbitration module, the air conditioning compressor starts. At this time, the local voice module is in a low-power listening state, and the remote channel module is in standby mode.

[0072] Assuming the vehicle is in motion, the main vehicle unit completely freezes due to a software infinite loop and becomes unresponsive. Its heartbeat response is missing for three consecutive cycles (approximately 300 milliseconds), and the arbitration module's status assessment submodule marks it as "failed." The arbitration logic immediately initiates, checking the status of the backup channel: the local voice channel's heartbeat is normal, and the remote channel's heartbeat is normal. Based on the preset priority (local channel takes precedence over remote channel), the arbitration module decides to switch to the local independent voice channel. The signal routing submodule completes its actions within milliseconds: first, it cuts off the physical path of the main vehicle unit's output control signal to the actuator; second, it connects the output path of the local voice channel to the actuator controller; finally, it sends an "activate" command to the local voice channel. Simultaneously, the independent feedback submodule drives an independent LED indicator above the instrument panel to flash green twice, and plays a prompt tone "Backup mode is ready" through the local voice module's built-in miniature speaker.

[0073] After the switch was completed, the user was unaware that the main vehicle infotainment system had gone black and was unresponsive. Feeling hot, the user said, "Hey, turn on the air conditioning." The command was picked up by the independent microphone of the local voice module, whose built-in AI chip offline recognized the wake-up word and the command, generating a control code for "Air conditioning on." This command code was sent to the arbitration module via the LIN bus. After confirming that the currently active channel was the local channel, the arbitration module routed it to the air conditioning controller, and the air conditioning immediately started. Upon completion, the feedback submodule of the arbitration module could play "Air conditioning on" through the speaker of the same local voice module as confirmation. Thus, the user seamlessly controlled basic safety functions even when the main vehicle infotainment system was completely unresponsive.

[0074] Example 4 In another specific embodiment of this application, the technical solution of this application can also be extended to large-scale operation scenarios such as fleet management or car sharing.

[0075] In this scenario, in addition to individual users, vehicles may also be managed by a remote dispatch center. The firmware of the vehicle-side module of the remote control channel has been enhanced to support connections with two types of clients: one is a dedicated APP on the user's personal mobile phone, and the other is the service platform of the operation dispatch center (which establishes a secure tunnel connection with the remote channel module through the vehicle's built-in cellular network module, and this connection is independent of the main vehicle's T-Box).

[0076] When the main vehicle unit and local voice channel of an operating vehicle fail simultaneously due to a major hardware failure (such as water ingress and short circuit), the heartbeat monitoring of the heterogeneous arbitration and management module will mark both as "failed". The status assessment submodule, based on logic, switches the active channel to the remote control channel. At this time, the vehicle cannot respond to local voice commands, but the BLE / Wi-Fi Direct connection function of the remote channel remains effective.

[0077] For users inside the vehicle, they can scan the in-vehicle QR code or automatically connect to the vehicle's hotspot via a pre-downloaded and paired mobile app to manually control functions such as windows, air conditioning, and lights on the app interface. Control commands are sent directly to the in-vehicle remote communication module via a point-to-point connection, and then routed and executed by the arbitration module.

[0078] Meanwhile, for the remote dispatch center, the monitoring system receives an alarm message indicating that the vehicle's "main channel and local backup channel have failed" (sent by the arbitration module via an independent communication link). The dispatcher can proactively send safety commands to the vehicle through the management platform. For example, in hot summer weather, if the vehicle's interior temperature is detected to be too high and the user has not taken any action, the dispatcher can remotely send a command to "turn on the air conditioning ventilation mode." This command is sent to the vehicle's remote control channel module via a secure cellular network link, and is also verified and routed for execution by the arbitration module, preventing safety issues or battery damage caused by excessively high interior temperatures.

[0079] Example 5 In one embodiment of this application, under special scenarios such as complex faults or network interference, for example, when the vehicle suffers from strong electromagnetic interference, the main vehicle system and CANFD bus communication (including communication between the arbitration module and some actuators) are temporarily affected, resulting in intermittent faults. Simultaneously, the user is attempting to control the vehicle remotely via a mobile app.

[0080] Taking the aforementioned special scenario as an example, the design of the heterogeneous arbitration and management module demonstrates robustness. First, its heartbeat monitoring adopts a multi-path redundancy design: in addition to the CANFD bus heartbeat, a backup hard-wired digital signal (such as a PWM signal) is also reserved between the local voice channel and the remote channel as an "emergency heartbeat" path.

[0081] When bus communication quality degrades due to interference, the arbitration module can confirm the basic liveness status of the backup channel through hard-wired paths. Secondly, the arbitration logic of the status assessment submodule includes "sticky" and "timeout recovery" mechanisms. Once the system switches from the primary channel to any backup channel (such as a remote channel), unless the backup channel is also confirmed to be faulty, or the primary channel is confirmed to have stably recovered within multiple consecutive cycles, the system will maintain its backup channel operating mode to avoid frequent switching and command conflicts caused by the intermittent recovery of the primary channel.

