System for seamless handover of control right between mcu autonomous hill holding and whole vehicle

Abstract

The application belongs to the technical field of new energy vehicles, and particularly relates to an MCU autonomous hill holding and seamless handover system of vehicle control right, which comprises an MCU assembly, a multi-source signal real-time synchronous acquisition module, an MCU local autonomous hill rolling and hill holding use module, a motor zero-speed high-reliability autonomous hill holding closed-loop control module, a double-controller vehicle control right arbitration seamless handover module and a working condition linkage fault degradation safety protection module, and is electrically connected; the application, relying on the MCU local independent computing power, integrally completes accurate sensing of hill running working conditions, quantitative research and judgment of rolling risks, autonomous triggering of zero-speed closed-loop parking control, synchronous built-in power right seamless handover standardized timing strategy and torque smooth transition regulation algorithm, realizes bidirectional adaptive switching, low disturbance smooth connection and fault scene safety bottom protection of the exclusive parking control right of the MCU hill and the whole vehicle driving control right of the VCU, and is suitable for full production vehicle-mounted electric control hardware platforms.

Description

Technical Field

[0001] This invention relates to the field of new energy vehicle technology, specifically to a system for seamless handover of MCU autonomous hill-start assist and vehicle control. Background Technology

[0002] New energy vehicle drive systems lack mechanical axial locking mechanisms. When the vehicle is idling or temporarily parked on a slope, it is susceptible to passive slippage due to the force of gravity. This places high demands on the driver's coordination and objectively poses a driving safety hazard. Currently, mainstream slope assist parking solutions in the industry all adopt a centralized main control architecture of the vehicle controller. The VCU collects multi-dimensional operating signals such as gear status, braking pressure, parking brake, and driver torque demand. After centrally calculating the slope anti-slip balance torque, it sends a torque control command down through the vehicle's CAN communication network, which in turn triggers the motor controller to perform passive anti-slip intervention.

[0003] Currently, traditional centralized architectures have several inherent technical defects: First, the centralized signal aggregation and bus message forwarding inherently involve communication and scheduling delays, resulting in delayed response to sudden slippage on ramps, making vehicles prone to short-term slippage, and compromising reliability for complex ramp scenarios in heavy-duty commercial vehicles; Second, the entire functional chain heavily relies on the VCU hardware computing power, low-voltage power supply, and the normal operation of the entire communication link. Any single point of failure, such as VCU computing power congestion, instantaneous low-voltage fluctuations, or communication message timeouts, directly leads to the failure of parking assistance functions. The lack of a local redundancy fallback mechanism fails to meet the needs of vehicles. The system lacks functional safety design specifications for the vehicle's electronic control system; thirdly, the traditional parking judgment logic has high signal coupling, and the old strategy needs to simultaneously meet seven linkage access conditions, which is prone to false triggering and failure to trigger abnormal operating conditions, resulting in long vehicle calibration cycles and high overall debugging costs; fourthly, the entire process of parking steady-state release and power torque intervention lacks standardized timing control, and torque step change is prone to causing shock to the transmission system, resulting in poor smoothness of hill start. At the same time, it is not adapted to mass production calibration adaptation logic such as brake delay release, closed-loop measurement of parking times, and graded torque limit, resulting in poor engineering mass production implementation.

[0004] Existing conventional technical solutions lack a dedicated link for MCU local integrated perception, operating condition analysis, and torque closed-loop execution. They also lack a lightweight, loosely coupled parking access assessment mechanism, an orderly delayed parking strategy, and a graded torque amplitude limitation system adapted to mass-produced motor models. Furthermore, they lack a two-way handshake collaborative interaction mechanism between MCU parking-specific control permissions and VCU vehicle-wide driving control permissions. This makes it difficult to simultaneously address multiple core engineering requirements such as rapid anti-slip on heavy-load slopes, fault tolerance protection across the entire electronic control link, seamless start-up output, and low-cost mass production adaptation. There is an urgent need to optimize the vehicle electronic control adaptation logic and build a highly integrated, highly reliable, and easily calibrated MCU autonomous parking and vehicle control seamless handover architecture. This would simplify the parking access assessment coupling conditions, optimize the closed-loop control steady-state parameters, standardize the delayed parking sequence, and enhance the dual electronic control unit permission arbitration capability to meet the requirements for mass installation in all types of new energy vehicles. Therefore, we propose an MCU autonomous parking and vehicle control seamless handover system to solve the above problems. Summary of the Invention

[0005] (a) Technical problems to be solved To address the shortcomings of existing technologies, this invention provides a system for seamless handover of MCU autonomous hill-climbing control and vehicle control, thus solving the problems mentioned in the background section.

[0006] (II) Technical Solution To achieve the above objectives, the present invention specifically adopts the following technical solution: The MCU autonomous hill-holding and vehicle control seamless handover system includes an MCU assembly, which is electrically connected to a vehicle multi-source signal real-time synchronous acquisition module, an MCU local autonomous hill-slipping and hill-holding module, a motor zero-speed high-reliability autonomous hill-holding closed-loop control module, a dual-controller vehicle control arbitration seamless handover module, and an operating condition linkage fault degradation safety protection module.

[0007] Furthermore, the vehicle multi-source signal real-time synchronous acquisition module is the only front-end link for full-domain operating condition perception. It synchronously acquires multi-dimensional operating signals related to vehicle driving and hill parking at high frequency, such as motor speed, bus current, brake switch, gear signal, and VCU torque demand message. It simultaneously completes digital filtering and noise reduction, signal validity and compliance verification, and abnormal operating condition tracing and marking. It provides a high real-time, high-fidelity, and high-reliability raw data foundation for back-end hill slip risk assessment, accurate calculation of parking balance torque, and coordinated handover of vehicle power authority. It also distinguishes between hard-wired direct acquisition analog signals and CAN bus interactive digital signals, isolates electromagnetic interference and transient operating condition disturbances across the entire domain, avoids abnormal operating conditions such as false triggering and false exit of parking function, and ensures stable and reliable operation of the parking signal link throughout the entire life cycle.

