Vehicle-side instruction parameter protocol checking method based on action type whitelist

Abstract

The present application relates to the technical field of vehicle-mounted protocol verification, and particularly relates to a vehicle-end instruction parameter protocol verification method based on a motion type whitelist, comprising the following steps: determining associated parameters, protocol quantization relationships, physical association constraints and target controllers through the motion type whitelist, so that vehicle-end instruction verification is matched with specific control actions; reversing the protocol original code to physical parameter value intervals, retaining the parameter uncertainty range caused by rounding and quantization; then propagating each parameter interval according to the physical association constraints to obtain a vehicle actuator motion quantity envelope, so as to avoid single-parameter legal but combined action out-of-bounds; finally, taking the whole motion quantity envelope falling within the allowed action boundary as the instruction sending condition, so as to reduce the occurrence probability of the vehicle window motor locked-rotor and the controller protection action, and improve the accuracy and safety of the vehicle-end instruction verification.

Description

Technical Field

[0001] This invention relates to the technical field of vehicle protocol verification, and in particular to a method for verifying vehicle-side command parameter protocols based on an action type whitelist. Background Technology

[0002] In the scenario of remote window control in the Internet of Vehicles (IoV), users send requests to open or close windows via mobile terminals. The vehicle cloud platform converts these requests into vehicle-side commands, which are then transmitted to the door controller via the vehicle-mounted remote communication terminal and the central gateway. For incremental control of the left front window, the vehicle-side command typically includes information such as the action type, window movement speed, movement duration, and controller address. The door controller drives the window lift motor to rotate based on the movement speed and duration, causing the window glass to move accordingly. Existing vehicle-side command verification methods typically first determine whether the action type falls within the allowed range of commands, and then separately determine whether the encoded values ​​of each command parameter exceed the range specified in the protocol. When both the window movement speed and movement duration encoded values ​​are within the allowed range, the vehicle-side command is forwarded to the door controller. This verification method can only determine whether a single parameter is compliant, and cannot determine whether the window displacement resulting from the combined effect of multiple parameters exceeds the remaining travel distance between the current window position and the mechanical limit.

[0003] Vehicle-to-everything (V2X) communication protocols typically use integer codes to represent physical parameters such as speed and duration of motion, and convert between physical parameters and protocol code values ​​through proportional coefficients, offsets, and rounding methods. After rounding, rounding down, rounding up, or truncating to zero, a protocol code value may correspond to a continuous range of physical parameters, rather than a unique physical parameter value. Current vehicle-side command verification generally judges based on the nominal value converted from the protocol code value, without considering the parameter variation range corresponding to the rounding operation. For example, the speed and duration parameters may meet the protocol requirements, but the product of their maximum possible physical values ​​may result in a window displacement greater than the remaining mechanical travel of the window. In this case, the window displacement calculated according to the nominal value may not exceed the limit, but the door controller may still cause the motor to continue rotating after the window reaches the end point, thus causing motor stall, mechanism impact, or controller overcurrent protection.

[0004] Existing action type whitelists typically record allowed action identifiers, and some schemes also record the allowed encoding range of individual parameters. However, there is a lack of unified verification relationships between action identifiers and parameter encoding rules, physical relationships between parameters, the current action position of the window, the mechanical travel of the window, and the receiving range of the door controller. Therefore, existing vehicle-side command parameter protocol verification technologies suffer from the problem that while a single parameter encoding may be valid, the actuator action quantity corresponding to the parameter combination may exceed the limit. This invention proposes a vehicle-side command parameter protocol verification method based on an action type whitelist. The method determines the parameters involved in the verification and their protocol quantization relationships according to the action type, forms a quantization inverse interval combination of the physical parameter ranges corresponding to the protocol source code, calculates the lower and upper bounds of the vehicle actuator action quantity according to the physical relationships between parameters, and compares the range of vehicle actuator action quantity with the allowed action boundaries to solve the problem that remote window incremental control commands may exceed the window's executable travel under parameter combination conditions. Summary of the Invention

[0005] The purpose of this section is to outline some aspects of the embodiments of the present invention and to briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section, as well as in the abstract and title of the present application, to avoid obscuring the purpose of this section, the abstract and title of the invention. Such simplifications or omissions shall not be used to limit the scope of the present invention.

[0006] In view of the aforementioned existing problems, the present invention is proposed.

[0007] To solve the above-mentioned technical problems, the present invention provides the following technical solution: A method for verifying vehicle-side command parameters based on an action type whitelist includes: matching the action type whitelist according to the action type of the vehicle-side command, and determining the associated parameter set, protocol quantization relationship, physical association constraint, allowed action boundary and target controller; Extract the protocol source code corresponding to the associated parameter set from the vehicle-side instruction, determine the physical parameter value range corresponding to each protocol source code according to the protocol quantization relationship, and obtain the quantization inverse interval combination; Based on the physical association constraints, interval propagation is performed on the quantized inverse interval combination to obtain the lower and upper bounds of the vehicle actuator motion quantity, forming the motion quantity envelope; When the lower bound of the action quantity envelope is not lower than the lower limit of the allowed action boundary and the upper bound is not higher than the upper limit of the allowed action boundary, the vehicle-side command is sent to the target controller; otherwise, the sending is stopped.

[0008] The beneficial effects of this invention are as follows: This invention determines the associated parameters, protocol quantization relationships, physical association constraints, and target controllers through an action type whitelist, enabling the vehicle-side command verification to match the specific control actions; by reversing the protocol source code to restore the physical parameter value range, the uncertainty range of parameters caused by rounding and quantization is preserved; then, based on the physical association constraints, each parameter range is propagated to obtain the vehicle actuator action envelope, avoiding single-parameter validity but combined actions exceeding the limit; finally, the entire action envelope falling within the allowed action boundary is used as the command sending condition, thereby reducing the probability of window motor stall and controller protection actions, and improving the accuracy and security of vehicle-side command verification. Attached Figure Description

[0009] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein: Figure 1 This is a flowchart illustrating the vehicle-side command parameter protocol verification method based on an action type whitelist as shown in this invention. Detailed Implementation

[0010] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0011] Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without inventive effort should fall within the scope of protection of this invention.

[0012] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0013] The following describes in detail a specific implementation method for vehicle-side command parameter protocol verification based on an action type whitelist, using the scenario of protocol parameter verification before the vehicle network remote window incremental control command enters the left front door controller. The following implementation method takes the remote incremental position control scenario of the left front window of a passenger car as an example. The controlled object is the left front window lifting mechanism. The vehicle actuators include the left front window glass lifting motor, the reduction transmission mechanism, and the window glass guide mechanism. The target controller is the left front door controller. The action position of the vehicle actuator is determined according to the movement distance of the window glass from the fully closed position to the fully open position. The fully closed position is 0mm, and the fully open position is 100mm. The action amount of the vehicle actuator is the action increment relative to the current action position of the vehicle actuator. A positive value indicates that the window glass moves to the fully open position, and a negative value indicates that the window glass moves to the fully closed position.

[0014] In this embodiment, the vehicle-to-everything (V2X) communication terminal receives a remote control request. After the vehicle gateway completes identity verification, message integrity verification, and instruction sequence number continuity verification, a vehicle-side instruction to be verified is formed. The vehicle-side instruction includes, in sequence, an instruction sequence number, an action type identifier, a controller identifier, a number of parameters, a sequence of parameter identifiers, and a parameter payload. The action type identifier occupies 2 bytes, the controller identifier occupies 1 byte, the number of parameters occupies 1 byte, and each parameter identifier occupies 1 byte. In this embodiment, the instruction sequence number of the vehicle-side instruction is 8642, the action type identifier is 12577, the two transmitted bytes of the action type identifier are 49 and 33 respectively, the controller identifier is 49, the number of parameters is 4, the parameter identifiers are 33, 34, 35, and 36 respectively, and the parameter payloads are 120, 0, 100, 5, and 2 respectively. The parameter payload consists of 5 bytes, of which the first and second bytes jointly carry the basic action increment, the third byte carries the coarse adjustment multiplier, the fourth byte carries the fine adjustment multiplier, and the fifth byte carries the load compensation coefficient.

[0015] When the vehicle-side command arrives at the vehicle gateway, the left front door controller reports the current position of the vehicle actuator as 62.0mm, with a lower limit of mechanical travel of 0mm, an upper limit of mechanical travel of 100mm, a position validity status of 1, and a feedback sequence number of 8641. The time difference between the position feedback and the arrival time of the vehicle-side command is 18ms. The action type whitelist records that the maximum valid duration of the current position feedback is 100ms, and the position feedback sequence number is allowed to lag behind the vehicle-side command sequence number by no more than 1. Therefore, the current position of the vehicle actuator meets the verification conditions.

[0016] The action type whitelist is formed by the vehicle manufacturer based on the vehicle control protocol, the software version of the left front door controller, the mechanical travel of the left front window lift mechanism, the range of controller action received, and the limit of a single remote action. The action type whitelist is loaded into the protected storage area of ​​the vehicle gateway along with the vehicle protocol configuration package. Before enabling the action type whitelist, the vehicle gateway verifies the digital signature, vehicle model code, controller software version, and protocol version of the vehicle protocol configuration package. If any of these are inconsistent, the corresponding action type whitelist is not enabled, and the transmission of vehicle-side commands is terminated.

[0017] Each whitelist entry includes a whitelist action identifier, a controller identifier, the number of parameters, the order of parameter identifiers, the length of the parameter payload, the bit start position, bit width, byte order, data type, symbol attribute, protocol source code boundary, scaling factor, offset, rounding method, endpoint affixing rules, operation relationship of associated parameters, segment mapping relationship, vehicle actuator action relationship, operation node relationship boundary, vehicle actuator action quantization item, action safety boundary, current position feedback validity condition, and the mapping relationship between the controller identifier and the vehicle communication channel.

[0018] The vehicle actuator motion quantity quantization item is independent of the four associated parameter quantization items in the vehicle-side command. It records the lower limit, upper limit, proportional coefficient, and offset of the protocol source code used by the internal motion quantity interface of the left front door controller. The vehicle actuator motion quantity quantization item only participates in the conversion of the protocol acceptable lower limit and protocol acceptable upper limit, and does not participate in the quantization inverse interval calculation of the four associated parameters in step S2. Through the above distinction, the parameter quantization relationship of the basic motion increment is directly equated to the vehicle actuator motion quantity quantization relationship after the multiplier correction and segmented mapping.

