Layered progressive accelerator pedal signal monitoring method and system based on vehicle dynamics and functional safety

Abstract

The application discloses a layered progressive accelerator pedal signal monitoring method and system based on vehicle dynamics and functional safety, relates to the technical field of vehicle power control systems, collects two voltage signals output by an accelerator pedal sensor, performs voltage boundary detection and signal consistency detection on the two voltage signals, and determines that the accelerator pedal sensor signal meets a basic reliable condition when both voltage signals are in a preset effective range and a synchronous deviation meets a preset condition; when the accelerator pedal sensor signal meets the basic reliable condition and the vehicle is in an accelerating driving condition, vehicle longitudinal acceleration, vehicle speed, road slope and motor operating parameters are collected. The application realizes heterogeneous redundant monitoring through vehicle dynamics reverse verification and pre-calibration table verification, expands the fault detection range, and implements differentiated monitoring strategies for different operating conditions, thereby improving the accuracy of pedal signal monitoring and the reliability of vehicle power control without adding new hardware.

Description

Technical Field

[0001] This application relates to the field of vehicle power control system technology, specifically to a hierarchical progressive accelerator pedal signal monitoring method and system based on vehicle dynamics and functional safety. Background Technology

[0002] With the rapid development of new energy vehicles, intelligent vehicles, and vehicle electronic and electrical architectures, vehicle power control systems are gradually evolving from traditional mechanical control methods towards electronic, intelligent, and software-defined approaches. Electronic control components such as the Vehicle Control Unit (VCU), motor controller, and accelerator pedal sensor are playing an increasingly important role in vehicle power output and driving safety control. Among these, the accelerator pedal signal, as the core input signal for the driver's active torque demand, directly determines the analytical result of the vehicle's drive torque request and is a crucial control variable connecting the driver's operating intentions with the vehicle's power response.

[0003] According to the ISO 26262 standard "Functional safety of road vehicles", key input signals involved in vehicle power control usually need to meet the corresponding functional safety level requirements, such as ASIL B or ASIL C, to ensure that the vehicle can still maintain a controllable and safe operating state in the event of sensor failure, signal processing abnormality, or control logic failure.

[0004] In existing technologies, monitoring methods for accelerator pedal signals mainly focus on diagnosing the output signals of the pedal sensors themselves. For example, by collecting dual-channel voltage signals from the accelerator pedal, the output values ​​of the two sensors are judged for range, reasonableness, and consistency to identify faults such as open circuits, short circuits, and signal drift. Simultaneously, some existing technologies further combine driver behavior, vehicle operating status, or motor operating parameters for auxiliary judgment. For instance, some solutions analyze driver behavior characteristics by collecting driver facial information, thermal imaging data, cabin pressure data, and accelerator pedal force information to determine if there is accelerator pedal misoperation; others establish a mapping relationship between motor speed, motor torque, and virtual accelerator pedal opening, calculating the virtual pedal opening based on the vehicle's current operating status for use by driver assistance systems or vehicle control systems; still others collect information such as vehicle speed, acceleration, steering wheel angle, and accelerator pedal opening, using threshold scoring to determine if the driver has accidentally pressed the accelerator pedal; additionally, some solutions calculate pedal opening limits based on the dual-channel voltage information of the accelerator pedal sensor and prevent vehicle power output from exceeding safe ranges by limiting the output opening.

[0005] The above technical solutions improve the safety of the vehicle power control system to a certain extent and enable the detection and protection against abnormal accelerator pedal conditions.

[0006] However, existing accelerator pedal signal monitoring technologies still have certain shortcomings. First, most existing methods rely on the accelerator pedal sensor's own output signal for fault diagnosis, such as dual-channel voltage consistency detection, opening range detection, and signal limiting control. Their monitoring paths are highly correlated with the main control path, lacking a heterogeneous redundancy verification mechanism independent of the pedal sensor signal processing link. When the accelerator pedal sensor experiences a common cause of failure, such as power supply abnormalities, electromagnetic compatibility interference, or signal processing module malfunctions causing both sensors to output erroneous signals simultaneously, traditional monitoring methods based on the sensor's own signal may not be effective in identifying the anomaly.

[0007] Furthermore, some monitoring methods based on driver behavior characteristics rely on additional visual, pressure, and physiological sensors, which not only increases vehicle hardware costs and system complexity but also makes algorithm calibration difficult due to significant individual differences among drivers. Their judgments are easily influenced by the driving environment and driving habits. Some vehicle state-based methods for detecting accidental acceleration typically employ threshold judgments or event-triggered mechanisms, responding only after the vehicle has exhibited obvious abnormal acceleration or a dangerous state. This passive safety approach struggles to detect early signal anomalies in a timely manner.

[0008] Meanwhile, existing virtual pedal opening calculation methods are mainly used to generate auxiliary control signals, which aim to provide alternative inputs for vehicle status. They do not verify the consistency between the theoretical pedal opening calculated from the actual vehicle motion state and the actual pedal sensor output, and therefore cannot be used to judge the reliability of the real pedal signal.

[0009] In addition, existing technologies generally lack an independent verification mechanism based on the vehicle's longitudinal dynamics model, and cannot use the vehicle's actual acceleration, road resistance, motor output torque and other physical states to reversely determine whether the pedal signal conforms to the vehicle's actual motion law; at the same time, for the condition where the driver actively presses the pedal to maintain a constant speed, the accuracy of traditional dynamics estimation methods decreases because the vehicle's acceleration is close to zero, and existing solutions also lack a special monitoring strategy for this special condition.

[0010] Therefore, existing technologies cannot simultaneously solve problems such as common cause failure detection of accelerator pedal signals, identification of non-sensor faults, adaptive monitoring of different driving conditions, and active safety diagnosis. There is an urgent need for an accelerator pedal signal safety detection method that can combine vehicle dynamics models, functional safety requirements, and different vehicle operating conditions for hierarchical and progressive monitoring, so as to improve the reliability and safety of vehicle power control systems.

[0011] The information disclosed in the background section is only intended to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0012] The purpose of this application is to provide a hierarchical, progressive accelerator pedal signal monitoring method and system based on vehicle dynamics and functional safety, in order to solve the problems mentioned in the background art.