[0008] Furthermore, the vehicle multi-source signal real-time synchronous acquisition module reuses the MCU assembly's built-in high-speed analog-to-digital conversion sampling unit, resolver position decoding dedicated chip, CAN FD high-speed communication controller, and vehicle-specific hard-wired IO interaction circuit. It connects to the vehicle-mounted sensing unit and vehicle electronic control related signals in parallel and synchronously through multiple channels. These signals cover the motor rotor real-time position and speed resolver feedback signal, three-phase bus high-frequency current sampling signal, vehicle low-voltage power supply voltage monitoring signal, brake pedal hard-wired pressure linkage switch signal, front and rear driving gear hard-wired identification signal, driver-analyzed torque demand message periodically issued by the VCU, and vehicle slope collaborative estimation interaction message. At the software level: It incorporates a first-order inertial digital filtering algorithm, a transient jump interference elimination strategy, signal disconnection fault diagnosis logic, and a communication cycle timeout compliance verification mechanism. All operating signals are uniformly refreshed synchronously according to a fixed control cycle of 10ms, with precise timing alignment and binding of traceability timestamps to generate standardized compliant operating condition data packets, which are pushed to downstream decision-making and control modules in real time.

[0009] Furthermore, the MCU local autonomous slope sliding and parking module is the core decision-making center of the system. It is completely independent of the VCU working condition collaborative intervention and relies solely on the full-domain operation signals collected locally by the MCU to quantitatively analyze high-risk sliding conditions of the vehicle on the slope. It adaptively outputs parking function enable commands, parking lock protection commands, and parking pre-activation linkage commands. It accurately identifies different working conditions such as idling on a level road, steady-state parking on a forward slope, passive sliding on a reverse slope, and pedal misoperation disturbances. It avoids the defects of accidental activation of parking in non-slope scenarios and missed activation of parking in high-risk slope scenarios from the source and accurately controls the timing of the parking function entry point.

[0010] Furthermore, the MCU local autonomous slope sliding and slope holding module fully reuses the native main control computing power resources of the MCU assembly and the supporting resolver decoding and high-speed signal sampling integrated hardware circuits, without the need to add additional peripheral adapter hardware devices. It is purely lightweight software algorithm iteration and adaptation, and is compatible with the existing vehicle low-voltage power supply architecture and CAN bus native interaction protocol, so the mass production engineering transformation cost is controllable. On the software level: It conforms to the calibration process specifications of actual vehicle mass production, optimizes the low-coupling and lightweight four-linkage judgment state machine, eliminates redundant and invalid signal coupling conditions, embeds a dedicated weighted value A and weighted value B hierarchical quantification calculation system, matches the factory calibration parameters of different motor models, links the motor real-time speed direction discrimination and slope slip amplitude quantification calculation formula, retains the standardized parking number closed-loop metering and control logic, initializes the baseline valid number of times, and the background linkage real-time decrement count and reset refresh full-process closed-loop control.

[0011] Furthermore, the zero-speed high-reliability autonomous hill-start closed-loop control module for motors serves as the precise execution center for the parking function. Upon receiving the local parking enable command, it instantly completes the adaptive switching of the motor operation control mode, seamlessly switching from the conventional open-loop control mode for driving torque to the high-precision zero-speed closed-loop parking control mode. It dynamically outputs reverse balancing electromagnetic torque to offset the gravity load of the slope, forcibly locking the motor rotor to a steady-state static position, achieving stable parking of the vehicle in place without mechanical braking assistance. Simultaneously, it implements a dual protection strategy of limiting the temperature of power devices and limiting the output torque across the entire range, avoiding high-temperature overload damage to the motor body and power drive devices, and ensuring the safe and reliable operation of the hardware throughout the parking process.

[0012] Furthermore, the motor zero-speed high-reliability autonomous slope-holding closed-loop control module relies on the MCU assembly's native three-phase full-bridge power drive integrated hardware, high-precision synchronous current closed-loop sampling circuit, and millisecond-level rotor position real-time decoding unit to build a dual-closed-loop dedicated hardware execution link with the current inner loop coordinating with the speed outer loop. The hardware response rate matches the time requirements of the vehicle's extreme anti-skid working conditions, without the need for hardware iteration, expansion, or modification. On the software level: The optimal parameters are calibrated based on actual vehicle measurements, and the adaptive PI closed-loop control algorithm is solidified, with no additional dynamic parameter drift deviation; a mass production graded torque limiting control mechanism is embedded in the same way, limiting the maximum output electromagnetic torque in steady state under parking conditions to 75% of the peak torque of the motor's external characteristics, preventing overload and overheating of power devices; a hardware timer protection mechanism for the longest single parking time is superimposed, with a baseline effective parking time limit, and automatic and orderly degrading parking after the timeout, and synchronous linkage with the high-frequency inspection and protection logic for the entire range of motor winding temperature and IGBT junction temperature.

[0013] Furthermore, the dual-controller vehicle control arbitration seamless handover module is the core control unit for the smoothness of vehicle driving. It enables bidirectional safe and compliant arbitration, real-time status handshake synchronization, and gradual torque transition between the MCU assembly's hill-start parking-specific power control authority and the VCU's overall vehicle driving control authority. It covers three core operating conditions: smooth start from parking standby, emergency parking from normal driving, and mandatory safe takeover in case of electronic control failure. It achieves millisecond-level seamless connection of vehicle power drive authority, completely avoiding abnormal issues such as torque step disturbances during mode switching, transmission system nodding impact, and hill-start slippage jerking, ensuring smooth driving across the entire domain. It also clarifies the boundaries of authority and responsibility of the two electronic control units, eliminates cross-unit command conflicts and overlapping authority and responsibility interference, and standardizes the timing of overall power control.