[0019] According to an embodiment of the present invention, in combination Figure 1 The flowchart shown illustrates a method for verifying vehicle-side command parameter protocols based on an action type whitelist, which specifically includes the following steps: S1. Based on the action type of the vehicle-side command, match the action type whitelist to determine the associated parameter set, protocol quantization relationship, physical association constraints, allowed action boundaries, and target controller. Note that the following points should be noted in this step: S1.1 Extract the action type identifier from the vehicle-side command, compare the action type identifier with the whitelist action identifier in the action type whitelist, and determine the unique matching whitelist entry.

[0020] Specifically, the whitelist entries that determine a unique match include: The action type identifier is split according to the order of control domain code, execution object code, action code and protocol version code. Among them, the control domain code represents the control business domain, the execution object code represents the controlled object type, the action code represents the control action type, and the protocol version code represents the protocol version. Filter candidate whitelist entries from the action type whitelist whose control domain code and protocol version code are consistent with the corresponding code segments in the action type identifier; The execution object code and action code of the candidate whitelist entries are compared with the execution object code and action code in the action type identifier, and complete matching entries that are consistent in both are retained. When there is only one complete match, the complete match is identified as a whitelist entry; when there are no complete match entries or more than one complete match, the action type match is deemed to have failed.

[0021] Further, candidate whitelist entries are selected, including: Arrange the whitelist entries in the action type whitelist according to the control domain code, so that whitelist entries with the same control domain code are arranged continuously and form entry segments, and record the control domain code, starting position and number of entries for each entry segment; Select the target entry segment based on the control field code in the action type identifier, and limit the comparison range according to the starting position and number of the target entry segment; The protocol version code in the action type identifier is compared with the protocol version codes of the whitelist entries within the comparison range one by one. Whitelist entries with the same protocol version code are retained to obtain candidate whitelist entries.

[0022] In this embodiment, the action type identifier is obtained from the vehicle-side command; the action type identifier uses 16-bit unsigned encoding and is transmitted in the order of the most significant byte first; the action type identifier is divided into control field code, execution object code, action code and protocol version code from the most significant bit to the least significant bit, with each code segment occupying 4 bits.

[0023] As an example, the first transmitted byte of the action type identifier is 49; interpreting the high 4 bits and low 4 bits of the first transmitted byte as decimal numbers, we get control field code 3 and execution object code 1; the second transmitted byte of the action type identifier is 33; interpreting the high 4 bits and low 4 bits of the second transmitted byte as decimal numbers, we get action code 2 and protocol version code 1; therefore, action type identifier 12577 sequentially contains control field code 3, execution object code 1, action code 2, and protocol version code 1.

[0024] It should be noted that, in this embodiment, the control domain code is the vehicle control business domain to which the vehicle-side command belongs; in the action type whitelist of this embodiment, control domain code 1 represents the power control domain, control domain code 2 represents the chassis control domain, control domain code 3 represents the body control domain, and control domain code 4 represents the thermal management control domain; the execution object code is the type of controlled object within the vehicle control business domain; in the body control domain, execution object code 1 represents the left front window, execution object code 2 represents the right front window, execution object code 3 represents the left rear window, and execution object code 4 represents the right rear window; the action code is the type of control action received by the controlled object; among them, action code 1 represents absolute position control, action code 2 represents incremental position control, action code 3 represents stop control, and action code 4 represents position initialization; the protocol version code is the parameter arrangement rule and parameter quantization rule; among them, protocol version code 1 represents the first version of the window control protocol, and protocol version code 2 represents the second version of the window control protocol.

[0025] The whitelist action identifier and action type identifier use the same 16-bit encoding structure. Each whitelist action identifier consists of a control field code, an execution object code, an action code, and a protocol version code in sequence. The vehicle gateway does not match based on the natural language action name, but matches segment by segment based on the four code segments.

[0026] The action type whitelist is arranged in ascending order of control domain code, so that whitelist entries with the same control domain code are arranged consecutively. For each control domain code, the vehicle gateway stores the starting position of the corresponding entry segment and the number of entries. For example, the starting position of the entry segment corresponding to control domain code 3 is 41, and the number of entries is 24. Therefore, the position range corresponding to control domain code 3 is from 41 to 64.

[0027] The vehicle gateway selects target entry segments from position 41 to 64 according to control domain code 3 in the action type identifier, and retains whitelist entries with protocol version code consistent with 1 within the target entry segments, resulting in 8 candidate whitelist entries; the 8 candidate whitelist entries correspond to the absolute position control of the left front window, the incremental position control of the left front window, the absolute position control of the right front window, the incremental position control of the right front window, the incremental position control of the left rear window, the incremental position control of the right rear window, the stop control of the left front window, and the stop control of the right front window.

[0028] The vehicle gateway continues to compare the execution object code of the 8 candidate whitelist entries with execution object code 1, and compare the action code with action code 2, retaining only the candidate whitelist entries with execution object code 1 and action code 2; for example, if the result is 1 entry, the whitelist action identifier of this entry is 12577, so the candidate whitelist entry is determined as a whitelist entry.

[0029] When no complete matching entry is obtained, a protocol verification result of unauthorized action type is generated; when more than two complete matching entries are obtained, a protocol verification result of duplicate configuration of action type whitelist is generated; in both of the above situations, the current vehicle-side instruction transmission is terminated, and no whitelist entry is used to interpret the parameter payload.

[0030] S1.2. Compare the parameter identifier, parameter quantity, and parameter order of the vehicle-side command with the parameter identifier, parameter quantity, and parameter order recorded in the whitelist entries. If the three are consistent, form an associated parameter set according to the parameter order. If any of them are inconsistent, the protocol verification is deemed to have failed.

[0031] In a preferred embodiment, the vehicle gateway obtains the number of parameters 4 and the parameter identifier sequence 33, 34, 35, and 36 from the vehicle-side command; the number of parameters recorded in the whitelist entry is 4, and the parameter identifiers are arranged in the order of 33, 34, 35, and 36, where parameter identifier 33 represents the basic action increment, parameter identifier 34 represents the coarse adjustment multiplier, parameter identifier 35 represents the fine adjustment multiplier, and parameter identifier 36 represents the load compensation coefficient.

[0032] The vehicle gateway first compares the number of parameters 4 in the vehicle-side command with the number of parameters 4 in the whitelist entries, and then compares the parameter identifiers one by one in the order of the first to the fourth item. In this embodiment, the number of parameters, parameter identifiers and parameter arrangement order are consistent, so an associated parameter set is formed according to the parameter arrangement order. The associated parameter set includes the basic action increment, coarse adjustment multiplier, fine adjustment multiplier and load compensation coefficient in sequence.

[0033] The whitelist entry also records the basic action increment (16 bits), coarse adjustment rate (8 bits), fine adjustment rate (8 bits), load compensation coefficient (8 bits), and four related parameters (40 bits in total), corresponding to five parameter payload bytes. The vehicle gateway compares the five-byte parameter payload length of the vehicle-side command with the five-byte parameter payload length recorded in the whitelist entry. Once the parameter payload lengths match, it proceeds to step S1.3.

[0034] When the number of parameters is inconsistent, any parameter identifier is inconsistent, the parameter order is inconsistent, duplicate parameter identifiers appear, or the parameter payload length is inconsistent, the vehicle gateway will generate protocol verification results for the inconsistencies in the number of parameters, parameter identifiers, parameter order, duplicate parameter identifiers, or parameter payload lengths, and terminate the current vehicle-side command transmission.

[0035] For example, when the parameter identifiers of the vehicle-side command are 33, 34, 36, and 35 in sequence, although the number of parameters and the types of parameter identifiers have not changed, the order of the third and fourth parameter identifiers is inconsistent with the whitelist entries. The vehicle gateway does not exchange the positions of the two parameters, but directly forms a protocol verification result with inconsistent parameter order, thereby avoiding the interpretation of the load compensation coefficient according to the quantification rules of the fine adjustment ratio.

[0036] S1.3 Extract the bit start position, bit width, byte order, data type, sign attribute, scaling factor, offset, rounding method and endpoint affiliation rule of each associated parameter from the whitelist entries to form the protocol quantization relationship.

[0037] Specifically, the least significant bit of the first byte of the parameter payload is set to 0 as the starting bit position, and the bits are numbered continuously along the byte arrangement order of the parameter payload; within the same byte, the bit positions are increased in order from least significant bit to most significant bit, and the next byte is numbered after completing one byte.

[0038] The whitelist entries record that the bit starting position of the basic action increment is 0, the bit width is 16 bits, the byte order is low byte first, the data type is integer, the sign attribute is signed binary two's complement, the lower limit of the protocol source code is -200, the upper limit of the protocol source code is 200, each protocol source code corresponds to 0.1mm, the offset is 0mm, and the rounding method is nearest-nearest value rounding; when the nearest-nearest value rounding encounters the midpoint of two adjacent integers, the midpoint is assigned to the larger integer. Therefore, the lower midpoint corresponding to the current protocol source code belongs to the inverse interval of the current code value, while the upper midpoint does not belong to the inverse interval of the current code value.

[0039] The coarse adjustment factor starts at bit position 16, has a bit width of 8 bits, uses single-byte order, has an integer data type, is unsigned, has a lower limit of 90 for the protocol source code, an upper limit of 110 for the protocol source code, has 0.01 for each protocol source code, has an offset of 0, and uses rounding down. The inverse interval of the code value corresponding to the rounding down includes the current protocol source code but does not include the next integer.

[0040] The fine-tuning multiplier starts at bit position 24, has a bit width of 8 bits, uses single-byte order, uses integer data, has a signed two's complement sign attribute, has a lower limit of -10 for the protocol source code, an upper limit of 10 for the protocol source code, has 0.01 for each protocol source code, has an offset of 0, uses the nearest value rounding method, and has the same endpoint attribution rules as the basic action increment.