[0013] To achieve the above objectives, this application provides the following technical solution: a layered progressive accelerator pedal signal monitoring method based on vehicle dynamics and functional safety, comprising the following steps: Two voltage signals output from the accelerator pedal sensor are acquired. Voltage boundary detection and signal consistency detection are performed on the two voltage signals. When both voltage signals are within the preset effective range and the synchronization deviation meets the preset conditions, the accelerator pedal sensor signal is determined to meet the basic reliability conditions. When the accelerator pedal sensor signal meets the basic reliability conditions and the vehicle is in acceleration mode, the vehicle's longitudinal acceleration, vehicle speed, road slope and motor operating parameters are collected. The actual driving force of the vehicle is calculated based on the vehicle's longitudinal dynamics model. The actual motor output torque is converted based on the actual driving force of the vehicle. The theoretical accelerator pedal opening is calculated using the proportional relationship between the maximum output torque corresponding to the current motor speed and the actual motor output torque. The deviation between the theoretical accelerator pedal opening and the actual accelerator pedal opening output by the accelerator pedal sensor is calculated. When the deviation between the theoretical accelerator pedal opening and the actual accelerator pedal opening exceeds a preset deviation threshold and the duration exceeds a preset time threshold, the accelerator pedal signal is determined to be abnormal. When the vehicle is in a constant speed driving condition under the active control of the driver and is not in cruise control mode, the current vehicle speed, road slope and load status are obtained, the pre-established constant speed driving condition pedal opening pre-calibration table is consulted, the reference accelerator pedal opening corresponding to the current vehicle status is determined, the reference accelerator pedal opening is compared with the actual accelerator pedal opening, and the reliability of the accelerator pedal signal is judged based on the comparison result. Based on voltage boundary detection, signal consistency detection, theoretical accelerator pedal opening deviation detection, and reference accelerator pedal opening comparison results, progressive fault handling is performed on the accelerator pedal signal. When an anomaly is detected at the sensor layer, immediate safety handling is performed. When an anomaly is detected in the dynamics verification or constant speed driving condition verification, a safety response is performed based on the number of times the fault persists.

[0014] The two voltage signals output by the accelerator pedal sensor are acquired using different detection channels, and a valid voltage region is established based on the output range of the two voltage signals. When either voltage signal exceeds the preset voltage range, the abnormal channel is marked as faulty. When both voltage signals are within the valid region, the signal synchronization status is further determined by the ratio between the two voltage signals. The ratio is predetermined based on the calibration parameters of the accelerator pedal sensor to adapt to the output characteristics of different types of accelerator pedal sensors.

[0015] The vehicle longitudinal dynamics model is constructed using the actual operating state parameters of the vehicle, including vehicle mass information, vehicle speed information, road slope information, vehicle longitudinal acceleration information, and vehicle air resistance-related parameters. The power output demand is analyzed in reverse by the actual motion state of the vehicle, and the calculated power demand is converted into the corresponding motor output torque. This is used to judge the consistency between the accelerator pedal input signal and the actual power response of the vehicle, so as to detect abnormalities in the accelerator pedal signal and abnormalities in the power control process.

[0016] The calculation process of theoretical accelerator pedal opening adopts the mapping relationship between motor operating status and vehicle power demand. By obtaining the maximum output capacity corresponding to the current motor speed, the actual output torque of the vehicle is converted into the corresponding pedal demand ratio. The calculated theoretical accelerator pedal opening is used as an independent verification parameter to judge the consistency with the actual accelerator pedal opening collected by the accelerator pedal sensor, thereby realizing heterogeneous monitoring that is independent of the accelerator pedal sensor signal link.

[0017] The constant speed driving condition pedal opening pre-calibration table is established by collecting real vehicle test data under different operating conditions during the vehicle development stage. The test data includes vehicle speed, road slope, vehicle load status, and accelerator pedal opening information corresponding to the driver actively controlling the vehicle to drive at a constant speed. A reference accelerator pedal opening is established by associating data under various vehicle operating conditions, which is used to detect the reliability of the accelerator pedal signal under the driver's active control of constant speed driving conditions.

[0018] The constant speed driving condition pedal opening pre-calibration table is only used when the driver actively presses the accelerator pedal to maintain the vehicle speed. When the vehicle is in cruise control mode, the verification process between the reference accelerator pedal opening and the actual accelerator pedal opening is paused. When the driver requests temporary power output by pressing the accelerator pedal, the corresponding reference accelerator pedal opening is re-acquired based on the current vehicle speed and road gradient, and it is determined whether the driver's input signal meets the actual operating requirements of the vehicle.

[0019] The acceleration driving condition and the constant speed driving condition are switched using different monitoring trigger conditions. When the vehicle has longitudinal acceleration changes and meets the dynamic verification conditions, the longitudinal dynamics reverse verification process of the vehicle is initiated. When the vehicle speed remains stable and meets the constant speed monitoring conditions, the constant speed driving condition pedal opening pre-calibration table verification process is initiated. By matching the corresponding monitoring methods with different operating states, the adaptability of accelerator pedal signal diagnosis under different driving scenarios is improved.

[0020] The progressive fault handling process executes graded responses based on the abnormal results output at different detection levels. When an abnormality is detected by the accelerator pedal sensor voltage boundary detection or signal consistency detection, the accelerator pedal is directly adjusted to a safe state and a fault warning message is output. When an abnormality is detected by the vehicle dynamics verification or constant speed driving condition verification, the abnormal signal state is determined by recording the number of consecutive abnormalities, and torque limiting, fault recording, and driving prompts are executed based on the cumulative abnormality.

[0021] During the vehicle dynamics reverse verification process, the judgment conditions between the theoretical accelerator pedal opening and the actual accelerator pedal opening are adjusted according to the current operating state of the vehicle. The adjustment parameters include vehicle speed, road adhesion state, and vehicle load state. When the vehicle is in different driving environments, the corresponding deviation judgment conditions are used to perform reliability analysis on the accelerator pedal signal, reducing abnormal judgments caused by changes in the normal driving state of the vehicle, and improving the adaptability of the accelerator pedal signal monitoring method to complex road environments and different vehicle operating states.