[0014] Furthermore, the dual-controller vehicle control arbitration seamless handover module relies on the CAN FD high-speed vehicle bus to realize bidirectional real-time status handshake interaction between the two electronic control units. It is equipped with a hard-wired interlock enable pin to build a backup permission determination link. The dual-link redundancy ensures that there is no risk of failure during the entire power permission handover process. At the software level: It has an embedded three-state hierarchical permission arbitration state machine, which divides the VCU whole-vehicle control steady state, MCU slope parking exclusive control steady state, and dual-unit bidirectional transition interaction transient state into three types of compliant working conditions; it has an embedded torque progressive slope limit control algorithm, which directly inherits the actual output torque of the previous steady state as the initial reference value during mode switching transients, and gradually transitions to the target torque according to the preset gentle slope, without step jumps or transient impacts throughout the process.

[0015] Furthermore, the working condition linkage fault degradation safety protection module is the core unit for the safety backup of the entire electronic control system. It conducts real-time inspections of all-dimensional abnormal working conditions of electronic control, such as MCU main body operation faults, VCU offline disconnection faults, CAN bus communication interruption faults, and current sampling link abnormal faults. Once any single point of electronic control fault is determined, it immediately links and optimizes the parking control strategy, adjusts the vehicle power authority, orderly exits high-risk parking conditions, implements graded safety degradation control, and links the chassis mechanical braking to assist compliant parking. It avoids safety risks such as parking function failure and vehicle slope loss of control in the entire domain, and systematically improves the functional safety protection level of new energy vehicles in all working conditions when driving on slopes. The working condition linkage fault degradation safety protection module reuses the MCU's built-in dedicated fault diagnosis hardware unit, bus communication error accumulation counter, and overvoltage and overcurrent hardware protection circuit to capture the underlying hardware-level native fault codes in real time, making fault tracing accurate and efficient. At the software level: It has an embedded hierarchical fault handling strategy ledger, which divides the faults into three levels: minor alarm fault tolerance, moderate function degradation fault, and severe forced disconnection fault. It matches the parking function lockout, smooth speed reduction parking, and forced mechanical brake as a backup with differentiated handling logic, which conforms to the safety and compliance requirements of vehicle electronic control functions.

[0016] (III) Beneficial Effects Compared with existing technologies, this invention provides a system for seamless handover of MCU autonomous hill-climbing and vehicle control, which has the following advantages: This invention, through the cooperation of a real-time synchronous acquisition module of MCU assembly and vehicle multi-source signals, a module for MCU local autonomous slope slip and parking use, a module for high-reliability autonomous parking closed-loop control of motor at zero speed, a module for seamless handover of vehicle control authority arbitration between dual controllers, and a module for fault degradation safety protection in conjunction with a working condition linkage module, forms an overall architecture consisting of a hardware-level driver layer, a hierarchical software strategy control layer, and a dual-electronic control unit collaborative arbitration interaction layer. Relying on the independent computing power of the MCU, it integrates accurate perception of slope operation conditions, quantitative assessment of slip risk, and autonomous triggering of zero-speed closed-loop parking control. Simultaneously, it incorporates a standardized timing strategy for seamless handover of power authority and a torque smooth transition control algorithm, realizing bidirectional adaptive switching between MCU slope parking-specific control authority and VCU vehicle-wide driving control authority, low-disturbance smooth connection, and safety fallback protection in fault scenarios, and is compatible with mass-produced vehicle electronic control hardware platforms. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the control flow of the present invention.

[0018] Figure 2 This is a block diagram showing the overall hardware module connection of the system according to the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Example like Figure 1-2 As shown, an embodiment of the present invention proposes an MCU autonomous hill-holding and vehicle control seamless handover system, which includes an MCU assembly. The MCU assembly is electrically connected to a vehicle multi-source signal real-time synchronous acquisition module, an MCU local autonomous hill-slipping and hill-holding module, a motor zero-speed high-reliability autonomous hill-holding closed-loop control module, a dual-controller vehicle control arbitration seamless handover module, and an operating condition linkage fault degradation safety protection module.

[0021] like Figure 1-2 As shown, in some embodiments, the vehicle multi-source signal real-time synchronous acquisition module is the only front-end link for full-domain operating condition perception. It synchronously acquires multi-dimensional operating signals related to vehicle driving and hill parking at high frequency, such as motor speed, bus current, brake switch, gear signal, and VCU torque demand message. It simultaneously completes digital filtering and noise reduction, signal validity and compliance verification, and abnormal operating condition tracing and marking. It provides a high real-time, high-fidelity, and high-reliability raw data base for back-end hill slip risk assessment, accurate calculation of parking balance torque, and coordinated handover of vehicle power authority. It also synchronously distinguishes between hard-wired direct acquisition analog signals and CAN bus interactive digital signals, isolates electromagnetic interference and transient operating condition disturbances across the entire domain, avoids abnormal operating conditions such as false triggering and false exit of parking function, and ensures stable and reliable operation of the parking signal link throughout the entire life cycle.

[0022] In this embodiment, after the vehicle electronic control system is powered on and initialized, this module runs in parallel in the background without occupying the main control core's effective computing resources; it verifies the compliance of the physical range of the acquired signals, the integrity of the communication message cycle, and the matching of hard-wire level conditions in real time.

[0023] like Figure 1-2As shown, in some embodiments, the vehicle multi-source signal real-time synchronous acquisition module reuses the MCU assembly's built-in high-speed analog-to-digital conversion sampling unit, resolver position decoding dedicated chip, CAN FD high-speed communication controller, and vehicle-specific hard-wired IO interaction circuit. It connects to the vehicle-mounted sensing unit and vehicle electronic control related signals in parallel and synchronously through multiple channels. These signals cover the motor rotor real-time position and speed resolver feedback signal, three-phase bus high-frequency current sampling signal, vehicle low-voltage power supply voltage monitoring signal, brake pedal hard-wired pressure linkage switch signal, front and rear driving gear hard-wired identification signal, driver-analyzed torque demand message periodically issued by the VCU, and vehicle slope collaborative estimation interaction message. At the software level: It incorporates a first-order inertial digital filtering algorithm, a transient jump interference elimination strategy, signal disconnection fault diagnosis logic, and a communication cycle timeout compliance verification mechanism. All operating signals are uniformly refreshed synchronously according to a fixed control cycle of 10ms, with precise timing alignment and binding of traceability timestamps to generate standardized compliant operating condition data packets, which are pushed to downstream decision-making and control modules in real time.