[0041] The load compensation coefficient has a bit starting position of 32, a bit width of 8 bits, a byte order of single byte, a data type of integer, a sign attribute of signed two's complement, a lower limit of -10 for the protocol source code, an upper limit of 10 for the protocol source code, 0.005 for each protocol source code, an offset of 0, and a rounding method of truncating to zero. When the protocol source code is non-negative, the inverse interval of the code value includes the current protocol source code but does not include the next integer. When the protocol source code is negative, the inverse interval of the code value does not include the previous integer but includes the current protocol source code.

[0042] For example, the vehicle actuator motion quantity quantization item in the whitelist entry records: the internal motion quantity interface of the left front door controller uses 16-bit signed binary two's complement, the lower limit of the protocol received raw code is -200, the upper limit of the protocol received raw code is 200, each protocol raw code corresponds to 0.1mm, and the offset is 0mm; the vehicle actuator motion quantity quantization item and the basic motion increment quantization item have the same numerical resolution, but their meanings are different; the basic motion increment is the input parameter of the vehicle-side command, and the vehicle actuator motion quantity is the output quantity after the input parameter has been processed by the correlation parameter operation relationship and the segmented mapping relationship.

[0043] The vehicle gateway arranges the parameters of the associated parameter set according to their order, and forms a protocol quantization relationship by combining the bit position, bit width, byte order, data type, symbol attribute, protocol source code boundary, scaling factor, offset, rounding method and endpoint affiliation rule of the four associated parameters. The vehicle actuator action quantity quantization item is then added to the protocol quantization relationship for the conversion of allowed action boundaries.

[0044] S1.4. Determine the physical association constraints based on the associated parameter operation relationship, segmented mapping relationship and vehicle actuator action relationship recorded in the whitelist entries. Determine the target controller based on the controller identifier. Determine the allowed action boundary based on the current action position of the vehicle actuator fed back by the target controller, the mechanical travel boundary of the vehicle actuator, the protocol received raw code boundary of the target controller, the protocol quantization relationship and the action safety boundary recorded in the whitelist entries.

[0045] In a preferred embodiment, the operation relationship of the associated parameters recorded in the whitelist entries includes the following processing order: first, the coarse adjustment multiplier and the fine adjustment multiplier are added to obtain the combined action multiplier; then, the basic action increment is multiplied by the combined action multiplier to obtain the multiplier correction increment; at the same time, the basic action increment is multiplied by the load compensation coefficient to obtain the load compensation increment; then, the multiplier correction increment is added by the load compensation increment to obtain the action increment before mapping.

[0046] The basic action increment is used in the calculation of both the multiplier correction increment and the load compensation increment. Therefore, the basic action increment is a shared physical parameter. The basic action increment must use the same value in both reference positions. It is not allowed to use the lower end of the interval in one reference position and the upper end of the interval in another reference position.

[0047] The segmented mapping relationship recorded in the whitelist entries is symmetrical about 0mm; when the absolute value of the pre-mapping action increment does not exceed 10mm, the absolute value of the vehicle actuator action is the same as the absolute value of the pre-mapping action increment; when the absolute value of the pre-mapping action increment is greater than 10mm but not more than 30mm, the first 10mm is transmitted with the same displacement, and the part exceeding 10mm is transmitted with 0.8 times; when the absolute value of the pre-mapping action increment is greater than 30mm but not more than 50mm, the first 10mm is transmitted with the same displacement, the part from 10mm to 30mm is transmitted with 0.8 times, and the part exceeding 30mm is transmitted with 0.6 times; the positive and negative directions of the vehicle actuator action are consistent with the positive and negative directions of the pre-mapping action increment.

[0048] According to the above segmented mapping relationship, when the pre-mapping motion increment is 10mm, the vehicle actuator motion is 10mm; when the pre-mapping motion increment is 30mm, the vehicle actuator motion is 26mm; and when the pre-mapping motion increment is 50mm, the vehicle actuator motion is 38mm. When the pre-mapping motion increment is -10mm, -30mm, and -50mm, the vehicle actuator motion is -10mm, -26mm, and -38mm, respectively. Adjacent segments use the same output value at 10mm, 30mm, -10mm, and -30mm, therefore there is no output jump in the segmented mapping relationship.

[0049] The whitelist entries record the following vehicle actuator action relationships: the current position of the vehicle actuator and the amount of vehicle actuator action are combined in positive and negative directions to obtain the window position after the instruction is executed; a positive vehicle actuator action increases the window position, and a negative vehicle actuator action decreases the window position.

[0050] The whitelist entries record the following: the lower boundary of the combined action multiplier is 0.90, and the upper boundary is 1.10; the lower boundary of the multiplier correction increment is -22mm, and the upper boundary is 22mm; the lower boundary of the load compensation increment is -3mm, and the upper boundary is 3mm; the lower boundary of the pre-mapping action increment is -25mm, and the upper boundary is 25mm; the lower boundary of the vehicle actuator action amount is -22mm, and the upper boundary is 22mm.

[0051] In this embodiment, when a whitelist entry specifies a maximum allowed value for the output of a computing node, the maximum allowed value is determined as the upper relation boundary; when a whitelist entry specifies a minimum allowed value for the output of a computing node, the minimum allowed value is determined as the lower relation boundary; when a whitelist entry specifies both a lower and upper limit for output, the lower and upper limits for output are determined as the lower relation boundary and the upper relation boundary, respectively.

[0052] Before using the associated parameter operation relationship, the vehicle gateway performs a structural check on the associated parameter operation relationship. Specifically, the structural check includes: there are no circular connections between the operation nodes; each operation node has a clear input and a unique output; operation nodes are limited to addition, subtraction, multiplication, and piecewise monotonic operation nodes; the segment boundaries of each piecewise monotonic operation node are continuous and do not overlap; each segment has a definite monotonic direction; the same shared physical parameter cannot appear simultaneously at two inputs of the same multiplication operation node; the same shared physical parameter cannot form a square term or a higher-order term through different branches; if any structural check item is not met, the corresponding whitelist entry is marked as a configuration error, and the current vehicle terminal command transmission is terminated.

[0053] Preferably, the above-mentioned limitations enable the candidate endpoint combinations in this embodiment to cover the extreme positions of the vehicle actuator action.

[0054] As an example, the controller identifier recorded in the whitelist entry is 49; in the vehicle network configuration, controller identifier 49 corresponds to the left front door controller, controller identifier 50 corresponds to the right front door controller, controller identifier 51 corresponds to the left rear door controller, and controller identifier 52 corresponds to the right rear door controller; the vehicle gateway compares the controller identifier 49 carried in the vehicle-side command with the controller identifier 49 in the whitelist entry. If they match, the left front door controller is identified as the target controller; if they do not match, a protocol verification result of controller identifier inconsistency is generated, and the current vehicle-side command transmission is terminated.

[0055] Before determining the allowed action boundary, the vehicle gateway verifies the controller identifier, position validity status, feedback sequence number, and feedback duration fed back by the target controller. In this embodiment, the feedback controller identifier is 49, which is consistent with the target controller; the position validity status is 1; the feedback sequence number 8641 is only one sequence number behind the vehicle-side instruction sequence number 8642; the feedback duration of 18ms does not exceed 100ms; therefore, 62.0mm is determined as the current action position of the vehicle actuator.

[0056] When the position valid status is not 1, the feedback controller identifier is inconsistent, the feedback sequence number is more than 1 behind, or the feedback time exceeds 100ms, the historical position or default position is not used to replace the current action position of the vehicle actuator. Instead, a protocol verification result indicating that the current position feedback is invalid is generated, and the current vehicle-side command transmission is terminated.

[0057] The lower limit of the mechanical stroke of the vehicle actuator is 0mm, and the upper limit of the mechanical stroke is 100mm. The lower limit of the mechanically operable actuator is determined by the difference between the lower limit of the mechanical stroke and the current position of the vehicle actuator (62.0mm), resulting in -62.0mm. The upper limit of the mechanically operable actuator is determined by the difference between the upper limit of the mechanical stroke and the current position of the vehicle actuator (62.0mm), resulting in 38.0mm.

[0058] The vehicle actuator motion quantity quantization item records that the lower limit of the protocol received raw code is -200 and the upper limit of the protocol received raw code is 200. Each protocol raw code corresponds to 0.1mm, and the offset is 0mm. The lower limit of the protocol received raw code -200 is converted to -20.0mm, and the upper limit of the protocol received raw code 200 is converted to 20.0mm. The smaller value -20.0mm is determined as the lower limit of the protocol that can be accepted, and the larger value 20.0mm is determined as the upper limit of the protocol that can be accepted.

[0059] The whitelist entries record a lower limit for safe actions of -15.0mm and an upper limit for safe actions of 15.0mm. The safe action boundaries are determined by the vehicle manufacturer in combination with the single remote action limit, the load range of the window lifting mechanism and the action limit of the left front door controller, and are fixed in the whitelist entries.

[0060] The vehicle gateway selects -15.0mm, the largest value among the mechanically executable lower limit (-62.0mm), the protocol acceptable lower limit (-20.0mm), and the motion safety lower limit (-15.0mm), to determine the lower limit of the allowable motion boundary; and selects 15.0mm, the smallest value among the mechanically executable upper limit (38.0mm), the protocol acceptable upper limit (20.0mm), and the motion safety upper limit (15.0mm), to determine the upper limit of the allowable motion boundary; therefore, the allowable motion boundary in this embodiment is from -15.0mm to 15.0mm.

[0061] When the lower limit of the allowed action boundary is greater than the upper limit of the allowed action boundary, the mechanically executable range, the protocol acceptable range, and the action safety range do not have a common range. The vehicle gateway generates a protocol verification result indicating that the allowed action boundary is empty and terminates the current vehicle-side command transmission.

[0062] S2. Extract the protocol source code corresponding to the associated parameter set from the vehicle-side instructions. Determine the value range of the physical parameters corresponding to each protocol source code according to the protocol quantization relationship, and obtain the combination of quantization inverse intervals. Note that the following should be noted in this step: S2.1. According to the parameter arrangement order in the associated parameter set, and based on the bit start position and bit width recorded in the protocol quantization relationship, sequentially extract the associated parameter bit segments from the parameter payload of the vehicle-side instruction; rearrange the associated parameter bit segments according to byte order, and perform unsigned conversion or binary two's complement conversion according to data type and sign attribute to obtain the protocol original code sequence.