[0022] A layered, progressive accelerator pedal signal monitoring system based on vehicle dynamics and functional safety includes: The basic reliability detection unit is used to acquire two voltage signals output by the accelerator pedal sensor, perform voltage boundary detection and signal consistency detection on the two voltage signals, and determine that the accelerator pedal sensor signal meets the basic reliability condition when both voltage signals are within the preset effective range and the synchronization deviation meets the preset condition. The dynamics verification unit is used to collect vehicle longitudinal acceleration, vehicle speed, road slope and motor operating parameters when the accelerator pedal sensor signal meets the basic reliability conditions and the vehicle is in acceleration driving condition. It calculates the actual driving force of the vehicle based on the vehicle longitudinal dynamics model, converts the actual motor output torque based on the actual driving force of the vehicle, and calculates the theoretical accelerator pedal opening using the proportional relationship between the maximum output torque corresponding to the current motor speed and the actual motor output torque. The deviation judgment unit is used to calculate the deviation between the theoretical accelerator pedal opening and the actual accelerator pedal opening output by the accelerator pedal sensor. When the deviation between the theoretical accelerator pedal opening and the actual accelerator pedal opening exceeds a preset deviation threshold and the duration exceeds a preset time threshold, the accelerator pedal signal is determined to be abnormal. The constant speed driving condition verification unit is used to obtain the vehicle's current speed, road slope and load status when the vehicle is in a constant speed driving condition actively controlled by the driver and not in cruise control mode. It queries a pre-established constant speed driving condition pedal opening pre-calibration table to determine the reference accelerator pedal opening corresponding to the current vehicle status, compares the reference accelerator pedal opening with the actual accelerator pedal opening, and judges the reliability of the accelerator pedal signal based on the comparison result. The progressive fault handling unit is used to perform progressive fault handling on the accelerator pedal signal based on voltage boundary detection, signal consistency detection, theoretical accelerator pedal opening deviation detection, and reference accelerator pedal opening comparison results. When an anomaly is detected at the sensor layer, immediate safety handling is performed. When an anomaly is detected in the dynamics verification or constant speed driving condition verification, a safety response is performed based on the number of times the fault persists.

[0023] The technical effects and advantages provided by this application in the above technical solution are as follows: This application constructs a hierarchical, progressive accelerator pedal signal monitoring mechanism. Through the coordinated operation of sensor signal detection, vehicle longitudinal dynamics reverse verification, and constant-speed condition pre-calibration table verification, a multi-path verification system with different sources and independent computational logic is established. This comprehensive verification process gradually expands from the accelerator pedal sensor voltage signal to the actual vehicle motion state, enabling cross-verification of pedal sensor anomalies, control logic anomalies, and power response anomalies, thus improving the reliability of the accelerator pedal signal. Simultaneously, the monitoring scope is expanded from a single sensor to the entire vehicle power control process, providing a higher ability to identify common-cause faults and non-sensor-related faults, thereby improving the operational reliability and safety stability of the vehicle power control process while ensuring functional safety requirements.

[0024] This application establishes differentiated monitoring strategies for different vehicle operating states. Under vehicle acceleration conditions, the theoretical pedal opening is calculated backward using the vehicle's longitudinal dynamics model. Under driver-controlled constant-speed driving conditions, an offline pre-calibration table is used to verify the reference pedal opening. This avoids the inadequacy of using a uniform monitoring method for different operating conditions and improves the accuracy of pedal signal monitoring under various operating states. The entire monitoring process relies on the vehicle's existing IMU, wheel speed sensors, and motor controller signals to acquire data, requiring no additional dedicated hardware equipment, thus providing favorable engineering implementation conditions. Furthermore, the judgment threshold can be dynamically adjusted based on vehicle speed and road gradient, reducing the probability of false alarms during normal vehicle operation and improving the effectiveness of the monitoring strategy in actual vehicles. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings.

[0026] Figure 1 This is a flowchart illustrating the overall method of this application.

[0027] Figure 2 This is a schematic diagram of the modules in this application. Detailed Implementation

[0028] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that the description of this disclosure will be more complete and fully convey the concept of the exemplary embodiments to those skilled in the art.

[0029] like Figure 1 As shown, this application provides a layered, progressive accelerator pedal signal monitoring method based on vehicle dynamics and functional safety, including the following steps: Two voltage signals output from the accelerator pedal sensor are acquired. Voltage boundary detection and signal consistency detection are performed on the two voltage signals. When both voltage signals are within the preset effective range and the synchronization deviation meets the preset conditions, the accelerator pedal sensor signal is determined to meet the basic reliability conditions. When the accelerator pedal sensor signal meets the basic reliability conditions and the vehicle is in acceleration mode, the vehicle's longitudinal acceleration, vehicle speed, road slope and motor operating parameters are collected. The actual driving force of the vehicle is calculated based on the vehicle's longitudinal dynamics model. The actual motor output torque is converted based on the actual driving force of the vehicle. The theoretical accelerator pedal opening is calculated using the proportional relationship between the maximum output torque corresponding to the current motor speed and the actual motor output torque. The deviation between the theoretical accelerator pedal opening and the actual accelerator pedal opening output by the accelerator pedal sensor is calculated. When the deviation between the theoretical accelerator pedal opening and the actual accelerator pedal opening exceeds a preset deviation threshold and the duration exceeds a preset time threshold, the accelerator pedal signal is determined to be abnormal. When the vehicle is in a constant speed driving condition under the active control of the driver and is not in cruise control mode, the current vehicle speed, road slope and load status are obtained, the pre-established constant speed driving condition pedal opening pre-calibration table is consulted, the reference accelerator pedal opening corresponding to the current vehicle status is determined, the reference accelerator pedal opening is compared with the actual accelerator pedal opening, and the reliability of the accelerator pedal signal is judged based on the comparison result. Based on voltage boundary detection, signal consistency detection, theoretical accelerator pedal opening deviation detection, and reference accelerator pedal opening comparison results, progressive fault handling is performed on the accelerator pedal signal. When an anomaly is detected at the sensor layer, immediate safety handling is performed. When an anomaly is detected in the dynamics verification or constant speed driving condition verification, a safety response is performed based on the number of times the fault persists.