[0024] In this embodiment, smoothing filtering optimization is implemented for low-frequency vibration signals such as pedals, and active shielding and interception are implemented for transient electromagnetic interference pulses. Once abnormal operating conditions such as signal disconnection, message loss, or value exceeding limits are detected, a fault tracing tag is immediately marked and the status word of the entire domain is uploaded simultaneously. Finally, the effective operating condition signals of the entire domain are compliantly organized to build an integrated operating condition dataset, which continuously provides stable data support for the backend slope gliding analysis and parking enable control logic, and operates in a closed loop with no interruption, low latency, and zero errors throughout the entire process.

[0025] like Figure 1-2 As shown, in some embodiments, the MCU local autonomous slope sliding and parking module is the core decision-making center of the system, completely independent of VCU working condition collaborative intervention. It relies solely on the full-domain operation signals collected locally by the MCU to quantitatively analyze high-risk sliding conditions of the vehicle on the slope in real time, and adaptively output parking function enable command, parking lock protection command, and parking pre-activation linkage command. It accurately identifies different working conditions such as idling on a level road, steady-state parking on a forward slope, passive sliding on a reverse slope, and pedal misoperation disturbance, thereby avoiding the defects of misactivation of parking in non-slope scenarios and missed activation of parking in high-risk slope scenarios from the source, and accurately controlling the timing of the parking function entry point.

[0026] In this embodiment, the background repeatedly retrieves the front-end compliant and standardized integrated working condition dataset at high frequency. It abandons the old seven redundant and highly coupled linkage judgment logic and adopts four core rigid access conditions after mass production optimization, linkage weighted value quantification sliding verification mechanism, and verifies the parking function access qualification without delay in a closed loop.

[0027] like Figure 1-2As shown, in some embodiments, the MCU local autonomous slope sliding and slope holding modules fully reuse the native main control computing power resources of the MCU assembly and the supporting resolver decoding and high-speed signal sampling integrated hardware circuits, without the need to add additional peripheral adapter hardware devices. Purely lightweight software algorithm iterative adaptation, adapting to the existing vehicle low-voltage power supply architecture and CAN bus native interaction protocol, and the mass production engineering transformation cost is controllable. On the software level: It conforms to the calibration process specifications of actual vehicle mass production, optimizes the low-coupling and lightweight four-linkage judgment state machine, eliminates redundant and invalid signal coupling conditions, embeds a dedicated weighted value A and weighted value B hierarchical quantification calculation system, matches the factory calibration parameters of different motor models, links the motor real-time speed direction discrimination and slope slip amplitude quantification calculation formula, retains the standardized parking number closed-loop metering and control logic, initializes the baseline valid number of times, and the background linkage real-time decrement count and reset refresh full-process closed-loop control.

[0028] In this embodiment, the following steps are performed: First, gear compliance verification: the vehicle's current driving gear is determined in real time to be non-neutral, and the gear feedback signal is stable without any abnormal jumps. Second, function enable verification: the local parking function's global enable bit is hard-set to be effective, and the background function is pre-activated and ready to go. Third, permission count verification: the parking valid access counter's real-time value is non-zero, the initial count baseline margin is compliant and effective, and the vehicle is qualified to perform parking closed-loop management. Fourth, shift condition verification: the vehicle has no real-time dynamic shift operation commands, and the shift interaction signal is hard-set to be ineffective, avoiding transient torque conflict disturbances during shifting. Synchronous linkage weighted value-assisted quantitative analysis: Relying on the motor-specific calibration weighted values ​​A and B as benchmark parameters, the system coordinates the real-time operating speed of the motor and the overall vehicle travel direction to quantitatively calculate the equivalent slope slip amplitude and accurately determine the high-risk reverse slip trend. The counter-clockwise rotation of the motor is defined as the forward reference speed. The D gear matches the forward travel vector calibration, and the R gear matches the reverse travel vector calibration. Under conditions of excessive speed and reverse direction, the weighted value A is accumulated as a quantitative integral every 2ms. Four core access conditions are considered. The system features a weighted sliding quantization verification function that ensures stable and compliant operation for two consecutive electronic control cycles. The MCU autonomously locks the high-risk sliding condition on the ramp, instantly outputting a native parking closed-loop enable command. This directly activates the backend parking steady-state control link, informing the VCU of the operating status via a single, simplified one-way message, eliminating the need for remote VCU authorization and coordinated torque distribution. If any core access condition fails instantaneously, the parking pre-activation link is immediately locked, automatically resetting to the normal vehicle driving standby condition. This comprehensively avoids disturbances caused by abnormal parking function conditions. The system also employs an A / B quantization slope slip verification model, which is an engineering experience calibration model, not a theoretical derivation algorithm. Weighted value A is an empirical judgment coefficient determined through actual vehicle ramp tests based on the correspondence between motor speed, rotation direction, and slope slip trend, used to cumulatively identify the true slope slip intensity. Weighted value B is an empirical correction coefficient obtained through bench and road calibration based on the maximum speed, load characteristics, and vehicle inertia of different motor models, used to eliminate system interference and improve judgment stability.

[0029] like Figure 1-2 As shown, in some embodiments, the motor zero-speed high-reliability autonomous hill-start closed-loop control module is the precise execution center of the parking function. After receiving the local parking enable command, it instantly completes the adaptive switching of the motor operation control mode, seamlessly switching from the conventional driving torque open-loop control mode to the high-precision zero-speed closed-loop parking control mode. It dynamically outputs reverse balance electromagnetic torque to offset the gravity load of the slope, forcibly locking the motor rotor to a steady-state static position, realizing the vehicle's steady-state parking without mechanical braking assistance. Simultaneously, it implements a dual protection strategy of power device temperature limiting and output torque amplitude limiting throughout the entire range, avoiding high-temperature overload damage to the motor body and power drive devices, and ensuring the safe and reliable operation of the hardware throughout the parking process.