[0063] In a preferred embodiment, the vehicle gateway processes the parameter loads 120, 0, 100, 5, 2 according to the order of the basic action increment, coarse adjustment multiplier, fine adjustment multiplier, and load compensation coefficient in the associated parameter set.

[0064] The basic action increment starts at bit 0 and has a bit width of 16 bits. Therefore, the first byte 120 and the second byte 0 of the parameter payload are extracted. Since the basic action increment uses a byte order with the least significant byte first, the second byte 0 is taken as the most significant byte and the first byte 120 is taken as the least significant byte, resulting in a 16-bit two's complement binary code 0000000001111000. The most significant bit is 0, so the two's complement binary code represents a non-negative integer, resulting in the protocol source code 120 of the basic action increment.

[0065] The starting bit position of the coarse adjustment ratio is 16, and the bit width is 8 bits. Therefore, the third byte of the parameter payload, 100, is extracted. The coarse adjustment ratio is interpreted as an unsigned integer, resulting in the protocol source code 100 of the coarse adjustment ratio.

[0066] The starting bit position of the fine-tuning ratio is 24, and the bit width is 8 bits. Therefore, the 4th byte 5 of the parameter payload is extracted. The fine-tuning ratio is interpreted using signed binary two's complement, with the most significant bit being 0, resulting in the protocol source code 5 of the fine-tuning ratio.

[0067] The starting bit position of the load compensation coefficient is 32, and the bit width is 8 bits. Therefore, the 5th byte of the parameter payload is truncated as 2. The load compensation coefficient is interpreted using signed binary two's complement, with the most significant bit being 0, resulting in the protocol original code 2 of the load compensation coefficient.

[0068] When the most significant bit of the 8-bit signed two's complement is 1, the remaining 7 bits and the most significant bit are interpreted as negative values ​​of the two's complement. For example, the parameter payload byte 254 corresponds to the two's complement 11111110, which yields the protocol source code -2.

[0069] Therefore, the protocol source code sequence 120, 100, 5, 2 is formed according to the arrangement order of the associated parameter set; the vehicle gateway compares the protocol source codes 120, 100, 5, 2 with the corresponding protocol source code boundaries respectively; the basic action increment protocol source code 120 is within -200 to 200, the coarse adjustment multiplier protocol source code 100 is within 90 to 110, the fine adjustment multiplier protocol source code 5 is within -10 to 10, and the load compensation coefficient protocol source code 2 is within -10 to 10, so the process proceeds to step S2.2; when any protocol source code exceeds the corresponding boundary, a protocol verification result of the associated parameter protocol source code exceeding the boundary is formed, and the current vehicle terminal instruction transmission is terminated.

[0070] S2.2. For each protocol source code in the protocol source code sequence, determine the inverse interval of the code value; round the most recent value with the midpoint between the previous integer and the protocol source code as the lower end and the midpoint between the protocol source code and the next integer as the upper end, and determine the open or closed end according to the endpoint assignment rules; round down with the protocol source code as the closed lower end and the next integer as the open upper end; round up with the previous integer as the open lower end and the protocol source code as the closed upper end; truncate to zero by using the endpoint corresponding to round down when the protocol source code is non-negative, and by using the endpoint corresponding to round up when the protocol source code is negative.

[0071] In this embodiment, the inverse code value range refers to the entire range of pre-quantized code values ​​that can be obtained after processing according to the corresponding rounding method; the pre-quantized code values ​​have not yet been scaled by the scaling factor and superimposed by the offset.

[0072] Specifically, the basic action increment is rounded to the nearest value, and the larger integer is rounded to the midpoint. The first integer before the protocol source code 120 is 119, and the second integer is 121. The midpoint between 119 and 120 is 119.5, and the midpoint between 120 and 121 is 120.5. Therefore, the inverse interval of the code value of the basic action increment starts from the lower end 119.5 and ends at the upper end 120.5. 119.5 belongs to the inverse interval of the code value, while 120.5 does not.

[0073] The coarse adjustment factor uses rounding down. The original code 100 corresponds to the range of pre-quantization code values ​​starting from 100 and extending to 101, where 100 belongs to the inverse interval of code values ​​and 101 does not belong to the inverse interval of code values.

[0074] The fine-tuning multiplier uses the most recent value rounded. Protocol original code 5 corresponds to the pre-quantization code value range starting from 4.5 and extending to 5.5, where 4.5 belongs to the inverse code value interval, and 5.5 does not belong to the inverse code value interval.

[0075] The load compensation coefficient adopts zero truncation. The original code 2 of the protocol is a non-negative value, so the non-negative value zero truncation rule is adopted, which corresponds to the range of code values ​​before quantization starting from 2 and extending to 3. Among them, 2 belongs to the inverse interval of code values, while 3 does not belong to the inverse interval of code values.

[0076] When the protocol source code obtained by truncation to zero is -2, the corresponding pre-quantization code value range extends from -3 to -2, where -3 does not belong to the inverse code value interval, and -2 belongs to the inverse code value interval; this negative value example illustrates that truncation to zero adopts different endpoint belonging directions on both sides of 0.

[0077] When the associated parameter is rounded up, the inverse interval of the code value corresponding to the current protocol source code extends from the previous integer to the current protocol source code, where the previous integer does not belong to the inverse interval of the code value, and the current protocol source code does belong to the inverse interval of the code value.

[0078] S2.3. Scale the inverse interval of the code value according to the scaling factor and add the offset. Determine the smaller and larger values ​​in the scaling result as the lower and upper bounds of the physical parameter value interval, respectively.

[0079] Specifically, the vehicle gateway scales the two endpoints of the inverse interval of each code value according to the corresponding scaling factor, and then superimposes the corresponding offset; the scaling factor and the offset are both derived from the whitelist entries determined in step S1.

[0080] As an example, each basic action increment corresponds to 0.1mm for each protocol source code, with an offset of 0mm. Scale the lower end of the inverse interval of the code value (119.5) by 0.1mm to obtain 11.95mm; scale the upper end of the inverse interval of the code value (120.5) by 0.1mm to obtain 12.05mm. Therefore, the range of physical parameter values ​​for the basic action increment extends from 11.95mm to 12.05mm, where 11.95mm belongs to the range of physical parameter values, and 12.05mm does not.

[0081] The coarse adjustment factor corresponds to 0.01 for each original code of the protocol, with an offset of 0. The lower end 100 and the upper end 101 of the inverse interval of the code value are scaled to obtain 1.00 and 1.01 respectively. Therefore, the range of physical parameter values ​​for the coarse adjustment factor extends from 1.00 to 1.01, where 1.00 belongs to the range of physical parameter values ​​and 1.01 does not belong to the range of physical parameter values.

[0082] The fine-tuning factor corresponds to 0.01 for each original code segment of the protocol, with an offset of 0. The lower end (4.5) and upper end (5.5) of the inverse interval of the code value are scaled to obtain 0.045 and 0.055 respectively. Therefore, the range of physical parameter values ​​for the fine-tuning factor extends from 0.045 to 0.055, where 0.045 belongs to the range of physical parameter values, and 0.055 does not.

[0083] The load compensation coefficient corresponds to 0.005 for each original code segment of the protocol, with an offset of 0. By scaling the lower end 2 and the upper end 3 of the inverse interval of the code value, we obtain 0.010 and 0.015 respectively. Therefore, the range of physical parameter values ​​for the load compensation coefficient extends from 0.010 to 0.015, where 0.010 belongs to the range of physical parameter values ​​and 0.015 does not belong to the range of physical parameter values.

[0084] When the scaling factor is positive, the endpoint with the smaller value after scaling is the lower bound of the physical parameter value range, and the endpoint with the larger value is the upper bound of the physical parameter value range. When the scaling factor is negative, the numerical order of the two scaling results is reversed. The vehicle gateway still selects the smaller value as the lower bound of the physical parameter value range and the larger value as the upper bound of the physical parameter value range, and the endpoint affiliation attribute is transferred with the corresponding scaling result.

[0085] It should be noted that the physical parameter value range in this embodiment refers to the range of physical quantities before encoding corresponding to a certain protocol source code in the vehicle-end command under the joint limitation of rounding method, endpoint attribution rule, proportional coefficient and offset; the physical parameter value range of the basic action increment has mm dimension, while the physical parameter value ranges of coarse adjustment ratio, fine adjustment ratio and load compensation coefficient are dimensionless ranges.

[0086] S2.4. According to the parameter arrangement order in the associated parameter set, the value intervals of the physical parameters are combined to obtain the quantized inverse interval combination that is associated with the associated parameter set one by one.

[0087] In this embodiment, the vehicle gateway combines the ranges of physical parameters according to the order of the associated parameter set, without reordering them according to the magnitude of the values ​​in each range.

[0088] As an example, the first item of the quantized inverse interval combination is the physical parameter value range of the basic action increment, ranging from 11.95mm to 12.05mm; the second item is the physical parameter value range of the coarse adjustment ratio, ranging from 1.00 to 1.01; the third item is the physical parameter value range of the fine adjustment ratio, ranging from 0.045 to 0.055; and the fourth item is the physical parameter value range of the load compensation coefficient, ranging from 0.010 to 0.015. The endpoint attribution attribute of each physical parameter value range is retained along with the corresponding range.

[0089] Preferably, step S2 converts the discrete protocol original code into a continuous range of physical parameter values ​​that may correspond to it before encoding by bit segment truncation, byte order adjustment, signed interpretation, determination of the inverse code value range, and physical quantity scaling, thus solving the problem of missing rounding errors when only a single decoded value is used.

[0090] S3. Based on the physical association constraints, perform interval propagation on the quantized inverse interval combination to obtain the lower and upper bounds of the vehicle actuator motion quantities, forming the motion quantity envelope. Note that the following points should be noted in this step: S3.1 According to the physical parameter reference relationship and operation order in the physical association constraint, the quantization inverse interval combination is arranged into an interval operation chain from the association parameter to the vehicle actuator action quantity, and the operation type and relationship boundary of each operation node are determined.