[0030] Specific Implementation Method 1: In this implementation method, the hierarchical progressive accelerator pedal signal monitoring method based on vehicle dynamics and functional safety first performs basic reliability testing of the accelerator pedal sensor signal. By performing hardware-level boundary constraint judgment and multi-channel consistency judgment on the accelerator pedal sensor output signal, a preliminary identification of the accelerator pedal sensor's own fault state is achieved. This implementation method is mainly used to detect input signal failure problems of the accelerator pedal sensor caused by abnormal power supply, open circuit, short circuit, signal drift, sensor aging, and abnormal dual-channel output, providing a reliable data foundation for subsequent heterogeneous redundancy verification based on vehicle motion state.

[0031] In practice, after the vehicle is powered on and running, the two voltage signals output by the accelerator pedal sensor are collected in real time. and The first voltage signal Second voltage signal These correspond to the output results of two independent detection channels within the accelerator pedal sensor. Since vehicle accelerator pedals typically employ a dual-channel design, the two detection channels can mitigate the safety risks caused by the failure of a single sensor to some extent. Therefore, it is first necessary to determine whether both output channels are within their normal operating range.

[0032] During voltage boundary detection, the two acquired voltage signals are compared with pre-set upper and lower voltage thresholds. Taking a vehicle control system powered by 5V as an example, the upper voltage threshold can be set according to the sensor characteristics. Set the lower voltage threshold. When the first voltage signal is detected satisfy: or: If the first accelerator pedal sensor output signal exceeds the normal operating range, it is determined that there may be a power supply short circuit, ground short circuit, wiring abnormality, or internal sensor fault. Similarly, if the second voltage signal... satisfy: or: If this occurs, it is determined that there is a boundary anomaly in the output signal of the second accelerator pedal sensor.

[0033] When any voltage signal exceeds the preset valid range, the monitoring method directly determines that the accelerator pedal sensor has a boundary failure fault and initiates the fault handling process. For example, the current accelerator pedal opening can be set to a safe value, limiting the pedal request to a zero torque request state, while recording the corresponding fault code and prompting the driver to check the fault. In this way, obvious fault states such as complete sensor failure, output saturation, and output disconnection can be quickly identified.

[0034] When both voltage signals are within a preset valid range, a dual-signal consistency check is further performed. Since the two output channels of the accelerator pedal sensor may use different voltage ratios in different vehicles, a proportional correction coefficient needs to be introduced based on the sensor calibration parameters. The synchronization deviation between the two output channels is calculated to determine whether the two signals maintain a reasonable correspondence. The formula for calculating the synchronization deviation is as follows: in, This is the calibration scaling factor between the output channels of the two sensors. When both sensors output from the same voltage range... It can be set to 1; when two sensors output with different voltage ranges, the corresponding proportional relationship is determined according to the sensor design parameters and calibration results.

[0035] The synchronization deviation was calculated. Then, it is compared with a preset synchronization threshold. Compare. When: If the signal is not clear, it indicates that the correspondence between the two accelerator pedal signals exceeds the normal error range, which may indicate single-channel drift, abnormal sensor output, or signal processing error. In this case, it is determined that the accelerator pedal sensor has experienced a synchronization failure.

[0036] It should be noted that the first-level monitoring in this embodiment mainly detects the output signal of the accelerator pedal sensor itself. Its detection is based on the sensor's electrical characteristics and the consistency relationship between the two channels, effectively identifying traditional sensor-level faults. However, because the two sensor channels may share a common power supply, grounding, communication link, and electromagnetic environment, when a common-cause failure occurs, both sensors may simultaneously produce erroneous outputs in the same direction. In this case, relying solely on the first-level monitoring cannot completely guarantee the authenticity of the accelerator pedal signal. Therefore, after passing the first-level monitoring, a second-level heterogeneous redundancy monitoring based on the vehicle dynamics model is required.

[0037] When the voltage boundary detection result is normal and the dual-channel signal consistency detection result meets the preset requirements, the current accelerator pedal sensor signal is determined to meet the basic reliability conditions, and the current accelerator pedal signal status is sent to the subsequent monitoring process. Through the above implementation method, rapid screening of basic faults in the accelerator pedal sensor can be completed in the initial stage of vehicle power control, while retaining the ability to independently verify the signal using the actual vehicle motion state, thus realizing a progressive safety monitoring architecture from the sensor level to the vehicle operating state level.

[0038] This implementation corresponds to the first layer of monitoring in the hierarchical progressive accelerator pedal signal monitoring method. Its technical advantages are: to achieve rapid diagnosis of hardware faults in the accelerator pedal sensor by using dual-channel voltage boundary detection and consistency detection; to provide effective input for subsequent dynamic reverse verification by judging the reliability of basic signals; and to avoid the safety risks caused by relying solely on a single sensor signal, thus providing a primary fault protection capability that meets the functional safety requirements for the power control system of new energy vehicles.

[0039] Specific Implementation Method Two: In this implementation method, after the first-layer monitoring completes the boundary detection and dual-path consistency detection of the accelerator pedal sensor signal and determines that the output signal of the accelerator pedal sensor meets the basic reliability conditions, a second-layer heterogeneous redundancy monitoring based on vehicle dynamics and functional safety is further implemented using the actual operating state of the vehicle. This implementation method is mainly applied to scenarios where the vehicle is in an acceleration driving condition, that is, the driver has a clear power demand, requests the vehicle to increase driving force by pressing the accelerator pedal, and the actual longitudinal motion state of the vehicle can reflect the change in the driver's torque request. Compared with the first-layer detection method that relies on the electrical characteristics of the accelerator pedal sensor itself, this implementation method no longer directly relies on the accelerator pedal sensor signal processing path, but uses the actual vehicle motion results to deduce the theoretical accelerator pedal opening, and achieves heterogeneous redundancy verification independent of the pedal sensor signal link through cross-validation between the driver input path and the vehicle motion feedback path.

[0040] In practice, when the vehicle is in normal driving condition, the current vehicle operating status information is first obtained, including the vehicle's longitudinal acceleration. Actual vehicle speed Current road slope Real-time motor speed Motor operating parameters and vehicle transmission system parameters. Among these, vehicle longitudinal acceleration... Vehicle speed can be acquired through the vehicle's inertial measurement unit (IMU). Road gradient can be obtained through wheel speed sensors, vehicle speed sensors, or speed estimation algorithms within the vehicle controller. Motor speed can be estimated in real time using IMU attitude information. This information can be obtained in real time from the motor controller.