[0030] In this embodiment, after receiving the local parking enable command, the module instantaneously latches the real-time native load torque of the motor and calibrates it as the initial compensation reference value for the closed-loop feedforward; it cuts off the external VCU remote torque command intervention channel in milliseconds, locally forces the target closed-loop speed of the motor to be locked at 0 r / min, and starts the zero-speed adaptive dual closed-loop control strategy with solidified PI parameters at full speed; it dynamically fine-tunes the electromagnetic output torque in real time to accurately offset the vehicle's gravity load on the slope, strictly controls the instantaneous slip distance of the vehicle within the safe and compliant threshold range, and achieves steady-state locking of the vehicle in place without mechanical braking intervention throughout the process.

[0031] like Figure 1-2 As shown, in some embodiments, the motor zero-speed high-reliability autonomous slope-holding closed-loop control module relies on the MCU assembly's native three-phase full-bridge power drive integrated hardware, high-precision synchronous current closed-loop sampling circuit, and millisecond-level rotor position real-time decoding unit to build a dual-closed-loop dedicated hardware execution link with current inner loop coordinating with speed outer loop. The hardware response rate matches the time requirements of the vehicle's extreme anti-skid working conditions, without the need for hardware iteration, expansion, or modification. On the software level: The optimal parameters are calibrated based on actual vehicle measurements, and the adaptive PI closed-loop control algorithm is solidified, with no additional dynamic parameter drift deviation; a mass production graded torque limiting control mechanism is embedded in the same way, limiting the maximum output electromagnetic torque in steady state under parking conditions to 75% of the peak torque of the motor's external characteristics, preventing overload and overheating of power devices; a hardware timer protection mechanism for the longest single parking time is superimposed, with a baseline effective parking time limit, and automatic and orderly degrading parking after the timeout, and synchronous linkage with the high-frequency inspection and protection logic for the entire range of motor winding temperature and IGBT junction temperature.

[0032] In this embodiment, three major production compliance protection logics are executed simultaneously during the steady-state operation phase of parking: firstly, torque upper limit protection, which strictly limits the output to 75% of the peak torque of the external characteristics corresponding to the motor model; secondly, time-based closed-loop protection, which continuously accumulates the effective parking time, and triggers a pre-retraction warning immediately upon reaching the benchmark threshold; and thirdly, full-domain temperature control protection, which monitors the operating temperature of power devices and motor windings in real time, and automatically and smoothly limits torque and cools down when approaching the warning threshold. Throughout the process, high-priority parking status indicators are continuously locked, providing a steady-state compliance benchmark for subsequent delayed and orderly retraction and seamless handover of power authority between the two electronic control units.

[0033] like Figure 1-2As shown, in some embodiments, the dual-controller vehicle control arbitration seamless handover module is the core control unit for vehicle ride comfort. It enables bidirectional safety and compliance arbitration, real-time status handshake synchronization, and gradual torque transition between the MCU assembly's hill-start parking-specific power control authority and the VCU's vehicle-wide driving control authority. It covers three core operating conditions: smooth start from parking standby, emergency parking from normal driving, and mandatory safety takeover in case of electronic control failure. It achieves millisecond-level seamless connection of vehicle power drive authority, completely avoiding abnormal issues such as torque step disturbances during mode switching, transmission system nodding impact, and hill-start slippage jerking, ensuring ride comfort across the entire domain. It also clarifies the boundaries of authority and responsibility between the two electronic control units, eliminates cross-unit command conflicts and overlapping authority and responsibility interference, and standardizes the timing of power control across the entire domain.

[0034] In this embodiment, during the entire steady-state cycle of hill parking, the MCU exclusively controls the power drive authority of the entire vehicle motor. The VCU only passively monitors the entire operating condition in the background and freezes all active torque issuance commands, without interfering with the motor's closed-loop parking steady-state operation. It strictly follows the mass production compliant exit sequence specification and configures five types of standardized exit trigger conditions. If any one of the conditions is met, the seamless handover sequence will be started immediately.

[0035] like Figure 1-2 As shown, in some embodiments, the dual-controller vehicle control arbitration seamless handover module relies on the CAN FD high-speed vehicle bus to realize bidirectional real-time status handshake interaction between the two electronic control units, and constructs a backup permission determination link with hard-wired interlock enable pins. The dual-link redundancy ensures that there is no risk of failure throughout the power permission handover process. At the software level: It has an embedded three-state hierarchical permission arbitration state machine, which divides the VCU whole-vehicle control steady state, MCU slope parking exclusive control steady state, and dual-unit bidirectional transition interaction transient state into three types of compliant working conditions; it has an embedded torque progressive slope limit control algorithm, which directly inherits the actual output torque of the previous steady state as the initial reference value during mode switching transients, and gradually transitions to the target torque according to the preset gentle slope, without step jumps or transient impacts throughout the process.

[0036] In this embodiment, the following five mechanisms are triggered: First, power demand intervention triggers the VCU to send the absolute value of the required torque to the driver. If the torque exceeds 106% of the current steady-state parking output torque of the MCU, the driver's intention to start driving is adaptively determined. Second, braking delay release triggers the VCU to continuously and stably delay the release operation before proceeding in an orderly manner after detecting that the braking feedback signal has been hard-set to a valid value. If the braking signal is canceled midway, the delay time is immediately reset to zero. The delay logic is not coupled with the parking duration. Third, gear shift triggers the VCU to detect when the gear shift signal has been switched to neutral and immediately terminate the parking-specific control with one click. Fourth, dynamic shift triggers the VCU to receive a valid shift operation command and immediately exit the parking condition when the shift interaction signal is set to a valid value. Fifth, parking timeout triggers the VCU to automatically downgrade and orderly exit the parking state when the continuous parking duration reaches the baseline threshold. The entire process of authority handover is controlled in a closed-loop sequence: priority is given to verifying that the MCU is in a steady state with no slippage anomalies. Using the current parking balance torque as the initial reference for starting, the driving power torque is gradually increased. Simultaneously, the zero-speed closed loop is gradually exited and the normal driving torque closed loop is smoothly entered. The number of valid parking accesses is reset to the initial reference value. The full-domain power control authority is completely transferred to the VCU, enabling the vehicle to start smoothly on the slope without slippage or jerking. In the event of a sudden high-risk slippage or bus communication anomaly, the hard-wired interlock signal has the highest priority. The power authority is instantly reclaimed to the MCU for backup control, ensuring safe and compliant driving on the slope.