[0091] Specifically, determine the operation types and relational boundaries of each operational step, including: Based on the bracket hierarchy, operation priority, and physical parameter reference relationship in the physical association constraints, the operation relationship between the association parameters and the vehicle actuator motion quantities is broken down into sequentially connected operation nodes; Based on the operators or segmented mapping relationships of each operation node, the operation node is determined as an addition operation node, a subtraction operation node, a multiplication operation node, or a segmented monotonic operation node; For each operation node, the value of its output boundary is determined according to the constraint expression form corresponding to the operation node. Specifically, when the output of the operation node corresponds only to a one-sided upper limit constraint, the value corresponding to the upper limit constraint is used as the upper relation boundary of the operation node output; when the output of the operation node corresponds only to a one-sided lower limit constraint, the value corresponding to the lower limit constraint is used as the lower relation boundary of the operation node output; when the output of the operation node corresponds to an interval constraint composed of upper and lower limits, the lower limit of the interval constraint is used as the lower relation boundary of the operation node output, and the upper limit of the interval constraint is used as the upper relation boundary of the operation node output. In this embodiment, the constraint expression form is a mathematical constraint structure used to characterize the way the output variables of the operation node are restricted, including a one-sided upper limit constraint expression form, a one-sided lower limit constraint expression form, and a two-sided interval constraint expression form. For segmented monotonic operation nodes, the boundary value of adjacent monotonic segments is determined as the segment boundary, and the lower limit and upper limit of the output of each monotonic segment are determined as the lower relation boundary and upper relation boundary of the monotonic segment, respectively.

[0092] It should be noted that, according to the bracket hierarchy, the coarse adjustment multiplier and the fine adjustment multiplier are first added together, and the resulting combined action multiplier is then multiplied with the basic action increment; according to the operation priority, the multiplier correction increment and the load compensation increment are multiplied together before addition, and the segmented mapping process is performed after addition; according to the physical parameter reference relationship, the basic action increment enters the multiplier correction branch and the load compensation branch respectively, the coarse adjustment multiplier and the fine adjustment multiplier only enter the combined action multiplier branch, and the load compensation coefficient only enters the load compensation branch.

[0093] Five operation nodes are formed according to the above relationship; among them, the first operation node receives the coarse adjustment ratio and the fine adjustment ratio, performs addition processing, and outputs the combined action ratio; the second operation node receives the basic action increment and the combined action ratio, performs multiplication processing, and outputs the ratio correction increment; the third operation node receives the basic action increment and the load compensation coefficient, performs multiplication processing, and outputs the load compensation increment; the fourth operation node receives the ratio correction increment and the load compensation increment, performs addition processing, and outputs the action increment before mapping; the fifth operation node receives the action increment before mapping, performs piecewise monotonic mapping processing, and outputs the vehicle actuator action amount.

[0094] The first to fifth operation nodes form an interval operation chain in sequence; the second and third operation nodes jointly reference the basic action increment, and the two references point to the same physical parameter, thus not forming two independent physical parameters.

[0095] For example, the segment boundaries of the 5th operation node are -30mm, -10mm, 0mm, 10mm and 30mm respectively; the negative 30mm to 50mm segment, the negative 10mm to 30mm segment, the center segment, the positive 10mm to 30mm segment and the positive 30mm to 50mm segment all increase in output as the input increases, so each segment is a monotonically increasing segment.

[0096] It should also be noted that the reverse interval contraction in step S3 only uses the operational node relationship boundary in the physical association constraint, and does not use the allowed action boundary determined in step S1; the allowed action boundary is only compared with the final action quantity envelope in step S4.

[0097] S3.2. For addition nodes, accumulate the lower and upper bounds of the input interval respectively; for subtraction nodes, use the lower bound of the minus interval minus the upper bound of the subtraction interval as the lower bound of the output, and use the upper bound of the minus interval minus the lower bound of the subtraction interval as the upper bound of the output; for multiplication nodes, calculate the product of the endpoints of the input interval and select the minimum and maximum values; for piecewise monotonic operation nodes, split the input interval according to the piecewise boundaries and determine the output interval according to the monotonic direction.

[0098] The first operation node is an addition operation node; the lower bound of the coarse adjustment multiplier, 1.00, is added to the lower bound of the fine adjustment multiplier, 0.045, to obtain the lower bound of the combined action multiplier, 1.045; the upper bound of the coarse adjustment multiplier, 1.01, is added to the upper bound of the fine adjustment multiplier, 0.055, to obtain the upper bound of the combined action multiplier, 1.065; the combined action multiplier range is within the relational boundary from 0.90 to 1.10.

[0099] The second operation node is a multiplication operation node; both the basic motion increment range and the combined motion multiplier range are positive values. Therefore, multiplying the lower limit of the basic motion increment of 11.95mm with the lower limit of the combined motion multiplier of 1.045 yields the lower limit of the multiplier correction increment of 12.48775mm; multiplying the upper limit of the basic motion increment of 12.05mm with the upper limit of the combined motion multiplier of 1.065 yields the upper limit of the multiplier correction increment of 12.83325mm.

[0100] The third operation node is a multiplication operation node; both the basic action increment range and the load compensation coefficient range are positive values. Therefore, multiplying the lower limit of the basic action increment of 11.95mm with the lower limit of the load compensation coefficient of 0.010 yields the lower limit of the load compensation increment of 0.1195mm; multiplying the upper limit of the basic action increment of 12.05mm with the upper limit of the load compensation coefficient of 0.015 yields the upper limit of the load compensation increment of 0.18075mm.

[0101] The fourth operation node is an addition operation node; add the lower bound of the multiplier correction increment of 12.48775mm to the lower bound of the load compensation increment of 0.1195mm to obtain the lower bound of the action increment before mapping of 12.60725mm; add the upper bound of the multiplier correction increment of 12.83325mm to the upper bound of the load compensation increment of 0.18075mm to obtain the upper bound of the action increment before mapping of 13.014mm.

[0102] Before mapping, the entire range of motion increments is located in the positive 10mm to 30mm range; the 5th operation node transmits the first 10mm with the same displacement, and transmits the part exceeding 10mm with 0.8 times, resulting in the lower limit of the initial range of vehicle actuator motion amount of 12.0858mm and the upper limit of the initial range of 12.4112mm.

[0103] When the addition node has two input intervals, the lower and upper bounds of the two input intervals are accumulated respectively; when the subtraction node has a minus input interval and a subtraction input interval, the lower bound of the output interval is determined by subtracting the upper bound of the subtraction input interval from the lower bound of the minus input interval, and the upper bound of the output interval is determined by subtracting the lower bound of the subtraction input interval from the upper bound of the minus input interval.

[0104] When the input interval of the multiplication node contains both positive and negative values, calculate the product of the four endpoints of the two input intervals respectively, and select the minimum and maximum values ​​from the four endpoint products as the boundaries of the output interval.

[0105] When the input interval of a piecewise monotonic operation node crosses the segment boundary, the input interval is divided into multiple sub-intervals according to the segment boundary. The output interval is determined according to the monotonic direction of each sub-interval, and then adjacent or overlapping output intervals are merged.

[0106] S3.3 Starting from the last-level operation node where the vehicle actuator motion quantity is located, the relation boundary is converted into the allowed input interval level by level according to the inverse operation of each operation node; for multiplication operation nodes, if the other input interval does not contain zero points, the inverse division operation is performed; if the other input interval contains zero points, the inverse division operation is performed on the non-zero segments after segmenting according to the zero points; for segmented monotonic operation nodes, the reverse mapping is performed according to the monotonic direction; the intersection of the allowed input interval and the corresponding quantization inverse interval is taken to obtain the contracted inverse interval.

[0107] Specifically, starting from the 5th operation node where the vehicle actuator action is located, the relationship boundaries of each operation node are reverse-calculated.

[0108] The boundary of the vehicle actuator motion quantity relationship of the 5th operation node is -22mm to 22mm; the input range of the central section is -10mm to 10mm, which is the same as the output range; for the positive 10mm to 30mm section, when the vehicle actuator motion quantity increases from 10mm to 22mm, the output portion exceeding 10mm is 12mm; according to the segmentation ratio of 0.8, the 12mm output portion corresponds to the 15mm input portion, which is then merged with the first 10mm to obtain the upper limit of the motion increment before mapping, which is 25mm; the negative section obtains the lower limit of the motion increment before mapping, which is -25mm, according to the symmetrical relationship; therefore, the allowable input range obtained by the reverse conversion of the 5th operation node is -25mm to 25mm.

[0109] The intersection of the allowed input interval with the relational boundary of the 4th operation node (-25mm to 25mm) and the pre-mapping action increment interval (12.60725mm to 13.014mm) obtained by forward propagation is used to obtain the contracted inverse interval (12.60725mm to 13.014mm) of the 4th operation node.

[0110] When performing a reverse calculation on one of the inputs for an addition node, the lower bound of the current allowed input interval is determined by subtracting the upper bound of the other input interval from the lower bound of the allowed output interval; the upper bound of the current allowed input interval is determined by subtracting the lower bound of the other input interval from the upper bound of the allowed output interval.

[0111] In this embodiment, based on the output allowable range of -25mm to 25mm of the 4th operation node and the load compensation increment range of 0.1195mm to 0.18075mm, the allowable input range of the multiplier correction increment is calculated in reverse to extend from -25.18075mm to 24.8805mm; the intersection of the allowable input range with the forward propagation range of the multiplier correction increment of 12.48775mm to 12.83325mm and the multiplier correction increment relationship boundary of -22mm to 22mm is used to obtain the inverse range of the multiplier correction increment contraction of 12.48775mm to 12.83325mm.

[0112] Based on the output allowable range of -25mm to 25mm from the 4th operation node and the multiplier correction increment range of 12.48775mm to 12.83325mm, the allowable input range of the load compensation increment is calculated in reverse. The allowable input range covers the forward propagation range of the load compensation increment from 0.1195mm to 0.18075mm, and the forward propagation range is located within the relational boundary of -3mm to 3mm. Therefore, the inverse range of the load compensation increment contraction is still 0.1195mm to 0.18075mm.

[0113] When performing a reverse calculation of the input to be subtracted for a subtraction operation node, the allowed output interval and the input subtraction interval are processed by addition interval; when performing a reverse calculation of the input subtraction, the allowed output interval is subtracted from the input subtraction interval, and the boundary is determined according to the subtraction interval rules.