[0041] To avoid increased calculation errors due to minimal acceleration changes when the vehicle is in a low-dynamic state, this implementation method sets a second layer of monitoring activation conditions. This is achieved when the vehicle meets the conditions that the driver intends to accelerate and the vehicle's longitudinal acceleration... Furthermore, when the vehicle speed reaches a preset activation threshold, a reverse verification process based on the vehicle dynamics model is initiated. For example, in practical applications, the following settings can be configured: This serves as an activation condition for acceleration. When the vehicle's longitudinal acceleration falls below this threshold, it is considered to be in a low-dynamic-change state. In this case, the second-layer dynamic back-calculation method is not used for judgment, but instead, the third-layer dedicated monitoring strategy for constant-speed driving conditions is adopted.

[0042] During the second-level monitoring process, the total resistance during the current vehicle movement is first calculated based on the vehicle's longitudinal dynamics model. The force relationships of the vehicle in the longitudinal direction satisfy: in, For vehicle driving force, The total resistance force experienced by the vehicle. For the overall vehicle quality, This refers to the vehicle's longitudinal acceleration.

[0043] Vehicle running resistance mainly includes rolling resistance, air resistance, and gradient resistance. Therefore, the formula for calculating total running resistance is as follows: To elaborate further: in, For the overall vehicle weight; It is the acceleration due to gravity; This refers to the rolling resistance coefficient of the vehicle tires. air density; This refers to the air drag coefficient; The frontal area of ​​the vehicle; The vehicle's current speed; This represents the current road gradient.

[0044] The above calculations reveal the impact of external resistance on the vehicle. Since the vehicle's actual acceleration is determined by both the driving force and external resistance, the longitudinal acceleration measured by the IMU is further utilized. Calculate the vehicle's current actual driving force: in, This represents the actual driving force of the vehicle, calculated backwards from its actual motion state. The result reflects the magnitude of the driving force actually required from the powertrain to achieve the vehicle's current acceleration state.

[0045] Obtain the actual driving force of the vehicle Next, the vehicle's wheel-end driving force needs to be further converted into the actual output torque of the motor. Considering the reduction gear and transmission efficiency in the vehicle's transmission system, the formula for calculating the actual output torque of the motor is as follows: in, The actual output torque of the motor is calculated based on the actual motion state of the vehicle; The tire's rolling radius; The transmission ratio of the vehicle's reduction gear; For power transmission efficiency.

[0046] Subsequently, the maximum drive torque that can be output under the current motor speed is obtained based on the motor's external characteristic curve. Since the output capability of an electric vehicle motor is affected by its speed, with different speeds corresponding to different maximum allowable torques, the current speed is obtained by querying the motor's external characteristic curve or reading the maximum available torque parameter provided by the motor controller. Maximum output torque: In the power control process of new energy vehicles, there is usually an approximately linear proportional relationship between the accelerator pedal opening and the torque request; that is, the torque requested by the driver can be represented by the pedal opening. Therefore, this embodiment uses the proportional relationship between the actual output torque of the vehicle and the current maximum output torque of the motor to calculate the theoretical accelerator pedal opening in reverse: in, This is the theoretical accelerator pedal opening calculated backwards from the actual vehicle motion state. This parameter does not come from the accelerator pedal sensor, but is calculated through the vehicle dynamics model, motor operating state, and actual vehicle motion results. Therefore, it does not share the same data source as the pedal sensor signal in the first layer of monitoring.

[0047] After completing the theoretical accelerator pedal opening calculation, the theoretical accelerator pedal opening will be... Compared with the actual accelerator pedal opening obtained from the first layer of monitoring Compare and calculate the deviation between the two: in, This represents the difference between the theoretical pedal opening corresponding to the actual movement state of the vehicle and the actual pedal opening input by the driver.

[0048] when: If the duration of this abnormal state exceeds a preset time threshold, the accelerator pedal signal is determined to be abnormal. For example, in one implementation, the deviation threshold can be set to 20%, and the duration threshold to 200ms. When the system continuously detects a deviation of more than 20% between the theoretical pedal opening and the actual pedal opening, and this deviation persists for more than 200ms, it is considered that the current accelerator pedal signal cannot accurately reflect the actual movement state of the vehicle, and a safety response needs to be triggered.

[0049] For example, in a specific application scenario, a vehicle is traveling at 60 km / h on a dry, straight road, and the driver presses the accelerator pedal deeply to request rapid acceleration. The first-level monitoring detects that the dual-channel signals of the accelerator pedal are normal and reads the actual pedal opening. Subsequently, the second layer of monitoring is activated, and the IMU detects the vehicle's longitudinal acceleration: The system takes into account the vehicle speed of 60 km / h and the road gradient: Calculate the rolling resistance and air resistance currently experienced by the vehicle, then combine this with the vehicle's mass to calculate the actual driving force, and further convert this into the actual output torque of the motor: By querying the maximum output torque at the current motor speed: Calculate the theoretical pedal opening: at this time: The deviation is less than the preset threshold, therefore the current accelerator pedal signal is determined to be normal.

[0050] If another scenario occurs, such as the accelerator pedal sensor erroneously outputting 80% due to a common cause fault, but the vehicle's actual motion only corresponds to 30% of the power demand, then the following can be calculated through vehicle dynamics: at this time: If the signal significantly exceeds the set threshold and the abnormal duration meets the judgment requirements, the system determines that the accelerator pedal signal is abnormal and performs safety procedures, including limiting torque output, adjusting the pedal request to a safe value, recording fault codes, and alerting the driver.

[0051] The core technical advantage of this implementation lies in establishing a verification path independent of the accelerator pedal sensor signal path through the vehicle's longitudinal dynamics model. Traditional methods only determine whether the "pedal signal meets electrical rules," while this implementation further determines whether the "pedal signal conforms to the actual motion law of the vehicle." Even if both signals from the accelerator pedal sensor simultaneously produce erroneous outputs, or if there are abnormalities in the VCU torque analysis logic or motor execution process, as long as the actual vehicle motion state does not match the theoretical response, the anomaly can be detected through reverse dynamic verification.