[0037] like Figure 1-2 As shown, in some embodiments, the working condition linkage fault degradation safety protection module is the core unit for the safety backup of the entire electronic control system. It conducts real-time inspections of all-dimensional abnormal working conditions of electronic control, such as MCU main body operation faults, VCU offline disconnection faults, CAN bus communication interruption faults, and current sampling link abnormal faults. Once any single point of electronic control fault is determined, it immediately links and optimizes the parking management strategy, adjusts the vehicle power authority, orderly exits high-risk parking conditions, implements graded safety degradation management, and links the chassis mechanical braking to assist compliant parking. It avoids safety risks such as parking function failure and vehicle slope loss of control in the entire domain, and systematically improves the functional safety protection level of new energy vehicles in all working conditions when driving on slopes. The working condition linkage fault degradation safety protection module reuses the MCU's built-in dedicated fault diagnosis hardware unit, bus communication error accumulation counter, and overvoltage and overcurrent hardware protection circuit to capture the underlying hardware-level native fault codes in real time, making fault tracing accurate and efficient. At the software level: It has an embedded hierarchical fault handling strategy ledger, which divides the faults into three levels: minor alarm fault tolerance, moderate function degradation fault, and severe forced disconnection fault. It matches the parking function lockout, smooth speed reduction parking, and forced mechanical brake as a backup with differentiated handling logic, which conforms to the safety and compliance requirements of vehicle electronic control functions.

[0038] In this embodiment, the system continuously monitors the health and operation status of the entire electronic control link around the clock. Once conditions such as VCU message timeout and offline disconnection, excessive CAN bus packet loss rate, or MCU sampling circuit hardware abnormality are detected, the system immediately determines that the vehicle's electronic control system is in a degraded operation condition. It prioritizes suspending unnecessary power authority handover processes, locks the current MCU steady-state parking torque to temporarily stabilize the vehicle's attitude, and then gradually reduces the motor's output electromagnetic torque according to a preset, gentle degrade slope. Simultaneously, it sends out a mechanical braking-assisted parking request to rely on the chassis braking system for compliant parking. After the electronic control fault is completely eliminated, the fault traceability identifier is automatically cleared and reset, restoring the MCU's autonomous hill-start assist and seamless full-domain handover full compliance functions. For irreversible severe hardware faults, the parking assist function is permanently locked, vehicle-level fault alarm information is uploaded, and the vehicle's driving permission in high-risk hill-start conditions is restricted.

[0039] During use, the MCU assembly uses a multi-source signal real-time synchronous acquisition module to collect multi-dimensional operating signals related to vehicle driving and hill-start parking at high frequency, such as motor speed, bus current, brake switch, gear position signal, and VCU torque demand message signal. Simultaneously, it performs digital filtering and noise reduction, signal validity and compliance verification, and abnormal operating condition tracing and marking. This provides a high-real-time, high-fidelity, and high-reliability raw data foundation for downstream hill-start slip risk assessment, accurate calculation of parking balance torque, and coordinated handover of vehicle power authority. It also simultaneously distinguishes between directly acquired analog signals and CAN bus-interacted digital signals, and provides full-domain isolation from electromagnetic interference. It mitigates transient disturbances in operating conditions, avoids abnormal conditions such as false triggering or false exit of the parking function, and ensures stable and reliable operation of the parking signal link throughout the entire lifecycle. The MCU's local autonomous slope sliding and parking module are completely independent of the VCU's condition-based collaborative intervention. Relying solely on the full-domain operating signals collected locally by the MCU, it quantitatively analyzes high-risk sliding conditions of the vehicle on slopes in real time, and adaptively outputs parking function enable commands, parking lock protection commands, and parking pre-activation linkage commands. It accurately identifies different operating conditions such as idling on level roads, steady-state parking on forward slopes, passive sliding on reverse slopes, and pedal misoperation disturbances, thus avoiding non-slope-related disturbances from the source. To address defects such as accidental activation of parking in low-speed scenarios and missed activation of parking in high-risk slope scenarios, the system precisely controls the timing of parking function activation. Upon receiving the local parking enable command, the high-reliability autonomous slope parking closed-loop control module instantly and adaptively switches the motor operation control mode, seamlessly transitioning from the conventional open-loop torque control mode to the high-precision zero-speed closed-loop parking control mode. It dynamically outputs reverse-balancing electromagnetic torque to counteract the gravity load of the slope, forcibly locking the motor rotor to a steady-state static position, achieving stable parking of the vehicle without mechanical braking assistance. Simultaneously, it implements a dual protection strategy across the entire system: power device temperature limiting and output torque amplitude limiting. It avoids high-temperature overload damage to the motor body and power drive components, and ensures the safe and reliable operation of hardware throughout the parking process. The MCU assembly’s exclusive power control authority for hill parking and the VCU’s overall vehicle driving control authority are subject to two-way safety and compliance arbitration, real-time status handshake synchronization, and gradual torque transition. It covers three core operating conditions: smooth start when switching from parking standby, emergency parking when switching from normal driving, and forced safety takeover in case of electronic control failure. It achieves millisecond-level seamless connection of the vehicle’s power drive authority, completely avoiding abnormal issues such as torque step disturbances during mode switching, transmission system nodding impact, and hill slipping jerking, and ensuring a smooth driving experience throughout the entire process.Simultaneously clarify the boundaries of authority and responsibility between the two electronic control units (ECUs) to prevent cross-unit command conflicts and overlapping authority and responsibility interference. Standardize the timing of power control across the entire domain. The fault-based safety protection module conducts real-time inspections around the clock for all-dimensional electronic control abnormalities, including MCU operation faults, VCU offline disconnection faults, CAN bus communication interruption faults, and current sampling link abnormalities. Once any single point of electronic control fault is detected, the system immediately optimizes the parking control strategy, adjusts the vehicle's power authority, orderly exits high-risk parking conditions, implements graded safety downgrade control, and links the chassis mechanical braking to assist compliant parking. This comprehensively avoids safety risks such as parking function failure and vehicle loss of control on slopes, systematically improving the performance of new energy vehicles. This system features a full-condition functional safety protection level for vehicle slope driving, an autonomous anti-slip parking control architecture with independent computing power for fully closed-loop management, and is compatible with all types of pure electric vehicles, hybrid vehicles, and new energy commercial vehicles. It meets core engineering needs such as slope parking anti-slip, millisecond-level smooth switching of vehicle drive permissions under multi-control unit collaborative interaction, and redundancy and fault tolerance for vehicle functional safety. Even without real-time command and collaborative control from the vehicle controller (VCU), it can achieve autonomous static parking on slopes, shock-free electromagnetic torque transition during operating mode switching, and safety takeover of vehicle power in abnormal electronic control link conditions. It possesses high reliability, strong real-time performance, and high adaptability for engineering implementation.