[0114] When performing a reverse calculation on one of the inputs for a multiplication node, first determine whether the other input interval contains 0; if the other input interval is all positive, perform division with the boundary of the output allowed interval and the endpoint of the other input interval respectively, and select the smaller and larger values ​​from the results as the current allowed interval boundary; if the other input interval is all negative, perform the same division and then re-determine the lower and upper bounds according to the numerical values.

[0115] When the other input interval contains 0, it is divided into a negative sub-interval, a 0 value, and a positive sub-interval at 0. The negative and positive sub-intervals are respectively subjected to reverse division. When the output allowed interval contains 0, the 0 value is retained as a feasible value. When the output allowed interval does not contain 0, the 0 value does not enter the allowed input interval. The unbounded reverse range generated near 0 continues to intersect with the original physical parameter value interval and the boundary of the corresponding relationship. Therefore, the final shrinking of the reverse interval is still limited by the finite range of the original parameters. 0 must not be used as a divisor.

[0116] In this embodiment, the combined action multiplier range of 1.045 to 1.065 does not include 0, and the allowable input range of the basic action increment obtained by the reverse conversion of the second operation node covers 11.95mm to 12.05mm; the load compensation coefficient range of 0.010 to 0.015 does not include 0, and the allowable input range of the basic action increment obtained by the reverse conversion of the third operation node also covers 11.95mm to 12.05mm.

[0117] When performing reverse conversion on piecewise monotonic operation nodes, first obtain the intersection of the allowed output interval and the output range of each monotonic segment, and then convert it into the input interval according to the monotonic direction and segmentation ratio of the corresponding segment; monotonic segments with empty intersection do not generate allowed input intervals.

[0118] Each allowed input interval intersects with the corresponding forward propagation interval, quantization inverse interval, and relation boundary. The lower bound of the intersection is the maximum value among all lower bounds participating in the intersection, and the upper bound of the intersection is the minimum value among all upper bounds participating in the intersection. When the lower bound of the intersection is less than the upper bound of the intersection, a non-empty contracted inverse interval is formed. When the lower bound of the intersection is equal to the upper bound of the intersection, a single-point contracted inverse interval is formed only if the same endpoint belongs to all participating intervals. In other cases, the intersection is determined to be empty. When the intersection is empty, a protocol verification result indicating that the physical association constraint is not valid is formed, and the current vehicle-side instruction transmission is terminated.

[0119] S3.4 When the same physical parameter is involved in two or more computing nodes, the intersection of the shrinking inverse intervals of the physical parameter in each computing node is taken to obtain the shared parameter interval.

[0120] In a preferred embodiment, the basic action increment participates in both the second and third computing nodes; the vehicle gateway obtains the inverse interval of the basic action increment shrinkage obtained by the reverse conversion of the second computing node, the inverse interval of the basic action increment shrinkage obtained by the reverse conversion of the third computing node, and the range of values ​​of the basic action increment physical parameters obtained in step S2.

[0121] The maximum value among the lower bounds of the above three intervals is selected as the lower bound of the shared parameter interval, and the minimum value among the upper bounds of the above three intervals is selected as the upper bound of the shared parameter interval. In this embodiment, the common range of the three intervals is 11.95mm to 12.05mm. Therefore, the shared parameter interval of the basic action increment is 11.95mm to 12.05mm, where 11.95mm belongs to the shared parameter interval and 12.05mm does not belong to the shared parameter interval.

[0122] When the shared parameter range is empty, it means that the same physical parameter cannot simultaneously satisfy its relationship boundary in multiple operation branches. The vehicle gateway forms a protocol verification result of shared parameter relationship conflict and terminates the current vehicle-side command transmission.

[0123] S3.5. Within each segmented monotonic interval, the same endpoint of the shared parameter interval is simultaneously configured at all reference positions of the physical parameters, and forms a candidate endpoint combination with the endpoints of the remaining contracted inverse intervals; the candidate endpoint combination is passed along the interval operation chain to the vehicle actuator motion quantity, and the minimum and maximum values ​​of the obtained motion quantities are selected as the lower and upper bounds of the motion quantity envelope.

[0124] Specifically, the vehicle gateway forms candidate endpoint combinations according to each monotonic interval. In this embodiment, the pre-mapping action increment interval from 12.60725mm to 13.014mm is entirely located in the positive 10mm to 30mm range, thus forming candidate endpoint combinations within this monotonic range.

[0125] For basic action increments, the lower end of the shared parameter range of 11.95mm or the upper end of 12.05mm should be configured simultaneously in all basic action increment reference positions in both the second and third operation nodes; 11.95mm should not be used in the second operation node and 12.05mm should not be used in the third operation node.

[0126] The coarse adjustment ratio, fine adjustment ratio, and load compensation coefficient are selected from the lower or upper end of the corresponding contraction inverse interval, respectively; each of the four physical parameters has two endpoint selections, and the two references of the basic motion increment are counted as only one common selection, thus forming 16 sets of candidate endpoint combinations.

[0127] The relationship between the associated parameters has been verified through the structure check in step S1.4. No squared terms or higher-order terms have been formed for the same shared physical parameters. Each operation node has a definite monotonic direction within the current segment. Therefore, the minimum and maximum boundaries of the vehicle actuator's motion are located in the output boundaries corresponding to the 16 candidate endpoint combinations.

[0128] The vehicle gateway sequentially sends each candidate endpoint combination to the 1st, 2nd, 3rd, 4th and 5th computing nodes; the candidate endpoint combination consisting of the lower end of the basic motion increment of 11.95mm, the lower end of the coarse adjustment ratio of 1.00, the lower end of the fine adjustment ratio of 0.045 and the lower end of the load compensation coefficient of 0.010 yields the vehicle actuator motion amount of 12.0858mm.

[0129] The candidate endpoint combination consisting of the upper limit of the basic motion increment (12.05mm), the upper limit of the coarse adjustment ratio (1.01), the upper limit of the fine adjustment ratio (0.055), and the upper limit of the load compensation coefficient (0.015) yields the upper limit of the vehicle actuator's motion amount of 12.4112mm. Since none of the above four upper limits belong to the corresponding physical parameter value range, 12.4112mm is the upper bound of the set of possible values ​​for the vehicle actuator's motion amount and does not belong to the actual obtainable value.

[0130] The vehicle actuator motion quantities obtained from the remaining 14 candidate endpoint combinations are all between 12.0858mm and 12.4112mm; therefore, 12.0858mm is determined as the lower bound of the motion quantity envelope, and 12.4112mm is determined as the upper bound of the motion quantity envelope, while the endpoint attributes of the lower bound being closed and the upper bound being open are preserved at the same time.

[0131] When the pre-mapping action increment interval crosses the segment boundary, the vehicle gateway takes each segment boundary as an additional candidate input boundary and forms candidate endpoint combinations in the monotonic interval of each segment. After completing the propagation of all segments, the minimum value is selected from all output results as the lower bound of the action quantity envelope, and the maximum value is selected as the upper bound of the action quantity envelope.

[0132] Preferably, step S3 obtains an action quantity envelope that covers quantization errors and conforms to physical parameter dependencies by forward interval propagation, reverse contraction of relation boundaries, intersection of shared parameter intervals, and synchronous configuration of shared endpoints; this solves the problem that ordinary interval calculation amplifies the interval range by treating multiple reference positions of the same physical parameter as independent variables, while avoiding the omission of critical action quantities by using only a single-point decoding value.

[0133] S4. When the lower bound of the motion envelope is not lower than the lower limit of the allowed motion boundary and the upper bound is not higher than the upper limit of the allowed motion boundary, send the vehicle-side command to the target controller; otherwise, stop sending. Note the following in this step: S4.1. Subtract the lower limit of the allowed action boundary from the lower limit of the action envelope to obtain the lower boundary margin; subtract the upper limit of the action envelope from the upper limit of the allowed action boundary to obtain the upper boundary margin.

[0134] For example, the lower boundary margin is determined by the difference between the lower boundary of the motion envelope (12.0858 mm) and the lower limit of the allowable motion boundary (-15.0 mm), resulting in 27.0858 mm; the upper boundary margin is determined by the difference between the upper limit of the allowable motion boundary (15.0 mm) and the upper boundary of the motion envelope (12.4112 mm), resulting in 2.5888 mm.

[0135] S4.2 When both the lower boundary margin and the upper boundary margin are non-negative, the motion envelope is determined to be within the allowed motion boundary; when the lower boundary margin is negative, the lower limit is determined to be out of bounds; when the upper boundary margin is negative, the upper limit is determined to be out of bounds.

[0136] For example, the lower boundary margin of 27.0858mm and the upper boundary margin of 2.5888mm are both non-negative values, therefore it is determined that the entire motion envelope is within the allowable motion boundary of -15.0mm to 15.0mm.

[0137] When the lower boundary margin is negative, the out-of-bounds type is determined to be lower boundary out-of-bounds; when the upper boundary margin is negative, the out-of-bounds type is determined to be upper boundary out-of-bounds; when both the lower and upper boundary margins are negative, the protocol verification result includes both lower and upper boundary out-of-bounds.

[0138] When the endpoint of the motion quantity envelope is an open endpoint, the value of the open endpoint is still used as the boundary of the motion quantity envelope for comparison; when the open upper bound is not higher than the upper limit of the allowed motion boundary, all actual possible values ​​within the motion quantity envelope are lower than or equal to the upper limit of the allowed motion boundary; when the open lower bound is not lower than the lower limit of the allowed motion boundary, all actual possible values ​​within the motion quantity envelope are higher than or equal to the lower limit of the allowed motion boundary.

[0139] S4.3 When the action quantity envelope is within the allowable action boundary, determine the vehicle communication channel according to the mapping relationship between the target controller's controller identifier and the vehicle communication channel, and send the vehicle-side command through the vehicle communication channel.

[0140] The vehicle network configuration records the mapping relationship between the controller identifier and the vehicle communication channel; in this embodiment, the controller identifier 49 corresponds to the left front door controller, the body CAN-FD channel 1 and the target communication identifier 1441; the controller identifier 50 corresponds to the right front door controller, the body CAN-FD channel 1 and the target communication identifier 1442; the controller identifiers 51 and 52 correspond to the left rear door controller and the right rear door controller in the body CAN-FD channel 2, respectively.