[0052] Meanwhile, this implementation method designs dedicated monitoring logic for the vehicle acceleration phase, making full use of the high accuracy of dynamic model calculations when there are significant longitudinal acceleration changes in the vehicle. This enables proactive diagnosis of the authenticity of the accelerator pedal signal under acceleration conditions, improving the detection coverage of the new energy vehicle power control system for sensor faults, control logic anomalies, and actuator anomalies, and meeting the requirements of vehicle functional safety for independent monitoring paths and heterogeneous redundancy verification.

[0053] Specific Implementation Method 3: In this implementation method, addressing the issue of decreased accuracy in traditional dynamics back-calculation due to small changes in accelerator pedal opening and near-zero longitudinal acceleration during constant-speed driving controlled by the driver, a third-layer refined monitoring method based on a pre-calibrated table for accelerator pedal opening under constant-speed driving conditions is proposed. This implementation method belongs to the third-layer monitoring mechanism in a hierarchical progressive accelerator pedal signal monitoring method based on vehicle dynamics and functional safety. Together with the first-layer sensor signal boundary and consistency detection and the second-layer driving condition back-verification based on the vehicle's longitudinal dynamics model, it constitutes a complete heterogeneous redundant monitoring architecture.

[0054] During actual vehicle operation, the second-layer monitoring primarily relies on inverse calculations based on changes in the vehicle's longitudinal acceleration. When the vehicle is in a state of significant acceleration or deceleration, the vehicle's motion state can effectively reflect changes in the power system output. Therefore, the actual driving force can be calculated using the vehicle's longitudinal dynamics model, and the theoretical accelerator pedal opening can be further deduced. However, when the driver actively depresses the accelerator pedal to maintain a stable vehicle speed, the vehicle's longitudinal acceleration is usually close to zero. At this time, the vehicle's driving force is mainly used to counteract various resistances during vehicle operation, including tire rolling resistance, air resistance, and resistance generated by road slope. The change in the vehicle's motion state is relatively small. If the second-layer dynamics inverse calculation method is continued, the calculation results are easily affected by sensor measurement errors, minor road changes, and changes in vehicle mass due to the near-zero acceleration measurement value, leading to a decrease in the accuracy of the theoretical pedal opening estimation. Therefore, this implementation establishes a dedicated pedal opening reference model for the driver-controlled constant-speed driving condition. Through offline calibration, the reasonable pedal opening range corresponding to different vehicle state conditions is obtained, thereby achieving a refined judgment of the authenticity of the accelerator pedal signal under constant-speed conditions.

[0055] In the specific implementation process, a pre-calibration table for pedal opening under constant speed driving conditions is first established during the vehicle R&D and calibration phase. During the calibration process, actual road tests or test track tests are conducted under different vehicle speeds, road gradients, and vehicle load conditions. During the tests, the driver actively depresses the accelerator pedal to control the vehicle to maintain the target speed, and key operating parameters when the vehicle reaches a stable constant speed state are recorded, including vehicle speed, road gradient, actual vehicle load, motor output torque, and the corresponding accelerator pedal opening.

[0056] Among these features, vehicle speed can be divided according to preset intervals, such as setting a speed calibration point every 10 km / h; road gradient can be divided according to different gradient levels, such as setting increments of 1° or 2°; vehicle load status can be classified according to different states such as empty, half-loaded, and fully loaded. Through the collection of a large amount of calibration data, a vehicle speed... Road slope Vehicle load With reference accelerator pedal opening The correspondence between them, and their data mapping relationship, are as follows: in: Indicates the vehicle's current speed; Indicates the current road gradient; Indicates the current vehicle load status; This indicates the reference accelerator pedal opening required for the vehicle to maintain a constant speed under current speed, gradient, and load conditions.

[0057] Using the above calibration method, a three-dimensional constant-speed operating condition pedal opening pre-calibration table can be established, for example: This pre-calibration table reflects the power requirements for maintaining a stable speed under different operating conditions.

[0058] In this embodiment, the theoretical basis for establishing the pedal opening pre-calibration table under constant speed conditions is derived from the longitudinal dynamics balance relationship of the vehicle. When the vehicle travels in the longitudinal direction, it satisfies: in, For vehicle driving force, The total resistance force experienced by the vehicle. For the overall vehicle quality, This refers to the vehicle's longitudinal acceleration.

[0059] When a vehicle is traveling at a stable and constant speed, the vehicle speed remains stable, and the longitudinal acceleration satisfies: Therefore, the longitudinal dynamics equation of the vehicle can be simplified to: That is, when the vehicle is maintaining its current speed, the power system outputs driving force that needs to completely offset the driving resistance experienced by the vehicle.

[0060] Vehicle running resistance is mainly composed of rolling resistance, air resistance, and gradient resistance: Further expressed as: in, For vehicle quality; It is the acceleration due to gravity; This is the rolling resistance coefficient; air density; This refers to the air drag coefficient; The frontal area of ​​the vehicle; For vehicle speed; This refers to the road slope.

[0061] As can be seen from the above relationships, given a fixed vehicle mass, road gradient, and vehicle speed, the driving force required for the vehicle to maintain a constant speed is deterministic. This driving force further corresponds to a unique motor output torque and accelerator pedal opening. Therefore, by using a pre-established pedal opening pre-calibration table for constant speed driving conditions, a reasonable reference pedal opening can be obtained in reverse based on the current vehicle state during operation.

[0062] During vehicle operation, when the activation conditions for the third-level monitoring are met, the pedal opening verification process for constant-speed driving is initiated. To avoid misjudgments caused by non-driver-controlled scenarios such as cruise control, this implementation method explicitly limits the third-level monitoring to driver-controlled constant-speed driving conditions outside of cruise control.

[0063] Specific activation conditions include: The vehicle is not currently in cruise control mode; The vehicle speed remains stable; for example, the difference between the vehicle's highest and lowest speeds over 10 consecutive sampling periods satisfies the following condition: The accelerator pedal opening is greater than a preset threshold, for example: Used to determine if the driver is currently requesting active power; The brake pedal was not depressed to avoid affecting the judgment of power demand due to the braking status. The vehicle is in D gear to ensure it is in normal driving mode; The road slope meets the monitoring accuracy requirements, for example: When the road gradient exceeds this range, the accuracy of the pre-calibration table decreases due to the large gradient affecting the vehicle, thus exiting the third-level monitoring.