[0040] In summary, this MCU autonomous hill-start assist system seamlessly transfers control between the MCU and the vehicle. Its overall architecture consists of a hardware-level driver layer, a hierarchical software strategy control layer, and a dual-electronic control unit collaborative arbitration and interaction layer. Relying on the MCU's local independent computing power, it integrates precise perception of hill-start assist conditions, quantitative assessment of slippage risks, and autonomous triggering of zero-speed closed-loop parking control. Simultaneously, it incorporates a standardized timing strategy for seamless transfer of power authority and a torque smooth transition control algorithm. This enables bidirectional adaptive switching between the MCU's hill-start assist control authority and the VCU's full-domain vehicle driving control authority, with low-disturbance smooth transition and safety fallback protection in fault scenarios. It is compatible with mass-produced automotive electronic control hardware platforms.

[0041] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A seamless handover system for autonomous hill-climbing control and vehicle control via MCU, comprising an MCU assembly, characterized by: The MCU assembly is electrically connected to the vehicle multi-source signal real-time synchronous acquisition module, the MCU local autonomous slope slip and parking module, the motor zero-speed high-reliability autonomous parking closed-loop control module, the dual-controller vehicle control arbitration seamless handover module, and the working condition linkage fault degradation safety protection module.

2. The MCU autonomous hill-climbing and vehicle control seamless handover system according to claim 1, characterized in that: The vehicle multi-source signal real-time synchronous acquisition module is the only front-end link for full-domain operating condition perception. It synchronously acquires multi-dimensional operating signals related to vehicle driving and hill parking at high frequency, such as motor speed, bus current, brake switch, gear signal, and VCU torque demand message. It simultaneously completes digital filtering and noise reduction, signal validity and compliance verification, and abnormal operating condition tracing and marking. It provides a high real-time, high-fidelity, and high-reliability raw data foundation for back-end hill slip risk assessment, accurate calculation of parking balance torque, and coordinated handover of vehicle power authority. It also distinguishes between hard-wired direct acquisition analog signals and CAN bus interactive digital signals, isolates electromagnetic interference and transient operating condition disturbances across the entire domain, avoids abnormal operating conditions such as false triggering and false exit of parking function, and ensures stable and reliable operation of the parking signal link throughout the entire life cycle.

3. The MCU autonomous hill-climbing and vehicle control seamless handover system according to claim 1, characterized in that: The vehicle multi-source signal real-time synchronous acquisition module reuses the MCU assembly's built-in high-speed analog-to-digital conversion sampling unit, resolver position decoding dedicated chip, CAN FD high-speed communication controller, and vehicle-specific hard-wired IO interaction circuit. It connects to the vehicle-mounted sensing unit and vehicle electronic control related signals in parallel and synchronously through multiple channels. These signals include the motor rotor real-time position and speed resolver feedback signal, three-phase bus high-frequency current sampling signal, vehicle low-voltage power supply voltage monitoring signal, brake pedal hard-wired pressure linkage switch signal, front and rear driving gear hard-wired identification signal, driver-analyzed torque demand message periodically issued by the VCU, and vehicle slope collaborative estimation interaction message. At the software level: It incorporates a first-order inertial digital filtering algorithm, a transient jump interference elimination strategy, signal disconnection fault diagnosis logic, and a communication cycle timeout compliance verification mechanism. All operating signals are uniformly refreshed synchronously according to a fixed control cycle of 10ms, with precise timing alignment and binding of traceability timestamps to generate standardized compliant operating condition data packets, which are pushed to downstream decision-making and control modules in real time.

4. The MCU autonomous hill-climbing and vehicle control seamless handover system according to claim 1, characterized in that: The MCU's local autonomous slope sliding and parking module is the core decision-making hub of the system. It is completely independent of the VCU's working condition collaborative intervention and relies solely on the full-domain operation signals collected locally by the MCU. It quantitatively analyzes high-risk sliding conditions of vehicles on slopes in real time and adaptively outputs parking function enable commands, parking lock protection commands, and parking pre-activation linkage commands. It accurately identifies different working conditions such as idling on level roads, steady-state parking on forward slopes, passive sliding on reverse slopes, and pedal misoperation disturbances. It avoids the defects of accidental activation of parking in non-slope scenarios and missed activation of parking in high-risk slope scenarios from the source and accurately controls the timing of parking function entry points.