[0141] The vehicle gateway retrieves the mapping relationship using controller identifier 49 to obtain the unique body CAN-FD channel 1 and target communication identifier 1441; the arbitration segment rate of body CAN-FD channel 1 is 500 kbit / s, and the data segment rate is 2 Mbit / s; before transmission, the vehicle gateway verifies that the transmission permission status of body CAN-FD channel 1 is 1 and the bus shutdown status is 0, and verifies that the target communication identifier 1441 is not duplicated with other controllers.

[0142] When the controller identifier does not receive a mapping result or receives more than two mapping results, a protocol verification result of controller channel mapping abnormality is generated; when the vehicle body CAN-FD channel 1 is in the bus closed state or the transmission permission state is not 1, the current transmission is terminated, and a processing result of vehicle communication channel cannot be transmitted is generated; vehicle communication channel cannot be transmitted and parameter protocol out of bounds are recorded separately, and communication failure is not interpreted as parameter out of bounds.

[0143] In this embodiment, the mapping between the controller identifier and the vehicle communication channel is unique, and the vehicle body CAN-FD channel 1 meets the transmission conditions; the transmitted vehicle-side command retains the instruction sequence number 8642, action type identifier 12577, controller identifier 49, number of parameters 4, parameter identifiers 33, 34, 35, 36, and parameter payloads 120, 0, 100, 5, 2; the vehicle gateway encapsulates the CAN-FD data frame according to the target communication identifier 1441, calculates the corresponding frame verification content, and sends it to the left front door controller via the vehicle body CAN-FD channel 1; the vehicle gateway does not modify the protocol source code of the four associated parameters.

[0144] S4.4 When a lower limit or upper limit is exceeded, the sending of vehicle-side commands is terminated, and the corresponding exceedance type is determined as the protocol verification result.

[0145] It should be noted that when the motion amount of the vehicle actuator is the motion increment relative to the current position of the vehicle actuator, the permissible motion boundary is determined as follows: The lower limit of mechanically operable actuators is obtained by subtracting the current position of the vehicle actuators fed back by the target controller from the lower limit of the mechanical stroke of the vehicle actuators; the upper limit of mechanically operable actuators is obtained by subtracting the current position of the vehicle actuators from the upper limit of the mechanical stroke of the vehicle actuators. According to the protocol quantization relationship, the lower limit and upper limit of the protocol received raw code of the target controller are converted into two action values, and the smaller and larger values ​​of the two action values ​​are determined as the lower limit and upper limit of the protocol that can be received, respectively. The maximum value among the mechanically executable lower limit, the protocol acceptable lower limit, and the action safety lower limit recorded in the whitelist entry is determined as the lower limit of the allowed action boundary; The minimum value among the mechanically executable limit, the protocol acceptable limit, and the action safety limit recorded in the whitelist entries is determined as the upper limit of the allowed action boundary; When the lower limit of the allowed action boundary is greater than the upper limit of the allowed action boundary, the allowed action boundary is determined to be empty, and the protocol verification is determined to fail.

[0146] In this embodiment, the protocol verification result includes instruction sequence number, action type identifier, controller identifier, lower bound of action quantity envelope, upper bound of action quantity envelope, endpoint attribute of action quantity envelope, lower limit of allowed action boundary, upper limit of allowed action boundary, lower boundary margin, upper boundary margin, out-of-bounds type, and sending conclusion.

[0147] For example, the result is as follows: instruction number 8642, action type identifier 12577, controller identifier 49, lower limit of action quantity envelope 12.0858mm, upper limit of action quantity envelope 12.4112mm, lower limit of action quantity envelope is closed, upper limit of action quantity envelope is open, lower limit of allowed action boundary -15.0mm, upper limit of allowed action boundary 15.0mm, lower boundary margin 27.0858mm, upper boundary margin 2.5888mm, boundary crossing type is no boundary crossing, and the transmission conclusion is that it is sent to the left front door controller via the vehicle body CAN-FD channel 1.

[0148] As an example of upper limit overshoot, the basic action increment parameter load in the same vehicle-side command is changed from 120, 0 to 180, 0, while the loads of other parameters remain at 100, 5, 2; the basic action increment protocol source code is changed from 120 to 180, and the corresponding physical parameter value range is extended from 17.95mm to 18.05mm; after processing according to the same range operation chain, the action increment range before mapping is extended from 18.93725mm to 19.494mm, the lower bound of the action quantity envelope is 17.1498mm, and the upper bound of the action quantity envelope is 17.5952mm.

[0149] Compared to the allowed action boundary of -15.0mm to 15.0mm, the lower boundary margin of the upper limit out-of-bounds example is 32.1498mm, and the upper boundary margin is -2.5952mm. Therefore, the out-of-bounds type is upper limit out-of-bounds, and the vehicle gateway terminates the transmission of vehicle-side commands. The corresponding protocol verification results are: command number 8643, lower boundary of action quantity envelope 17.1498mm, upper boundary of action quantity envelope 17.5952mm, upper limit of allowed action boundary 15.0mm, upper boundary margin -2.5952mm, out-of-bounds type is upper limit out-of-bounds, and the transmission conclusion is to terminate transmission.

[0150] As an example of lower limit overshoot, the basic action increment parameter load is changed to 76 and 255; the two bytes are combined in byte order with the least significant byte first, corresponding to the 16-bit signed binary two's complement protocol original code -180; the value range of the physical parameter of the basic action increment is extended from -18.05mm to -17.95mm; the load of other parameters remains 100, 5, and 2.

[0151] After processing according to the same interval operation chain, the pre-mapping action increment interval extends from -19.494mm to -18.93725mm, the lower bound of the action quantity envelope is -17.5952mm, and the upper bound of the action quantity envelope is -17.1498mm. Compared with the allowable action boundary of -15.0mm to 15.0mm, the lower boundary margin is -2.5952mm, and the upper boundary margin is 32.1498mm. Therefore, the boundary violation type is lower limit violation, and the vehicle gateway terminates the transmission of vehicle-side commands.

[0152] In this embodiment, the motion amount of the vehicle actuator is limited to the motion increment relative to the current position of the vehicle actuator. Therefore, the allowed motion boundary must be limited by the mechanically executable range, the protocol-acceptable range, and the motion safety range. The mechanically executable range reflects the remaining movement distance of the vehicle actuator from its current position to the two mechanical stroke ends. The protocol-acceptable range reflects the range of motion that the internal motion amount interface of the left front door controller can accept. The motion safety range reflects the motion amplitude that can be applied in a single remote command. The three ranges correspond to different sources of restriction and none of them can replace the others.

[0153] When converting the protocol's acceptable range according to the quantization of the vehicle actuator's motion, the lower limit and upper limit of the protocol's received raw code are proportionally scaled and offset superimposed respectively. In this embodiment, the lower limit of the protocol's received raw code -200 corresponds to -20.0mm, and the upper limit of the protocol's received raw code 200 corresponds to 20.0mm. Therefore, the lower limit of the protocol's acceptable range is -20.0mm, and the upper limit of the protocol's acceptable range is 20.0mm.

[0154] When the quantization term of the vehicle actuator motion uses a negative proportional coefficient, the numerical order of the received raw code is reversed compared to the numerical order of the converted motion values. In this case, the smaller value is still selected from the two conversion results as the lower limit that the protocol can accept, and the larger value is selected as the upper limit that the protocol can accept.

[0155] The protocol receive original code boundary represents the discrete code extreme value that the internal action quantity interface of the left front door controller is allowed to receive. Therefore, when converting the protocol receiveable boundary, the decoded value corresponding to the protocol original code boundary is directly used, and the protocol receive original code boundary is not expanded in reverse interval of step S2. The reverse interval expansion of the code value in step S2 is for the associated parameters that have been rounded in the vehicle-end command. The two have different processing objects.

[0156] Step S1 first determines the allowable action boundary based on the current position of the vehicle actuator. Step S3 then determines the action quantity envelope based on the vehicle-side command parameters. Step S4 performs an inclusion relationship judgment on the allowable action boundary and the action quantity envelope. The allowable action boundary represents the acceptable range of actions under the current vehicle state, and the action quantity envelope represents the range of actions that may be generated by this vehicle-side command. The two are not double-counted or mutually substituted.

[0157] As an example of allowing an empty action boundary, another whitelist entry limits the lower safety limit of the remote incremental activation action to 2.0mm and the upper safety limit to 15.0mm. When the current action position of the vehicle actuator is 99.0mm, the lower mechanically executable limit is -99.0mm and the upper mechanically executable limit is 1.0mm. The lower protocol acceptable limit is -20.0mm and the upper protocol acceptable limit is 20.0mm. At this time, the maximum value among the lower mechanically executable limit, the lower protocol acceptable limit, and the lower action safety limit is 2.0mm, and the minimum value among the upper mechanically executable limit, the upper protocol acceptable limit, and the upper action safety limit is 1.0mm. The lower limit of the allowed action boundary of 2.0mm is greater than the upper limit of the allowed action boundary of 1.0mm, so the allowed action boundary is empty. The vehicle gateway terminates the current vehicle-side command transmission in step S1 and does not proceed to steps S2 and S3.

[0158] It should be noted that step S4 converts the motion quantity envelope into a clear vehicle communication processing result through boundary margin calculation, boundary violation type determination, controller identifier matching with vehicle communication channel, and transmission conclusion generation. This solves the problem of only verifying the vehicle-side command format without checking the current mechanical margin, controller motion quantity reception range, and single remote action limit. It ensures that the vehicle-side command can enter the left front door controller only when all possible motion quantities within the quantization error range are within the allowable motion boundary. When lower limit boundary violation, upper limit boundary violation, allowable motion boundary is empty, or controller channel mapping is abnormal, a processing result with specific boundary values ​​and abnormality type is generated.