[0064] Once all the above activation conditions are met, the vehicle's current speed will be obtained in real time. Road slope and vehicle load status Based on the current vehicle status, consult the constant speed driving condition pedal opening pre-calibration table to obtain the reference accelerator pedal opening for the corresponding condition: Then, the actual pedal opening input by the driver, collected by the vehicle controller, is used: Compare the accelerator pedal opening with a reference opening and calculate the deviation between the two: in: This indicates the difference between the current pedal opening input by the driver and the reasonable pedal opening corresponding to the actual operating state of the vehicle.

[0065] when: Furthermore, if the duration of this deviation exceeds a preset time threshold, the current accelerator pedal signal is determined to be abnormal.

[0066] For example, in one specific implementation scenario, the vehicle is traveling at 80 km / h on a straight road. Cruise control is not activated, and the driver maintains a stable speed by lightly pressing the accelerator pedal. The third-level monitoring system detects that the current speed fluctuation range meets requirements, the road gradient is 0%, and the vehicle load is half-loaded. The reference pedal opening for the current operating condition is obtained by querying the pre-calibration table. However, the vehicle controller actually reads the accelerator pedal opening: The calculation at this point yields: If the system sets the deviation threshold to 10% and the abnormal duration exceeds 200ms, the current accelerator pedal signal is determined to be abnormal, and the system enters the safety processing procedure.

[0067] In addition to the third-layer monitoring logic, this implementation further combines the results of the first-layer and second-layer monitoring to form a progressive fault handling strategy.

[0068] When the first-level monitoring detects an abnormal voltage boundary of the accelerator pedal sensor or an abnormal consistency of the dual-channel signals, since this type of fault is a clear sensor-level fault, safety procedures are immediately implemented, including adjusting the accelerator pedal opening to a safe value, limiting power output, illuminating the fault indicator light, and recording the fault information.

[0069] When the first-level monitoring is normal, but the second-level dynamics reverse verification or the third-level constant-speed condition pre-calibration table verification detects anomalies, since such anomalies may be caused by instantaneous road changes, vehicle load changes, or measurement errors, serious fault handling is not immediately triggered. Instead, a fault counting mechanism is activated. The system records the number of anomaly occurrences. When the number of anomalies reaches a preset threshold, such as 3 to 5 consecutive anomalies, the accelerator pedal signal is deemed insufficiently reliable, and further safety responses are executed, including limiting the vehicle's maximum output torque, limiting over-throttle torque requests, recording fault codes, and adjusting the pedal response strategy.

[0070] Through the above implementation methods, this application establishes differentiated monitoring strategies for different vehicle operating conditions. During acceleration, it utilizes vehicle dynamics back-calculation for rapid dynamic verification, while during driver-controlled constant-speed driving, it employs a pre-calibration table for refined state verification, avoiding blind spots in monitoring under different operating conditions with a single algorithm. Simultaneously, a three-layer progressive heterogeneous redundant monitoring architecture is constructed through first-layer sensor signal detection, second-layer vehicle dynamics verification, and third-layer constant-speed condition pre-calibration table verification. This expands the accelerator pedal signal monitoring range from sensor malfunctions to abnormal vehicle power response, enabling proactive detection of pedal sensor malfunctions, control logic anomalies, motor response anomalies, and vehicle motion state mismatches, thereby improving the functional safety and operational reliability of the new energy vehicle power control system.

[0071] The foregoing has only described certain exemplary embodiments of this application by way of illustration. Undoubtedly, those skilled in the art can modify the described embodiments in various ways without departing from the spirit and scope of this application. Therefore, the foregoing drawings and descriptions are illustrative in nature and should not be construed as limiting the scope of protection of the claims of this application.

Claims

1. A hierarchical, progressive accelerator pedal signal monitoring method based on vehicle dynamics and functional safety, characterized in that, Includes the following steps: Two voltage signals output from the accelerator pedal sensor are acquired. Voltage boundary detection and signal consistency detection are performed on the two voltage signals. When both voltage signals are within the preset effective range and the synchronization deviation meets the preset conditions, the accelerator pedal sensor signal is determined to meet the basic reliability conditions. When the accelerator pedal sensor signal meets the basic reliability conditions and the vehicle is in acceleration mode, the vehicle's longitudinal acceleration, vehicle speed, road slope and motor operating parameters are collected. The actual driving force of the vehicle is calculated based on the vehicle's longitudinal dynamics model. The actual motor output torque is converted based on the actual driving force of the vehicle. The theoretical accelerator pedal opening is calculated using the proportional relationship between the maximum output torque corresponding to the current motor speed and the actual motor output torque. The deviation between the theoretical accelerator pedal opening and the actual accelerator pedal opening output by the accelerator pedal sensor is calculated. When the deviation between the theoretical accelerator pedal opening and the actual accelerator pedal opening exceeds a preset deviation threshold and the duration exceeds a preset time threshold, the accelerator pedal signal is determined to be abnormal. When the vehicle is in a constant speed driving condition under the active control of the driver and is not in cruise control mode, the current vehicle speed, road slope and load status are obtained, the pre-established constant speed driving condition pedal opening pre-calibration table is consulted, the reference accelerator pedal opening corresponding to the current vehicle status is determined, the reference accelerator pedal opening is compared with the actual accelerator pedal opening, and the reliability of the accelerator pedal signal is judged based on the comparison result. Based on voltage boundary detection, signal consistency detection, theoretical accelerator pedal opening deviation detection, and reference accelerator pedal opening comparison results, progressive fault handling is performed on the accelerator pedal signal. When an anomaly is detected at the sensor layer, immediate safety handling is performed. When an anomaly is detected in the dynamics verification or constant speed driving condition verification, a safety response is performed based on the number of times the fault persists.

2. The hierarchical progressive accelerator pedal signal monitoring method based on vehicle dynamics and functional safety according to claim 1, characterized in that, The two voltage signals output by the accelerator pedal sensor are acquired using different detection channels, and a valid voltage region is established based on the output range of the two voltage signals. When either voltage signal exceeds the preset voltage range, the abnormal channel is marked as faulty. When both voltage signals are within the valid region, the signal synchronization status is further determined by the ratio between the two voltage signals. The ratio is predetermined based on the calibration parameters of the accelerator pedal sensor to adapt to the output characteristics of different types of accelerator pedal sensors.