5. The MCU autonomous hill-climbing and vehicle control seamless handover system according to claim 1, characterized in that: The MCU local autonomous slope sliding and slope holding module fully reuses the native main control computing power resources of the MCU assembly and the supporting resolver decoding and high-speed signal sampling integrated hardware circuits. No additional peripheral adapter hardware devices are required. Pure lightweight software algorithm iteration and adaptation are used to adapt to the existing vehicle low-voltage power supply architecture and CAN bus native interaction protocol. Mass production engineering transformation costs are controllable. On the software level: It conforms to the calibration process specifications of actual vehicle mass production, optimizes the low-coupling and lightweight four-linkage judgment state machine, eliminates redundant and invalid signal coupling conditions, embeds a dedicated weighted value A and weighted value B hierarchical quantification calculation system, matches the factory calibration parameters of different motor models, links the motor real-time speed direction discrimination and slope slip amplitude quantification calculation formula, retains the standardized parking number closed-loop metering and control logic, initializes the baseline valid number of times, and the background linkage real-time decrement count and reset refresh full-process closed-loop control.

6. The MCU autonomous hill-climbing and vehicle control seamless handover system according to claim 1, characterized in that: The zero-speed high-reliability autonomous hill-start closed-loop control module is the precise execution center for the parking function. After receiving the local parking enable command, it instantly completes the adaptive switching of the motor operation control mode, seamlessly switching from the conventional open-loop control mode of driving torque to the high-precision zero-speed closed-loop parking control mode. It dynamically outputs reverse balancing electromagnetic torque to offset the gravity load of the slope, forcibly locking the motor rotor to a steady-state static position, realizing the vehicle's steady-state parking without mechanical braking assistance. Simultaneously, it implements a dual protection strategy of power device temperature limiting and output torque amplitude limiting throughout the entire range to avoid high-temperature overload damage to the motor body and power drive devices, ensuring the safe and reliable operation of the hardware throughout the parking process.

7. The MCU autonomous hill-climbing and vehicle control seamless handover system according to claim 1, characterized in that: The motor zero-speed high-reliability autonomous slope-holding closed-loop control module relies on the MCU assembly's native three-phase full-bridge power drive integrated hardware, high-precision synchronous current closed-loop sampling circuit, and millisecond-level rotor position real-time decoding unit to build a dual closed-loop dedicated hardware execution link with the current inner loop coordinating with the speed outer loop. The hardware response rate matches the time requirements of the vehicle's extreme anti-skid working conditions, without the need for hardware iteration, expansion, or modification. On the software level: The optimal parameters are calibrated based on actual vehicle measurements, and the adaptive PI closed-loop control algorithm is solidified, with no additional dynamic parameter drift deviation; a mass production graded torque limiting control mechanism is embedded in the same way, limiting the maximum output electromagnetic torque in steady state under parking conditions to 75% of the peak torque of the motor's external characteristics, preventing overload and overheating of power devices; a hardware timer protection mechanism for the longest single parking time is superimposed, with a baseline effective parking time limit, and automatic and orderly degrading parking after the timeout, and synchronous linkage with the high-frequency inspection and protection logic for the entire range of motor winding temperature and IGBT junction temperature.

8. The MCU autonomous hill-climbing and vehicle control seamless handover system according to claim 1, characterized in that: The dual-controller vehicle control arbitration seamless handover module is the core control unit for vehicle ride comfort. It achieves bidirectional safe and compliant arbitration, real-time status handshake synchronization, and gradual torque transition between the MCU assembly's hill-start parking-specific power control authority and the VCU's overall vehicle driving control authority. It covers three core operating conditions: smooth start from standby, emergency parking from normal driving, and mandatory safe takeover in case of electronic control failure. It achieves millisecond-level seamless connection of vehicle power drive authority, completely avoiding abnormal issues such as torque step disturbances during mode switching, transmission system nodding impact, and hill-start slippage jerking, ensuring ride comfort across the entire domain. It also clarifies the boundaries of authority and responsibility between the two electronic control units, eliminates cross-unit command conflicts and overlapping authority and responsibility interference, and standardizes the timing of overall power control.

9. The MCU autonomous hill-climbing and vehicle control seamless handover system according to claim 1, characterized in that: The dual-controller vehicle control arbitration seamless handover module relies on the CAN FD high-speed vehicle bus to realize bidirectional real-time status handshake interaction between the two electronic control units. It is equipped with a hard-wired interlock enable pin to build a backup permission determination link. The dual-link redundancy ensures that there is no risk of failure during the entire power permission handover process. At the software level: It has an embedded three-state hierarchical permission arbitration state machine, which divides the VCU whole-vehicle control steady state, MCU slope parking exclusive control steady state, and dual-unit bidirectional transition interaction transient state into three types of compliant working conditions; it has an embedded torque progressive slope limit control algorithm, which directly inherits the actual output torque of the previous steady state as the initial reference value during mode switching transients, and gradually transitions to the target torque according to the preset gentle slope, without step jumps or transient impacts throughout the process.

10. The MCU autonomous hill-climbing and vehicle control seamless handover system according to claim 1, characterized in that: The working condition linkage fault degradation safety protection module is the core unit for the safety of the entire electronic control system. It conducts real-time inspections of all-dimensional abnormal working conditions of electronic control, such as MCU main body operation faults, VCU offline disconnection faults, CAN bus communication interruption faults, and current sampling link abnormal faults. Once any single point of electronic control fault is determined, it immediately links and optimizes the parking management strategy, adjusts the vehicle power authority, orderly exits high-risk parking conditions, implements graded safety degradation management, and links the chassis mechanical braking to assist compliant parking. It avoids safety risks such as parking function failure and vehicle loss of control on slopes, and systematically improves the functional safety protection level of new energy vehicles under all working conditions when driving on slopes. The working condition linkage fault degradation safety protection module reuses the MCU's built-in dedicated fault diagnosis hardware unit, bus communication error accumulation counter, and overvoltage and overcurrent hardware protection circuit to capture the underlying hardware-level native fault codes in real time, making fault tracing accurate and efficient. At the software level: It has an embedded hierarchical fault handling strategy ledger, which divides the faults into three levels: minor alarm fault tolerance, moderate function degradation fault, and severe forced disconnection fault. It matches the parking function lockout, smooth speed reduction parking, and forced mechanical brake as a backup with differentiated handling logic, which conforms to the safety and compliance requirements of vehicle electronic control functions.

Images