[0159] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for verifying vehicle-side command parameter protocols based on an action type whitelist, characterized in that, include: Based on the action type of the vehicle-side command, match the action type whitelist to determine the set of associated parameters, protocol quantization relationships, physical association constraints, allowed action boundaries, and target controller; The determination of the associated parameter set, protocol quantization relationship, physical association constraint, allowed action boundary, and target controller includes: extracting action type identifiers from the vehicle-side instructions; comparing the action type identifiers with whitelist action identifiers in the action type whitelist to determine a uniquely matching whitelist entry; comparing the parameter identifiers, parameter quantity, and parameter order of the vehicle-side instructions with the parameter identifiers, parameter quantity, and parameter order recorded in the whitelist entry, forming an associated parameter set according to the parameter order when all three are consistent, and determining that the protocol verification fails when any one is inconsistent; extracting each parameter from the whitelist entry... The bit start position, bit width, byte order, data type, sign attribute, scaling factor, offset, rounding method, and endpoint attribution rules of the associated parameters form a protocol quantization relationship; physical association constraints are determined based on the associated parameter operation relationship, segmented mapping relationship, and vehicle actuator action relationship recorded in the whitelist entries; the target controller is determined based on the controller identifier; and the allowed action boundary is determined based on the current action position of the vehicle actuator fed back by the target controller, the mechanical travel boundary of the vehicle actuator, the protocol received source code boundary of the target controller, the protocol quantization relationship, and the action safety boundary recorded in the whitelist entries. Extract the protocol source code corresponding to the associated parameter set from the vehicle-side instruction, determine the physical parameter value range corresponding to each protocol source code according to the protocol quantization relationship, and obtain the quantization inverse interval combination; The extraction of the protocol source code includes: extracting associated parameter bit segments sequentially from the parameter payload of the vehicle-side instruction according to the parameter arrangement order in the associated parameter set and the bit start position and bit width recorded in the protocol quantization relationship; rearranging the associated parameter bit segments according to the byte order; and performing unsigned conversion or binary two's complement conversion according to the data type and sign attribute to obtain the protocol source code sequence. The process of obtaining the quantized inverse interval combination includes: determining the inverse interval of code values ​​for each protocol source code in the protocol source code sequence; rounding the most recent value with the midpoint between the previous integer and the protocol source code as the lower end and the midpoint between the protocol source code and the next integer as the upper end, and determining the open or closed end according to the endpoint attribution rules; rounding down with the protocol source code as the closed lower end and the next integer as the open upper end; rounding up with the previous integer as the open lower end and the protocol source code as the closed upper end; truncating to zero with the endpoint corresponding to the rounding down when the protocol source code is non-negative, and with the endpoint corresponding to the rounding up when the protocol source code is negative; scaling the inverse interval of code values ​​according to the scaling factor and superimposing the offset, and determining the smaller and larger values ​​in the scaling result as the lower and upper bounds of the physical parameter value intervals, respectively; combining the physical parameter value intervals according to the parameter arrangement order in the associated parameter set to obtain a quantized inverse interval combination that is one-to-one associated with the associated parameter set. Based on the physical association constraints, interval propagation is performed on the quantized inverse interval combination to obtain the lower and upper bounds of the vehicle actuator motion quantity, forming the motion quantity envelope; The process of forming the motion quantity envelope includes: arranging the quantized inverse intervals into an interval operation chain from the associated parameters to the vehicle actuator motion quantity according to the physical parameter reference relationship and operation order in the physical association constraints, and determining the operation type and relation boundary of each operation node; accumulating the lower and upper bounds of the input interval for addition operation nodes; using the lower bound of the subtraction interval minus the upper bound of the subtraction interval as the output lower bound for subtraction operation nodes, and using the upper bound of the subtraction interval minus the lower bound of the subtraction interval as the output upper bound; calculating the endpoint product of the input intervals for multiplication operation nodes and selecting the minimum and maximum values; splitting the input intervals according to the segmented monotonic operation nodes according to the segmented boundaries, and determining the output interval based on the monotonic direction; starting from the last-level operation node where the vehicle actuator motion quantity is located, converting the relation boundary into an allowable input interval level by level according to the inverse operation of each operation node; and for the multiplication operation nodes... When the input interval does not contain zero, perform the inverse division operation; when the input interval contains zero, perform the inverse division operation on each non-zero segment after segmenting according to the zero point; perform reverse mapping on the segmented monotonic operation nodes according to the monotonic direction; take the intersection of the allowed input interval and the corresponding quantization inverse interval to obtain the contracted inverse interval; when the same physical parameter participates in two or more operation nodes, take the intersection of the contracted inverse intervals of the physical parameter in each operation node to obtain the shared parameter interval; within each segmented monotonic interval, simultaneously configure the same endpoint of the shared parameter interval at all reference positions of the physical parameter, and form a candidate endpoint combination with the endpoints of the remaining contracted inverse intervals; pass the candidate endpoint combination along the interval operation chain to the vehicle actuator motion quantity, and select the minimum and maximum values ​​of the obtained motion quantity as the lower and upper bounds of the motion quantity envelope; When the lower bound of the action quantity envelope is not lower than the lower limit of the allowed action boundary and the upper bound is not higher than the upper limit of the allowed action boundary, the vehicle-side command is sent to the target controller; otherwise, the sending is stopped.

2. The vehicle-side instruction parameter protocol verification method based on an action type whitelist according to claim 1, characterized in that, The action type whitelist matched based on the action type of the vehicle-side command includes: The action type identifier is split according to the order of control domain code, execution object code, action code, and protocol version code. The control domain code represents the control business domain, the execution object code represents the controlled object type, the action code represents the control action type, and the protocol version code represents the protocol version. Filter candidate whitelist entries from the action type whitelist whose control domain code and protocol version code are respectively consistent with the corresponding code segments in the action type identifier; The execution object code and action code of the candidate whitelist entries are compared with the execution object code and action code in the action type identifier, and complete matching entries that are consistent in both are retained. When there is only one complete matching entry, the complete matching entry is identified as a whitelist entry; when there are no complete matching entries or more than one complete matching entry, the action type matching is determined to have failed.

3. The vehicle-side instruction parameter protocol verification method based on an action type whitelist according to claim 2, characterized in that, The process of filtering out candidate whitelist entries includes: Arrange the whitelist entries in the action type whitelist according to the control domain code, so that whitelist entries with the same control domain code are arranged continuously and form an entry segment, and record the control domain code, starting position and number of entries for each entry segment; The target entry segment is selected according to the control field code in the action type identifier, and the comparison range is limited according to the starting position and number of the target entry segment; The protocol version code in the action type identifier is compared with the protocol version code of each whitelist entry in the comparison range, and the whitelist entries with the same protocol version code are retained to obtain the candidate whitelist entries.

4. The vehicle-side instruction parameter protocol verification method based on an action type whitelist according to claim 1, characterized in that, Determining the operation type and relational boundaries of each operation step includes: According to the bracket hierarchy, operation priority, and physical parameter reference relationship in the physical association constraints, the operation relationship between the association parameters and the vehicle actuator motion quantity is broken down into sequentially connected operation nodes; Based on the operator or segmented mapping relationship of each operation node, the operation node is determined as an addition operation node, a subtraction operation node, a multiplication operation node, or a segmented monotonic operation node; For each operation node, the value of its output boundary is determined according to the constraint expression form corresponding to the operation node. Specifically, when the output of the operation node corresponds only to a one-sided upper limit constraint, the value corresponding to the upper limit constraint is used as the upper relation boundary of the operation node's output; when the output of the operation node corresponds only to a one-sided lower limit constraint, the value corresponding to the lower limit constraint is used as the lower relation boundary of the operation node's output; when the output of the operation node corresponds to an interval constraint composed of upper and lower limits, the lower limit of the interval constraint is used as the lower relation boundary of the operation node's output, and the upper limit of the interval constraint is used as the upper relation boundary of the operation node's output. For the segmented monotonic operation node, the boundary value of adjacent monotonic segments is determined as the segment boundary, and the lower limit and upper limit of the output of each monotonic segment are determined as the lower relation boundary and upper relation boundary of the monotonic segment, respectively.

5. The vehicle-side instruction parameter protocol verification method based on an action type whitelist according to claim 1, characterized in that, Sending the vehicle-side command to the target controller includes: The lower bound margin is obtained by subtracting the lower limit of the allowed action boundary from the lower bound of the action quantity envelope; the upper bound margin is obtained by subtracting the upper bound of the action quantity envelope from the upper bound of the allowed action boundary. When both the lower boundary margin and the upper boundary margin are non-negative, the action quantity envelope is determined to be within the allowed action boundary; when the lower boundary margin is negative, the lower limit is determined to be out of bounds; when the upper boundary margin is negative, the upper limit is determined to be out of bounds. When the action quantity envelope is within the allowed action boundary, the vehicle communication channel is determined according to the mapping relationship between the controller identifier of the target controller and the vehicle communication channel, and the vehicle-side command is sent through the vehicle communication channel; When the lower limit or the upper limit is exceeded, the sending of the vehicle-side command is terminated, and the corresponding exceedance type is determined as the protocol verification result.

6. The vehicle-side instruction parameter protocol verification method based on an action type whitelist according to claim 5, characterized in that, When the motion amount of the vehicle actuator is an increment relative to the current position of the vehicle actuator, the allowable motion boundary is determined as follows: The lower limit of mechanically operable actuators is obtained by subtracting the current position of the vehicle actuators fed back by the target controller from the lower limit of the mechanical stroke of the vehicle actuators; the upper limit of mechanically operable actuators is obtained by subtracting the current position of the vehicle actuators from the upper limit of the mechanical stroke of the vehicle actuators. According to the protocol quantization relationship, the lower limit and upper limit of the protocol receiving raw code of the target controller are converted into two action values, and the smaller and larger values ​​of the two action values ​​are determined as the lower limit and upper limit of the protocol receiving. The maximum value among the lower limit of the machine's executable capability, the lower limit of the protocol's acceptability, and the lower limit of the action safety recorded in the whitelist entry is determined as the lower limit of the allowed action boundary; The minimum value among the machine-executable limit, the protocol-receivable limit, and the action security limit recorded in the whitelist entry is determined as the upper limit of the allowed action boundary; When the lower limit of the allowed action boundary is greater than the upper limit of the allowed action boundary, the allowed action boundary is determined to be empty, and the protocol verification is determined to fail.

Images