3. The hierarchical progressive accelerator pedal signal monitoring method based on vehicle dynamics and functional safety according to claim 1, characterized in that, The vehicle longitudinal dynamics model is constructed using the actual operating state parameters of the vehicle, including vehicle mass information, vehicle speed information, road slope information, vehicle longitudinal acceleration information, and vehicle air resistance-related parameters. The power output demand is analyzed in reverse by the actual motion state of the vehicle, and the calculated power demand is converted into the corresponding motor output torque to determine the consistency between the accelerator pedal input signal and the actual power response of the vehicle.

4. The hierarchical progressive accelerator pedal signal monitoring method based on vehicle dynamics and functional safety according to claim 2, characterized in that, The calculation process of theoretical accelerator pedal opening uses the mapping relationship between motor operating status and vehicle power demand. By obtaining the maximum output capacity corresponding to the current motor speed, the actual output torque of the vehicle is converted into the corresponding pedal demand ratio. The calculated theoretical accelerator pedal opening is used as an independent verification parameter to judge its consistency with the actual accelerator pedal opening collected by the accelerator pedal sensor.

5. The hierarchical progressive accelerator pedal signal monitoring method based on vehicle dynamics and functional safety according to claim 1, characterized in that, The constant speed driving condition pedal opening pre-calibration table is established by collecting real vehicle test data under different operating conditions during the vehicle development stage. The test data includes vehicle speed, road slope, vehicle load status, and accelerator pedal opening information corresponding to the driver actively controlling the vehicle to drive at a constant speed. A reference accelerator pedal opening is established by associating data under various vehicle operating conditions, which is used to detect the reliability of the accelerator pedal signal under the driver's active control of constant speed driving conditions.

6. The hierarchical progressive accelerator pedal signal monitoring method based on vehicle dynamics and functional safety according to claim 5, characterized in that, The constant speed driving condition pedal opening pre-calibration table is only used when the driver actively presses the accelerator pedal to maintain the vehicle speed. When the vehicle is in cruise control mode, the verification process between the reference accelerator pedal opening and the actual accelerator pedal opening is paused. When the driver requests temporary power output by pressing the accelerator pedal, the corresponding reference accelerator pedal opening is re-acquired based on the current vehicle speed and road gradient, and it is determined whether the driver's input signal meets the actual operating requirements of the vehicle.

7. The hierarchical progressive accelerator pedal signal monitoring method based on vehicle dynamics and functional safety according to claim 1, characterized in that, The acceleration driving condition and the constant speed driving condition are switched using different monitoring trigger conditions. When the vehicle has longitudinal acceleration changes and meets the dynamics verification conditions, the longitudinal dynamics reverse verification process of the vehicle is initiated. When the vehicle speed remains stable and meets the constant speed monitoring conditions, the constant speed driving condition pedal opening pre-calibration table verification process is initiated.

8. The hierarchical progressive accelerator pedal signal monitoring method based on vehicle dynamics and functional safety according to claim 4, characterized in that, The progressive fault handling process executes graded responses based on the abnormal results output by different detection levels. When an abnormality is detected by the accelerator pedal sensor voltage boundary detection or signal consistency detection, the accelerator pedal is directly adjusted to a safe state and a fault prompt message is output. When an anomaly is detected during vehicle dynamics verification or constant speed driving condition verification, the abnormal signal status is determined by recording the number of consecutive anomalies, and torque limiting, fault recording, and driving prompt operations are executed based on the cumulative anomaly.

9. The hierarchical progressive accelerator pedal signal monitoring method based on vehicle dynamics and functional safety according to claim 1, characterized in that, During the reverse verification of vehicle dynamics, the judgment conditions between the theoretical accelerator pedal opening and the actual accelerator pedal opening are adjusted according to the current operating state of the vehicle. The adjustment parameters include vehicle speed, road adhesion state and vehicle load state. When the vehicle is in different driving environments, the reliability of the accelerator pedal signal is analyzed using the corresponding deviation judgment conditions.

10. A hierarchical progressive accelerator pedal signal monitoring system based on vehicle dynamics and functional safety, used to implement the hierarchical progressive accelerator pedal signal monitoring method based on vehicle dynamics and functional safety as described in any one of claims 1-9, characterized in that, include: The basic reliability detection unit is used to acquire two voltage signals output by the accelerator pedal sensor, perform voltage boundary detection and signal consistency detection on the two voltage signals, and determine that the accelerator pedal sensor signal meets the basic reliability condition when both voltage signals are within the preset effective range and the synchronization deviation meets the preset condition. The dynamics verification unit is used to collect vehicle longitudinal acceleration, vehicle speed, road slope and motor operating parameters when the accelerator pedal sensor signal meets the basic reliability conditions and the vehicle is in acceleration driving condition. It calculates the actual driving force of the vehicle based on the vehicle longitudinal dynamics model, converts the actual motor output torque based on the actual driving force of the vehicle, and calculates the theoretical accelerator pedal opening using the proportional relationship between the maximum output torque corresponding to the current motor speed and the actual motor output torque. The deviation judgment unit is used to calculate the deviation between the theoretical accelerator pedal opening and the actual accelerator pedal opening output by the accelerator pedal sensor. When the deviation between the theoretical accelerator pedal opening and the actual accelerator pedal opening exceeds a preset deviation threshold and the duration exceeds a preset time threshold, the accelerator pedal signal is determined to be abnormal. The constant speed driving condition verification unit is used to obtain the vehicle's current speed, road slope and load status when the vehicle is in a constant speed driving condition actively controlled by the driver and not in cruise control mode. It queries a pre-established constant speed driving condition pedal opening pre-calibration table to determine the reference accelerator pedal opening corresponding to the current vehicle status, compares the reference accelerator pedal opening with the actual accelerator pedal opening, and judges the reliability of the accelerator pedal signal based on the comparison result. The progressive fault handling unit is used to perform progressive fault handling on the accelerator pedal signal based on voltage boundary detection, signal consistency detection, theoretical accelerator pedal opening deviation detection, and reference accelerator pedal opening comparison results. When an anomaly is detected at the sensor layer, immediate safety handling is performed. When an anomaly is detected in the dynamics verification or constant speed driving condition verification, a safety response is performed based on the number of times the fault persists.

Images