[0082] For user operations via the mobile app, the remote channel uses a BLE / Wi-Fi direct connection, and its communication frequency band differs from the interfered vehicle bus, potentially maintaining a connection. When the user clicks the "Close all windows" command, it is transmitted to the remote channel module via a relatively stable direct connection. The arbitration module, recognizing the remote channel's normal status and active state via the still-functioning hardwired link, attempts to send the window-closing command to the window controller via the less interfered LIN bus (used in some body controllers) or by directly driving the backup hardwired connection. Simultaneously, the independent feedback submodule emits a beep through its directly controlled buzzer to inform the user that the command has been received (even if bus communication is disrupted at this time, preventing the app from updating the status).

[0083] In complex fault scenarios where some links fail, the system can still maximize the execution of core control functions through heterogeneous communication paths and conservative arbitration strategies.

[0084] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0085] Furthermore, the units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0086] Furthermore, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0087] It should be noted that if the function is implemented as a software module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0088] In this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, without necessarily requiring or implying any such actual relationship or order between these entities or operations.

[0089] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A vehicle control system, the control system comprising a vehicle main input channel and an execution module, characterized in that, The control system also includes a local slave input channel, a remote slave input channel, and a heterogeneous arbitration and management module. When the vehicle is operating normally, the vehicle's main input channel generates a main control command based on the received interactive operations. The heterogeneous arbitration and management module then generates a first control signal according to the main control command to control the corresponding execution module. The heterogeneous arbitration and management module is used to determine the health status of the vehicle's main input channel according to a preset time interval. If the vehicle's main input channel is determined to be faulty, a backup channel activation command is generated and sent to the local slave input channel or the remote slave input channel to switch the local slave input channel or the remote slave input channel to the activation mode. The heterogeneous arbitration and management module generates a second or third control signal based on the control command obtained from the input port corresponding to the local or remote input channel, in order to control the corresponding execution module.

2. The system according to claim 1, characterized in that, The heterogeneous arbitration and management module includes: The status assessment and arbitration submodule is configured to receive the readiness status signals reported by the local input channel and the remote input channel respectively, and select an available backup channel based on a preset priority strategy. The signal routing and switching execution submodule is configured to generate a switching command based on the health status of the vehicle's main input channel to achieve the switching of the vehicle's control channel. The switching command includes a backup channel activation command.

3. The system according to claim 1, characterized in that, The heterogeneous arbitration and management module also includes a heartbeat monitoring submodule, which is configured to periodically send heartbeat query messages to the vehicle main input channel through a communication link independent of the vehicle main bus, and determine that the vehicle main input channel is faulty if no valid response is received within N consecutive query cycles.

4. The system according to claim 1, characterized in that, The heterogeneous arbitration and management module also includes an independent feedback submodule, which is configured to drive an audio-visual prompt device independent of the vehicle's main audio system to output a confirmation signal after the signal routing and switching execution submodule completes the control channel switching.

5. The system according to claim 3, characterized in that, The heartbeat monitoring submodule periodically sends heartbeat query messages with rolling counters and CRC checks to the vehicle's main input channel via the CANFD bus.

6. The system according to claim 3, characterized in that, The heartbeat monitoring submodule periodically sends PWM format heartbeat query messages to the vehicle's main input channel via a hard-wired digital signal line.

7. The system according to claim 1, characterized in that, The local input channel includes an independent microphone array, and the heterogeneous arbitration and management module includes a dedicated AI voice processing chip. The dedicated AI voice processing chip is independent of the vehicle's main SoC and is used to run offline keyword recognition firmware; The independent microphone array is physically isolated from the microphone of the vehicle's main input channel and performs voice acquisition by being controlled by the activation command of the backup channel via an analog switch.

8. The system according to claim 1, characterized in that, The remote input channel includes an independent vehicle communication module, and the heterogeneous arbitration and management module includes a lightweight protocol stack MCU. The independent vehicle communication module integrates a dual-mode radio frequency unit of BLE5.0 and Wi-Fi6, and its power supply, clock source and baseband processor are physically isolated from the vehicle's main T-Box module; The lightweight protocol stack MCU is used to run the encrypted direct authentication protocol, supporting the establishment of a point-to-point secure tunnel with authorized mobile terminal APP; The instruction parsing unit of the lightweight protocol stack MCU is configured to directly map the JSON format control instructions issued by the APP into CAN / LIN messages that conform to the vehicle network protocol.

9. The system according to claim 2, characterized in that, The signal routing and switching execution submodule includes at least a solid-state relay array. The solid-state relay array controls the on / off state of the relays based on the received backup channel activation command, thereby enabling the switching of the vehicle's control channels. The switching command includes the backup channel activation command.

10. The system according to claim 4, characterized in that, The independent feedback submodule includes at least one independent LED indicator and an independent buzzer.

Images